a00506df34a2ace03a8ebe271727588e38aa824de32edb5a9863882d81ef65de

Analysis

user interaction
yes
max time kernel
165s
max time network
167s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/08/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 136KB
Sample260808-ph7cba1scx
SHA256 a00506df34a2ace03a8ebe271727588e38aa824de32edb5a9863882d81ef65de
MD5 af69f8a169102227cd011c17f62ffdbe
SHA1 d1b163c2fa4b3609640c75c42910477749d973f5
SHA512 adb41595f15af7ce15693f19e10a5efdc3cad0c7e54e9d61708154403987a050cc3c6c44f3863fa5f081b0830423f3dd213b54a13002006292005783c5a053da
SSDEEP 1536:vGI9L1E2/nVypN567rOdKkkw2SITVmHChTLbgSrUFqgI2SCf5GZvqxUcVVyLYfqQ:1QcSfX7szAE0eF1Je
TLSH
T15AD3C7B360E15014633A8A40419966DFF2418107C75C8EA877BD33AEDFE7BEA46B364D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
704	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306652600527248"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{F5F88AA0-AA8A-4AD3-867E-A5F8E3E99800}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{BAFB9E68-C7F4-4E8C-99C5-5E267AE39D94}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6120	msedge.exe
6120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1628	2592	msedge.exe	80
PID 2592 wrote to memory of 704	2592	msedge.exe	81
PID 2592 wrote to memory of 4484	2592	msedge.exe	83
PID 2592 wrote to memory of 4484	2592	msedge.exe	83
PID 2592 wrote to memory of 3312	2592	msedge.exe	82
PID 2592 wrote to memory of 3312	2592	msedge.exe	82
PID 2592 wrote to memory of 3312	2592	msedge.exe	82
PID 2592 wrote to memory of 3248	2592	msedge.exe	84
PID 2592 wrote to memory of 3248	2592	msedge.exe	84
PID 2592 wrote to memory of 3248	2592	msedge.exe	84
PID 2592 wrote to memory of 1552	2592	msedge.exe	85
PID 2592 wrote to memory of 1552	2592	msedge.exe	85
PID 2592 wrote to memory of 1552	2592	msedge.exe	85
PID 2592 wrote to memory of 2988	2592	msedge.exe	87
PID 2592 wrote to memory of 2748	2592	msedge.exe	88
PID 2592 wrote to memory of 1892	2592	msedge.exe	89
PID 2592 wrote to memory of 3752	2592	msedge.exe	90
PID 2592 wrote to memory of 2988	2592	msedge.exe	87
PID 2592 wrote to memory of 2988	2592	msedge.exe	87
PID 2592 wrote to memory of 2748	2592	msedge.exe	88
PID 2592 wrote to memory of 2748	2592	msedge.exe	88
PID 2592 wrote to memory of 1892	2592	msedge.exe	89
PID 2592 wrote to memory of 1892	2592	msedge.exe	89
PID 2592 wrote to memory of 3752	2592	msedge.exe	90
PID 2592 wrote to memory of 3752	2592	msedge.exe	90
PID 2592 wrote to memory of 2604	2592	msedge.exe	93
PID 2592 wrote to memory of 1684	2592	msedge.exe	94
PID 2592 wrote to memory of 2604	2592	msedge.exe	93
PID 2592 wrote to memory of 1684	2592	msedge.exe	94
PID 2592 wrote to memory of 3952	2592	msedge.exe	95
PID 2592 wrote to memory of 4724	2592	msedge.exe	97
PID 3952 wrote to memory of 4872	3952	msedge.exe	98
PID 2592 wrote to memory of 712	2592	msedge.exe	99
PID 2592 wrote to memory of 712	2592	msedge.exe	99
PID 2592 wrote to memory of 712	2592	msedge.exe	99
PID 2592 wrote to memory of 4040	2592	msedge.exe	100
