hxxp://twitter[.]com

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
241s
max time network
241s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://twitter.com
Sample260809-st3p2sttgx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2436	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307627672864675"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{EE1F1825-5955-4987-A169-3D6EDF0BE63C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{ABEBAC54-E220-4087-ACDF-2B9D7C00DD8C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4660	msedge.exe
4660	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe
3688	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 4220	3688	msedge.exe	87
PID 3688 wrote to memory of 2436	3688	msedge.exe	88
PID 3688 wrote to memory of 5112	3688	msedge.exe	89
PID 3688 wrote to memory of 5112	3688	msedge.exe	89
PID 3688 wrote to memory of 5112	3688	msedge.exe	89
PID 3688 wrote to memory of 1120	3688	msedge.exe	90
PID 3688 wrote to memory of 1120	3688	msedge.exe	90
PID 3688 wrote to memory of 1460	3688	msedge.exe	91
PID 3688 wrote to memory of 1460	3688	msedge.exe	91
PID 3688 wrote to memory of 1460	3688	msedge.exe	91
PID 3688 wrote to memory of 4692	3688	msedge.exe	92
PID 3688 wrote to memory of 4692	3688	msedge.exe	92
PID 3688 wrote to memory of 4692	3688	msedge.exe	92
PID 3688 wrote to memory of 1000	3688	msedge.exe	94
PID 3688 wrote to memory of 1000	3688	msedge.exe	94
PID 3688 wrote to memory of 1000	3688	msedge.exe	94
PID 3688 wrote to memory of 4540	3688	msedge.exe	95
PID 3688 wrote to memory of 4540	3688	msedge.exe	95
PID 3688 wrote to memory of 4540	3688	msedge.exe	95
PID 3688 wrote to memory of 2448	3688	msedge.exe	98
PID 3688 wrote to memory of 2448	3688	msedge.exe	98
PID 3688 wrote to memory of 2448	3688	msedge.exe	98
PID 3688 wrote to memory of 1812	3688	msedge.exe	99
PID 3688 wrote to memory of 1812	3688	msedge.exe	99
PID 3688 wrote to memory of 1020	3688	msedge.exe	100
PID 3688 wrote to memory of 1020	3688	msedge.exe	100
PID 3688 wrote to memory of 3932	3688	msedge.exe	102
PID 3688 wrote to memory of 5640	3688	msedge.exe	103
PID 3688 wrote to memory of 5640	3688	msedge.exe	103
PID 3688 wrote to memory of 5780	3688	msedge.exe	105
PID 3688 wrote to memory of 5784	3688	msedge.exe	106
PID 3688 wrote to memory of 5780	3688	msedge.exe	105
PID 3688 wrote to memory of 1608	3688	msedge.exe	110
PID 3688 wrote to memory of 1608	3688	msedge.exe	110
PID 3688 wrote to memory of 1608	3688	msedge.exe	110
PID 3688 wrote to memory of 5296	3688	msedge.exe	114
PID 3688 wrote to memory of 5296	3688	msedge.exe	114
PID 3688 wrote to memory of 5296	3688	msedge.exe	114
PID 3688 wrote to memory of 2508	3688	msedge.exe	115
PID 3688 wrote to memory of 2508	3688	msedge.exe	115
PID 3688 wrote to memory of 2508	3688	msedge.exe	115
PID 3688 wrote to memory of 3020	3688	msedge.exe	116
PID 3688 wrote to memory of 3020	3688	msedge.exe	116
PID 3688 wrote to memory of 3020	3688	msedge.exe	116
PID 3688 wrote to memory of 1196	3688	msedge.exe	118
PID 3688 wrote to memory of 2316	3688	msedge.exe	119
PID 3688 wrote to memory of 3256	3688	msedge.exe	120
PID 3688 wrote to memory of 5428	3688	msedge.exe	121
PID 3688 wrote to memory of 5428	3688	msedge.exe	121
PID 3688 wrote to memory of 5428	3688	msedge.exe	121
PID 3688 wrote to memory of 5436	3688	msedge.exe	122
PID 3688 wrote to memory of 5436	3688	msedge.exe	122
PID 3688 wrote to memory of 5436	3688	msedge.exe	122
