hxxps://go[.]whitetrafsa[.]com/?userId=56094839fd4d973609fb19f8c161f18eb82e0a59e151ebc38dfc1e9741264072&memberId=discord_961970166009298964&p1=961970166009298964

Analysis

user interaction
yes
max time kernel
358s
max time network
361s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 18:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.whitetrafsa.com/?userId=56094839fd4d973609fb19f8c161f18eb82e0a59e151ebc38dfc1e9741264072&memberId=discord_961970166009298964&p1=961970166009298964
Sample260812-xmvhbashqe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2864	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310347650213446"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{97B95949-C207-434E-A6A5-122D40D327C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 4680	4888	msedge.exe	86
PID 4888 wrote to memory of 2864	4888	msedge.exe	87
PID 4888 wrote to memory of 1100	4888	msedge.exe	88
PID 4888 wrote to memory of 1100	4888	msedge.exe	88
PID 4888 wrote to memory of 1100	4888	msedge.exe	88
PID 4888 wrote to memory of 3120	4888	msedge.exe	89
PID 4888 wrote to memory of 3120	4888	msedge.exe	89
PID 4888 wrote to memory of 3684	4888	msedge.exe	92
PID 4888 wrote to memory of 3592	4888	msedge.exe	91
PID 4888 wrote to memory of 3684	4888	msedge.exe	92
PID 4888 wrote to memory of 3684	4888	msedge.exe	92
PID 4888 wrote to memory of 3592	4888	msedge.exe	91
PID 4888 wrote to memory of 3592	4888	msedge.exe	91
PID 4888 wrote to memory of 1488	4888	msedge.exe	95
PID 4888 wrote to memory of 1488	4888	msedge.exe	95
PID 4888 wrote to memory of 1488	4888	msedge.exe	95
PID 4888 wrote to memory of 3356	4888	msedge.exe	97
PID 4888 wrote to memory of 1108	4888	msedge.exe	98
PID 4888 wrote to memory of 3356	4888	msedge.exe	97
PID 4888 wrote to memory of 1108	4888	msedge.exe	98
PID 4888 wrote to memory of 5420	4888	msedge.exe	99
PID 4888 wrote to memory of 5420	4888	msedge.exe	99
PID 4888 wrote to memory of 5420	4888	msedge.exe	99
PID 4888 wrote to memory of 5268	4888	msedge.exe	100
PID 4888 wrote to memory of 5268	4888	msedge.exe	100
PID 4888 wrote to memory of 5268	4888	msedge.exe	100
PID 4888 wrote to memory of 5396	4888	msedge.exe	102
PID 4888 wrote to memory of 4052	4888	msedge.exe	105
PID 4888 wrote to memory of 4052	4888	msedge.exe	105
PID 4888 wrote to memory of 4052	4888	msedge.exe	105
PID 4888 wrote to memory of 5692	4888	msedge.exe	109
PID 4888 wrote to memory of 3060	4888	msedge.exe	110
PID 4888 wrote to memory of 3488	4888	msedge.exe	111
PID 4888 wrote to memory of 5440	4888	msedge.exe	112
PID 4888 wrote to memory of 5440	4888	msedge.exe	112
PID 4888 wrote to memory of 5440	4888	msedge.exe	112
PID 4888 wrote to memory of 5616	4888	msedge.exe	113
PID 4888 wrote to memory of 5616	4888	msedge.exe	113
PID 4888 wrote to memory of 2704	4888	msedge.exe	114
PID 4888 wrote to memory of 2704	4888	msedge.exe	114
PID 4888 wrote to memory of 2704	4888	msedge.exe	114
PID 4888 wrote to memory of 4748	4888	msedge.exe	115
PID 4888 wrote to memory of 4748	4888	msedge.exe	115
PID 4888 wrote to memory of 4748	4888	msedge.exe	115
PID 4888 wrote to memory of 4188	4888	msedge.exe	116
PID 4888 wrote to memory of 4188	4888	msedge.exe	116
PID 4888 wrote to memory of 4188	4888	msedge.exe	116
PID 4888 wrote to memory of 892	4888	msedge.exe	117
PID 4888 wrote to memory of 892	4888	msedge.exe	117
PID 4888 wrote to memory of 3388	4888	msedge.exe	121
PID 4888 wrote to memory of 3388	4888	msedge.exe	121
