hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
93s
max time network
96s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260808-bk8fhaxbnf

Score

3^/10

adware discovery spyware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2644	msedge.exe

Checks SCSI registry key(s) 3 TTPs 36 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\007A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{259abffc-50a7-47ce-af08-68c9a7d73366}\000C	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{78c34fc8-104a-4aca-9ea4-524d52996e57}\005A	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{cf73bb51-3abf-44a2-85e0-9a3dc7a12132}\0006	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{8c7ed206-3f8a-4827-b3ab-ae9e1faefc6c}\0004	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	TextInputHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{540b947e-8b40-45bc-a8a2-6a0b894cbda2}\0009	TextInputHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com	TextInputHost.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\DOMStorage	TextInputHost.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000\Software\Microsoft\Internet Explorer\DOMStorage\microsoft.com\NumberOfSubdomains = "1"	TextInputHost.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306252370778574"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{7B318B6E-189A-4F9A-AAE4-4420B540C0DB}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{9BFBD29E-5801-4A39-9AAC-ECF08589E71D}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2996	TextInputHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2996	TextInputHost.exe
2996	TextInputHost.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
2996	TextInputHost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
2996	TextInputHost.exe
2996	TextInputHost.exe
2996	TextInputHost.exe
2996	TextInputHost.exe
2996	TextInputHost.exe
2996	TextInputHost.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4436 wrote to memory of 3544	4436	msedge.exe	88
PID 4436 wrote to memory of 2644	4436	msedge.exe	90
PID 4436 wrote to memory of 1500	4436	msedge.exe	92
PID 4436 wrote to memory of 5604	4436	msedge.exe	91
PID 4436 wrote to memory of 1500	4436	msedge.exe	92
PID 4436 wrote to memory of 5604	4436	msedge.exe	91
PID 4436 wrote to memory of 5604	4436	msedge.exe	91
PID 4436 wrote to memory of 1220	4436	msedge.exe	94
PID 4436 wrote to memory of 1220	4436	msedge.exe	94
PID 4436 wrote to memory of 1780	4436	msedge.exe	95
PID 4436 wrote to memory of 1220	4436	msedge.exe	94
PID 4436 wrote to memory of 1780	4436	msedge.exe	95
PID 4436 wrote to memory of 1780	4436	msedge.exe	95
PID 4436 wrote to memory of 1448	4436	msedge.exe	96
PID 4436 wrote to memory of 1448	4436	msedge.exe	96
PID 4436 wrote to memory of 1448	4436	msedge.exe	96
PID 4436 wrote to memory of 3416	4436	msedge.exe	97
PID 4436 wrote to memory of 3416	4436	msedge.exe	97
PID 4436 wrote to memory of 3416	4436	msedge.exe	97
PID 4436 wrote to memory of 3620	4436	msedge.exe	99
PID 4436 wrote to memory of 3620	4436	msedge.exe	99
PID 4436 wrote to memory of 3620	4436	msedge.exe	99
PID 4436 wrote to memory of 2280	4436	msedge.exe	100
PID 4436 wrote to memory of 4296	4436	msedge.exe	101
PID 4436 wrote to memory of 2280	4436	msedge.exe	100
PID 4436 wrote to memory of 4296	4436	msedge.exe	101
