hxxps://www[.]spigotmc[.]org/resources/arlun-custom-hopper-speed-1-20-26-1-fast-hopper-speed[.]134776/

Analysis

user interaction
yes
max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 13:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.spigotmc.org/resources/arlun-custom-hopper-speed-1-20-26-1-fast-hopper-speed.134776/
Sample260809-q5dtysssdv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2736	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307570300974469"	msedge.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a0000001001000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Mode = "4"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0e000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0000000001000000ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe10000000c4c770c51ae3dc01e668193e25e3dc0121ee663e0628dd0114000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616193"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByDirection = "4294967295"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 14002e8005398e082303024b98265d99428e115f0000	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:FMTID = "{B725F130-47EF-101A-A5F1-02608C9EEBAC}"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f50e04fd020ea3a6910a2d808002b30309d0000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FFF9F445-D16A-4C08-81BA-FFD211181030}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\NodeSlot = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\SniffedFolderType = "Downloads"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
364	msedge.exe
364	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe
1524	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 2984	1524	msedge.exe	87
PID 1524 wrote to memory of 2736	1524	msedge.exe	88
PID 1524 wrote to memory of 1904	1524	msedge.exe	89
PID 1524 wrote to memory of 1904	1524	msedge.exe	89
PID 1524 wrote to memory of 1904	1524	msedge.exe	89
PID 1524 wrote to memory of 1280	1524	msedge.exe	91
PID 1524 wrote to memory of 1280	1524	msedge.exe	91
PID 1524 wrote to memory of 1080	1524	msedge.exe	92
PID 1524 wrote to memory of 3060	1524	msedge.exe	93
PID 1524 wrote to memory of 1080	1524	msedge.exe	92
PID 1524 wrote to memory of 1080	1524	msedge.exe	92
PID 1524 wrote to memory of 3060	1524	msedge.exe	93
PID 1524 wrote to memory of 3060	1524	msedge.exe	93
PID 1524 wrote to memory of 204	1524	msedge.exe	94
PID 1524 wrote to memory of 204	1524	msedge.exe	94
PID 1524 wrote to memory of 204	1524	msedge.exe	94
PID 1524 wrote to memory of 1208	1524	msedge.exe	95
PID 1524 wrote to memory of 1208	1524	msedge.exe	95
PID 1524 wrote to memory of 1208	1524	msedge.exe	95
PID 1524 wrote to memory of 2668	1524	msedge.exe	97
PID 1524 wrote to memory of 2668	1524	msedge.exe	97
PID 1524 wrote to memory of 2668	1524	msedge.exe	97
PID 1524 wrote to memory of 1636	1524	msedge.exe	99
PID 1524 wrote to memory of 1636	1524	msedge.exe	99
PID 1524 wrote to memory of 828	1524	msedge.exe	100
PID 1524 wrote to memory of 828	1524	msedge.exe	100
PID 1524 wrote to memory of 3904	1524	msedge.exe	102
PID 1524 wrote to memory of 2488	1524	msedge.exe	109
PID 1524 wrote to memory of 1416	1524	msedge.exe	110
PID 1524 wrote to memory of 4016	1524	msedge.exe	111
PID 1524 wrote to memory of 3068	1524	msedge.exe	120
PID 1524 wrote to memory of 3068	1524	msedge.exe	120
PID 1524 wrote to memory of 3068	1524	msedge.exe	120