PID 2592 wrote to memory of 4040	2592	msedge.exe	100
PID 2592 wrote to memory of 4040	2592	msedge.exe	100
PID 2592 wrote to memory of 1864	2592	msedge.exe	101
PID 2592 wrote to memory of 1864	2592	msedge.exe	101
PID 2592 wrote to memory of 1864	2592	msedge.exe	101
PID 2592 wrote to memory of 1836	2592	msedge.exe	102
PID 2592 wrote to memory of 808	2592	msedge.exe	103
PID 2592 wrote to memory of 1588	2592	msedge.exe	104
PID 2592 wrote to memory of 3364	2592	msedge.exe	105
PID 2592 wrote to memory of 3364	2592	msedge.exe	105
PID 2592 wrote to memory of 3364	2592	msedge.exe	105
PID 2592 wrote to memory of 1976	2592	msedge.exe	106
PID 2592 wrote to memory of 1976	2592	msedge.exe	106
PID 2592 wrote to memory of 1976	2592	msedge.exe	106
PID 2592 wrote to memory of 2132	2592	msedge.exe	107
PID 2592 wrote to memory of 2132	2592	msedge.exe	107
PID 2592 wrote to memory of 2132	2592	msedge.exe	107
PID 2592 wrote to memory of 2712	2592	msedge.exe	108
PID 2592 wrote to memory of 4228	2592	msedge.exe	109
PID 2592 wrote to memory of 4228	2592	msedge.exe	109
PID 2592 wrote to memory of 4132	2592	msedge.exe	111
PID 2592 wrote to memory of 4452	2592	msedge.exe	112
PID 2592 wrote to memory of 4592	2592	msedge.exe	113
PID 2592 wrote to memory of 4452	2592	msedge.exe	112
PID 2592 wrote to memory of 4592	2592	msedge.exe	113
PID 2592 wrote to memory of 4592	2592	msedge.exe	113
PID 2592 wrote to memory of 4976	2592	msedge.exe	114
PID 2592 wrote to memory of 4976	2592	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff9435cc188,0x7ff9435cc194,0x7ff9435cc1a0
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,10274971061453931059,13378819846912255274,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,7739315354252503314,677590102260903612,262144 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,10702448159260751006,2753997135278435710,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=1368 /prefetch:13
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,14799871106715776897,12923714397423894769,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,9726837614728841347,15772768131979419587,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,9962127249840788108,16447655229656934669,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,1088182845115270093,1609918955530751082,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:9
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4160,i,17121227351887951275,1079176505304455255,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4176,i,12912091757928688730,14805128468752591587,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13072357438827572027,14159759000080338649,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,5253607460455616084,3074365512486987510,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,6500949691278366144,3866298594431778768,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6648689782083223093,14030268410394923461,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