ca499e707789c3c847e4326fa8ad9e69f9d56546e8e74081f1e3ccad8bc71ba6

Analysis

user interaction
yes
max time kernel
500s
max time network
510s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 22:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
the-futa-doctor.html
Size 164KB
Sample260809-11dcqswfmc
SHA256 ca499e707789c3c847e4326fa8ad9e69f9d56546e8e74081f1e3ccad8bc71ba6
MD5 f9b01c25de826af2e3ee0eadd7f6c660
SHA1 ddf9e403f5a576c7f08598bac95ce3541892ae76
SHA512 a6f82ec9b9f5707ab16c61af80c08f73cb15dc776e0b4edef2f89d7f558432311f2aca70f3dba4ea81987a7c1c5cf03653eb0499f45665a5c0246bf81d6dfadc
SSDEEP 1536:xYP+1cJfYrWuF1FPkcwooAdqfonqoJKRLasdrXwIwRxP/zOIthvxDHlgINmV8Qhr:xYaFPkDdQnLGctO
TLSH
T1DEF3417396E1A83B530397C472173B6C34EB6A9DC9C20815B2BA43D41BDADF19E8356C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307868128002296"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{E3FF32AD-26BA-45FC-A351-948EA4D8CEB9}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{11FB3EBF-B2CA-4310-92AC-5A7EA0E85783}	Game.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
1432	Game.exe
1432	Game.exe
920	Game.exe
920	Game.exe
1500	Game.exe
1500	Game.exe
2668	Game.exe
2668	Game.exe
5144	Game.exe
6140	Game.exe
5144	Game.exe
6140	Game.exe
2828	Game.exe
2828	Game.exe
4852	Game.exe
4852	Game.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 3652	4396	msedge.exe	88
PID 4396 wrote to memory of 4720	4396	msedge.exe	89
PID 4396 wrote to memory of 1060	4396	msedge.exe	90
PID 4396 wrote to memory of 1272	4396	msedge.exe	91
PID 4396 wrote to memory of 1060	4396	msedge.exe	90
PID 4396 wrote to memory of 1060	4396	msedge.exe	90
PID 4396 wrote to memory of 1272	4396	msedge.exe	91
PID 4396 wrote to memory of 1556	4396	msedge.exe	93
PID 4396 wrote to memory of 4296	4396	msedge.exe	94
PID 4396 wrote to memory of 1556	4396	msedge.exe	93
PID 4396 wrote to memory of 1556	4396	msedge.exe	93
PID 4396 wrote to memory of 4296	4396	msedge.exe	94
PID 4396 wrote to memory of 4296	4396	msedge.exe	94
PID 4396 wrote to memory of 4336	4396	msedge.exe	95
PID 4396 wrote to memory of 2012	4396	msedge.exe	96
PID 4396 wrote to memory of 4336	4396	msedge.exe	95
PID 4396 wrote to memory of 4336	4396	msedge.exe	95
PID 4396 wrote to memory of 2012	4396	msedge.exe	96
PID 4396 wrote to memory of 2012	4396	msedge.exe	96
PID 4396 wrote to memory of 6000	4396	msedge.exe	98
PID 4396 wrote to memory of 6000	4396	msedge.exe	98
PID 4396 wrote to memory of 5960	4396	msedge.exe	99
PID 4396 wrote to memory of 5960	4396	msedge.exe	99
PID 4396 wrote to memory of 3140	4396	msedge.exe	101
PID 4396 wrote to memory of 2328	4396	msedge.exe	104
PID 4396 wrote to memory of 2328	4396	msedge.exe	104
PID 4396 wrote to memory of 2328	4396	msedge.exe	104
PID 4396 wrote to memory of 2240	4396	msedge.exe	106
PID 4396 wrote to memory of 2448	4396	msedge.exe	107
PID 4396 wrote to memory of 2332	4396	msedge.exe	108
PID 4396 wrote to memory of 976	4396	msedge.exe	109
PID 4396 wrote to memory of 976	4396	msedge.exe	109
PID 4396 wrote to memory of 976	4396	msedge.exe	109
PID 4396 wrote to memory of 2476	4396	msedge.exe	110
PID 4396 wrote to memory of 2476	4396	msedge.exe	110
PID 4396 wrote to memory of 2476	4396	msedge.exe	110
PID 4396 wrote to memory of 1912	4396	msedge.exe	111
PID 4396 wrote to memory of 1912	4396	msedge.exe	111
PID 4396 wrote to memory of 1912	4396	msedge.exe	111
PID 4396 wrote to memory of 2948	4396	msedge.exe	112
PID 4396 wrote to memory of 2948	4396	msedge.exe	112
PID 4396 wrote to memory of 2948	4396	msedge.exe	112