PID 1524 wrote to memory of 4712	1524	msedge.exe	122
PID 1524 wrote to memory of 4712	1524	msedge.exe	122
PID 1524 wrote to memory of 1816	1524	msedge.exe	124
PID 1524 wrote to memory of 1816	1524	msedge.exe	124
PID 1524 wrote to memory of 4440	1524	msedge.exe	125
PID 1524 wrote to memory of 4440	1524	msedge.exe	125
PID 1524 wrote to memory of 4440	1524	msedge.exe	125
PID 1524 wrote to memory of 116	1524	msedge.exe	126
PID 1524 wrote to memory of 116	1524	msedge.exe	126
PID 1524 wrote to memory of 116	1524	msedge.exe	126
PID 1524 wrote to memory of 3000	1524	msedge.exe	128
PID 1524 wrote to memory of 3000	1524	msedge.exe	128
PID 1524 wrote to memory of 3000	1524	msedge.exe	128
PID 1524 wrote to memory of 648	1524	msedge.exe	129
PID 1524 wrote to memory of 1920	1524	msedge.exe	130
PID 1524 wrote to memory of 1920	1524	msedge.exe	130
PID 1524 wrote to memory of 2292	1524	msedge.exe	131
PID 1524 wrote to memory of 2292	1524	msedge.exe	131
PID 1524 wrote to memory of 2292	1524	msedge.exe	131
PID 1524 wrote to memory of 4964	1524	msedge.exe	132
PID 1524 wrote to memory of 4964	1524	msedge.exe	132
PID 1524 wrote to memory of 4964	1524	msedge.exe	132
PID 1524 wrote to memory of 4704	1524	msedge.exe	133
PID 1524 wrote to memory of 4704	1524	msedge.exe	133
PID 1524 wrote to memory of 4704	1524	msedge.exe	133
PID 1524 wrote to memory of 3948	1524	msedge.exe	134
PID 1524 wrote to memory of 3948	1524	msedge.exe	134
PID 1524 wrote to memory of 3948	1524	msedge.exe	134
PID 1524 wrote to memory of 3952	1524	msedge.exe	135
PID 1524 wrote to memory of 364	1524	msedge.exe	137
PID 1524 wrote to memory of 4712	1524	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.spigotmc.org/resources/arlun-custom-hopper-speed-1-20-26-1-fast-hopper-speed.134776/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7fff2847c188,0x7fff2847c194,0x7fff2847c1a0
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,3465606095746110208,6225176757992886967,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7006976389639290769,2319384637251248859,262144 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,242821313224474179,11398040493113567566,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,3533923758853976173,2885645276913607769,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,2692107078248014087,3302582723970094563,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,4115693382423953478,9885231095351183743,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,10435807339956687793,9377755572800788007,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4824,i,6483418780248207856,5101729662256022367,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,1493152037812148495,2201332016946316051,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,8986375881169919624,390729478221127111,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15293014125035099892,2096893248396301877,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,15293014125035099892,2096893248396301877,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4156,i,14531348270447618530,3777824368213617069,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,14838110416944106281,16643871049272505851,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,3613119223197946591,10102107923168013605,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3024,i,5459667286359699065,2224774121175227876,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