PID 4436 wrote to memory of 4872	4436	msedge.exe	103
PID 4436 wrote to memory of 3400	4436	msedge.exe	107
PID 4436 wrote to memory of 3400	4436	msedge.exe	107
PID 4436 wrote to memory of 3400	4436	msedge.exe	107
PID 4436 wrote to memory of 5264	4436	msedge.exe	108
PID 4436 wrote to memory of 5264	4436	msedge.exe	108
PID 4436 wrote to memory of 5264	4436	msedge.exe	108
PID 4436 wrote to memory of 6400	4436	msedge.exe	109
PID 4436 wrote to memory of 6624	4436	msedge.exe	110
PID 4436 wrote to memory of 6624	4436	msedge.exe	110
PID 4436 wrote to memory of 4868	4436	msedge.exe	111
PID 4436 wrote to memory of 4868	4436	msedge.exe	111
PID 4436 wrote to memory of 4420	4436	msedge.exe	113
PID 4436 wrote to memory of 4968	4436	msedge.exe	114
PID 4436 wrote to memory of 1840	4436	msedge.exe	115
PID 4436 wrote to memory of 4068	4436	msedge.exe	116
PID 4436 wrote to memory of 4068	4436	msedge.exe	116
PID 4436 wrote to memory of 4068	4436	msedge.exe	116
PID 4436 wrote to memory of 6552	4436	msedge.exe	118
PID 4436 wrote to memory of 6552	4436	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff80678c188,0x7ff80678c194,0x7ff80678c1a0
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,2163520565553331192,11017753030619387366,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,2616474977942132852,3568510141908390632,262144 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:2
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,17972925549514318396,7202172071061736618,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:13
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,17888437135391961946,6530782295621309945,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,8835258338892387358,10431184556412398263,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,12422315938519604447,10044929212895548675,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4352,i,9441946325058232344,9139510580348102287,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:9
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3448,i,8889479078962200056,3271633572759013577,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,14636547517792932344,13848368434206506326,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,18425539523464826404,2373283953174090385,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,10362668675813838629,4703777899123886315,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,10362668675813838629,4703777899123886315,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6668,i,1096294243526797278,3500634749168796919,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6608,i,2130608304847394091,3193464682746585160,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14478275544652022355,13368832571118776621,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  - Modifies registry class
  PID:6400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,8394333784261322703,6551837082259915313,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:12
  2⤵
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,9726529071756109332,10400271400783974510,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:14
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,7077353245136849271,278306568697276371,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=7248 /prefetch:14