PID 3688 wrote to memory of 3432	3688	msedge.exe	124
PID 3688 wrote to memory of 3432	3688	msedge.exe	124
PID 3688 wrote to memory of 4660	3688	msedge.exe	126
PID 3688 wrote to memory of 3044	3688	msedge.exe	127
PID 3688 wrote to memory of 3044	3688	msedge.exe	127
PID 3688 wrote to memory of 456	3688	msedge.exe	128
PID 3688 wrote to memory of 456	3688	msedge.exe	128
PID 3688 wrote to memory of 4420	3688	msedge.exe	129
PID 3688 wrote to memory of 4420	3688	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://twitter.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbf900c188,0x7ffbf900c194,0x7ffbf900c1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,10894377911558856875,208031510580772127,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6882836758042685002,11927782687904726885,262144 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,6625405299367472459,7781539985237166747,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12470963429010966484,13211443819001207652,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,18045322195094303244,7367806314792911052,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17656371561027577214,11357596596326570943,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,6032099272940539484,11503480860363938402,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3616,i,12478767414506064664,55714218410176854,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,8433434627885676475,6358648476715056270,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,3084753052127191493,6157899267257789204,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14927535638755758923,12277627307579647087,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,14927535638755758923,12277627307579647087,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,2547569665592461091,9338043600438944884,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,6276457232968704505,9113612150072443059,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,15569591236565353190,428838864826688610,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6504,i,5395349896001403722,11256686867858193214,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4968,i,16742118914990549390,17698253433678363818,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6760,i,5804680684577216421,16128152871974140587,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6740,i,7893971113055164668,14688659778478128629,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,8512177184988805238,8102944568078744752,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6832,i,5414048453166550072,15214109034326838444,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,5880661447863102069,17069378685294731057,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6872,i,7348407662348795635,10189552923575373356,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6928,i,4745988233426809139,2862194013980347539,2097152 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,3956673666833533629,2013241860934306036,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7732,i,12835588870916734672,18215777945450938135,262144 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=7748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,2481401415336874885,1583379990550261954,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,5198508928923023461,3057470500510775649,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,18146817479935355550,14073843849084645581,524288 --field-trial-handle=2324,i,15862497894918301974,923384605719060039,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