PID 4888 wrote to memory of 3388	4888	msedge.exe	121
PID 4888 wrote to memory of 1044	4888	msedge.exe	122
PID 4888 wrote to memory of 1044	4888	msedge.exe	122
PID 4888 wrote to memory of 1044	4888	msedge.exe	122
PID 4888 wrote to memory of 4908	4888	msedge.exe	123
PID 4888 wrote to memory of 4908	4888	msedge.exe	123
PID 4888 wrote to memory of 4908	4888	msedge.exe	123
PID 4888 wrote to memory of 944	4888	msedge.exe	126
PID 4888 wrote to memory of 944	4888	msedge.exe	126
PID 4888 wrote to memory of 1548	4888	msedge.exe	127
PID 4888 wrote to memory of 1548	4888	msedge.exe	127
PID 4888 wrote to memory of 1548	4888	msedge.exe	127
PID 4888 wrote to memory of 5208	4888	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.whitetrafsa.com/?userId=56094839fd4d973609fb19f8c161f18eb82e0a59e151ebc38dfc1e9741264072&memberId=discord_961970166009298964&p1=961970166009298964
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffaade1c188,0x7ffaade1c194,0x7ffaade1c1a0
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1310104188382391680,9555189045562758160,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,4514912121721610426,13126370166594513515,262144 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,10715979034697261322,4661008466892245813,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,1519794368712745485,2752339323004474394,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,12971592722797300243,5426410507187066071,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4924,i,875654663132561761,7122722415542539552,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,3303438534915198892,10800103230764897497,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,6787826882042156996,4926814124055455902,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5520,i,15105429119061517033,2579082748785575235,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6020,i,10538173039233090089,17408929513493069009,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3654633932591154664,2693685976487656719,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,3654633932591154664,2693685976487656719,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6160,i,6087463719821124944,16014801625857698806,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,4428524128248687855,12014931669187219064,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=140,i,8413814846313744151,3447246628618507563,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,6763114325746950402,5446031690313575275,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5548,i,1414669633677239392,8452565765060766334,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,4913398292058031846,8598642361246946428,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6724,i,16905439456772532945,13239456170106081674,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6656,i,7710622596682015000,6933502927038710959,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7068,i,4912015646007140452,16193560387581852544,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7288,i,13953429241713999529,8440108088622203969,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=7312 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7516,i,4269065359546550035,9507491204869350603,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7604,i,14127757300223280389,1629085238586228202,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7500,i,8083234103074017719,12401771341670671526,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,4587017037175760177,2500333079585759701,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=7988 /prefetch:8