6648689782083223093,14030268410394923461,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6128,i,16247486458458981440,17934037964705880441,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6716,i,14695751777682151757,11702486171225520035,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4916,i,3935781728976506494,12633663700477170326,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,14948957780661645990,6444239855334989926,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:14
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,14354938999809894822,8449954217462158589,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,8514096399154473763,7881506421915887346,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:14
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5552,i,16136373988243189181,10909903924550418343,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6956,i,14661046069913221243,17656074466095226928,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6880,i,980830315655430214,7190497387345628605,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,14221657138015439234,12609865655448893949,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,608095641856653865,5860435360232152273,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:12
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,5139670761887178879,4995198383432164307,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,5139670761887178879,4995198383432164307,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=3984 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4152,i,12145314435085308048,6885125660503582975,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3952,i,616816214611204715,7271828210130631640,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7544,i,16058135693660754032,15421678223098794323,524288 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7124,i,15994793063671101846,4754823580661758251,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7040,i,5718599071734290781,6470701874319612790,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8236,i,12981166465630546594,4454452971328775447,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:1
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=8184,i,7740697002742362251,16860817259901555854,2097152 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=8280 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4900,i,7621465408679539606,8680274701637184033,262144 --field-trial-handle=2184,i,12371961634956436115,12007195693340008957,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6120

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2468

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fde5025ef66eed55fd88d8ade54159c6896f668960612cdc8ac646f38c6df2db
MD5 92fd10844698a944de0d2c25a0e93afa
SHA1 1449b369c4e6fcd8a01e721c49cb1ff8abbf0718
SHA512 6db7c50c102e0f642aa312115f988b94bf36359d77515a4972a61ddbac533d9fb04756ac734eb4054291d3cc6f89ad0157b4047c9a055152fdd82eff17da3b5d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 83KB