6905a955-5457-4653-babc-455e3fd7eabb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6905a955-5457-4653-babc-455e3fd7eabb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 27KB
SHA256 247c4874cc775aad822d5e90ef36b1547d1848ea50254e980a7b02add940132f
MD5 164d351b97c000823d5eb559664f4838
SHA1 c88864dbf995a3e1e0687888b6f296e10f8803c6
SHA512 6bd691a158925140a6301438e4fa1a4b9fdb70103948802162a9d2915335662b8988557c556eabb9912a842b3f78c9efa5924ef431eb377f90a81267fb5a6a22
SSDEEP 768:+yU0HJ6ro0JrWJcj2po/A0wR4Y+/oJschqS7:wqs0JIf/WlDscv7
TLSH
T110C2F1033F4A9903A563ABEF5907ACCCB4594609819CE98FDDE7AA943D162BF3701718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 27KB
SHA256 d07b651c0fe4feaa46ea16d44de11ff0c9e19c892ccab1101507446188d7c501
MD5 9d3a653a3ec07d82645ace1e4d622f57
SHA1 d8ac01b287f8f84984c05f90e6e9dbe8e260c847
SHA512 5a90cb4794e894df06c60669b0045bfacdfb87eeb02b4cd0675b3df66a07fb59d529f5ef0ff892ce68f1a0d7a98c1303764541dc0fd5cf72a1b8098ddea08a2c
SSDEEP 768:+rVs3UYYJo7u9qVBL7/NIq5wPsBBidIT6ECZQFUKTr7:+rWPu9qVBP/NTwPsGdcGZQFUC7
TLSH
T152D2F111B1C16DDCE981224DFBB7769C1B3435C7AECDCA4AA92EFD62DF495844C81C28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000113

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000113
Size 2.0MB
SHA256 f6f931cd2ceeeaa9f3acc69c75049e6c53b1340e9ce95dd9a6c832b138b348ac
MD5 4e5b3998fa555a4e88186785a3d2db6e
SHA1 19b909d7d45e8e47891c0fa9831ba102c0a851a5
SHA512 e2afda5c7f2c9d479cb608cf5b3e187985ac86c0b48cedfba9f482e4dbfcdc1a23480ea6468530b1a05592cc14df89abf43f0b61bb881ada836e86afb5c6ae1e
SSDEEP 49152:lZUdM2eAu2P861bLRjFx0leuO801FVLG8ooNce/rxOp:lypek88tcleuO80zw8oZW0p
TLSH
T1C2A53318658F602DBD001AA3ECDBE705EAC5D634F884A34A5B0F49491BF70F85926FDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 17KB
SHA256 6709a83c93aa2ac820f358987ae4889b075f549cb174ffc88f5d244650f566b2
MD5 63b59e89cc08c065d1499476f0971077
SHA1 c5ca3c026f197ccc98010589ca2a433eb233de28
SHA512 b5bbcd1618bbe822f3285b8d52d6457603f71e50723bae25da23022f3e07eaaaecde8743347578a07bd18719f7d7df164c05df5a123bb1e7ae3a894ed4b5ba5c
SSDEEP 192:iSLPx0jrEMm1QFLSmdp04SHnqwbH3owvUYhj6NSafpvscjzDNw:iSjxRd6ZQCYhj6NSqp0cjdw
TLSH
T1CC723C42BAA25482EB241AB4DED6092A7CFCD4964B4F0F87339C5C7ED33EFDA0458419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 17KB
SHA256 4335da4b0af5c6bc2845ef9f4fc9cc206164af2ce39f2974f2dee472f9f89a30
MD5 c10fa8a0acc71aee78112820d1eb260d
SHA1 8fab6c5f51df511439599793c0277fd12f3f9f85
SHA512 f7ed978defacf9f353fffe8fa5cef5c376dbb69ec45d1df2d110fa541139844b5a0e3e5ca3b12956d9458ac595b1c015fee01e9a606b1485484a9cc77ddc115e
SSDEEP 192:+SLPx0jrEMm1QFLSmdp44SHnqwbH3owvUYhj6NSafpvscjzDNo:+SjxRd6Z8CYhj6NSqp0cjdo
TLSH
T1E4722C42BAA25482EB241AB4DED6092A7CFCD4960B4F1F87339D5C7ED33EFDA0458419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 16KB
SHA256 1c21a890835c40cdcc0f135342e88404f83a85f363b2e173cad9669b6837f329
MD5 b89e9c90f5fafad30d6ddf5b7ebaab10
SHA1 59fe33e9c0186a1d5f33bbfca2c57df14e8aaeda
SHA512 f6eb35b1eb1af69dcb5775d7b897e0139c91b265bdcae36766618c5ddb9e964e02cff5ce7d5fc565604ef79c8a09e0e3bc35b43ed450a4b46d769a59dd9c95ad
SSDEEP 192:BdLwxHfXAms7HLVLE1CrhGTmvk3dsTOL+CU3v++p0fcsS3Nm:BdExfRCKLlL+CU3vfp6csUm
TLSH
T1B272F952BAA20492EB244AB4DEC509267CFCD4A60B4F1F87739D1C7ED33EFDA0859419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593acd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593acd.TMP