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,6961120760282135279,4336602199182376776,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7256,i,17587538450921692498,5905218643044237339,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7232,i,4099179908593089729,16704771765901604561,2097152 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,14259464323582039428,14044388345752955313,524288 --field-trial-handle=2580,i,4138355141533738389,12686225798365556393,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:6552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5084

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TextInputHost.exe" -ServerName:InputApp.AppXk0k6mrh4r2q0ct33a9wgbez0x7v9cz5y.mca
1⤵
- Checks SCSI registry key(s)
- Modifies Internet Explorer settings
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:2996

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9bac789d2429af6b056887d03ac586bd502742212edae8d03b7f1239ad5e3a40
MD5 88452ae60c2664be9c532b7f6bd3ca92
SHA1 869531d0cec0701cf0d059375648cfd9f9c2f1e8
SHA512 e6a6345a994e5520505c8099eaf2300cf45f2d2e8593801041f25e33b292fc1b38c46ce45ee73c02d61ce06b63335d5e36557a50462183eede3068da971bf41a
TLSH
T15781A41463D754F2D71C603910F0444422FA8AF58F0BBB99895F5F7DC8A2FB591E8263
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a9a0f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a9a0f.TMP
Size 2KB
SHA256 4a77c0171c85bbe7dcfe75bbc289f073502eec16af912f7fa3366e931c502d5a
MD5 0ec7e95ba6eb044d15cf4273b4f47b98
SHA1 cef296602ff9faca1407efd671ed54c13efa3ca8
SHA512 1c1a641bedefc540979d8695a8e71c3729b34ddd7d3a650cfa125cfedfcacd8c7577630764df93bf16eb359377cf59f437f3f6edf3ccbc4d7a7a0714abfcddb6
TLSH
T17151F85463E718F1E72DA17254F0559832F486798D07BB81D05F6F3CCAA2F3891E82A7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 226KB
SHA256 e5c487ade9b6a938144710abc183d56b4cc992fb6e68d19caf327565e0de4f1f
MD5 fdbe77a97beced85ef27274930fa6d4c
SHA1 fec926211b48e99c7f12662cff8b38058bad7ad3
SHA512 2672677234581336bbbb4de1e57dd0e6adcba3cc0e3834a62d11a772024f3a145c866fb34ddf0fcbdc47dca7e40c493c603e16dbab20980104d10835b05c5f5f
SSDEEP 3072:7qOTuuSA6viY9vc9GcGd3+W1ovo6n7/1NTR7QO/b/1u2:CvcmC
TLSH
T10D34F71462E562D6F13E83731521ED07E3799EC855A9309BB8A13A0D67FBB403B7072E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000017.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000017.ldb
Size 22KB
SHA256 391cae76c21db36473af3c7c6e30eaa13986fe570466e6acfe21f8aa8002e87d
MD5 d4ea2861f694fb78791f80356003dde4
SHA1 6fbc01a8b98c028c476299f874adb35962d11667
SHA512 9457e053859408ea09402b9662fef78724547cc63ae79863263c65891a8fff8d39f8926a60b32a3799b803ffffe99d4d0bf667d7de8e40a5faa6d00b71340977
SSDEEP 384:DOK8j2dbfAG+EnZdRZp3VXKvNquupFE+JegSgC1Pb0x9e5PZwrk:CRjiA9WRZpBUNquupm+JegrTx9q
TLSH
T10DA2AF363AC9884BD4BEA7B755FE06C8AD21FE4D2A46E0CC5552310C0C539BB6ADE60D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000020.ldb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000020.ldb
Size 17KB
SHA256 f18c5e939e8cbd8a2bbd569c6cdb6dbfcbfbd8d91706b00f5457d3335e155ce6
MD5 dd0e5a0fcf8860eef8ed056b0b9c903e
SHA1 05997fb8f2db6d3a03690028ee1ce54fa07a3069
SHA512 8d8ca09696c702b236b5d6e78f6294e7e03e19e0070f1d77b36c395c691371c6472e7af58a5b73c656bbd04cc624762fd99af67c2776d46d1a68cc1f914a74c4
SSDEEP 384:5sd5z0SKANsuaFE+JegSgC1Pb0x9e5PZwrF:5W5YS7Nsuam+JegrTx9T