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=8156,i,11132798857568276028,3739165725568568594,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=8136 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7516,i,3865186773008073159,2348193155136199649,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=8348 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=140,i,2958380888677641264,8831830378977494221,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6680,i,17939729087112695040,12642255965543420740,2097152 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8000,i,11071141417509660930,13008486641415159537,262144 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,10136952873338140217,15933740817167788512,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,10401638250840897791,18023057658046456694,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,13714035330569285706,9858123369030425774,524288 --field-trial-handle=2224,i,18420155017213963662,11254716729658636361,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 7KB
SHA256 ecdb238360e03dc8736db205c2eeaf838925c7d6571dd876cbf369408eb333a1
MD5 4d1ebc76af1d7894d616bca2632f6e02
SHA1 bc39c8600b80638b07972323059420b6832597e9
SHA512 002ef0c16b79e41c10fe0273d09be68f9304e9550db63142e557fd31c0118004f0743f95d66169a93efef8077023ef989b0e2ff1fdd7cc4f2e8745da90dca0ab
SSDEEP 192:wj3N807f5NSjdAffOOFFabr61n+ZwQQ5IIDyycARh:wj3N807f5NSjdAffOOFFabr61+ZwQQ5h
TLSH
T151F15C5782D4D79FAF06518B4AA1A35C01707B0EEBECF50C078D89DE304E9AAE5A67D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 151B
SHA256 638fc7e45a745683ad16c83c4be835e65031503a39b5c456ce140c71d890910e
MD5 00a76bdd21b71faf50b8ecdd6027696f
SHA1 1e4e7650207c1941c05d1eda32fed3a6de831ad4
SHA512 263500319a5bd0ee03b7aa67af740ba8dfc0c9724a4ccff796526f04be4f699eccb58c2cd738fe74cb967c8096a9d5e6ac7d4ebc11dc1c72a2e721a58da4a4f2
TLSH
T1E3C08C7938DD681AEAA8287AA34AA0040FB042052022FC2642B8EE847A815A40A5A124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 2b4b67728fd987a7e9573b7dd360e0cf3917ed4cfdf54c4a7cd90fd90b827239
MD5 fed54973c3cb4e69d9af8972da86393e
SHA1 a9e5246d445a5e37fcaca77c01e4e7077ea84f46
SHA512 56647d2489b441a9811d4c1c00c64b001ac42d2f5433898dbe76ff9815a7bcb76e5a03be47e07aa3d35b64d2492a3d13540a70d9c031139b8988b498480b52ca
TLSH
T10BE0EDA6D826F82708FE5B69A00D8A86E75123172A50898E3A3C81098FB063A45C985C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 68KB
SHA256 508f1bbfca8cfc57a697efa003d7bb1f8f9f163b5a02d92d1594c3fe03423737
MD5 afb2d2605df7f8cd7555497de81390d7
SHA1 820d53f074d37246554e0877be8642fb7aec8a82
SHA512 33adb5e0d109a727313a317a9ed45697ccc571e33aeb2978fc03603a2ec487d4eb12532df9347641e81c862b7d7aad49c47979d427086750d9c6b9b9cfbdb523
SSDEEP 1536:ygOijaeydh66CIF7ZZYl37znub2rNz9Cs/VEYKnek5r/+nX:ygGep4ZYhzub255CxnB+X
TLSH
T17E63027525CEE16DFE4D0AA4BE5511AC8D3BC439041F24C36E18F3C692329574AAFCE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 407KB
SHA256 433e0c6ea66a2d2be0547d670cd9585bd8e942933f9be1ad86d5d3e9cd073fbb
MD5 381fa8a8d777a6a6eebd59b572639b68
SHA1 611ba20a9e716144bdce71c5e3984445b94ca76d
SHA512 c4b2c775b34116bce321a4ff8b5d57fc3a55df378b1bd18d222e337335f3a84d3ee6e9b50ec33ca6e86efc0eab5ac3a05713b28216c952b80ada604e20303613
SSDEEP 12288:8AyE2ZrhK+zuZtQKOZV9BWHyMuoma03fvMd1SDdV9ue:85ERcKwjM/+Md1mdVb