,12165504548057909277,10323181295566301329,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,4616827097485263578,7526640478442009067,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6924,i,9260237476855758391,10950568245394311017,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7052,i,7883430180822264148,13789591760434543088,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7236,i,16572397252481555427,8464068605380365713,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7380,i,6077882839512203799,11858698972400878196,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:8
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4484,i,15295730798234441911,3839553790180196862,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7408,i,3907732904291072840,2930358092098815996,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5148,i,401377040978312383,9570175799162445837,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7452,i,17781999612904246748,14962341768079244180,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7608,i,3126010498364668887,1781060589999244799,2097152 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7556,i,17599168545420962655,2576404773174802484,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7572 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7564,i,11682716895688759046,7111494151606975878,262144 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,8794144322492195194,9193886848078308756,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8989477950779214862,8528161144432045215,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=7820 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,17512144214246058765,17297441354840727239,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7592,i,3245285925985899636,4434574876151063032,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7836,i,6777336956019827886,1400256481334001083,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,7272443669449929609,1556517917524354564,524288 --field-trial-handle=2148,i,16155328894018835839,4119177006549565245,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 940d17921bde8de627e1df6a2514c8b3fa162d125a077e8179f39b5b8c9051cb
MD5 8f1976d278f5f3878b71e37366030520
SHA1 2e1a106c74408bccb299bfe5d6c47bfc6830d443
SHA512 8bfb55b62052ebb4ad84ddc2856f84c4fd88e93032fd4fe6b83405a4748dfa127f9c01d819995bc08a7b34a940622e650868f0b9546ac5df1bc6c24f7018fd3f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T1FAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 5ab8485281db391ce78d215fc731d146074df6c5b82702c8abb717b6e295f557
MD5 6e968574699903d55aa6c3b680db43e8
SHA1 417b934a1546220b4573bf794382505bd8d4c280
SHA512 b95c739e9fad3ea8557a92b0cc0b2a5f6a50ae210f5ab046cc1a3dcdf652f960f1e442ee5edefe80c1b234f53ba6e6c0d9c2651b7141a3071fa6f7f93ec8fbdd
TLSH
T1A9E0929E53AFC6AA0F009487A3646B24C191750F9D8CCE5E7309B0C4BD4004452A18A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 39c28bf3d8fc2215a51e013a4b966922d353b0151c91158a3930871fdd1cf946
MD5 88a665d5719095d922dbee6f4a935073
SHA1 be1e27e9c6fb76ca381eb4858021d4ec45f4496d
SHA512 54c974f88f1dab02295f08e9c8e6f9f165005cc45801e2597d3838847d5be3c2ffd39c9b50d1179dedc798722ca8e3d26cc6dec5d1973adb199694175e4b8b2d
TLSH
T155E0268906CEC32EE700E48B53B8770CD2E0365F9AC8E94F1B04E8C47685048ABC39A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2676594e5cc7c5758bf31b8f433821b41701f2da98e66ac33f5316da20e2a06b