TLSH
T1C372BF2B2ACD8847D4B6A77795FF014C6E32FA0D354AE1CC6642310C18A6A7F75F960E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 353B
SHA256 8ef4446e272db72eb50579c279ff6f450bc4afe5ca61e35809368a5199faedc0
MD5 ecec7fdd02c494c795b168c6136544b1
SHA1 6335c114191d11c8bedc04dc9b1ed8298f71a71d
SHA512 f564bd568a0d2207f5c37158a6fbc3cfb192ec5e3e863b13ba2ca672baca8a3ad5761ea3c708966cb1502968c9a4f4307384a6643cfdeb1d6443709800c9bd4c
TLSH
T153E0C02884C9C15F11A420DB55387B0ED6DFB14FDBCCFD560F08D8087046048902D992
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 d094261e49b0909b0a79f4f8190f9f3e14f41fdbe50a1950026441d454a394bb
MD5 29ec707d9f4f55a115b2bfb3b8f726fe
SHA1 0570fba74158af88255d68eceb03432bf0ae2d47
SHA512 d05e336cb0a35887331958cea31dafd1a7b65b7e9d844eec1000332006e7fbe73a457ac97fcd9eb76e8a42cba173a2335f315b5bb395a88de6e9aebd5cb82356
SSDEEP 384:DJjQUaz2VckEcYNpi88GJfHUvWcAIeebFXiZwUgudJQWKUkr5tDGNW/QwW8aYZwT:d8N
TLSH
T1BC62ABF3C3D8822DD81216F89B587E1EDE2D0E2883283C3AD9D5BE4B53E5431E21565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cba0ef10834cd7ae5302d1504aa546161c65561a815a01f6ad9f868e845e6f91
MD5 59528d92a4c0c3f2f586820d96b1bdde
SHA1 1dd57a89be8d91728112b639985fab224d805d29
SHA512 54e12d2f9e1a4aaa44b2761a4bddf8a78b6d92a0ba63c6df1140410f604c4a20dacdfdb633e3a64071e9977dad876bfd6ff345a70430a1f6f86b3a759cfff04a
SSDEEP 192:sxREXRRb6/fMsTMKCA94/mzoA8pjFNIFWy/g6+WNLVBQ4UgI5/YD936SFGGhIgDL:sxREX/6/fMsTMZ8Ojfy/5h5Vi/bSv/
TLSH
T19042D7126938A97B4CC7E21DBA25BF53D6F91032A1D01E58A7FC9A0C04EB7DD620380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 52aa2974ee544fdc2194586f37a96f8105889fc45ad7ab23ced1d5ae928e2b3c
MD5 2bd1ed5c7b8278aecd9b7d561206063c
SHA1 e575d0eaa476cdf5a3ca11668254cde40ab77ee3
SHA512 a0659a961e71ef7b8f9a6b7cf294968b633cccfe91a1d16c0a8ebc913037584dc4129778d6afa759373df3ec63e77b68f2eb92861f5314a77868a08e683b78ef
SSDEEP 192:sxRxXRRb6/fMsjMKCA94/izoA8pjYb/g6+WN9Q4/YD9k6SFGGhIgIJ:sxRxX/6/fMsjMZ846/59/kSvs
TLSH
T13632A6166E38A93B9CC7E21DBA65BF53D2F9503261D01E58A6FC961C04EB7DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d208395d2b110a0111f535eefa9a0ed5d2cb097f08814dccbcad91a26b535ac3
MD5 26b0688673ae7f7bad7362ab722fb014
SHA1 66b82cda659354903fd00b6b0719afb96cf7f070
SHA512 125211cf0da72c2f18c735737d917f0a1d5d600844b5c2bea3e7d6901f69cb0a49b6da261cad31a48babbb7c36d9c04c8cbe361211a66449c524464facb03684
SSDEEP 192:sxRWXRRb6/fMsTiKCA94/jzoA8pFgF4dFO/g6+WNLVBQ4UgI5/YD9CO6SFGGhIgt:sxRWX/6/fMsTiZ8Ds/5h5Vi/lHSvt
TLSH
T13052C7126D34A97B4CD7E21DBA25BF57D6F95032A1D01E58A7FC9A0C14EB7DE220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7e9aa51c25e7ddb0bc90fe965dfc440f2151bd19efaf623b24bba8aff44aacb7
MD5 ecb63ec7ddc8c0f1700166b48371e40b
SHA1 713c539ae233f2435daf00c2d5aaef6c55cdeed5
SHA512 4da6dbf1260ec23fcb451e0fef3a4a76d07b6fa32b39c117656554f344b6825409d38b0b1e4ecfacd9ea699930890aa015f5ba88c74df6b22f4d584b4914a6c2
SSDEEP 384:a8YfWRmfCtg/NFfHfKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcyropDN:azfWR0Wg/XfHf8F1+UoAYDCx9Tuqh0VB
TLSH
T119B2EA2F200DCB7F5F800AADAD196FD76D9802C79B588D5047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\12f16a7b-93cd-45db-8c79-2d9a859b72ef\index-dir\temp-index
Size 2KB
SHA256 43bfa9bacfa74a1106068a261afb3dd6a7a283c1e61aff23848260fee83403e8
MD5 b24b67fb8cf9f540525d95d97d87ecab