SHA256 7d40765179bc45d7b2a36b9f0d49d12c2048abb154ed0ecfaa2433417fd0cdbc
MD5 95ad70b0720495f26f4b7dc7aa152c13
SHA1 d325d177460b579980d6b36a4da2defbc709d6ce
SHA512 ca9f7e4fd11ce28a5eacee9cda062c8418b4d6cb440ed82328c03d7c1d1835d7aa175a2ac5e35ce2ec3ab6a37ed2fae0bf2eb61c7b08199299b6dae9e5194fc6
SSDEEP 1536:29P/RzSMd667XkZMMts0KAYxxuADuwcF/0ApNk:2ZRu+BeKZxceuwOtk
TLSH
T1EF83EC8423927D0B62FFA7139C3EE9CAACBD90A41743A407D7C7F699DAE91C6C301558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 2f61ff0ba9b5cd03217b4b91c0e21d448a42068e9861d3ae162e6e312de3e0e7
MD5 a2258026f6db354a544542c6d224ae9d
SHA1 9e9385c43cf0235d0dd599ac492de1d912795798
SHA512 e216778db0df2bae87866bd4ffbc65ffc751ba30c0f35e716b896c7cb333cfa480108dfcdf7791e9c57279216c70117546eef160a50707c782a4696a1f2bc40a
SSDEEP 96:g9X9IdLqZIZXbchTJZULtdugyfqj18Lf1TgVOQtt0SsWVmznk:6X9eGZcrkTAWqwtTg8Qf09WVr
TLSH
T108D173144EC6AAD9FB5420BFF4A51A4A6170E04BFAAF7B2308D4DE60A40B3C40DF4539
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 69fa07f72877df186e62584b8bfa539395c340ac6c086d2adb91bcd1a3b737c4
MD5 440705ee389408a35239e5c45941a1b6
SHA1 a570b8e42d11373eca175d9e34eadc9ca628c1a3
SHA512 6cd19f53d1569acb581c47f09f5fc3eebb90ceb6ab56f2a12f777d36584458770352e9c2b0314862c797006ab3e43769ae60540e0cc8c21b94b2f6532723de19
SSDEEP 96:LjA9Ht8wFr0I0M1GwEUwv4s9aLW7H0uBtu:A9GSr0pwGwEUwvbaLWm
TLSH
T12D91D8250EC11AD8FB1810BFF5F92A1B7171850AEBAB2E7211E4DE74250E7850CF863D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe595375.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595375.TMP
Size 3KB
SHA256 2575a5d74fa08ff8b7f20d53e5dcb41e67a8fa78777692a76c5c3e7eb42cfc05
MD5 1c935e94074b66f0e1ed0f9f04f91f7b
SHA1 1a5a1c66dbfbc1aaa8eff7742afaace350a6d6ca
SHA512 e3973212d927fed5f47993d33827fd6e8ab59b5f672b390b2054d9013c2dea557f6f839d21b36045e810a6d21cea84b0884c3727dc1287d751ba6694e91afc11
TLSH
T1ED7150290DC21AD5F32900BFB0F2221F75758168CBAB6E7211D4C7B56A0EB920CF427C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.aliexpress.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 fcbf5a264f9e662eec68f1606e4e37a7d97e63968f8870d6c0d52a3edcc48fb2
MD5 551bb1cc3c47a1fc3375458e34bb707b
SHA1 9e9ceeff4aa83e788ee7fca00a74f4eac2f3f028
SHA512 9c7a740afebc6a2386efefce459d77d212dbe8bb70fba6909a9cfeac427c40c3a109dc3874ffce75472796cbed33aaefea23163433527915ec5f2a5d28e1cae4
SSDEEP 384:DNnQB6yDWl8XHYOj/J+mZDCP9CZkjhG3hwljkzcXpWkYRjDMUEsSVf29WEw4sFr7:U3cJo4
TLSH
T170426BB6C3E8862ED91151F1A7147E1FCE1D0529436C3C5BC9E9BE4BA3E24B1E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 bb477c832504a50352ffbbbc566df0032f3ada6b6904495015b0ed512ce2cc42
MD5 7749c522d52ac5e691a425eac15f8f64
SHA1 542ea8e370709d3d0949306e2a90e4723bb376a5
SHA512 220d659d08f7b2595f4b58230a53e2cee69a9e7d7278b619fa1c3c161c759c081fdd392999d0bd371e86e10a6566abeefb3a1cfb35274bc9cc98b95b6d035a85
SSDEEP 384:DNnQB6yDWl8XHYOj/J+ObeUeZDCP9CZkjhhhwljkzcXpWkYRjDMUEsSVf29WEwAe:N3cIow
TLSH