TLSH
T13A942319B1A92370FCB9D9E69183E31F3E415E07C5809FE9052BAD69A05A7BD373084B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 77KB
SHA256 f4b52346894904041c697cfe0aaa2cb1d08a1451620e6be7ada812f649f74574
MD5 631af6b2e0e0a4c206a1de0551ab9897
SHA1 9211d4e1212ea714cffa70a0f28b39e65dc177fe
SHA512 e47d4cc6a74f2044e558e761627e9079b2e3b35741c9e55e0068364d9a0a0ec7d3b968e91a5e3482dac69815473fdca11fe6200992ee4747486486428bdf9ce1
SSDEEP 1536:vYDo+iYS7hb+0dL0A8C+0nLIHo71DWEqRMWLu0lUfFawEgpSauNReGhxQdnLVkTe:vYD9khbbgA8x0LIHo7teMN06FawEIJu6
TLSH
T1F973123FFD7BA531A4C9CDE9C3E454DA6BBF20325034182B4B8A1151D023BB7A49B71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 16KB
SHA256 f1d76f41d21fe34b0a82fc0ea39933f9aadb371488c635eae19e2d2f14f61700
MD5 8ce394b6a5f47f58f30720e5ee8e113f
SHA1 75fee251b6ced1c4dd496f0c69c7376e3d35dea1
SHA512 14ed895d7182164b1ebae85b38cffd9e2ee3430c9b847c964c0b391c16fe1fd6b48535a03aed910da26648fa5eeee83ebe5ebac4e3c3423871ab7f2f454a6717
SSDEEP 384:qAjxTnCVfJnXFXGj3/ZXaVGj8e+VEDaDMKMwNWyt9lGxdxysK4B:DjxbCVfVgj3/ZX3JOEuWyTaxysK4B
TLSH
T11172E1BCBA81728EBEA3070C791784239B9DD5CAD1BDB46C5E5212E3D11375A2014ACC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 60KB
SHA256 4aa1e360419a353d4a90554b5a97e7c8f1574121ddb51574354430d22d87ec6a
MD5 943306a3b415fb47090db22703f6cb30
SHA1 9833a316652f297054791d4585b51589d749612d
SHA512 1cd867b27edf01247e39efa9359404253acdb6672c8fee442e705612a3fb5f6a82aa32cdc095cbcf565986ded14ca09247c110a8083bc1c4e206571751a21089
SSDEEP 1536:vLiTxMg5No42qBUdqmASK8ROIF6JamZ1C84moczzYH:Dvg8qGd/ASTe1QH
TLSH
T19953F133BC27D069733218283F147A653228AC78E459AF17BADD268BC7157A125886DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 72KB
SHA256 84b462e89cd4dc9c4712a72f8f0cd279b7ab0f7e49ea7dcb0c7cbdef3b1def7e
MD5 1d6a99f11095371df8fc5e45b1b5fd71
SHA1 af4683177ef65ca07232db930bc31466f8056a9b
SHA512 0bbec3fcd26e41320d5ef4f5e40923b8f1a7844fd3230e8fc6b1e1cc1f51be4a5ae170ed53521d068c5a76cda6b951f377d64dfc15b14248569a3f8854f08bc2
SSDEEP 1536:GtOFPiv85IX7IFXuNqomje7qXsHzCpZpkNoitK+1AfjsEk9SJt3VZ/HGs1UWzY+:GoKm0IVuN0jMDHzgZpv8z10sXqVhHGaB
TLSH
T1A373013C81999CB9268033FDF1BE68C18A7853C716F6662F918AD4D67816DF7039072B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 5acc2e2e878c662bfa2fe9fdec44b30e81b95d31392f25657129b58690ba81da
MD5 a4d0b1f33a1019f7c37a2335db8ba6c1
SHA1 b37cb084c2824099042d6f1df69052b38a376ab6
SHA512 25129bf6f8b1e81cf252f2435fc16e4799268618320b65765b5566480f916ca75d2b9ea58be236d4978e6dc7f67451abb0c62c6e06eea38a0441587dc48eaaa5
SSDEEP 96:ncpO68HZrNyVPIUxCet8Jsv3mm+o0hytLKVlhYS16vmRtDe4yxwpfpvgqrY0sgsJ:0+rNMPIUxHKZULKHiCK4yN7cr8dvSK/
TLSH
T193227271CBC6E865EF29647105D40CF53D79D0FBEB6BAE6203802C70E6873942A5E4AC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 870b1555b8566183248ac327a274af88469fab3ad483823015dcb904392f867d
MD5 c8c82ebbb77beb89760fa2e599080639
SHA1 ba046bf76320fbb9b7fb5fc6b0e69f696004be17
SHA512 c1edc9c922716acc7f4e29230c01ad459129f15eac4f0b1dc43c7441670437778a74337df920187bbe5983ef13ecc2bab37dc0a87d156d6682b0c2b2a09e8d3c
SSDEEP 96:yB460HQRPjNBN0ne9YffHS/Xf+TgvQnqXPW6:y9RPjN996yiqe6
TLSH
T1DA910AB1CA8328A6EF35543194D00AE57D31E8FAF77BFE6642947838D9872A441474BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_stripchat.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

8d3e32cb-91ac-42c9-8cec-7f2e91a3accf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8d3e32cb-91ac-42c9-8cec-7f2e91a3accf.tmp
Size 11KB