PID 4396 wrote to memory of 244	4396	msedge.exe	113
PID 4396 wrote to memory of 244	4396	msedge.exe	113
PID 4396 wrote to memory of 5380	4396	msedge.exe	115
PID 4396 wrote to memory of 5380	4396	msedge.exe	115
PID 4396 wrote to memory of 5380	4396	msedge.exe	115
PID 4396 wrote to memory of 3648	4396	msedge.exe	116
PID 4396 wrote to memory of 3648	4396	msedge.exe	116
PID 4396 wrote to memory of 3176	4396	msedge.exe	117
PID 4396 wrote to memory of 3176	4396	msedge.exe	117
PID 4396 wrote to memory of 3176	4396	msedge.exe	117
PID 4396 wrote to memory of 4668	4396	msedge.exe	118
PID 4396 wrote to memory of 3936	4396	msedge.exe	119
PID 4396 wrote to memory of 5012	4396	msedge.exe	120
PID 4396 wrote to memory of 3936	4396	msedge.exe	119
PID 4396 wrote to memory of 5012	4396	msedge.exe	120
PID 4396 wrote to memory of 4336	4396	msedge.exe	121
PID 4396 wrote to memory of 4336	4396	msedge.exe	121
PID 4396 wrote to memory of 3636	4396	msedge.exe	122
PID 4396 wrote to memory of 3636	4396	msedge.exe	122
PID 4396 wrote to memory of 1212	4396	msedge.exe	124
PID 4396 wrote to memory of 5788	4396	msedge.exe	125
PID 4396 wrote to memory of 5788	4396	msedge.exe	125

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\the-futa-doctor.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffccf0ec188,0x7ffccf0ec194,0x7ffccf0ec1a0
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,13647588807165288213,682707763532643997,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,4805354692894347905,16691683582382911916,262144 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:2
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,13293225353941690899,7113928728715561932,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:13
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,11202310607296936880,14586485483209396022,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,15652217523268643026,18242343279050088938,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,13198249784597959940,9309575407935552956,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,16216495358429499294,6005961602307948725,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:9
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,5214569733440135222,2258302637753050587,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,6236361702339797910,15148931600494556605,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2629596673059427137,15953080409225006762,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,2629596673059427137,15953080409225006762,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4252,i,6748586947795115266,7190340169047222684,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7348145388877981279,10785870412797014184,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:14
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,6166132075395543648,14290760916000094247,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=3872 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,17619019210749190469,13175825027059745706,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3088,i,1741236582798763976,10264773362290996458,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4976,i,938288580530313889,2632863821774677642,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6288,i,2141938183944239245,17753375392409008584,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4316,i,4908858780543892029,8418467793007067480,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=3912 