T16D529DB6C3E8862ED91151F1A7147E1FCE1D0529436C3C5AC9E5BF4BA3E24B1E241A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 eda53a16be22c00f0de2ee57ddd981b54df698d370b717042082f4ceff74a767
MD5 7b2ce2be1ae8d83bae476198effe11f1
SHA1 19734c77248947912167990a2fb98101ecd7b157
SHA512 c6a1c9e105a31be41e351b79761fa517624c18184a91fab8231957fc9d9b5bd6f0014418f7587d709dd118078233a5983b60860a5e6f011f6974d074a0c1b779
SSDEEP 192:sxZN2R0yM/jK1Ml8MoA/fDsFkFIdpA3NHjKNCNxIZ/W6+WNglXNJAoNE53/YHzsi:sxZN2GQA/fDsFk2SoEm/beJHm3/xRY5
TLSH
T11E62E652AA345E77DCDBD309F952BB53D2F5506292D00E54AAFC9A1C08E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 25634d2f81ffd388281bf84af19dd39ec372034d1f39423905bd0365e6c4add3
MD5 dd1212d7e03432c2f56df65264eee8e3
SHA1 2b7e8453351f4c6e343287cc4efc189740a2b702
SHA512 014abd32753b9c61f6202f97a451e46b731fcdd66ab0b9675b5c2f8b239de2ef2dd59e6c899cacf489500fd63105e9cdd2f0b77bf967192c52f4b37d990c6058
SSDEEP 192:sxZN2R0yM/jK1Ml8MFA/fDsPweIdpy7Ill/W6+WNGY0stTLgIgrJ:sxZN2GdA/fDsPwPh/bG5J9
TLSH
T18F52D711AA34A977CCCBD309F955BF53D6F9147292900E48AAFCDA1C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 71887f0d077da3ac5b8707d2953c17e4a199b335f5150047e43e182125aa40ac
MD5 0a7bc24f095c5086adf5d757f16a4c12
SHA1 6b0d605a2a92f65375647bb6e61f6ad55810c5c8
SHA512 c913748bea1a0205e8927442052ec54ccb900aeb5185872896ce35446868f141eec086ace50a7537e82bebd9f146b7f85a27742fd4dddf6c56335eba6d801f59
SSDEEP 384:sxZNyn0Gq0A/fDsFka/pOoEm/beJqlm3/xS5:sm0J0A/fSkE/b4TxS
TLSH
T1F882FA42A9301E7BDCDBD219F512BB67D6F4106295D44E44AAFC9E1C08F6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 9647e1051773d33309515e636f1b0d2be6d619f288ddb261cfcdf614fa2f9491
MD5 57fc97fdf0dab200da4fde777e225877
SHA1 88d7594a948adf3c3f4bde6a425f22a1ee202877
SHA512 8541917dde209644432397939dde3b424b79202b40a27d29d6b2b60750e1ee59bcd141e6422e45fdc5fb4082adc3b770d59e89b181e8a1eb9b650e2c754440c6
SSDEEP 384:sxZNyn0GQA/fDsFka/pOoEm/beJqlm3/xS5:sm0HA/fSkE/b4TxS
TLSH
T13982FA42A9301E7BDCDBD219F912BB67D2F4106295D44E44AAFC9E1C08F6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f6a704c35a24cf0aab61dc377f46efc42181d8e68c723bf7bb74b389d1cd813d
MD5 6e3a641ee8c8a9229ba3edbce3273297
SHA1 bef72dad7b7e44307adc274d4f2d28035773701b
SHA512 2a1cd5611cb265c22ef9c72ec80fa3297731dfb516d890b2d82acdacccf845b6910486d4b38bef865468972d982f225976caef712967ed2fa900330372ee237a
SSDEEP 768:aN/Xh8dF27kWRmwcQDw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601d1roh9:aN/Xh8dF27kWRmwcQDwu1jaKmjLpkD1C
TLSH
T1ABE21A3F280CC77E4F844E6DEC26AF966DE801CBA6684D5447FA494C03C77EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 3KB
SHA256 7d85886fca7617a0c8e261acc921bd787d23b4fc0b010ce985e153553e2d718e
MD5 4bc7340b9fe153fb7689e8a3b3247c05
SHA1 0d8374ca2e857739ada97df75069028e7c5cf219
SHA512 5331d795609d5ec976820b33f018353eda6518a65ba61480df68fbe7d5cca71fa9f3670a0bc6c3cd905c7b18e2deba491e7f2bd5c453ff60b94d58d9de1ea420
TLSH
T12C51D84E8D825955C9AD11F21CFA24507B3AE8DE96C9DF4B32ECB035BCC333A2D55261