MD5 8f011b92232ac2957a71827ffbf97f23
SHA1 00ca8c8326ceaf8fb836d68b99fa3d5d7e40444e
SHA512 2c9a57931fa240a62db7b131aaf4b3b2c75e5bcb9f1931b26557f83fca1fe89ed654dc951e54f4f36b3a5d23513547b34202c17d2f38175200c64c316ffb7a3e
TLSH
T16AE0268806CEC26E9708A4876278570CD2E0361FAAC9E94E7700DCC57A02480A2C39E8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 b04b0216f705f289bb3bb6f559dab031b2663187aca68823c55b7b3cb3d9bbb2
MD5 66744ba87a0727a54a77d92986d2a288
SHA1 5fde81dc70b666aa0d5ab110459a248b1df0a90d
SHA512 4c0ba391768d3c7148f8ab4149716e1d9438a0bacde0eafd3dc46f20a306e496931cef5fcf1e804260977f6aef743ee5627bb9f31db215463627a276a6bb7480
SSDEEP 96:gFWevQTjDOaIq9cVBznU2MYZ45dam/gdG5wCjw:g4evoWaUUE4OmYI5wew
TLSH
T1B9C13BB122024366DF600FB164F7B1F0BCFD66DAF24B9EB61B619D3295067D841AB05C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d4a6366862f2404f2908cf6fcba2f98675fa5443e4a48410c744e583cb480c3b
MD5 7907649386de9c6443eeab949dc03a6e
SHA1 d8c58fd70633495ce06acac329a1fd2ae7abe73e
SHA512 66e2fb59b00e75b7a6108d50ca6043fb490abb047ac5c89d42528c4bf0622085a21f6be837884ead8ec789bf67384995b62e1c3c1d7daa31642cb8907a895a95
TLSH
T1F4713DB521014153EF610F3090A372F17DFCB6D8F2479EF62D7189B766067A085AE91C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 401075288efc3610ea7d7b4cadc1d9ee40b6160adfb27a0ef9036920e8ea19ea
MD5 1f15d382459006acada55f2baa44fe27
SHA1 8506a6a0bfe0ec97bd7d6bfa3121f514d504ebf5
SHA512 a19340dbc8bbc1e972e7b674adc77e436418b5fab4bd188d7cdfa2796483dc2fb98340811c72da9502ebb5e53d3f0fcba20b80ed65d87567a02c01060c250a16
TLSH
T10D813CB621014253EF610F3090A372F17DFCB6D8F6479EFA2D7199B765063A085AE91C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cf13.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cf13.TMP
Size 3KB
SHA256 46482a5f4031fb897fb025010f464eabbb139fa21cc44505e7a7790714e8fd57
MD5 4c5eb42ba6b752d1f088035d81540b8c
SHA1 f982d480fa6ee9006b18b96b05126db8301eadbb
SHA512 572770807fc8303eea6ecf15ff8a8a45e53dc5f9120e7860344b66d7cdbdf5b7fda56b7ca40ee525fe54011893be2768137a22403a16a7a11f5e9e3d7e9336d1
TLSH
T1337129B620010153EF210F70909372F27DFCB6E9F2579EF92D7099BB65063A096AE94C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 740a7e0597cd418c144b49c46c186b45cf365a3743f125ae41cf9c35d1fa0690
MD5 7bb3cab2e7c145e4c3127ef093fdf621
SHA1 f750d816ada154c27d61f16c4ffc57f0c475e9a2
SHA512 46d8a2d2ef123c856befffe983391b88fee68db087402a6dc76e8cbc1a40be23424ea4f9643daf8b3d13bdd234969d79f55ed050ab808134fa6310dc13922daf
SSDEEP 384:DfIj2MKxgeLEWdi1pC6ljlvehxTcm+g/RP3r13ZRGcNKk6IcQMnhDCigFInnJiaq:SCbP/aY
TLSH
T1CE429CF7C7E4872ECD1556F1AA242E27CE1D0DA9422C3D5AC9D5AF4FA3E2070E24194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 c3443721c582e01a7821dba3cd52c18f4b79bffb4b0dcd854c1d37187a6f4eb6
MD5 ef68ca45945fcf56706c95c609a16c7b
SHA1 dd731de5b619a3d6522738ecad59bff6201818c6
SHA512 2bbdd60f8ce0c2e82430abee6c30220e2c20877a2425f94c1557d3191ef7dd87b6ebf74f4f98fc4fcfbee0f29f67f5eb99aca1c0f91311db4e618137bdd1102f
SSDEEP 192:DWfVctZeweL9tTR1pC6ljlvedxTccgqSP3r1gZR8cNlGQucQknPDCigFInnJiaL4:DWfVctZeweL9tTR1pC6ljlvedxTccgqs
TLSH
T14A32CEF793F4876ECD1156F0AA246E27CE2D0965432C3DA9C5D5AE0BB3E2070E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 615d1b8b2da55723e2a274e0c83e426b9251b019b8715bef15eff51ef37c54c5
MD5 8b842897a110e2b1ba96a6a42cd60935
SHA1 0d4964257f70a7c64fbd7e90669ab998b8d75dd6