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,3534794653192314417,5456823995155065580,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6900,i,7206752109119222094,1204363020770997818,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7248,i,6651563569493927879,597939293699742431,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=7244 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7216,i,3171322105846025269,8598497698062607904,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6440,i,10398952696386822172,1554455010153576801,262144 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,1511103548774711613,817707119446563098,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,13120446633248911800,8653824573361724141,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,15670144977107926911,8779383147869600045,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,15714534180917189970,12444683399785511898,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=4724 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7040,i,10471812060828621471,8804614614617822644,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,9245967324175580377,13659060040094035769,524288 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6900,i,3026569529602288809,8711037527690359645,2097152 --field-trial-handle=2476,i,13097826502721115319,7594124459824324031,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:4764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5080

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5064

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5696

C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
"C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:1432
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\nwjs\User Data" --annotation=plat=Win64 --annotation=prod= --annotation=ver= --initial-client-data=0x238,0x23c,0x240,0x214,0x244,0x7ffccc969ec8,0x7ffccc969ed8,0x7ffccc969ee8
  2⤵
  PID:2228
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=gpu-process --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --start-stack-profiler --gpu-preferences=MAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAQAAAAAAAAAAAAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAA= --mojo-platform-channel-handle=1608 /prefetch:2
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:1500
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --service-sandbox-type=network --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --service-sandbox-type=utility --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\the-futa-doctor-windows\gen" --js-flags=--expose-gc --no-zygote --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --nwjs --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2712 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6140
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=renderer --no-sandbox --file-url-path-alias="/gen=C:\Users\Admin\Downloads\the-futa-doctor-windows\gen" --js-flags=--expose-gc --no-zygote --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --nwjs --extension-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2776 /prefetch:1
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --service-sandbox-type=audio --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2828
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4852
- C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe
  "C:\Users\Admin\Downloads\the-futa-doctor-windows\Game.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1568,12443232433257565113,13458093821813789263,131072 --lang=en-US --service-sandbox-type=none --no-sandbox --user-data-dir="C:\Users\Admin\AppData\Local\User Data" --nwapp-path="C:\Users\Admin\Downloads\the-futa-doctor-windows" --mojo-platform-channel-handle=3888 /prefetch:8
  2⤵
  PID:4268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 521b1abb255b034f67e4c2c3bc8a996e2e5cda91c3b180839fea79a6447a234b
MD5 7feacea381a226dab3b0a4826af6a3d0
SHA1 be798bd725ca9b8ec9acb8b094dc771d2777e645
SHA512 5786f03863e705e3b6a2e86dce255bb866a3e55c2d5eecd7b3bd594dab18d01543e598196159319753ca7611901585684bda16a4adf36b51cbbce624d4c1ee2f
TLSH
T1F0E0788814D4D31DB5006987A17D47CFC1C4370ED7C4ED091704888871025D5B7C1BF0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 43KB
SHA256 08b668ab17c2dde5424fbfacddfcca4e37e2471be0e1cfff477831d4122157b3
MD5 a524ec6f978e298c04ff7e6e618245df
SHA1 15e6b5ac570c11bd38953ed2c8d9c2306f062a2c
SHA512 416e1be619b0d64f694a2aa7bf945d89d0d812e7cd12e387efac6574d1c66596d3b075b786a2a399d3c03de326666bb7a196851d85c4b85aa609c85c920ddb42
SSDEEP 768:aD2YhIpzPQAP6aqZjY5tBJtKLNtyn1EnHHDpDm4cuK12p5ZNS/DeWTzR:aDTapzIAP6BuzJtIdptcuG0zNADb
TLSH
T1E5130219B14CB841D529773F326A76F1F61DD50AF9E6FE403A7103400BDADB260A68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 331e12f3aa71b3c2dbe1a87bda63ee531c47ce36157830f843fe8e7c6465b77d
MD5 dd57f4a27e8e76f55973fd1931da7f2b
SHA1 b28d2e9bf08ff56966fb4fae1fab8d7867d8f672
SHA512 e4e3def77a252b4f96836b4650c6aee5a44a2ce146bc5d2d1ba91e803b8c2b5643473be3a345312b558eb7c059e0104e61a97a811ff3336435da41e22c186e25
TLSH
T109613C5C2B6905F1D7DC5CB941ED54A932FB84600F0BBA01C8586DB7EC2AF3452C5363
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 685f232e23fe3ee7eeed4a7e4e27c78c1ba6384d3f37e468ac950ef6bf588b4d
MD5 1c9a730c18c4dad653778ff31c439d59
SHA1 ba7beb1510eed5effe0ac66cedeceed5c9478c0a
SHA512 864e9e973d78225d3ba2aef757092837caf84e8fc0f511efb03ed4199f8428102763913b5fdaf6af3c396224219fb5c7bef5e6a870a26a3378a0647b8abda6f9
SSDEEP 48:FktcJqkN4aH7KCvIB1cS5ox8YffcH6gZj+5CNKD7yNt+Gp0j2m:UcA6OCwkS5phagZ9NKDEfq
TLSH
T1D8912D5C2B6945B0EBDC9EB543D954A6B5F644110E07BE01EE482F72EC2AF7433C8A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59ebcd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59ebcd.TMP
Size 3KB
SHA256 6eddaf86ed1cfbf9cfff825a5faa1cad6cd5d774680ac4fd0e775ed242cda7b8
MD5 9a0890b10daaf9738e927c6822ee90c5
SHA1 a38e1dcc77251ce9b591d7689d224aa84817eca3
SHA512 19c8b7002150361c8c2579138d71d20f6645bffcdd377ec0df11a1f366c9f99983e709e95dae91822a48947dd10d3703d0b2ed9eb61034a0eae02ac2e885aa91
TLSH
T1D1613C5C2B5905F1D7DC5CB981AD54A932FB84540E0BBA01C45C6DB7EC2AF3852C1363
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 447e4707740fbde4c553cc0b68006c70e839860d9d3941862287aa547f557449
MD5 4aa056633ec9996b7e4a702757aaf4c5
SHA1 148545455be2c8f2b185bd4129c18d030f0fa4e6
SHA512 28ee5951ec4d7122473ce41d3e7df9bf751701b36211da6ff40c9da89292f4aaf1048881c9e1f95e08cd1ea21393cbd697ea645d7be032b858ac9ce32b2f76b8
TLSH
T12531CDF3C6E8563D890142F87A143E2BCE2D0854832C3D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 7dc66abd7ccf16105b5e4c0bda6b587d17dcacfb7a8df358119635387242dd18
MD5 4783906de7d4c02ea71b692ee48678df
SHA1 9900eea7b06d675785592fa40eb3f6d685f80729
SHA512 d45672faa87542a98dc35e91a4bd08e712a980e50feda520ccb7641be13d051bafe1e32a91f460cad86e636fde8f1227ae8d6f40129fe6ccf2cf6347c44fc187
SSDEEP 96:DxOX3shtBjVVaaijhnF8z1hS5Zzp/JNwEyiENjmjTIjZeGjhijljhe:DkX3sTBjVVaaijhnF85hS5Zzp/JNRyii
TLSH