SHA1 854da2eebe020a894a6041c7168b5fc5c2ce69ba
SHA512 f4d00aa35362bf9817004e42cd04b1282a0aee981c3a6eef9549bfd3a1216b74e5ca4eb9536c1d18b32c1b8168733f33bc34c346e5575e0777574f6f9d317bb4
TLSH
T1FD51954DC980A7AEDCB162FE1C5818B293B12D28FC58C3A191B4F5A238536A917076FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\12f16a7b-93cd-45db-8c79-2d9a859b72ef\index-dir\the-real-index
Size 2KB
SHA256 de64e33cda68a1d4c796d01b3e0e569c7e2ed9c6f9eee31e8154308e7b47019f
MD5 fd01e97ed099f15c95f93b7542796e3e
SHA1 9da4c6f25d38c145188e4ad235df34512a068f24
SHA512 bd0b014b977eecaba499c481acd7ab11278399233fb246907ea1d462383af4ef9d091488cc4083fc35089779b109fa2a48ccd82f0c51ac86b3ffc259a962d601
TLSH
T11941744DC98057ADDCB561FF1D5815B153B12D28FC58C39254A4B6A63403A9417476FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bbf3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\12f16a7b-93cd-45db-8c79-2d9a859b72ef\index-dir\the-real-index~RFe59bbf3.TMP
Size 48B
SHA256 867b92a06bf33754370967bfe8186a7efb51a1a6bbf683e6db2032ca11446c06
MD5 0f7d7d93080d19c6f000d6d35e447bb6
SHA1 4e6c6f60726962cfcceccec84c79cd5a2fee7e59
SHA512 6a88988595d7c34f7ce74873c508dc13b07eaadfcb7c2c0e3565b7401628059c0c48477b3fe019b7a062938455fdcbff0456e954443f99652fdad250949164da
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\98a6b2e3-1eb1-46e2-a3f0-9ecfff7339c4\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 8ca8926d115171b02b41e800d1ffdb011edb6f53cd3c6d14de602ca20a43ed14
MD5 5a127cd6dedd2bc7975a430d06743f28
SHA1 dc61cd3adb7c7411c284ea55d62790610aa45cc2
SHA512 2155dddac66121ee16be07fa34e13a1c56a1e2516304ccf1a192b0469f39f0d5a5c27b154a55fc06fb76673a64a64552030ba72b4ae7e20feb63aeec647bc8cc
TLSH
T1FED0A9F64672C85B2730ABC85434200EA93A998A88C8C8EC9809B08338B8942C00AA39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 1567885257e43ab701c9a33ded5319dfa798f5f0fa151a4af89942d23a318840
MD5 16cab13b8cdc07ed79bbd3f346816079
SHA1 94e59c16518b7ab1736bd0de74e4599d7d39f826
SHA512 0393179e888cd7f258925d43109791083cbdb3e369f02e868eb7c9362e3c59de0e9f98992f45cbcc9a396f7a34892c08fe26f53e82899d033f4e5385318bd2e2
TLSH
T1C8C04CE70951899B1670EB881024761DA90B514A88D5C8F85448A04724749528405925
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 582e009bffaece44134d85a7a3cdf3cbde15c0a60171781f423acc1fcc9979ce
MD5 849c8e651cb056e40f75c627f0686c21
SHA1 5e20773a196bda5e6e5346addb25be4ed173b399
SHA512 67cccbcd9e0dcfb97ac89b5ec045dc3ff01f562a61d5bb45ff528b983acede1140fdd6a254388813589cda1365d9f7c1f182e7df1812cb68240cfda56113269e
TLSH
T117C04CE7095185971B30EB8C3424761DA90B524A88C5D8F85848A04721749528415926
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 15946da1ae23a9eb21473613068e7b0db33c71114af1392c233111ba38ab9908
MD5 84e35487f1bcc61e60036c4085516898
SHA1 b60a5476725e8669db9ade42e58a4093e39082c8
SHA512 fdaafec52c1b5561f7e854c3750dc2b04ffb6216169f9173da203007dba4945c8792cf94525ee4b74800a005486c5eb2ede6cff155082a66bfaae818da2d84bc
TLSH
T197D0A7E68F22C8E61730D7483424214DB816991BD8C6D8A85D48B04330B8522C018D76
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 276B
SHA256 706cd53e89dfcbe80f86712446df94f51eb90cfc8542edbcfc05472b30950687
MD5 45c5114fb0815c982bc9b58132f71d26
SHA1 8c70368d84d65ea5b6d3c29ca79fe431ca62a7fe
SHA512 7d39182da5aeaf9ebee3ddacb98a4c1390c46f8f636827dea4c2d92682dbaf0747ba9be7631f4020384f593b54a74cdfa2e20f41ac3cb7f0ca14a26b06f3a4fa