SHA512 7f0394c7ee2f6ea2a3a4fc7e81c30dc67e6be5fe2b03d3b6be14e0078ae2fbfc94356986663951c4dd80c0f7cbe1e5e204322d4d6b8072449399cd85c676e469
SSDEEP 192:DfIj2MKxgeLEWdGxTcm+g/RP3r13ZRGcNKkQmIdC/xs:DfIj2MKxgeLEWdGxTcm+g/RP3r13ZRGb
TLSH
T1B1F19CA7D3E4862ECD1516F1AB246E27CD6D0DA842283DAAC9D6EF4F63E2070D30155F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2ea01c1c587b5570c0b6fea3ec35bd2fbdc1fcadc9610fa66f483abbcb92ea10
MD5 f98572f8c61dc2c719aef6bef96f0dcf
SHA1 b58da775ace2d1fa84c952004b1c91684c7a1c48
SHA512 678f56dd5f65092139b2077798c38f701c4240d482b91b05740e2d573e4ed523da411243d8e32d47730838770fa4a425a04afa951f208c6b7db6e9a613b4caa2
TLSH
T195D0222312AA70B6A96C3EC264EABCCFC33740ED084BDDD862D0AC9906714AC170B183
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59fd71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59fd71.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6cf8bf3ce822960c3ab11b1ae445a2a00f5a463f4e08747ac9459aedb23f9d92
MD5 e45a33ef9f23358392621d6d1124f509
SHA1 b4bd50fa5e32dfd69c8206e4bd1f8f5dade95e9d
SHA512 45eb34fe4624de3434cab3c5658fa851b595330be7ac19ef660b7bfb59a8fa1a6c7b66819727c9b6e4ed905377d70ff4a075f25e21e02b7eb9b5d0945a2e0fc3
SSDEEP 192:sxZ1ROyM/jK1Ml8Mkh/fus5j0XVVTIdp3YHW6+WNr6B/YvrYEHzIgrJ:sxZ1AMh/fusCXcIHb0/Qr9
TLSH
T17C52F9126A34A977CCDBD209FA45BF53D6F9047292900E54AAFCDA1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 922d9f6cf76a830abf82d9cc129e3b61348d822ec42afb725098934f0e99b7eb
MD5 bbfb7ba7b52c5d9604bc86d7b81b927b
SHA1 75092f5dc43bf37932be9bc1684f945f9462c8a4
SHA512 609fc9741f765269bf682113f2a0f357046ad584fa65254bf0c5806bc3267b6fe0d6ca3c33ed423fb1e8448040cdf20de9ff49745b922f3314e0ec5c4e3736c4
SSDEEP 192:sxZ1ROyM/jK1Ml8M9h/fusqj0UBVTIdp0rWHW6+WNrNaZYvvPfHzIg5oJ:sxZ1w1h/fusVUQ9HbIZWr2
TLSH
T15B52D7126A346A77CCDBD20DFA45BF63D6F5046292901E54AAFCDA1C04E7AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cf40f15023cc3ee190386c269dcbc91aec4ca66b66ac9720145f5557e3bf2e30
MD5 90ac642390a47dce03c29395ec7dc7d6
SHA1 c7fd282f15909cb5744a27fe8bb2561421e8b33a
SHA512 6a5f3a52db0acf5da0260024074d08c3a0e3d636fcdc9c8089c9efda564e568da3ad454f5023145ded1482791c39cff719c9fe44ceed4d1fea90d7709a984cb2
SSDEEP 192:sxZ1ROyM/jK1Ml8UQ70cB4h/fusqj0UFMV7dp97hqv7atWHW6+WN/EGVHFrObIf5:sxZ1wq4m4h/fusVUFUQHbv9cdrr6522p
TLSH
T1A572E852A6349A778CDBD609F925BF63D6F5046296510E4C6AFCD90C00EBAFD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d21aa75c4219121121df5011348e457063668dc5dce4d1f06481a626071ed881
MD5 0b66bb8a1d16c1bd192862343f731205
SHA1 5f36e7d124086141e90aacdfa098689c97a1a35b
SHA512 c4388f5c1771b23c279004460e7955077ac8d26161b63d096241d82bd2f1476178be9721677fad816fac645d2a72708df5116dfa685c0c0c32df81ffca27fb69
SSDEEP 192:sxZ1ROyM/jK1Ml8M9h/fusqj0UfVTIdp6a4HW6+WNrkzXYv7QEHzIg5oJ:sxZ1A1h/fusVUW6Hb4Xer2
TLSH
T11A52E9126A346977CCDBD209FA45BF63DAF5146292900E54AAFCDA1C04E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 263675ed39400cfaf0ae46dfedf74968825d6de1a4bc1e6a226e7762d151e912
MD5 4f3aee0f4c018c94343408b56c7f01d9
SHA1 2afa0dd51aa69da6874bc78cdfa2ea1210616c3b
SHA512 5cba0f4bb3093cc3ccd6922c0c249ba02b14c1089aa05133664e5567ac0beea85bd4c657040228ac97f5b0c5030c7549751ca3a932fe6e061f101f4b806e9b91
SSDEEP 192:sxZ1ROyM/jK1Ml8M0cB4h/fusqj0UFMV7dp97hqv7atWHW6+WN/8FrObIfCdYvHq:sxZ1wsm4h/fusVUFUQHbGcdGr6522p
TLSH
T10C72F852A6349A77CCCBD609F925BF63D6F5046296510E4CAAFCD91C04EBAFC2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 677b428d94c667e3e23fd1edbd4c6b0b6648fe0aeb689c2620dc197e6da077e3