SHA256 2f3c1aa9ce2747a72e8a9436c1ca8ffcfba2392fe1e09c4f59e2b9895635870b
MD5 d1b7690bd04c957f08ddea2c32d4f6ec
SHA1 27a46deff023b0c12de4585c9bcb998c7223c104
SHA512 324b84fde8b044d21995476df52453f0724330f155f8b096e80d5f7ad8ec89354b9ea1d38ed42263e0c8ac81a63d19ed970385c2cd4a59659f1b604924626f63
SSDEEP 192:D1Ru8B6CUaPXJCIgdDEYaaij6M1RfoBjoBF2NAU1z+k6hR7/txtVRFRVIVpIkVRD:D1Ru8B6CUaPXJCIgdDEYaaiGM1RfoBjD
TLSH
T10C329DF3C3E9862DC91156F09B14BE1ACE1D092987283C6AC9D4BE5BA3F2471E21165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 20KB
SHA256 b8f543aad64c9e6bb813e6cfe241b394c5b56f948b623a960e2e7c1a58eead4a
MD5 804e774257aed188c7104e9f3121e6e8
SHA1 1af587615865d1ee431993af1abde0ee25727088
SHA512 bae79dabf00559c51f1687e4e68b783c74f848cc3b63c373622842760ef68b332210cfe1aa630178b76fe32b7e92c4bb9c8128a0feb5318581efcbcb3e00539e
SSDEEP 384:D1Ru8B6CUaPXJCIgdDEcAxiEJIejJQZvJB7eBeaMa3e/sXJcUfApaaiGM1CoBjeB:f66rUs+wXQmHVw
TLSH
T19EA2C0F3C3D88A6EC81256F05B247E1BCF1D052946183C2AD9E5FF4BA3E2472E25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f1f58f91398e119e20aa31c43ff85ddc1dbb506a9b1c21bf6a8ce999675db68d
MD5 7f59eff5beb2d5a551af85a18dc83fdc
SHA1 47ee36256de7d7d1edf711d1b687997a910e3f50
SHA512 1ddd63a1a6300089e7218ac4959b26bd750324ce03de36a5ff3329419e7d8ad629a4751de3ab3f719883647d460539cf466a5a0e38d24c32789a5b3727d00e0c
TLSH
T199D023631300707556BCBFDE8457EE8FD36600300413DDD512D0945C153145D490B140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 dbb374227a986b816357792b396266bbe1db35128649a7c6c57244f5cf2e5414
MD5 5198d18affbba6c8fea7ca640ee51758
SHA1 53d7807a410f5f740dc482590d2afd511f195ff4
SHA512 e335e8172404fb2c944a74af06f64bb223bd4af89f7088e67fe903b06479b9b8fdc7c29fb9c3af683b2cd6499dd0aaec2ab833c26f4b25a1d4b0287ef04b7fd4
SSDEEP 384:sxZajq0m4u/f2sBSzb7cUIwWeHbt654+/nz8MOp8Y:sie0m4u/f7Szb/IwWeHbA5dnNIz
TLSH
T13692F742692449778DDBD61AF911BF93D7F91423DAA04E88A9FCCD0C00EA6ED3217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6da06176d9482884b49590fb5021df712988157379d74b32eb1b218e4a4d6fa4
MD5 775e0c5f1fe6354a4faa424be56ce3b8
SHA1 e408c5b35ee9651b5610a7d6855efbccf5ed2567
SHA512 4969c9929b0eb0f9a264d803e4ae8e1ab654195a4acfc8790b0721567fe3bfb7a15d6fa2abdf36a6241a669207da10777e43a5cc6100c0370239377881b09df2
SSDEEP 192:sxZIjRLyMqZjK1Ml8Mku/f2sshtaZdUzodpUpqwuTeHW6+WN5pfs/YvDC+3rIgja:sxZaAMu/f2sshtaznUIwbHb52/wzja
TLSH
T1D362D7166A78997B8DD7D219F645BF93D3F90532A2A04E4499FCCE1C00E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ed7f8167e9093cb81723558eedbd66ee016d600da302c5e94de9ee0197c546e0
MD5 decd93ebb6c538891947571376ec1e5b
SHA1 804ed2f11692973ed65bf7024f9856a46e0bd22e
SHA512 fb88fea769abf0257272e3480a0870f5ae1d85f998f10963d40f12cfe5c16421ad107ca6a53ed1f53e7011c3b806cb3c452639dbbf679bcb64ffcf54f55d881d
SSDEEP 384:sxZajsm4u/f2sBSzb7cUIwWeHbt6146/8z8MOp8Y:siAm4u/f7Szb/IwWeHbA1J8NIz
TLSH
T11F92F852652459778DDBD61AF911BF93D7F90023DA904E88A9FCCD1C00EA6ED3217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 69690d2198cc306427fbb8202494acb3e58ca790c539ab8396a31bbe3545a3a8
MD5 9166f7b9794665be027a1291532d1ec5
SHA1 48981e4fe99bb26e05e00212afb0383a9fc696cd
SHA512 1519e1ca6e5e68d98f9a18776fedd7dababef57a24ac9285707effaf4f10fe9913e2555e74f75ec093c5981b2a824ccf2c42231e4e98c2f38b6983b65a1cb30a
SSDEEP 768:ZYsv8Od/hWvFvQX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQro9RLG:eY8Od/hWvFvQXu1ja10Lm2Nu/S
TLSH
T1F8E20C3B284CCB7E4F840E9DEC26AFD66DD801CB66984D5447FA884C02C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\temp-index