Size 3KB
SHA256 e42b8a053be138e5274e22bdd8306a15d3ab404dde39a868c9aa35b4572f1d11
MD5 68f56f9b65f41104c499d4b49d2697a5
SHA1 f47fb61c5b807aa6a8bf9387841d50ab174620e0
SHA512 712acf6456e9a046e7b3be4a3b52f6ebf47f3bb1ce37da92b81bb3e7aa5dacbb89a41ea452a21d93218a64652a280d3963fd2e728519aa4fe3aefe0dbc95b3e8
TLSH
T1866160472E930CE5F3708FB1DFDA1A3830B4A8A60F0F2F561152A4BD25397245E5E52E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\00\00000000
Size 2.5MB
SHA256 02b537f800552ecd88ee17364004ff2ed006899899548fe6af57e93ed5b5fed2
MD5 0870c66db55445294425422910519dae
SHA1 93e3e42716a7a6b3273c2c00bedae1eb70d5f5ec
SHA512 0061a963a2c84d4a26f34527a90119bfa1974b8b51717e895f6a5363c791014899681918b66732f01a5a47b88da955ad917daeff24301e1beb762290614a2135
SSDEEP 12288:aZqu+W49CR7vJlwv7XRLzqZBbRZNxClLlCBNTnREZDqclQEY8gLD7zLXzPjLb7Xp:a1SFq3NwlJCBNTRAxdhjk
TLSH
T1E1C5712F1206DE76EB46BB31F07639E7EF74781B03ED9C1029991D6B013A256E1E460B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_x.com_0.indexeddb.leveldb\000003.log
Size 9KB
SHA256 59eacb5c6fc913b722a96e6605f24172725d3ca7b2ad8835e0a69dd7ea542e6a
MD5 0b0b1797c890b2769eef9a42646c5bb5
SHA1 57da8fb9828cd3fc2078bc81911d8e5f2daadf98
SHA512 c624681cfd1d019cd219cbe8281a096662a726131d65312703bd4916048c8f6e9933b870b64242df8f9be4ce8e11eaf335e589356251a36abaa8f3e16305a7d9
SSDEEP 192:CEF/RRLH7HA/Ppz5lJmfOanotRcoGsj6gGg0Fy:rRLbgtfJmfOanotRcoGo6gGgj
TLSH
T1D912497B6BC88E22E0F90A364DB21B9AC7377D46BC45910FE0C3F76C95726444BA129D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_x.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_x.com_0.indexeddb.leveldb\LOG
Size 331B
SHA256 7bee36c2490f9b61d4f31ce2a867db3c6be37076c0521b88e9adc42734d9cb63
MD5 6cfff3d49ef10a18a05131d47e59d27e
SHA1 e1368d04437ca74208b24f528c01461ede36ca7b
SHA512 12fc5633b50e3773eb78d831cf0725773daaaa988386caa2d9da4113d6108b9109d978f195cfbda4b5a8065ce0be7a386bec8fcbc2393eaf198848f45d18e802
TLSH
T15DE0C06CC5C8C22F120450D305387F0DE1D3390EDBC8FE854F8ACC00704204590AE560
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_x.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 dfa9ce6b8c8ef6ba34112d7a2a579d4942f1ab43dfd3cfb80a3d6ff5ab7c2f04
MD5 06b133217fc394b6378dd3498c797468
SHA1 ba6583f4b73725fc89da5bdfd76c4b6ccbb24f47
SHA512 6217c3dc87925ee84f540db08ca726199c8f3508f51ef0e85c9e93c2fa763a8fc23caab25015baeed0eb52d2456958545713f020eec377d764d99cf4b3a60634
SSDEEP 192:Dk6ev+NebBe7JFJsVJSRNeGwnPfV1frRxf0BP5BRLZGZauPw2rPLPaxPike9bcQ/:Dk6e2NebBe7JTsjSRNeGwnHV1frXf0Be
TLSH
T19FF1CEF6D3E4463EC91262F05A146E17CE6E0A2A03983C9986D4FE4B93E2471F2D195F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5d7e855c7d433248776aab47111307c64603da2594487751000a121ea8d6007a
MD5 636709335d2b4dccd81f7d3bfca3142f
SHA1 d9cfc6751e3a59a54c3a813cf29b198ead3ba771
SHA512 8f3adc800956cf5eac8c70104e2d2dd8d0ce8589445681957ba190735b9abd2a2f8b79c95fa89bb71eb4b9722ca14a516c108f30eac39f865e1e345decd78413
SSDEEP 192:sxZCRSyM/jK1Ml8MkI/fZsQruPIdp4M7HW6+WNj5F/YHcnRDIgrJ:sxZCIMI/fZsQrug9Hb//z9
TLSH
T1BD52F7126A38A977CCCBD209F945BF53D6F51472E2900E44A9FC9A1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7b346ad0a76fd49d6fde4aca94032886e86c664c0f4f7fe7dcfc6024ce4fb00b
MD5 8e0057418270667f0a598e4a1fe9fcfd
SHA1 a4a0ae76a31aabc227276fd4a22c9671f8113dc0
SHA512 4ec484bcfbe0c54bcf0c9b2e2f027c94b8b106b1838fdf369ff43886d3d4ffa2156cd23dd8cb268e463ba9adbd4aa374915b742128d0aa84ed7f7b1cff315982