T15BC1CEF7C3E4427EC91152F0AA156F1BCE1D045A436C3C1A89E4AE5BA3F24B1E141A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 6d2a7d6c09a1acbb94239882ddd7e08e5fa818c08284950ed96dad0a980a48bc
MD5 e0f1a6bd68caf4932df7ca559cbbc5eb
SHA1 b360d039219b7081898f56e3fa6d47c1a627121d
SHA512 bda5193d31e5a519bc6ca4bb74d8193ad8de6c2fddffe3d0b7ffec65761d2db97a73db23f61ffc3945878a7b80bd2350480fd507f5575a8e4c53ea9301804d5e
SSDEEP 96:D/OkUaOWjIVaaijhnFuz1h25ZzpiNyiENjmjTBjxvjhzjhijlwBJGj4/3:DWkUaOWjIVaaijhnFu5h25ZzpiNyioj6
TLSH
T197B1BFF783B4427EDA1196F09A156E2FDE1D001B436C7C6589E0AE1BA3F24B1E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6a37095c2c87b6253ec34fbb6b95cdf334fe91b5ef6dbb50355b577d7559de0a
MD5 644f1365f5ac31aa07e0d0cffe8e6546
SHA1 db7b077a9e3c9e64d7a35fdd723cffc1a79ef9bb
SHA512 452c83a21dcf68a06b56483e811f1b90f3799f5fb26584fddcdb0998bedb7250d5441c4fa8d8b9e693e59048d21c5e265d8c1157c471890483d149bfb4c3a575
TLSH
T14A31BEF3C6E8567D894146F87B143E2BCE2D0955832C7D5AC8D4AF5FA3E1871D28094E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 032a76b0a71a3505842cba2c7ccb290b38bd75233402ee30bbbd26226689ab38
MD5 2bf6adc026a22e1dc38f58457e220537
SHA1 829070c83c9210524de7b80f8b2c12885c157a6f
SHA512 95e4ada89ad75cc38b91c2e12dfd7cbe0624a6b04fe5f815c6c993cfb8e154f728e461c0aac436d8961ce859612f3ff1f3caf631660a217504e7e5a535066143
TLSH
T1FAD023D3110030F4B65C3F91C099BC4EC325106054429DD412D058AD157346C5D3B0C1
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 869a7775ddfc1427c334a432401ea19ea2e5497b98ce31a18632000be498ceb0
MD5 0a236c6a55047d212d3fdfaaedec4c26
SHA1 4d79006f8ed3f92897da32f56a50f5227bc03e11
SHA512 09222217b2f7d958769ee9b3acb4f91ae5aed5df4fbba97b9292f2df5d1b6a5fc5c8087a5d7c941ecd2c2d7ca0b98b513df26411f0986a1e017be452eb2fc9af
SSDEEP 192:sxRWR4HcB1u/fo+s0rlx3AtroA8pKR20lP/g6+WN/kstT/YZFLQyUGLIgDvGw8t5:sxRWIm1u/fDsAlxr4/5se/SJKw8tXfh
TLSH
T13462D6526924D97B8CD7D60DBE36BF53E7F8106298911E5CAAFCD61C00DB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 dc706d2e30d63a1fb2e1ffea79ef38e399306b0cf70c85107d27c6e74a9129ca
MD5 bee2b195f5a7b0de465965b95e961896
SHA1 4f4d1e34d3a9bbaac111f6ad525df5c3cf3c9330
SHA512 b9cfb61516d97ccb8823231c1271dfdd348bbe6336d2f76fac601549e7cda590a40afeb68de6e420aaeeef5fedff11917c0df8495d84cebd084f6b465e37138d
SSDEEP 192:sxRZR4bu/fo+sNrq3At9zoA8p4r/g6+WNIYZFLKsUGLIgIJ:sxRZgu/fDshqdS/5ISDs
TLSH
T10C32C7156E28A93B4CC7E21DBB56BF53D6F95032A1902E58B6FC960C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4f548f90d1cae7801713bfa538a80b0f10e87857c4f655892949394c6f6024a4
MD5 b0f733f59c64b22afbc7ff60b9163dc9
SHA1 75f47f4a9ac5f9b05bad419ffb3bbfb893620f6f
SHA512 b1135465633404cb147b97af3a55f6b3bffdee36bcd2508c326f7822bd41852ab3d34ffe4a8044cf214d8c3e7adc6a15ad3a71d636e1a4291844f85a77e9273f
SSDEEP 192:sxRWR4bu/fo+s0rq3At9zoA8p4r/g6+WNIYZFLKsUGLIgDJJ:sxRWgu/fDsAqdS/5ISD/
TLSH
T17F32C7156E28A93B4CD7E21DBB56BF53E6F95032A1902E58A6FC960C04E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 f07154ea2d6f64c44f30b6567987639b929cbb18d3078bfb7dd1e4d28b21e705
MD5 6b42d3ce8435715d7ff068778932a9f0
SHA1 8d0d699957a36287f7222ef434084eab68a8fa5c
SHA512 49cc9358c664acc48ccd0af5cf3e1727a44f602de84328b847a6313cf13e86f10bed191561c410a2b7404c5d87ff94b6ac9a0c889b84431b8649825885440a3e
SSDEEP 384:sxRWIm4u/fDsAd66s8qMpRiYnazAW8pZS15posJWeT+jx+u/5s81/SsKw8tXfh:sCIm4u/fNd4Mnc7WeT+jxh/5s0S48Vfh
TLSH
T195D208459814C87B8EC35D18693D7E33EAEC50626685DEDE2AECCA1C009E1FDAF07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5ad690c7b8185770a10881b6f59df8f524793f71c4426ad728f46a7103c522bc
MD5 58dfb2d7f99d5e92d327df278e79910a