Size 3KB
SHA256 10a564f6208edebbf193d713f9c09f32bf28954128a4ed980e86d94844d9ebd4
MD5 17735254c7a06cfcd69c646c8acafb63
SHA1 6cf20dd5e90a371ff2ceaba08329a42940781120
SHA512 182e27caad46559660c6a3277febd84b00dbe362f2c5ae60686428fa3fdf80a2ce80b4f82c13c3b817113fac4fce3a7dd675de34638a55afe35af4c353f26ed3
TLSH
T19451E94E4D476E39C99C01B228F70C52733934FEA6889B0BA45CE434BCC37262D65275
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 1KB
SHA256 2a3f4c1924f30885ca1bd1c889e8790930640be1002f2dd26929e29aa76534ae
MD5 ec9b04c71c06b2b31e3635b4c680918b
SHA1 9a2091cf0a9f9ebdd828a53a7bb471fc183d3846
SHA512 ef01610229ad20ed7df5c31e2f74ac2cd44532766ab3c40fa71e11ad32bab2fd5866031d76d4820b2a1139e6bfad17993c1c27702c7aab47faf30b4285e274b8
TLSH
T1B841968D4D518A9FED9441B200B664A437B4DCCD2B1192178C7D333BBC6336E2A5B5AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index~RFe592b6b.TMP
Size 1KB
SHA256 799672c65f53ffe946e731d98aba5f8037e25d8963f060d82ec4274406fe1c20
MD5 7077793a29db583407ceebaf1175370a
SHA1 e0dfe8cedb4fcf55ffdf990d492f98d31c38dd3a
SHA512 46fe4045b7fb35f5a46aaad186a9e04736c16ae1af07d69a35f3199ebb54cc7d8342a9d7bf1529e71d320d07d5b80f05c6026e530f23e35e79a31104bf6c8512
TLSH
T1EF41A58A4E41861FECD040720993B4B4333DE80097227B8BA4BC523AB8B17FE2D4E1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 07d58ed85d87ae0cd53c3f7d8657a91a9dc6e366cf393a83aa240f7cadd0f3f3
MD5 4309f0c9a1463b758ac69781f277c22d
SHA1 de9c047302bff93dfb0de0fdb375fcec00a8720d
SHA512 0f518663bd5f5d6cb90a6bf98ade3e0ff3b0759c03ead87203de64c8e1d0c951565947d4d99895a45dcca439450b287b7ce12254030147de819447140fb79394
TLSH
T1FAE068B33EFB1860FD6BA3C6203008A10005755098809D1F2826A28324A13592416CA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5ba9397e1807d2e674b4d79e61c9318dc2ea612f3b85ab12e682aaeaf7e8b3db
MD5 7b69b4c0a1b8fc22a3807a7cb4820b6b
SHA1 308b452c03034d3beec6337abefc134042008f3f
SHA512 82efe909b68035961d91333d0bc77cd32bdc17621903dc358ae0a0c0630b50f9ae6bfcd6bbef0c84ea0c4ced321a57ee4efc79937d3d67a66f1f22874a5c8cd2
TLSH
T196E068B33EFB1850FC6B93C6203008A00005755498809D1F2816B28325A13192016CA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\c4c534b5-f16b-4de8-8ed7-cd7bfb68b604\index-dir\the-real-index
Size 96B
SHA256 f259f9ad7d45365396277c274e199b32f86d66669c36580241f220385e4e8649
MD5 89d57fcff758e572d51602ef9730a796
SHA1 8e49beb9a8d08d37821266494618a3781c9c41f7
SHA512 2251b655b53df44b46c2540b8b592d9825ef3201a980aae3fef313f5e5f44a1fc608a70f2caea66187dc3bccff2712db692ebcd43ad4a736c2356f1361c03b45
TLSH
T191B022300A830C0FC033233030C38AEC323CAC308AA2238AC3E008BA80F0FC2C083008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b8eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\c4c534b5-f16b-4de8-8ed7-cd7bfb68b604\index-dir\the-real-index~RFe58b8eb.TMP
Size 48B
SHA256 626066f723f0e4f74e936ba4b99e584e32f7b574345dcbc8dc1388e220f3078a
MD5 22027acaa7affa998918eaa968307dc5
SHA1 792153e979d2e7c6416a82cc805b884ae84d01d9
SHA512 0c712e4fbf29e3f7e18a33b86556c499bd3d1a88d36bb19b0dc9c8b62134f25eccea9d40a97ba18659db09b69e552feba636360df79d701748ea88935f19196e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt
Size 176B
SHA256 9c7456654bc3288427e09618b26d2a2f0a3f6198cfcc3c6509ef5e9627e416cc
MD5 b9d9d1ce99b0a3084bbf6e004798af94
SHA1 fb3412e24dcac8bd227f5a2a07bc5c9d31a9f8e7
SHA512 64a82dbb6bc52be40887b9db81ac9152711eba7bf33ba4e6a567f68de225980e52a8962f7f3fc83bcdeec5976d0ff470843b4e789a8d9b34ac54aa78246e95e3
TLSH