SSDEEP 192:sxZMcRSyM/jK1Ml8UQEkI/fZsxrmkIdpuM8HW6+WNjJ/1YHLWjDIg5FJ:sxZtIqfI/fZsxrm9oHbZ1jB
TLSH
T14C62E7126A385977DCDBD20DF945BF53D6F51472A2900E44A9FCAA2C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 83bbf906b5fbcb0adfe10854c3b749d957b05003ff8849a05ea273dc980ffca5
MD5 0fbe29be63cb64efd44b4d91b8e7189a
SHA1 6952426a850aaf1ee0112f17075e5e81fbe7f2a7
SHA512 3a51bd26ae99e1d77bdd802ffbb943840b2133e77c69ab7bcfc03a251bfe7bb8acd82cf324d187730ab57ef3fb81d1d4a59cf45d5af90b21d87a50981ce80e49
SSDEEP 192:sxZMcRSyM/jK1Ml8MkI/fZsxrmkIdp4M8HW6+WNjgpFXYHCtRDIg54J:sxZtIMI/fZsxrm9aHb4Xj6
TLSH
T19C52D7126A3859778CDBD209F945BB53D6F51472A2900E54AAFCDA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6ac51c6f0edb47f59d101c6fca67e74e83d4536ee54d79f1477b81b3152e7f23
MD5 dee241635e861fedab489f5685f5e8ef
SHA1 f35a3d50272d0d71c8886b8d0924d0279616f67d
SHA512 9e836acfd50808e932e15a5d9d5b05b1e0e4080fac10da30fcc5cd7c886c97316b9341211501021803274d4215b0bdfe4b01293e02aaa46fb2fbaea94a2a5b88
SSDEEP 192:sxZMcRSyMojK1Ml8UQEkI/fZsxrmkIdpuM8HW6+WNjdbVYH7WjDIg5FJ:sxZtfqfI/fZsxrm9oHb5VnB
TLSH
T18A62F7126A385977DCDBD20DF945BF53D6F91432A2901E44A9FCAA1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c915840c8b3418c7e028b3a524d23cbcac0aaff5f09a572d0c16c90f0285a6b1
MD5 358822059ea07d576717ab78712e6e37
SHA1 2a16f828d60baa9a1f59afa5654bb21dd71e9d09
SHA512 79ebb24b9a6220ed5f62aaf37269d2fc27187159d389e3ea5df84277b357b4db505335be0766326a80c4afce9a57fb7e8b8e77d4f7f2515aa5907f7a188c0cce
SSDEEP 768:rmUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RYroVn00:rmUZYTMWvg0Pou1ja7eLZmRja0
TLSH
T152D20A2B280CCB7E4F844E9DEC266F967ED801CB5A584D5447EA894C03CB3EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\d3d27199-b2a8-451f-b46e-1a0c876194f1\index-dir\the-real-index
Size 72B
SHA256 cd36d045fc8165d5fafddb84b06613f4dbe47d70387bb9d3f17c6fadc9d0ad8a
MD5 8599bb1e0d09412ea73339d874e6b48b
SHA1 f94926f764835009e22e24a973430606d2d625b5
SHA512 c8d279ab6d288a396b5ff562e48ff4c4ff5e25f1fde95fd9f71f6cec94ef72ac7c124ea50547de9662a076554607fd68d3549720902a65e3ecba34a47fed83c7
TLSH
T1C4A00224C1A40411C5140374706309816210DA52824B628290FAA744EDB1B865123641
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c1b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\d3d27199-b2a8-451f-b46e-1a0c876194f1\index-dir\the-real-index~RFe58c1b5.TMP
Size 48B
SHA256 eb52715b5a299cc09a0656d35db490898917f35c618c556a160a1e0feee3ceaf
MD5 320e3d0f143c9f8477234abc3ed2a91b
SHA1 7cfc413401c6ab6e38ee8324d927ff1f95be5070
SHA512 7437b2a30aeb7b67ef5de5c3a13658964403a692a26107a6d9a8236f605d8fe3cb89356a80d63d5b513eb0feb299e6923e609ff37789fe7c310211594ab2df89
MD5 SHA1 SHA512

Submit Download

d00cfa6805584942_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\ec009080-d016-47d5-b64f-6e1bcae9ec7a\d00cfa6805584942_0
Size 13KB
SHA256 31c27450a4ae8c521104549f7628ec838cd1ecf976a1598958194b66ae822ea1
MD5 da2954ab65ac1b509fb19b6d0991c037
SHA1 1809767d5158fc84946f8e071690bcc84873d70c
SHA512 17908ec629194c5eb23c6d846233ec034ab8cd69d69dcd06526290b6c2109605a6ef0aad07f4cdc4bbf389d816938f09452191ccd8dddcffc41a4745e9fdd109
SSDEEP 384:TfOdxDlntuaGb/TkyegQfbNB95yw1UNNp2c6gE1:CnJngjQydIBtyw1CAcI
TLSH
T12C52D8F75125092E6BB1C3C11B0E3B0DE933811EBDD4EDD9D1608C6A8981FB2D15AF6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\ec009080-d016-47d5-b64f-6e1bcae9ec7a\index-dir\the-real-index
Size 15KB
SHA256 642fbd2e6d5304e8d8e2d9da8b0bfa7ca44f618aaca298a8aca7732cfeb8913b