TLSH
T130D02B9B799280EFA973CB852830754EFA5B61854CC8DCF8688A604A3879D07B801D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 283B
SHA256 8afc7e2dfb64faecd3b0156585b8d63f7bd0f0b6bed66717cd0f1300ac9e1bd2
MD5 3fbfec61cca5779ae94004fe209cdaf7
SHA1 a1b1fef7fba5c92be0eb11966efb5195002bc84d
SHA512 86508b8dcde392fc6a36931fb9fbbf5768b96a46451d3114da8e61c5eb328de7206d15aa336facb7f4a2f428f8988c036d16f80592db4b8252bcd05858a8055e
TLSH
T1DCD02757B55244DBDD33C7853834354EF56765454C84DCF4384A70073475907B905D27
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a7cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe59a7cf.TMP
Size 137B
SHA256 f569f5b12d08384a622575983bfcc2839714e421ef296c27d39f16a5d6f9a008
MD5 1d9f5e7c48529115f91b8c60ab18a5c4
SHA1 0e3d7f4ebba60a337373d414dba680a50ba4d0c2
SHA512 e0563a9f8a61ee5d5561de618a171baf8090e34dd615b94161bda1eb5aba9dca3587c92b3aa1c0a56aa9ae7b28073586a0e4311b1bf754e39381bb11c1b8bfb5
TLSH
T14FC09BE7095185971731EBC81034764DF91B5D5FCCC5CCFC544DB0473074553C409925
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 01164940125d891a73320bf2423b3b395e8ab27b61e7cce0a9fb0c48655cf7d1
MD5 ca33d1877366ac8e4de6ba5f8f6e0907
SHA1 07eba8259038fc51accb77f3a240e159e091b1a3
SHA512 1125a1fa57527f9bb2f06100a4a4ee8e92311ae11ddce65439c72b3ee812a19126fdd3f4ff18183503d5357d911ac0e675e9a021fd5aadb43aa68f1f276fa783
TLSH
T1A0A0026115481469C1B402F8D846058C32395DE11746020545FCC485E875981A20D242
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a10e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a10e9.TMP
Size 48B
SHA256 803ecb218ee7189d604719f887efad5466fadd538fdcf61ccbf6258e8cdd052c
MD5 abd67d81d88cdc7ee4edf2d2afc24936
SHA1 145c12470fa8ce0c492d9758257b3e0be4c48286
SHA512 c9ad6fbe971975705ac6ad7980e610e3ebc2ace3b491cf933d2463fed8befa419ea132708f41860c6be1b6dd7a92a53d4b1960e5a31d651f76604e052bd18ade
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 81926e3a58d45182cf6f83a689cbce7308664d0c4b6fb3caa8cfca136a9b451c
MD5 213219ea9d4f173a4a1b8cca38cb5aaf
SHA1 488d6d2b60522043586338387e8b759a87cd96fe
SHA512 dd85e3c0869baa8a9d6c851f64a6630ea14569b260cc3e916ec8a5332eff49672b0a660a9340f39d4d664be19fd8635f25348fd0b38dffa1b515d8736ea08d37
TLSH
T170B0223000C80EA2CC008BB030C3CA0033F30EA0EB2FC023B0C02088C833230830302C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 2KB
SHA256 bff1fde74752577705e6a31eb388c4c4b439c1f1b09d8f279df37003b77b4290
MD5 a57c4f329030c6c837b61f54bdaf34b5
SHA1 7be9597daa491b2d00abc5507ab659ca3504743a
SHA512 f1ce8ec2a3420d206e883c714b80a33853906331695843f35d80cbe10718e77efc2711ce85ffdcd59dc1b53a2b9584a92685e97fef5f5d0990d7aa19ae7d76a8
TLSH
T169514100357F02013C7E651D94A5A91ED2C274A6317DA42BF7AD056B0FAAF014EFDDD9
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a4ad5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a4ad5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 1bc0188d753aea6da5ec641886535e4ab199c861b3ab32a9eee04da8a63e361f
MD5 8d47e1687f918e85c06b3ba56cdd4825
SHA1 01a21d4c9325681edb2ac0c6c195c3839a62894e
SHA512 bf861a9f7bd2e245f17f454edc6b74c17c69e9e7c85c7ac60ea538b89f6ddae5f4c351e167a598d31c8df00615f1e89020c72545f43f5507f2731b11cb46252e
SSDEEP 768:trv+4UNbdb3+1i0KWrEnjN3Gac1FG2ewBKZOrc:tbsbN3uHQnjMax2evZ2c
TLSH
T13F13BF316978DEB38DF6E285B1077A037EB4069385D40BA4DADD7B0D169B5E8230BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 32fb0ac692db6f6680a95a3f9d8ed0df9ae13a49691a6bb859d8c6a2d2bad82a