SHA1 b009f28e09848a2e6ac58c29a5e4786246b00310
SHA512 d954029db3408693e7a5e9919f95897a05c806c43f0c6b2bba43368293ac6de2c68335c5ffa4ffdba0c0ea86af9da2da00661266def793efabbd57575242482f
SSDEEP 192:sxRWR4HcB4u/fo+s0rlx3AtQoA8pgR20lP/g6+WN/kr9qHtT/YZFLDyUGLIgDvG5:sxRWIm4u/fDsAlx+u/5s81/SsKw8tXfh
TLSH
T1B362D7525924D97B8CD7D60DBE36BF53E7F9106299911E5CAAFCC61C00DB6ED220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e20ace4fa899c4d801fc125a8b1f6f27a7f1041df6d33344a161df56f83d255e
MD5 573cf172c4681fe7afe3dae226985d80
SHA1 ea2023e34ec3a82abfa2fbc07ca4e62349673f2d
SHA512 10d3e26d1ebe9db5fbd6307b40cc9f84cb2804e0900db34f5f375850c429da5fdc053a0e12433ca54888b452e7fb1c07d3dc8f47d6942c0e107ee7f5c43ccaf4
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGNrocmW:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0V3
TLSH
T169B2CA3B640DCB7E5F800A9DAC196FD77DA802C7A6588D4047FE994C02C77EA91194DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\647a1225-3ff1-4a47-ada6-633e5baaf9fa\index-dir\temp-index
Size 720B
SHA256 653658ba05d759837d5726f08a3cbe2d8345280ecc3eab4796dfb5a0baac22e1
MD5 ec83ae0a3383711f2485d9c91c31db29
SHA1 780ae5c16cf275db3cc9585aaff34e68bc7cb1cd
SHA512 78ad1b341cd5cfa41c12270052a6002d28750be8fca81cc72c262fcc59d6911d456a1c645bd06b7563b7b9fc4e82d9cb1a414f19a35ce95505b916d8ee74073c
TLSH
T1DF01C08B8CD55847DD2779BA2639204A333D04ED164BDD8B006C743D8966A385640245
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e2d67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\647a1225-3ff1-4a47-ada6-633e5baaf9fa\index-dir\the-real-index~RFe5e2d67.TMP
Size 720B
SHA256 3a4dfbf809ce6d3651484854d9726a8d970c176ff06c27c108a0a76396771d39
MD5 850c40c14cda6ad50dcfa41a30228c59
SHA1 418365cecbb4c9c918a44d6fc2c507e3ca7d0905
SHA512 603e162dbd64e95f79228c0b7ebc6e05bc7dcd0fd0345dcbcc2ef28724f0fd7786d69c43164e88b834eedcb97910fec55cdaf3f9f8cc56389b1e0c7cec15e96c
TLSH
T1660154DB00D1EC43DE17B0F9320A6006733F4830215ADB4F20DA7CBE9962B384680691
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0ed3d6409dce9e73537c413ec75eaab2e13b16763e4246ba1cd145a469377a40
MD5 c23dc161d24f821a06785d0bccfc1698
SHA1 ef78e882863e6a10e95d3f9b8e64115ced427f91
SHA512 c2b157a4047527004bc1cad32f957ba1c9e8b0f5a78699e9a87b1c495e93724279f4bc4b8ad994f52d16f9948d7d7449f19a5c84a6ab741ccfe8123c28e92553
TLSH
T148E068B23DB31C50F99BD7D614B1D8A0421179449540FF4E602597CB00E12A23446C71
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a8704.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a8704.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 25d67bd278604b8dd9241d961dcf3ab17dbeb2e1f4566e026cb352be0c0625dc
MD5 982d820f0e1f89d810248d728dd8d72b
SHA1 246deb8ebee9051424fbabf59b94aec0e29f448b
SHA512 98fe2783823d8217b23581420efdf912be266edcf49da4fdd1157b8a4c28790115882f486ad552afcec91b97f82b3183b40266bd0076e9d51c4094048a91d09f
SSDEEP 768:Xrv+4UNbdT3Z/+LeSFOUDMX4fouOToPvB2thtA9VAgwEn:Xbsb93bsnnwthttpEn
TLSH
T1F703CE72A8AC9D33DDE2D398710B76432FF0815391C40F949ADD2B9D068BAEE170BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0b497015447e62e5ce4838713d1f60e2b8d9587eb05bc3e0bd595a087357aebc
MD5 59611a5e4f362a889909393f4bb16b16
SHA1 b77774b89757ac4610d9cbce6928ebdd89703c73
SHA512 acfe90aaf297d0a8849ecef8691eb07ef382d4df5066f7dd5a73a0b79117a165d9d04762356dd24f720a3206b8b722a0cc792213165bf523de4aa7f22211b647
SSDEEP 768:mM3m/+LeSFOUDxX4fouOToPvB2thtA9VAgw2ewBKZO5f:mM3Jsnnwthttp2evZS
TLSH
T196F2CFB168AC9C73DDE6E398720B72435EF08163A1D41F949AED6B1D0197A9E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 02fe25c3953ad6308aa69a610d50af49bd56c85a52220b0fdf2ddf83c5a5e58f