MD5 d8eb369e39ef49d55b1c01e28d8c9765
SHA1 b1759a8f9e784441e986a33a70111495411e82f9
SHA512 dd3542e11a536f0cd379729e73977b20f915828263c51a9e6bd7ce8814fb635ec634e790fe9eabaf9f441d8deffacaa0d97cc6740320a86181393890f0359f3e
SSDEEP 384:Q5Fpk4oqtqsaibq5rmqdMK9Zmil4sL3H4P38E:Qj+4ohdFZnCs3YP38E
TLSH
T155722645DD7A866BD80A06B139B910487F7CD6CC970CA73F2AEC58B0BDC2B492DD125A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59e584.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\ec009080-d016-47d5-b64f-6e1bcae9ec7a\index-dir\the-real-index~RFe59e584.TMP
Size 48B
SHA256 1c2626984ec996a0e28e5512eda9cf76cd48878cc74265cbb0d0e1e1b6b60356
MD5 e1109127b880b61453cafe88bc148e2e
SHA1 0ffdd49f8e97be8f0166829e78fdaedad25d0cca
SHA512 a852975a83ee20a7d0ee13fad3d473929334bbb632e364f9ef3f9932ecb72325d87269d473494cf9861821cc6a72c34722de549353f197c25e152d7c3293d364
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\index.txt
Size 705B
SHA256 8c579052c9c25cb2e5d14a8f248ba95e75a19997c9932a3e3da07bf800489022
MD5 044b0b9eca764fa69936824806d5ab80
SHA1 fc9a31ff0d7ec65a25e320f857fdfb18a12bf838
SHA512 db9730cd15998a08acd400795b5fd5bece07cb2712ef87522e4189c003e9e30113fb3e2b6eada9b3376ed6ab323ae7619f17b1a12cbe9df124b707611b5ceb44
TLSH
T19601493E9DA5213752FAD4A4C1E401D7AD6929D235871C094CCB53522B26F573DC982C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\index.txt.tmp
Size 703B
SHA256 45283a6a3e3f1a40bcd5dba6bb8165888dc35732adb9bf220f9e95f7ce6e5f0c
MD5 07e2210e6ec8371e32846b72c192f98e
SHA1 c572f9b7c6aafbb5b16a8adb6ebdd87a70c56783
SHA512 e3536849cfcf96201068bf4297a5aa05b44af64a9e6382cbe6a5ef171d2d89e0821eb0206209365f3c8aab5d3419529a6727dc797fea9be0f0f96334a0dcbd96
TLSH
T1EF01493EAEA5213752FAD5A4C1E401D7AD6924D235861C094CCA43626B16F173DC982C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5870f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\bd1c4d03a881bd4b56183475e9bd7806830c983b\index.txt~RFe5870f5.TMP
Size 308B
SHA256 d067832968a96f2a5fa3c94ce7ef55afb31ce30fb675ada2849a8e1aa036cf7e
MD5 c9a3eb6fbd81d54aba063b082478b9fa
SHA1 4d6451b49d34e315bdf242be26c5a75bf306568a
SHA512 f22c610e920c9a0ec1194254cff9d118228667da6baa64b61af7e0e1ad93aa1169863e5ab0a672e6801d1db0a2e1f190f9912daae2e29a2a362a28335def6f14
TLSH
T194E02B3E5EA5213313D8C8A4C09405DBAD7D2CE63D4759089CC572B23A35D6379CD53C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 b654180ab56242f26728f3408532edae0053042090682c2e588c1efda4775295
MD5 4ceba5310b537247a8be87140c8d6df1
SHA1 2a372e2d2f51db6b82e63829c5cb761a7688cfe7
SHA512 be0a2149db6d41466d1a55b8a7fb12f8977af882e46b985a7147689764959e8dc52facf35152667b1b9df3837885a743869b1f2b684c0aad7972d36e479089b0
TLSH
T1DBB0045555340443D474037474D1455D751D7D113705131745FDD0F4D43D7D5571715D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bf34.TMP
Size 48B
SHA256 498a587e493f44d51a3e02d496e0ac7f0676e09f73b82a04534bcce23c0796d1
MD5 a03a37c30fb10512f3cefc98d46ed8be
SHA1 22218ff1660463ef23215e483f17b51ebab0ecc1
SHA512 6b5cd6427583f794877ff121ed59ba1e38a5f6b015908759a23636113fe9eab54661a1caac5371d1d4431c61697cc36adb71490155331cb6b758d9e953289d4d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 411231093e9083d9f914bc0bef185a8369fe5c49ac09ec26870bd9614bbc20d4
MD5 f1b742566eb1c8c5a77af2c7af0d6928
SHA1 ed4de328a8aa45921b0a3ab9c455caa8be5cb053
SHA512 39bdfd9daa1e45e7f3e31cfd469325b702807b4f616d5c14c136f18f5589e996eef711a13e9da3cc46e1cfac578b668280aa012d1970fe690333cdc6f53fce19
TLSH