MD5 76f36fd81dba95089394bfabe1647207
SHA1 e32d5a6ca3f786d4e572eea3234ddc21cf42f9f0
SHA512 10c5ecf9b8880e74910f14a7a053b6e05299a438a8ca32038cf2d32bfe31f9c51a9ca5c53944360370718972ba7f92d30f8cd51bc2c7d1303582d05c29bc9b0f
SSDEEP 384:bZcI838Nswg9Iy6b8WZlf8hyEGoH77jaF2y2rEoajo4cdR8eHhVODjYPNDUMG2T+:D83k1i0K5rEnjN3Gac1FG2ewBKZOrL+
TLSH
T1A8F2CF706D74DDB38CEAE385B5037603AEF047A3D1D40BA496DD7B0D1593AA8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 edf39425cebceabe5e7e8dfeb9993593e771650ae8645f27c05ec9897fd29cf2
MD5 abb8d4fb4474a18f6896a6ea0f4b1a4b
SHA1 64ba3c44b5233332419b2883368d1b6b2db10277
SHA512 bf2acc5a2666ca563142b020a62ddd7868d75e97c621bb0ea475d4b00a81d72ad4bd4180d71a382899357e51ed95452bf0098bb94830f62cb4658a69b5e36562
SSDEEP 384:pZcI838NsRg9Iy6U8WZlf8hyEGoH77jaF2y2rEoajo4cdR8eHhVODjYPNDUMG2T+:h83k1i0K5rEnjN3Gac1FG2ewBKZOrL+
TLSH
T17FF2CF706D759DB38CEAE385B5037603AEF047A3D1D80BA496DD7B0D1593AA8230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 42ec1118ef204ccd9c6791f5214f06f5fbb24047cc8c37de31ec31422222cd33
MD5 efdff4d26c745c1e45c0fd9943ab3381
SHA1 56fa8ae42a5a84f48106767bbe6c96608f205469
SHA512 87ec1823eb5e4284a472ab8181cb116617ab40acc2817128852a7fd556e80fe064a620da1ee209ae99387f9080a7e5fa3ccb582a9cbad2a06d7391c786ac38ae
SSDEEP 768:pFQc3zwgf1i0KorEnjN3Gac1FG2ewBKZOrL+:oc3hLQnjMax2evZ2q
TLSH
T1C8136BF158E789B7C8AE9747A73E3E029DBCC253B4944A60B7C8650CDD925BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 95becde2bc1aee0343c3c36b4640c766885ca640391590ab3bfe6db23398a200
MD5 36a3cd24aff09c49786f4e2a996bebef
SHA1 5b0f7cfe10a0468dfaf89366abb610c42ffd0224
SHA512 0f356a041bc580eb358c4dee26b4a9a84bce2b0d114e25d5936aea1c8f810bc80d5af17c589159343bb1d6e608e5de850107bcd95901f35f4ad99fb30c5a7a30
SSDEEP 768:rrv+4UNbdS3Emi0KUrEnjN3Gac1ZBeVH1SCz:rbsbg3D/QnjMaaEH1V
TLSH
T1D603CF3269A89EB38CE7E38571477A037FB4125385940BE0C6DD7B0D129B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 40c6f1e2298b20fb6fff7a3c987de6cfe372f2bb1d05f22666ed93c26ce5ea15
MD5 9787f86927ffa97db176f24e5ac3599d
SHA1 0eab8f0494f4ad72fa3cdc7cbd288ecc0a7f8763
SHA512 c1e7c62bc51da662c941f572ebee11867c64cc1f78136bd765f36dd4af1a7a8c112bdc48451939a647352860f5e5e08ab4d2f912689fd41754e099ae7fd93468
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ecaf41eed870894c9f94f16285ad530e2c874f0501f0068a1bb7b6b91bace2e8
MD5 efe9d3a1b0d0e3d7ecca44f4c76d687d
SHA1 ec03ec7977589777722601c5e49756c174c98d4b
SHA512 816aa3fc03b98e565c85683599c45b60096a36a9699d3dbd1c4e8bdd9aca6c80c0e8c2fa0678ef2a5602400b5c70db14cd796505ea161e71751a067db826c90b
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a10f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a10f9.TMP
Size 392B
SHA256 17fbbcf442025fda671484290c78f8aebd678725bad5d14d9b9e319dac941211
MD5 0c93787c5ac0dbd9ae0550f8ab92656e
SHA1 d527efae4f0822986430e056466958f9303da5ba
SHA512 b34d32281dfb638d9610422f829cbed79fb8ab00bc1efdd14d11ac3475239bca79feedd99ebd157b42198b0dc9247703bb5dda1ca32d66db09667f99f51f666b
MD5 SHA1 SHA512

Submit Download

0a9d18d8-8a61-40e1-84bb-847f5fdd522c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0a9d18d8-8a61-40e1-84bb-847f5fdd522c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/2996-261-0x0000023484690000-0x0000023484790000-memory.dmp

Download