MD5 64ee118a07e127a39a7aef63712b21e7
SHA1 6c2677a7d202e3da193618672c44bf76ae489ce5
SHA512 02ec221ace9ce4df861402b62f89a37f24fd862070d0087f365262dc9bf55a6aff2b24b646da154d0c9e2691c5ac63b5d156d8f66811ed0f5aeacf5ab1f923f2
SSDEEP 768:gFvF3qwgbmi+LeSFOUD7X4fouOToPvB2thtA9VAgw2ewBKZO5f:OF33snnwthttp2evZS
TLSH
T11D136AF258DB8877DDAD9797633E2E024EBCC163B4901A9477D86A1CCC425BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a78739849182d4e8e0f47f16e385c85fad3964cf29a9d3818bc23eadf30a12f2
MD5 b37a183aa399d05cd7777f5da3987da4
SHA1 785de1b892b234af732d411a700a1d179f73a5f4
SHA512 8cd4a9e667849e31de76b313dcf4058f6dca70d4571adb0f956a3af2f5ee13dfcbe6a3988c800fa54ed0a7e17f3b63b24d37b2454d5c71455e4990e40061d889
SSDEEP 768:tM36/+LeSFOUDxX4fouOToPvB2thtA9VAgw2ewBKZO5f:tM3lsnnwthttp2evZS
TLSH
T165F2CFB168AC9C73DDE6E398720B72435FF08163A1D41F949BED6B1D0197A9E070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6878ab82a52aad05b340779ff35c6612b764a900888a5ebf943b581257136564
MD5 10cfe93ef5c5ec478a7aa809602e8793
SHA1 51b593a91db6bf10f2aa5482e9a04a60e9666e97
SHA512 8cbc2f160079488c6dc8d61e2de6ad563d0f8e8afe73e9055bd0dbd4ff94b36f8e6fb80fb70abd6765a3f4943077035ecda731313ca6b0f052316a219693fc8b
SSDEEP 768:grv+4UNbdH3UA+LeSFOUDHX4fouOToPvB2thtA9VAw8eVH1SlX:gbsbh3WsnnwthttFEH1Y
TLSH
T11F03CF32A8AC8933DDE6D388310B72572FF4816395900FC49EDD2B4D069BADE470BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 4279d5da936b7678533ddab9185581db9d716bea2efe33b76a13614dcc393c8f
MD5 e4efbdc41bc17d51166d7c2381d85d86
SHA1 35abdbd3f87dc56d0398e229d45a4934975648d7
SHA512 85576d85b0f0418d71c61c0ed4d255bd011dbd3842cdfaecaebc39e0c65885d42a30eeee3120683bb85c4ef7659fe5595e605350bb7c8db519569f09537e199b
SSDEEP 768:gFQq3+wgomi+LeSFOUDFX4fouOToPvB2thtA9VAgw2ewBKZO5f:Tq3ssnnwthttp2evZS
TLSH
T13C135AF258DB8877DDAD9797633E2E024EBCC163B4905A94B7D86A1CCC465BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8106ed3584ea8c836e067e719af766cfe84d8a7558b4022e285e3a74773a2c38
MD5 e5389ed2e3c5c1a924657e52a1a0329b
SHA1 1ae5dcf77b5476d71022e6087eef93bb395583bb
SHA512 56906b0f6b62d4935b84133f1d63987eebd277ea8ca1f643f56a04ada1fe6def9ff73ce72adb05f74fe26f12a749d92d4abdebcce999c64e07b00666295f47fe
SSDEEP 768:qrv+4UNbdH33p+LeSFOUDlX4fouOToPvB2thtA9VABweVH1SlX:qbsbh3ysnnwthttGEH1Y
TLSH
T11403CF32A4AC8933EDE2D398710BB2532FF4915396C00FD49ADD2B5D069B9DE070BD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a78ed5f3079981886bfc1f1e02e0745451fb2219af6c192031f1eb8f31506711
MD5 3154e9303da0cd6e10aea04a63888124
SHA1 4889e7b14e615746d77f2127af8dd441dcb29e7d
SHA512 ba9c95c31991b76e1e72f2403539113ab38b1b27714edf89a5854e9141b99d11c09b79c35912f94d50c0488b2191f5c95bff27147f62382bfa506ab21bab26eb
TLSH
T1DEE0022793142196C024073110531FD02FD7853001610A0A4F30019C2C733003E51784
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3e04.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3e04.TMP
Size 392B
SHA256 22340d540d6a76c8b221ad71858f28ce079c5c2f77bfa26dbfb5d459211cc26d
MD5 981c69e892f5e9bf34481f58f6af0f70
SHA1 dff5c516ececd9e8f3ee66ca6f534abd22e83d3c
SHA512 c8938057f3d15445190be5c516385c84302196c2d1edd3359a7f451510155de20f86cdf317d4262e0112ee121568c1effdf477ad5bba3fc485dc1a1a7880ed98
MD5 SHA1 SHA512

Submit Download

76fe4a44-bb35-4820-9391-374837ffebbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76fe4a44-bb35-4820-9391-374837ffebbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

407b9a5c-b8e3-4f79-8ef3-38bdd6b3d151.tmp

Path C:\Users\Admin\AppData\Local\User Data\Default\407b9a5c-b8e3-4f79-8ef3-38bdd6b3d151.tmp