T1F1A0026101487055C402C6742E95617067944D150342120D53D58444DD599874115E01
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 e78ab6ff6f19b9535407571dd62eb2eb7ccec5b27112536c3e0c080969c18af5
MD5 c47187a4281645e94f92bda9a65a1ed2
SHA1 cae9357578955f269309f2ca7830a8c864ab9fbd
SHA512 641a3f60d1465a870a3a8d0bdcc4a8210feed6bfbfaca0c42c2d2fe7e3401ce8caf21b63df152aa20fcc410c799769337c59c87e4f61c88081c3b2a756effd5b
SSDEEP 96:KA1eK2A4hqKao060gKdSmnOKAwGyGPKMosDKFZzJN3+8:EMXPoNDlDKFZzJNO8
TLSH
T1CFE1460231FB16013DBD3A19A2A48B2B4742B5533118F42B7BE840B54E6EE745DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f170.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f170.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d2854a3de6acf49b2200359adb9a340f3e1b9cea61e5ce87905222cc7badd3c7
MD5 c673d1cc24276b612720b129dae8ce4a
SHA1 809ce35eaf971cae0b56b69161e7479787b289c0
SHA512 a12e65638d000476a9c684fd2e7784e41b53eeaa16f42d880a5ad7cb080f471b64f28c7a592a2c1894ae51494736f8de417a9a5d8dbcfed9daeef86a155f51a4
SSDEEP 384:eZcIhsNKOkpUWzX5od+2OO+ustJrp6XK9Li6Uq58bhP+YGvBu+:chUKOTOOnWhp6wLwTcBu+
TLSH
T1DD926C7258687C775DE6A145F84736138EF89067D6846EC4C5EC2F1D02AB6AC132AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3e1ba4b0de8358f34de25c594339bb41c2453e46e355f1cd3c15c1121b7ca18
MD5 73fd7168a253c07b852e3256ea9fe265
SHA1 295444a62c8c513348ae2987374727529afabd35
SHA512 289adb3a21cc2396c864c93a9ccd1b7fe2f4d67a336d42639a4d967a00cc32cc0ab8247db73d44cb531f3f5349b334787b4a65f156ecff07e28a257c511b3d45
SSDEEP 192:yONC61VWQmiUykdgGX5Obd+j6OuL+7/aV3BcU6:yONC6WngGX5od+2OO+e3cU6
TLSH
T1F302E835A8286C77CEE2BE49B48737235F95206BEA946F84D6EC1F1C01D769C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 34dca4e99e51638ca42ee44d32b81bfd06a60d85d913589ab3a0819d3c93292c
MD5 656419ac0194d5e9e92534c26a90884a
SHA1 cb634a6b2bc777a1cb16daedfc70ae025e1515ae
SHA512 b1e6ce125501f48e6b67569ccbc0b82b7672704debc17fb61969f2882e0ba7be8f3df31d517a812e9f9ee7164b0223e7216d1ba43a230148c5c6af3f05d3c681
SSDEEP 384:vZcIxsNKPkoUWzX5od+2OO+ustJrp6XK9Li6Uq58bhP+YGvBu+:nxWKOTOOnWhp6wLwTcBu+
TLSH
T10C926B7264387C775DE6E146F84736138EF89067D6C46EC086EC2F1D02AB6EC132AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 decd668929f8d62eb06d28ddd6dcc1e7c1dafbcf141a2027f3fb8a7994a30abb
MD5 3bc0e3ffe4f2588791fd06708dd28d14
SHA1 2cdb17387e533c3681ad1965915b5e399804ced4
SHA512 c186f94f01798ac47539cf36299f95c33a1ffa4bec1803bdaf9cca7d829f741ce8dd07827f0146e8c80bdd85bc392f055dab0272a8a3b9deccdb82ee526dc0cb
SSDEEP 384:WiFiZcI5nsNS8TUNTUlIlPkoqWzX5od+2OO+ustJr96XK9Li6Uq58bhP+YGvBu+:9FQpPwg0KOTOOnWh96wLwTcBu+
TLSH
T178D22AF244D79876D9AE9747BB3E2D138EBCD063B5846990B3981A0CCD5A1BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ea1f28f75bb3c86421c7c97dfad550d9f7ba45ba2a2c446ef49c3e7d46c2d8c5
MD5 d6366d708cc9c403df6003b4edbcd4de
SHA1 47c6a0812336238dd1329bde9d0e27213567c486
SHA512 30cdb84b28b495d1efae8d18d0ebd33ad3b757f36f0a72688a33885d976abea32ad0a71a0d3e471836a444c08819ce207e2684726b04abdb6f17ac0336526c9f
SSDEEP 192:JONL61DWQmiUyqdCGX5Obd+j6OuL+usySJrFjJKqSU6:JONL6EvCGX5od+2OO+ustJrX6U6
TLSH
T1FD1219326468AC779EE2A554F48736139FE55067EA897FC4C1EC2F1C01EB6AC131AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d6a208b4365363255fb8c05ed69337c23c88ea4a1c1fc421616a51abb1d9c887
MD5 5376e5d634aa8f89428581f6db0333c3
SHA1 0a9d03bb1c72c28cefb7eca9b07c25b29c4c536e
SHA512 2e836a20ca73f00ea2058b6fc15e65e0cdfe3763110979af8c23cb5fc7fd4e3c9a9955da215ad475991d32612b69f93121c1c61671eb79437f9e8a662e24b62c
TLSH