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index
Size 2KB
SHA256 369069709ad15f3aa59c3bf8a033b06a69416bd64fbbbf63cfa9c6763dfeff00
MD5 7e50e3f77ad52a417a0a7c6a4a5cae63
SHA1 2156846a68fcf6ed02b8f03390c231cd99d3792f
SHA512 8804435f2421e38e59ad7d2fe8c3af1ad43fc41b4adfedde92f5bd849c1a78854f18b29751b49e282d80713dc09d25d0ce075fdbcb8c7c20ac1ff9ad691ffee3
TLSH
T1FD41B64E8D818A2AD86C40B2257638D4337198CC07D1A69318FC2236AE4776D0E0B2AA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595c5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1927bbd8-f4f8-4811-b807-9378a5e80acf\index-dir\the-real-index~RFe595c5f.TMP
Size 2KB
SHA256 66c691fb9873c55b8024ecfe4f0682563a540cec4bfaad3e876aa869bd7c10dd
MD5 abca473ed8466f628c7cab54c20dfbd5
SHA1 66a9cebf872c092e7bb04e2d1fd55baf750e1d7d
SHA512 6176bf4f00c0fa4613d2083b5a925879b27eaef7bb48ea68a86e1669f2c573d252cd9089cb828c72aedd18ebbc7a1d57906ee42b5ce8043162cd2b030f7b599a
TLSH
T13841979A4E81862AE89440770DA364B47335580087557F53B8BC5635AC9279D2E491D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
Size 72B
SHA256 049a99fa51654b8cf1f78c87476e286e82c73ab830fd9c40ec4300edf97fd178
MD5 772a42099b14330c5563a47e8055acdd
SHA1 58866ec87fe15fa297a82006dceb7935e3534d32
SHA512 a904f7cfa4291e8f2b0a6aec0e7d8df66ed07c286c6488933ffe1260d77e616e3c25b819fe0c7197fdcc40c2b881e6b9c25d1b2277b0f622ca5c48b644df1c7b
TLSH
T1FCA0022512C48201C15222B0ABA6D15172914B50030A532D61D051A4CC586E6464110D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\35e883e0-6cb0-4875-9f9c-0a8beb1a83a9\index-dir\the-real-index
Size 72B
SHA256 243e383318055f8dff1d6545d7f50f27ace129783127b6246a80cd88b9b34dd0
MD5 af1c0ca5d49f7928d9798cb4fedbb887
SHA1 40c3a1086fc2176cfae4ecddaa1f9542dabb563f
SHA512 9a43749305ef7a29ee68d84d529ed8daec777feaa024fb1ea09bb525b072c5770c0fcc42903c43a9792b260948512822bc20c7fa2d9d03d0bb331a74c971ab25
TLSH
T1F8A002200F900085D01219B2599307C16320CA90A140531740D10294CC504D04D9310C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b9bcaa74c243adb58fdb4bf0cd0f7112cd179e8026717fabde911a2b19fc187a
MD5 766444f54b545ffa50ab02f074d308d1
SHA1 88fa3c4739862a694022552c2f23e5766925dd98
SHA512 3b9216c75f67030febec7f7b9bc0fa63043b51930819ca701fe17ef5ed6dcd9844590ff28e16d135b0288f73f7cc3dcbc25c3ea2b08318cf987d2a9d7b3d74db
TLSH
T1B8E0D8FA3FA31C6CE8AF93D5247151E00185BDA88986FD4E305AE7CB50B13553459D61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 dc82d4c1228e92bf1a30ffe9ac225816f472bf317d30c32cd948d8cfe6f914f5
MD5 19993174eed092bf33c4e1a005572f19
SHA1 ae7d6d64905a97640b56ec86b0807e143174bd1f
SHA512 27125832a104a7e4c564b48d8da71a22e53f3ab74003059ece678661c169d2c8f242da56236000294dc55f8b0cba673c678293bba75a75f470bb4a892c384e75
TLSH
T1F2B0245105544403C0000330F150505C71305CD0011F73D150FC007F50333100353C05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6a8cd8376c10cf3459a810be5f0b1b9146335dd9073c14e11684b420ba7a2bde
MD5 be116ac90d1abe723e8d1a570600e34a
SHA1 3510f138656601777f99270bf849db33f707f189