MD5 7bb4c53919a6bd2f7e9e8ae2213a9ee5
SHA1 4d1daa2d35b9d064f0d5f2e372af4be648557dd6
SHA512 6ba588e33cedc2746b2f9956b18984fc393729ff17455657850a1ffb8f507d0ebde953d8ed811cade57a3ac20c670354a6f83f68d6a8eedc13cecfadfeb17da2
SSDEEP 768:IGseJ3xWvhfwn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pprrohn:IGseJ3xWvhfwnu1jaVcL88pYl
TLSH
T111E20B2B280CCB7E4F844E6DEC266F966EE801CB67944D5487EA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 e2d28d6779c5d24562142445f81855301306d5888e44fda50ab12992a56ac8bf
MD5 c6374027214c2901cf9525832d2bf786
SHA1 fd3cf8d9643be1716abb81a0a0e7e460dce95580
SHA512 f827d4355084b89e3d6dba97c577154c670637bff5d5be65c181675fc87447d6bfe8e523b63ec3b4e9d04d061854d8d67e56ffbeb6d022fb556566f33d802772
TLSH
T17A31444D8E51959FD9A898B2147660F433F0C9EC171166538C7C253E7C2635A194B19C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfe5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cfe5d.TMP
Size 1KB
SHA256 af2654b9c974056f594d7460465db564ce9043a7418f0fa99f2188d904f30668
MD5 bb737b50b278585c7a71a5662b347f68
SHA1 2e73754bdd9e740b96142e075624d953b8f8d140
SHA512 29a1e04814b2f5f90da68d525ba71310355cfb3d77b46c6da1e931f258651ce20a908681ad4cc395f4c1626469b51c77ed8a2466d55036a7607645862b70c4e9
TLSH
T13C31468B4A45991FE8D450B20556A4F83376C94053127783987D623DBC757AD5E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d333348791b6b931e9c0461b0740d8c8641257fcf875c589684ddeae3aa71345
MD5 ba3b3064b9e6b9b964b433d7c9ef8e8c
SHA1 821be37c1d8ae5c258aba8f0514150fd3db4ea04
SHA512 b032e3ae4bb03564799ebade05cdc1d60dd12f92137865aa545af40326e5cbfa840daea354fb29d877a03b15ec2f593572c660eac85b623c0807cd80cfd0307b
TLSH
T112E0C0762DD72460BEAFC3D120308090060A749DF941FC4E541BF6D310B235530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4c8b28d0e59974a458e1ffe14afbb267994083dddeeb8c70e752e73c90cf920e
MD5 0a9a1d825118f2aabec22e537246b16f
SHA1 35e6fee744f187ce5c3b6a77ce9d9dbcf83640b9
SHA512 f8fd47912954e9e9d5cd355e2c7920c186795e40f619a1970e2071e63549a1b3e6c9bd38f3113ba7bf8e033b424afd80e1c816075563c54b3c55f88b9d03578b
SSDEEP 48:KYHIhKggkXy8+FCuEA8kMADPIDmkKqBickWO0VjEO5y083ocGO+2kOh9ILc2KWTt:KYH+Kggmu32KYAe+ReKSog
TLSH
T10A91661335BB030238BD664CA69BA63BCE4172673418A4AF7BB904524E27E251DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\966bf86a-50c0-4cf3-9f56-1bce5a58265b\index-dir\the-real-index
Size 72B
SHA256 5372eb2f6f6f2e3f65799e1a355612fe02e403f4241699b8a2a1e1d525c4ef2d
MD5 e91fe1d775e85776cbab57700ba779fc
SHA1 7683dc1c704fb05443e760b0daa5d635979c8ae9
SHA512 1cc777e9b8fa8123ae65877a36c8395fb50da6c5f01bd9408115202f6d0ff8d18a477e81b7a088bc083604522f8e567ece45fcf98e0ebd04e9d9c21bdeca50f7
TLSH
T1C8A0023961600602D81002706477196273364950EA05861282E6B1E4CAE21AD410B93C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ba71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\966bf86a-50c0-4cf3-9f56-1bce5a58265b\index-dir\the-real-index~RFe58ba71.TMP
Size 48B
SHA256 269b51db6c1947e34f23afd07f307b166d513c02c53999009cdba51b7ce96542
MD5 958ae3893eff9afbdda7aa968b1ff4d0
SHA1 9de132369fa9db157ff79ba8c6f52f1cb354e4d2
SHA512 984c9f33fad336ed9fafd1ef94a4eaa1a0f626ffe082235ec291ce38685db1e08a5d0ac4b2c910ef0d16affb60e904cc85d4c18ef7de8a1152c4fd4212c123fc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 153B
SHA256 9c56077612cdf797409894b380bfbec052f12da111786e0d79e09bec95dacc90
MD5 89016b4addff8dd01cb9e3238ff001c8
SHA1 1563b1fd5e4b500efe9fa215425889e5918238eb