T16BE04403C38A80BAC02C833800CB02303BA2C22203E2028B0A0088B83C02320AE30E82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 235a585a9fcc37d73daadcc4823755ba4d9994a4e2c189c41f4c513015c8b313
MD5 8aced8cebe6255fa39b10724fae832d1
SHA1 c9334154477761d501480643fe853cd5c9d8a887
SHA512 14e93dd5ee96a3a0ccd7d7e171e40d4d40def259c2fe3849d03b99197bba13bb49fcf6ec088e2ce455ee949dc8847090eee5781ea224c8ee7982e28da981ce55
TLSH
T1F0E00956D39A85BAD16D537804CB12757ABAC62606E6168B5A0099B93D02360AE34E82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 df805359008f1860d5895301a0a1989e6096a531f8882d47c6832b298877ec7a
MD5 3274724fc6fe349050fec8bc3a5b7592
SHA1 fbd2c4c4650d12e40515f5a225348c890b0148e3
SHA512 7e1385fd553343a4f6d0ebffbc2a6ebde5cb43be3d3e259967b01ef09a85f5af5b94a3b15d845ba4ade075171d31cd536a78597cbc3652dba323cb8b104ad468
TLSH
T149E00246931015B9C02D0234004B16605B95C51501D1134B4600A2A52D002105E35C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1416a538c5ad10eaf137a60e6c934e39815ec85d4f5b4167b8a1604e72b298e7
MD5 bfa584a6eb520d6553b553af146c6d8a
SHA1 52105c6bbc60add592eebdabcc3d808f5a8f9bb0
SHA512 2f9a10481965780ed90ee6f6dc0df84da0638fb0745aaeee0a6082cb4c4ced4fb6058a2a114bc7e20d2098e9394f4b147bafee5f674d4503d24cb2e2863607e5
TLSH
T1ABE00246D31415BDC03D0334008B16706BE9C52501F2134B4700A2B53C023209F35EC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d949fb25f2103be9873acb1af39155d997273ad06c9989523340d95fa99cc952
MD5 ded33fd5b2e9a68b1c4073197f542f23
SHA1 98b358a5ce4e0082e73c0f20214a88ee21ccd5f3
SHA512 284abea15c4a6fc557548ef7372a1254623ee97337be5edc43e69f249698f92852a64ca157b4a13aad30ecc124ec78d4d1502170fe8b373cdc00826f3cbc0efe
TLSH
T187E00156D35845BEC12D0334008B16616BEAC52501F6134B4A01A6A93C022209E35E81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 78a217c13157332d2629bfc3608283297ab5dd44a75706522c46aa941cb806df
MD5 473860217447cc1f86b335ea75461d6c
SHA1 2d7ddcb4be321d034286c513e344cd8a63ecd483
SHA512 7c6a7e332aa9e336854c2fe6c4d59e8639748a6b2c47a95105b4a7f2645e64ada952e65e6e65afa4360d1b08369b3f1e8d995b25c141507a34006588c74d15b1
TLSH
T1A2E00156D39945BAC16D437804CB12717FAAC62606E6134B4B0195B93C02320AE35E91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0b282d87b69cc5daa1204012f8df73ca4b6e7dabc29124b2ef5f8efe2ec5fb3f
MD5 4b3274f6bc641f4a646e4e1b1f7639de
SHA1 70e27814bf48c7512f1cf85980e7c6e08f13ee1c
SHA512 8b7d3e2091dc51cdccb7e7c3142481d76cc8548b0ce89b70400b511e558106d97339e4ff8ced7abf44edaae92244a36826be9481fc66c44bf772e26c677671c2
TLSH
T19DE00447131015F1C00D0334004F13405FD1C51501D113474700D1F40D013005C35D00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe587bc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587bc3.TMP
Size 392B
SHA256 2e98248b3eca615584ac7c8fe4a46ce8534bc39c611aa7e2ad93e312ffa09746
MD5 efe7548273f9d52ec92deb5feb715099
SHA1 1547ced8c4b069d108da8a701cd46eeef4459a0f
SHA512 92df8b3e044c635d0f5a72f028e2f10ed2e632e6086e3c338a427ea60dfe91f11fe964379fbb7a14fb91e26c35797efdd441ac214d96a2f42a778e91e78ac4df
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b26db27c9d8b43fabdcf6061e332af4276a027ab70ff8a25d739557a82d5c07f
MD5 26d0ba259b7ea358eb26a3cc825d4de4
SHA1 4c11c0a7d531faf6f01e2b8a288e98f62f98d354
SHA512 aa6cb3b64ed420e24fcdf1b7dd02a6a87fa1c4944215698811f30ea1ea694dbf40081231d06248d6834a3358a515b8fe2766d97427a52b36e6fdc8e4b75a1c8c
TLSH
T1BB41D65CAAED1148B3B76F4AABF6A86E847A79671F06C55E10110D4F0A26E00CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download