Size 148KB
SHA256 d98e226bea7a9c56bfdfab3c484a8e6a0fb173519c43216d3a1115415b166d20
MD5 728fe78292f104659fea5fc90570cc75
SHA1 11b623f76f31ec773b79cdb74869acb08c4052cb
SHA512 91e81b91b29d613fdde24b010b1724be74f3bae1d2fb4faa2c015178248ed6a0405e2b222f4a557a6b895663c159f0bf0dc6d64d21259299e36f53d95d7067aa
SSDEEP 12:YcFpCkgfvMbb555555555555555555555555555555555555555555555555555O:YepCb8bBvK
TLSH
T1FCE3AB8237F0C86CC264123CDD1AC3FB1E5DFD525665D20331A5BE3B3D57528591A785
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences
Size 3KB
SHA256 28e53057cac33543e23004a82ad14f9153f15c1a729f97a51db4906d5624c5d1
MD5 8515781c18d9580d9682956595c75b97
SHA1 1f6dc824df9db37e7d1e470a9ce7de1bb703a82d
SHA512 7f09dde033bb908dc94d8f6450b27fe88320ea8f793da6f2c59822eaa3e8683f6204bd3e7e01745dc87fa976c577fa838ed48119dcb15f0fb72989aa317318d9
TLSH
T1AB61B809AE14ACB35C9EC22CBE067A53D5FE009049D51D48DBF86D6C099AADE231782B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences
Size 2KB
SHA256 4526635771f0ce897ad1e51ab88a01ca1004b03ff2b010a448b1d258ee04b4de
MD5 3294a58f68b1684b054ee48ec6f91f2b
SHA1 7bfb8e48d03c5e5809b20f969d9f3c48db2fae25
SHA512 99068d793b94dc93c924518886c9db8c4fde9e5352104cf38942c92e4d4b30c5282a2d38af4f036c332517ef585ad954854920a85ca0a1d0201113c5889474b5
TLSH
T14451A549AE24ADB34CDAD128BE157B63D1FE009009801D4C9BF8695C0D9EADD231782B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe610176.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Preferences~RFe610176.TMP
Size 2KB
SHA256 ba3c1eee890d30fc0b862913a5ca1a0d2a0f6a9ae2429a0fbe5e44068e03e181
MD5 3741e0058e86da36304da1b55d37ec4d
SHA1 a4afff0dddf3ee2122dade096a28af63d3a3d75f
SHA512 d5f62420feea0b8f8a86f52cb635ec409379ac30a20d06ab35b63f45fa75109287bd6b7fb18d371aed29a156ee729a46159e4261e018611f38c89fcbcb6c9bc8
TLSH
T16851A549AE24ADB34CDAD128BE167B63D1FE009009801D4C9AF8695C0D9EADD231782B
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\User Data\Default\Secure Preferences
Size 6KB
SHA256 dbfd282210ef1c96b38c327aa4d29d82ead4f4e344d79ce0296c22bd7b810113
MD5 2df77f84e180c5f144f7a5cf754f7ce5
SHA1 726f310303bf5ec818b03709f964cab2f3cc616e
SHA512 f7f4123a44ef72b9be62745de4b14e587bb72e9b0b5c3f908b72f190664c5cfdcd1e9b1300d6d89fe4b74d0daa78e107bb3c25fa5165b570f38d4505f33fd75c
SSDEEP 96:m7Zwe2NXIQKSFA9V7PaTLChVVYGo3nVgxVZx7fmGh9QVwbO6YdbyQ4:Xe2N4QKSMlOuxgW0wbO688
TLSH
T102E108293D0DED753F849E6ADE776BA29EE2017675B08428C6F609CC03D26DD02132DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences~RFe612c8d.TMP

Path C:\Users\Admin\AppData\Local\User Data\Default\Secure Preferences~RFe612c8d.TMP
Size 6KB
SHA256 09d2a4ffd6d273608bc4db6d2b78ce7311c4bced963efffcc89d8a88258db29f
MD5 92edb12036ae9b62e9015a41ca7ba588
SHA1 46b874422d683840bfd17d88d1f9b8aa1533f0bf
SHA512 dbbfcbe67e8f34c2dc5bdaf9defd0ded49767e75e128d8447bfb4c0553903bac4c1242947f8ac2b0767dc3df2b0c115cbe63e6035110b204a1ef335281ff6b7b
SSDEEP 96:m79we2NXIQKSFA9V7PaTLChV+Pv3n461VZx7fmGh9QVwbO6YdbyQsg:de2N4QKSMlw461gW0wbO68z
TLSH
T143D108292C5EED753F849E69DE776B629EE2017A75B08418C6F609CC03D36DD02132D7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\nwjs\User Data\Crashpad\settings.dat
Size 40B
SHA256 893db0aa55f2e7d78e29607035037d9d800d5946b0d957e8e16c3d9f4fea1cb0
MD5 9bc9dd08e472bda6347d62a88e1bd4b4
SHA1 8f99a53af207ef188de56e83c18a4dfdd9192ad2
SHA512 6b5258dfd1d38105e40469e125b9ba49b80d4d77d7120150b3bd2da55445da60ae854e5d98a1765317b1462d51ee7efb5e943c3dfdbb4c99a230515e86286808
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download