T175C080F36800845C0D1341A6D58F7116D93B97C0514D54385CC046C6117F5F764B5A59
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b91a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\e5b7980a04e4805673a74179633ecd675ba6a857\index.txt~RFe58b91a.TMP
Size 181B
SHA256 d5d8841b2ff40917327dff61079f2860e1245ebdecac34ecc6991c73adb1be80
MD5 3c894941512fefdc408af9076550e4b0
SHA1 25fc07cf3af3df0b4efa0869522faab6711f68cf
SHA512 f8dc2ff68a55aaf1b27a3cf76136d23f68c586903f6c1f117f8590ea6a5ea0b7d17f435c87cf49cf663e4cc2ad04e406a47381ce18005c22fea4de6e58feaba9
TLSH
T1EBC080F36510801C0E1341A7D45F7006D97B9FC0554D44385CC166C5203F5F7A4F5A1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 144B
SHA256 541d369c4c02d6322a52a892254a19fd276934e5cd3657000c3658de8d160336
MD5 0d577055389e2825d851bc156c75d5cf
SHA1 7dd80daaa0b2d209d1d79674dd36ea6febbdd936
SHA512 3f9355cb2142043381b7cd9fcc014fbebdfaaea3ee505b84ffa71cf02c8843eabab2c340568cf59c7f0fd93739a6f6733d6c15252c57cc3accd5661b51984a27
TLSH
T105C09261D60AA147D4280B7991A2E06C323A68EA471D425E98B8947AB4762345495686
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1119ffc2448e79db94ef6b11a28100047438dea3b616cf93767719b7ee32557d
MD5 7787641ba30296365705d480df5e5b71
SHA1 5d5827374eb098f166485a892365ad7c306d972e
SHA512 62e072d1b502b50ff71c109abd9384d307e9f970cca53a63e4c2ff6252a58a6c0ccdb303f3469728b6071a7ae8c84cfcdd3a01400848fb75e6762baad903fa88
TLSH
T107A00224C64D1143C4104671545AD25437614C12822D42238ED5E4B8ACD93595241349
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b8ac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58b8ac.TMP
Size 48B
SHA256 a1354a9b5ff082b1c53a8a992710b3e917330e267e8019a95c9723a514302958
MD5 806db51db3f709f3228e4a95de83ec53
SHA1 e35573e0006c32d21f860e828f5ec6e8eba7a074
SHA512 ce08681a495ab885d1ff1053084333ef73fcec64f276760ce2574b73495a62b21303903dd9451e85aaba8f3f5d939e7da58e03389e8ae382cf50f230770ae7b1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 9dfa36644af82f28ab363eb7d80569b761b6c65d245bf0ff6501fe8fdd212459
MD5 002ff5bc75e6cb7eb6ed0f9136f86826
SHA1 0c0d4d2b4ff7114fdb52d90dc06ec8a8ef46aeef
SHA512 6cd46fdb98efd30497677461fd9d9b546014c85b4b1b3b098bc2d432e6ee0831de0f223e1107c6012a97f9354818058d3f5aac7462dd8675fea915e2453117ee
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGH:05ppxnY753RNBvRJJdt7p5J9NpZ1
TLSH
T175B2695A703A0211397E2988B39696364F4235A37058E4BF7FB814A54F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 da63826e9478554491bec207e9e98d52b924dc6d9723daac13f621eea23f19e5
MD5 e58bfb9b59de9092d9517cbf70657b4c
SHA1 4b341b4df8c31b60f0df58e214708cb4baf4fd18
SHA512 b5853ae63602d0ef72c5a1cd304c67b76988d6111aa4caceac0c1aaddc2075cdfc2f27c9593aa3005bc59505ab55882f22bcf9d0c901dfde8854d62836102152
SSDEEP 384:nqiFiZcIcX3sNp8TUNTUlI42QckCrmdjphiftGNZO0saBkyrgIKdMsRnlY8jty/O:hFQs3kwgnkdtoGNElsgIKdhn28J
TLSH
T10BD25B72DC64DAB7ECEB5B8AA74A3643EEF0426385CC5AD8D9D85E5C00871DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 7dbe2eb241282b1389a6117a17a67a420d41d04e8fbedaf8f252c242009bd55d
MD5 6c9aa00cb2d1b8de0204406a4058271c
SHA1 7f27af747972c43e32d5405a23749d03744197ac
SHA512 f8d0d492c055770a47c1924e4a465f1036f4fcca853e5638be28dd4853b83331e4e4c127c60bb303c03ac25c3d25b376dfc46e4fb240d3ca5eef877a57914f68
SSDEEP 384:npDiF9CcmyWCs3sNp8TUNTUlI4fQckCr7djphiftGNZO0saBkyrUIKdAjty/7Igi:puFccps3kwgWkItoGNElsUIKdAf
TLSH
T1FEB23A36E864CEB7ECE75B99A74A3A43DEF04223898C5AD4C9D91E1C00D71DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 68695b05a5a27910188e117d173976da1efa50b74d77748e6d7fdadf3f4ff8ed