SHA512 8d7e5170409c0c5abd2bc1195ca0dbf4bc118763fa01f5c9bab391598df2fb9210fffb45bd077b00f25d822d316757f2676f8e55a72cf4a301b9bcde924448b7
TLSH
T118A0021101D41845C9008278F0814795E2154C100186DB5BC5BC5464EC5214846A2095
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e569.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e569.TMP
Size 48B
SHA256 93bb753f11513823009cb23b7f8cd0beaf0f7f7c45aac90a5db26d18d510971c
MD5 948f58a78c3b1788a477139beb907353
SHA1 262e8cda20e02fb525ada9982ead86071d9a45be
SHA512 d8c232e6d7bf90568491ca36bda7749ee5a650fccb20be81fef0ab5506db4fe3eccfe8ad1bc2a61f4a403468efac5ad3cc6aa45d2b87b98665932f0578f9e347
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 028cc42d748c53fdc544b4f97667ea4250d65b16ec6e3495cc05f66374e30299
MD5 d4b9b69c20a25b1bb5f30a4a31ac0146
SHA1 274423b90be2c19e55257a300ee4b836d20de32f
SHA512 757a635f0bbb6130d477d56fe28e80a155a3cf20da353cf3f9d13851ca7022017f58fa528dcfc3b220d8dedf3ab30331aa80a44ba70cd9af4730436c89950b6c
SSDEEP 96:KRqoKD6qtEaEHEWEqEkEoE0EgIEwEhEzSESEgKqE1SE8EgGEiESEREcE39WKeYap:1/tdS7vdrbO/wr3hgStoVt4n3xp
TLSH
T17091845376BE02423C7E684C86A787174941B2A7309C6C7B7BA800B64E67E124DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dd579f2-a638-484c-9f20-e0a7d13161af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4dd579f2-a638-484c-9f20-e0a7d13161af.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 23ef891a97ff012c241c501dd9dd92c807a07ddc22280390c2417e093bfaccf7
MD5 e541ad8d6734e864be3735e0996b8c2e
SHA1 42c46db761ff6b5280415394475a1518a91e1149
SHA512 3821cf73acfce55a92874c233b5f0fd6c3874ed0a3ed0557e286d9c733c1315c50e08d8f30c4a75395d21a180a33ab447d18b3c39e98f5c19567a30b81e71d79
SSDEEP 384:C8NRuC4XiOcA2r/E5h+3jHnTKwBODNZOCVJ:CItAM/E/SHnewBKZO2
TLSH
T16D725C35A8389CB75DD39244F41B32179EB455A7E6C82F98D5ED6B2C09DA2C8230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4a39f5533d6463eb2e787b7a39ac47e4168a1ef455e344e78388adfeb2c31f4e
MD5 f3519ce22f9720774d0961749e01d667
SHA1 45aed054aae350d0d2a6b5f4c6463c68b051d1fa
SHA512 7cb7bde21edbe7f15dbbd56d6b9890a24b261566fbbf5afff84e1b50809cbf6e873545db279bec19135acac41409e10d2d3d04587dd43f39580834035a4083cd
SSDEEP 384:EiFiZcIG8Nj8TUNTUlIleC4Xiqbrr/E5h+3OHnTKwBODNZOCVZ:fFQGuwgbSf/E/1HnewBKZOI
TLSH
T14AD23AF158DB987AD99E8703A73E2E038DBCC063B5845A54B3D95A1CCC961BFD306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d8661848b5351fbc1008810afc6dc1e25c8693589abfb9179a146f6a2e18da7b
MD5 2d7cd73d174e10835cf4cb002a4481e8
SHA1 d08bbbc28d2dd255fa48a292239c9b416d4dddc5
SHA512 8e818902c43d6cb23e1572877769e1fac4b0d756c9326b3ea86b86ed499bdcd0bb6735f3829211cf8d5dd57cacc366072c39c1af07a838703b61510f06443d8c
SSDEEP 384:2ZcIh8NReC4XiOcA2r/E5h+3jHnTKwBODNZOCVZ:kh0tAM/E/SHnewBKZOI
TLSH
T1D3929E756C386C77ADD3A504F44732078EF89167F7C82F5891ED6B2D05E9698230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48f557d80568cc8cc9ca106bb21a24ceb3866f6f6adf8984488fecb459c92578
MD5 25416b59041f88aade7afba94be199fe
SHA1 6e94b5d30c9723dcbc9a27e465a0155e59069be0
SHA512 d66f4e3a8a23e040ea5be82568727ea44f867a472221f4c06b5dee9a5c1cf4440425571fb610d5401c289f3fe24b8d204890b1d8f4f8d12b7062fe1b2489c657