SHA512 c2f8d83058b15d053ebf876f202c6427358f7f660a1f0024bb4982a02b3d7fcf88b9063e7463a4ee54d94d4376db47ac0821ff06350decd0b01e8f1243df0cb6
TLSH
T1E2C08CF3190054DB8A30A5D92028360DE21B914C8CC4CEA4E408800220786234802A74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 78B
SHA256 f6e330e29b88c9e381a09b9c59ea2e3fe5887ada2897e984889dc35596d6ade7
MD5 87bfdd643d47b7c6bd8f0df09a937e53
SHA1 488dcba3e1a1ceef049ec83b7116887132b4abec
SHA512 cbc512de3f86a31591368dad1e4397535fc573e93786cf650bae89faf2d0554af605fd9fde4521abfaab7b45c3b07f45874df11ce698e1e1fba122587c67cfd1
TLSH
T1FBA001B71C04909A6B61A8E92025B71DE10B968C8CC4DEF4841884422129A230082A25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 159B
SHA256 c39ea6a629fa01d189ee1904d776b60943b38b3e4e0c44cd46178346710b725f
MD5 d2fca26cd4992b8d8f410b0e68d11124
SHA1 7d3b5f155486e2ba0631017069c2359cdbe7a114
SHA512 4357a317574a159f6a326c741dacd24f07d0ad8e258f85d8f6d3c3c03c077bf7f89994cec687fcc6a034a2d20c6bb825718a737893f834bd4f002e74e6b4cb1a
TLSH
T16FC08CF3191014EB873164D62034360DE22BAC4C8CC4CFA4E408B00220386238401A74
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe586a7d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe586a7d.TMP
Size 162B
SHA256 a7f459438e11cb43d1ddbddce74d6ad8326d643e9b8624d83fcb923dd6e5cb8c
MD5 ca8518864f701a5bc9e8d1559c072df0
SHA1 9c8712bc883916c9f16385989a3390f2e767527e
SHA512 b160c3756a267b10a49e2a711a96f4d1ac882b303d638aa47e1074fdffc0621806f8a6dca81d3cfafcf1997c33243becd113cec5c6f806ef80da0cb58e9ef9a2
TLSH
T10BC08CE75A31905AA720A4FA6820335CD02BAD8D9CC8C8E4D800B0C3247C2138092A39
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594aea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594aea.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 4274b74a42a9a4165aa88b03176a34c34ed239e25c517703c777f02d0aa79b8c
MD5 bd550a2520ff8ac6973713e7143981c3
SHA1 49c24f0044ef5abe033d4e9214d031635ef70e5b
SHA512 ff58ea4d35f9218b6c3d7577f8da2f62f03a1c01f5316544586d814b484a11074aa100387ca8a336c63f9591d00bc42f161e9db33e882b5e55fc71f62a1b4670
SSDEEP 192:uQm+xasuheOwQxMGsN34DQVVM7JfiQmiU1Zzb4MT/hCi0bcvNf8z1dq5QZYy:yZcIhsN34D17JerE9dck8QL
TLSH
T126626C736C785C7A9CA7E241F48A37134EB4816B96C45B54E6ECBF1D00DB5A8130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 22d4d224ed47dd3f78fbc874d5897750ad50aad4295c56d573d2ab3f8a209be5
MD5 ffa48f84c238523261f9da51121113e0
SHA1 a04ad638d24ee4d3f659963c9901f26beb9271bc
SHA512 d2a3d024ea926087485a65ad7be773ea92a4019bfa83d5baec747791ca964c21685428790771443561a4a6003b0a945e8ba3d8c590659bcdebf70a19de00c73c
SSDEEP 192:u4m+xasuheOwQxMGsN3VDQVVM7JfiQmiU1Zzb4MT/hCi0bcvNf8z1dq5QZYy:OZcIhsN3VD17JerE9dck8QL
TLSH
T1CC626C736C785C7A9CA7E241F48A3B134EB4806B96C45F54E6ECBF1D00DB6A8130B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9f54ef981dc438745b8ba3245e34b570a3a411992bef845687b59bf708ea732b
MD5 00fe285a4061e54d26b8e860d602d771
SHA1 3c548cff520eccd75d1d3e66e415471bd14358d3
SHA512 9076013655bae9060a1418736a8aef35ebed91850a3264dfa07ebdcc4741659f201b80cca367ebedf176707408105b0b829f3edc32eee9fd200a2dcfb4c8ce56
SSDEEP 384:YniFPZcIMEsNM8TUNTUlIlJD17J1H129dcb8QL:YiFHfbwgZf1Ado8QL
TLSH
T1A0B209F258D7893AD8AE9743E77D2E138EBCC067B5849A50B3D85A0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 28519f0d7b7b13cafa41b2ee842c8dca0f3a1da80b5c1cc80256a6cbd69fb16a
MD5 b76e475b30562429c1e2473cea4d2ce1
SHA1 687505ba30ff19f9740b9ea043ec14199cedef43