MD5 aa246c9d112fed4131b7b7c5869ff324
SHA1 680d3bbc373b7f3c85408778350554ddc180bbdc
SHA512 dde947acd631c8049378d99178fbccec2ed48fc017a8fb75a4aa6e74e385286aade88dab3850b5bf1f43ba043d1d0a8b55145035c0d5f147f0c24015ef482ed1
SSDEEP 384:npDiFiZcIcX3sNp8TUNTUlI42QckCr7djphiftGNZO0saBkyrUIKdMsRnlY8jty2:puFQs3kwgnkItoGNElsUIKdhn28J
TLSH
T14ED25B72DC64DAB7ECEB5B8AA74A3643EEF0426385CC5AD4D9D85E5C00871DD430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d72c9fff57ade3d58547e1a0566614d3c35bbff493dacce6b50b0400946d2456
MD5 2da61235ddb12c69485898c79f95f72f
SHA1 33887101d33ae948b228ede74b19651cbb0c246a
SHA512 0ca4a8489acc6801192192082d1685cc7b8d689e4e62db42516a2cbadd11d74e272bb0dcf21ed2acbf702b616f5b4f774ab74dcbd7d6914a58ebd038f47c403a
SSDEEP 384:npziF9CcmyWCs3sNx8TUNTUlIm2QckCr9lEKphiftGNZO0saDISp6e4KV8p054HH:peFccps38wgbkU2koGNEsIdI8p0gH
TLSH
T19AB25D36EC68CEB7ECE74F99B74A7A07DEE01227859C5AD4CAD81E1D00971DC530B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d3e08cd1930cafafd8ff0186935c7459f405c9b8d1c2f7f6735060326f30d9de
MD5 d8c9336c74dc3fc09a7b2f92ae9e8dcf
SHA1 5a27b2d6d60ca1abbb97ae0ec642e45ab6b6b644
SHA512 b87303e42ab01d42321770808c99d99b8216873970dd684743485b9010146a3d92d5caf9478570a309a44d80a9bf1a1cbed694cc6c3ef5616e0ca2560e55b285
SSDEEP 384:n/iFiZcI7X3sNp8TUNTUlI42TOckCr1pfphiftGNZO0saBkyraIKdMsRnlY8jty2:KFQ73kwgNkmRoGNElsaIKdhn28J
TLSH
T184D24B72DCA4DA77ECE75B8AA74A3643EEF0422385DC9AD8D9D85E5C00871DD430BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 29b03d8655f3271725ef6cb596b345d4d2d4dd04cfffc7612c205c08c37524cf
MD5 a229ff48f8dac0097808356662b00ffd
SHA1 28eadab16a84a70d6b5d4abfe16908981b78a23f
SHA512 4dd5e7ad24fa59251b08476b8e76afdf3389636c2961a5735d378441e3b898edb860b983df106220acf3b1ff26742153e3f9ba43069850edacdb009c030d50e7
SSDEEP 384:npviF9CcmyWCs3sN18TUNTUlIm2QckCr9skQphiftGNZO0saBkyrwIKde4KV8p0e:p6Fccps30wgbkU5WoGNElswIKdI8p0gH
TLSH
T187C25B36EC58CEB7ECD74B99A74A3A03DEE04227C68C9AE4CAD91E5D00D71DD530B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 934c69cb36b0acf1b120a8852ee7985e24878892cebd33404200118baf2c6ca6
MD5 957c0d52644bf15c8d768f17bf40cf18
SHA1 4bc49c6a0893acfc96a30d9424eb4ac0480cdb29
SHA512 bbcea9085e75141922efca238f56f3e08f08ba5e0b6ef08151fef86d19e5fdb55ede21488c1960ecae7f437071f42b0bf4b85695648cf63d62b164c1a2c1006c
TLSH
T112E00102D70000AFC524073041832B302BE3D0B802B2130B4A6045682C633146E24B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59622b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59622b.TMP
Size 392B
SHA256 c4275a1757883d085322e43e079e946fd2ac7e462c38e14c5906f70420b1349a
MD5 20b0bbf72b3388acc5d6cf70edaf2d89
SHA1 54657c8362a65fd13be4550d15bd2138891da1c5
SHA512 3cbb9b5837608658e56c1fb09caf9d244b1c5ce82d21e458dd09a191017924704d08383e8bcd165955f54294026f7e1b505c04b00d5319ecb567fdbdd083e16e
TLSH
T172E00202D70000EAC520073041432B201BD3D0B4017113074B6045583C233146E20B80
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5e9590d8b2f476688167162cbaf97b0ab12bdde3ede7e8ab80d9289efc82a092
MD5 9776822833f4abc33f81ec22802a8a21
SHA1 5128a267a3f2193ba3d878d0dff91d6c233045cb
SHA512 0945018f2bd87bc6f65ceb7bf04121d8f5dc63ad29defbf593b52beeaad921e1d8214d7619dd0308aa88e9710a1547a41a7ea6b4c79bc84449adb0081914ceaa
TLSH
T141410359A6F91148B3B76E5AABF7A96D447FB9672F0A806E00010D4E0A62A01C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

memory/5396-399-0x000001A3DB700000-0x000001A3DC700000-memory.dmp

Download