SSDEEP 192:SGNM6t6H3OQmiUyv00b2dq/rUH5mM+3a/9nJq+U6:SGNM6MXKI2dq/E5h+36HU6
TLSH
T140122B3578A8AC7F5D939940F48736138E95522BEBC96F84D4EC1A1C09DF6DC230B922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 3e9d446ba2024930d046fc647c053aedaf0cae86fac20907e042f7df8fe0fce8
MD5 0242590f1fbc425137af03404c1f8c13
SHA1 27dffa9c997091ff6072a2f25c29ca2da76f985a
SHA512 6d1a6cbac3ec25aea713ed8afbc7c42d3fcc95ab4d29fa589985cecc18a481fb50c970f6a0f9998b8bfe08474f91c4c5592a7ff20b647ad18bdbc734b5a49744
SSDEEP 384:EiFPZcIR8Nj8TUNTUlIlyTg4XiOo7r/E5h+3gHnTKwBODNZOCVZ:fFHRuwgzRP/E/xHnewBKZOI
TLSH
T1FAD23BF158DB987AE99E8703A73E2E078EBCC063B5845A54B3D85A1CCC961BFD306D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a78c3533bdabeff9d18bed9a608488a0ca744998cc7b231a765ca33d040186b
MD5 2df0c921e726e3360e26b8ef0ab28995
SHA1 e0159f4c14a9f454b76b51f5d69ccccdc72778f7
SHA512 489fcdb58bdfe6a6dfe592ab5c059744a577e8a8d32982ba0b65c2f720b901d5d85d88ee5a422db5ec3172a81d10bfa36eae48fa24437fd59deee7ad50e49538
SSDEEP 192:1GNlI6t6H3BQmiUyxHBH0b2Qq/rUH5mM+UD9M6yU6:1GNlI6MXf282Qq/E5h+LdU6
TLSH
T10E02F93878A86CBB9EA35E45B48777239F95216FE6D55F88D5F81B1C05DB28C1302832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f82d96ed7ba3342290a1ec9a6e737d4d20ac4c8a036907c5e3717882344a56d4
MD5 235735c0b166acf878d392ae45bec24c
SHA1 e76faa856a296060921b04f2ad92ba8193780edd
SHA512 1a9371ebb15ad5884ac34c38eb99c227a932a55c02f6e03284c728074f75f864e8fb1072589fdd69ab1be1501f4c4c5f89136f971f46e2c2245a4609d80f9a57
TLSH
T153E00213934380BED03C033000436B351AD3C07016F146064F3005686C333407F71F91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d18d589d786196bbb0365eeeead6d110e0fdd1c5f913cb7e322fd205fd87b1f1
MD5 dd36202502e0c4ef7935bfe44740445e
SHA1 17359783b4c2d172ea80a9bd425570cf53028274
SHA512 b9c553fc9a0c29c24251e8169b73306b344400c4c57d947ec9111c88da9950b708abe0ff3e172a1202e2035605d80c3a7bea4ddda50230983d67e7a4146d67c0
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 15b0940883ff549ec8a205946a278007459fa5b3dc5e4be0f88582742494cab1
MD5 76f36b655fdb8822a83526771a421642
SHA1 1f301e13f52a94a76547436e428c22d3848ae127
SHA512 b11ae5a5dcbb5fec6eb5d3baae1e7fa71011b12c4c0ed62e5e74dee2b1034ca5d959ee4e5bb107267d5160de26b07c3c303035153329b8c35177e57e5c4e7a39
TLSH
T159E002129343807DD03C033000432B351BD2C07016E147064A3005682C333002F31FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e8e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e8e4.TMP
Size 392B
SHA256 7285a03b9a2d486a1e74ac9e0959f6293d41b4cba3684583e8f600a5cd71325e
MD5 060d6f4ffd1e00fa2548e02f4cac8ef1
SHA1 c1cc622ccaeef54db089f26a3e3d8ac1d444e8ae
SHA512 aa37b3cd7a0eb6e393f7a23d78c1253ae79ed4451d78dad781eb51845ef5c8a715054a6d03d5bb04e9f1e55bfce3fa92b7565cc32d3cf844cb245bd187a65770
MD5 SHA1 SHA512

Submit Download

3a6ad828-f57f-400c-a3bb-df13f4c600ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3a6ad828-f57f-400c-a3bb-df13f4c600ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download