SHA512 17564e0edffa0396dc13d0afb4741694e31c2bd132533561692d5c644f1a7d80a16c64105a5da04a62f35f7b9e7a85004a5c4b930d7cd4abbe3f753144c5e916
SSDEEP 192:lONV6vMtPQmiUyVOThT/hCi0bC847D1U/u:lONV6UtRvTSdMBU/u
TLSH
T194022A36BC686C6BEEA3AE45F48A27171FF4117FA5905B50EAE82F1C00D765C130392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 c812a7cc88640e25ce90764ad5176cda327b4786386d026798154e9502c968fd
MD5 975a748188463432be26b18c3de19211
SHA1 7b306204768275bdcb9a0e6b0a6460817a28510a
SHA512 059cd68e737cc36d61f0539d1316f88d5c33ac9315a80d9e02d2031fae60a149b9f2d83183ea1e12259779da7222d56565ae7abc362b6399a33b634a6ed262cb
SSDEEP 384:YniFiZcIMzsNJ8TUNTUlIlVD17Je/E9dci8QL:YiFQwEwgJaOdn8QL
TLSH
T126B208F358D7893AD8AE9743A77D2E134EBCC067B5809A50B3D86A1CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a0a11957ce79610e4ceee025a84f0e2a8e29032b7000005136febbe984922fa2
MD5 9089a46b5daa50d44a77658b689a20f8
SHA1 b6855ebde4a2d77d70f6da065ee9cbe78d27befc
SHA512 ac52958ee677df468e8610bcfc5b6e9ad1b77dc8e6b76e036067b523d7df0d7fe38af5428be9887d3252eace75a57de52d562e819b54f1fcf0c8aa9e4df998b2
SSDEEP 192:MONy6vMBPQmiUymOEhT/hCi0bcvNa80Idq5U/u:MONy6UBR6ESdcD8U/u
TLSH
T1A3123B73ACA89C2BAD93A541F08A27175EB0826BDA845F50FADC3F1C01EF25C130791B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f624eff0b9bf29438b39902130c38ad664339ee3e195e51d85912e25794d4828
MD5 0d06b7a838c6098f3e2d85e31c731fdb
SHA1 709c984d01b312224bf2b78ef2ad2a9ffc369b08
SHA512 1bf4ad69c71b7d48087aa157ac135c8966a7170775b7eb71a9c6d74ea2d232667193e6f7b7c728368a498a6262156014d36e1d68d3e70f180f3a2ac397894c1b
TLSH
T158E00267970904F5C43D533000D71F202BF3E23001EB03179E3816A91C533042E60F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 196e26fdc971cdd7afdfc78d8f32502c6abdd8638c9a1ed2f5a4c45191bad1dd
MD5 3042f79d70d966696d8cacfd7351317b
SHA1 18f6a74dd219351d4f8f8a2340f0fdce47d7327f
SHA512 0b956fbe093c0d784bdf07e27e78a58a663f32f0f50601798ce61a166cbd8b9a4d215e3e496da2c834ab0c698a12cac20fdbff9bf3e63041ccb9e79682b3a277
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59529b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59529b.TMP
Size 392B
SHA256 e520d11624afdb48dc87d7b75f7389ec6cfb02fbe9d76d048a248ef659dd91ba
MD5 dc51bc8896daa522e158acaac8985feb
SHA1 9f4d1ff64cf3b0c2f642caf5981a21332bfeca83
SHA512 d91198fc07b719bfe75eb05d5e21c8bb7bc2f60dfd0326bc1d4a20ddc3219b4e2717e542f14d8070a75e833e0c27b08548838535d8d1b77c904892dbe26d3641
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 316dfccc043f76d3b85cab5ef141ae9e4a6af25a2cbcc2fd6b71434b0dd015d8
MD5 76d53f155cfcc8d61e967b60268e657b
SHA1 dc5e87da45c0133d5dafd424222538f18a97a824
SHA512 742ababa374808ff653017ff087a482facfc2352a7bc6e1b15fc4570102b18f8c8906dad54d653ecefc469f23858dbd6b9788aba0481e89020d3886cefd9e25d
TLSH
T1B441D358B7E91148B3B36E5AABF6A86D487ABD772E46955E10110D8E0A32F04C872733
MD5 SHA1 SHA512 TLSH

Submit Download

ArlunCustomHopper-1.0.0.jar

Path C:\Users\Admin\Downloads\ArlunCustomHopper-1.0.0.jar
Size 16KB
SHA256 83df0c04f349965fc347bc224dc4e3aec864add0e5e8c94322d75fec54f92d0f
MD5 6eef355fd88131b5a6b690bd7549da32
SHA1 fdf44f932e52a757a760cbe3d06dc7c75cbcd724
SHA512 d6a5896d8de308dcff5336e466385dcd0f693c51b72ad0f9d51f633453bf6da24e786838e21eecdd2a9ecd9501858f40fb4ef55b3a33642e6b86713fb09cad41
SSDEEP 384:ZTGgikXSDAmzYInA4xSpVcZRpAvucUamHK3Dsw+j0taQ+zt+7IrK4c96/Ug:gkXSDrkInA4IpVcRAvxGKTswsQaQ+eC3
TLSH
T18E72C00EFE2AB5B8DF89F0F4F122906A7A6114C5C7A9475799B439116C0C52D3D8A34F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download