c48e28e5bb984613ab6efe32dd42aba998b212069e6f4d5487a80afd05d968c1

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fission_receive.html
Size 5KB
Sample260814-12cslacc68
SHA256 c48e28e5bb984613ab6efe32dd42aba998b212069e6f4d5487a80afd05d968c1
MD5 0bea548d83ef718b121b50447e8ad0fe
SHA1 4fa4c95f1e92c60976e8b80f3a1af25cc9eca388
SHA512 33480ed55328e16c5efc2b4e1ebe8e280986ea64057a0b52f1a3b9e146fd6afb7503e9b42cadffd268bce2005ff568ee65fdb8cae7d2ddf977726627bf4c93a8
SSDEEP 48:0EOk0/5+EuDRAVK5V2pdN+oelDddTEiH8A1b2gPkPS4CtOA7b5ldCIolG7aAI6y:z70/5yUKX2XN85ddQi1TMsz7b5Ksy
TLSH
T15FB194868D2ECD4A0D968E3A83FAD10E3E58C577ED60DCE4F4A788CC4AD17D81716A4C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3488	msedge.exe

Checks SCSI registry key(s) 3 TTPs 22 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	ShellHost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID	ShellHost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	ShellHost.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312189124962686"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{DECD2CF2-62E3-415F-9833-821A70E531EB}	ShellHost.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{154BA873-FEF5-469B-B36F-94CE7CAB1A73}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{C8E180E2-09FA-4A6D-A0B5-A50FDB79D911}	ShellHost.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe

Suspicious behavior: LoadsDriver 18 IoCs

pid	Process
4	Process not Found
4	Process not Found
816	Process not Found
816	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
816	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of AdjustPrivilegeToken 16 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4464	ShellHost.exe
Token: SeCreatePagefilePrivilege	4464	ShellHost.exe
Token: SeShutdownPrivilege	4464	ShellHost.exe
Token: SeCreatePagefilePrivilege	4464	ShellHost.exe
Token: SeShutdownPrivilege	4464	ShellHost.exe
Token: SeCreatePagefilePrivilege	4464	ShellHost.exe
Token: SeShutdownPrivilege	4464	ShellHost.exe
Token: SeCreatePagefilePrivilege	4464	ShellHost.exe
Token: SeShutdownPrivilege	1676	ShellHost.exe
Token: SeCreatePagefilePrivilege	1676	ShellHost.exe
Token: SeShutdownPrivilege	1676	ShellHost.exe
Token: SeCreatePagefilePrivilege	1676	ShellHost.exe
Token: SeShutdownPrivilege	1676	ShellHost.exe
Token: SeCreatePagefilePrivilege	1676	ShellHost.exe
Token: SeShutdownPrivilege	1676	ShellHost.exe
Token: SeCreatePagefilePrivilege	1676	ShellHost.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
4464	ShellHost.exe
1676	ShellHost.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe
1256	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
4464	ShellHost.exe
1676	ShellHost.exe
3968	ShellHost.exe
2984	SystemSettingsAdminFlows.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1196	1256	msedge.exe	88
PID 1256 wrote to memory of 4076	1256	msedge.exe	90
PID 1256 wrote to memory of 3488	1256	msedge.exe	91
PID 1256 wrote to memory of 4076	1256	msedge.exe	90
PID 1256 wrote to memory of 4076	1256	msedge.exe	90
PID 1256 wrote to memory of 5552	1256	msedge.exe	92
PID 1256 wrote to memory of 5552	1256	msedge.exe	92
PID 1256 wrote to memory of 1248	1256	msedge.exe	94
PID 1256 wrote to memory of 1248	1256	msedge.exe	94
PID 1256 wrote to memory of 4988	1256	msedge.exe	95
PID 1256 wrote to memory of 1248	1256	msedge.exe	94
PID 1256 wrote to memory of 4988	1256	msedge.exe	95
PID 1256 wrote to memory of 4988	1256	msedge.exe	95
PID 1256 wrote to memory of 2908	1256	msedge.exe	96
PID 1256 wrote to memory of 2908	1256	msedge.exe	96
PID 1256 wrote to memory of 2908	1256	msedge.exe	96
PID 1256 wrote to memory of 1244	1256	msedge.exe	97
PID 1256 wrote to memory of 1244	1256	msedge.exe	97
PID 1256 wrote to memory of 1244	1256	msedge.exe	97
PID 1256 wrote to memory of 5640	1256	msedge.exe	100
PID 1256 wrote to memory of 4940	1256	msedge.exe	99
PID 1256 wrote to memory of 5640	1256	msedge.exe	100
PID 1256 wrote to memory of 4940	1256	msedge.exe	99
PID 1256 wrote to memory of 2880	1256	msedge.exe	102
PID 1256 wrote to memory of 3268	1256	msedge.exe	106
PID 1256 wrote to memory of 1768	1256	msedge.exe	107
PID 1256 wrote to memory of 3196	1256	msedge.exe	108
PID 1256 wrote to memory of 2736	1256	msedge.exe	109
PID 1256 wrote to memory of 2736	1256	msedge.exe	109
PID 1256 wrote to memory of 2736	1256	msedge.exe	109
PID 1256 wrote to memory of 4816	1256	msedge.exe	110
PID 1256 wrote to memory of 4816	1256	msedge.exe	110
PID 1256 wrote to memory of 5112	1256	msedge.exe	112
PID 1256 wrote to memory of 5112	1256	msedge.exe	112
PID 1256 wrote to memory of 5112	1256	msedge.exe	112
PID 1256 wrote to memory of 5056	1256	msedge.exe	113
PID 1256 wrote to memory of 5056	1256	msedge.exe	113
PID 1256 wrote to memory of 5056	1256	msedge.exe	113
PID 1256 wrote to memory of 2016	1256	msedge.exe	114
PID 1256 wrote to memory of 2016	1256	msedge.exe	114
PID 1256 wrote to memory of 2016	1256	msedge.exe	114
PID 1256 wrote to memory of 6088	1256	msedge.exe	115
PID 1256 wrote to memory of 6088	1256	msedge.exe	115
PID 1256 wrote to memory of 6088	1256	msedge.exe	115
PID 1256 wrote to memory of 5968	1256	msedge.exe	116
PID 1256 wrote to memory of 5968	1256	msedge.exe	116
PID 1256 wrote to memory of 5968	1256	msedge.exe	116
PID 1256 wrote to memory of 2132	1256	msedge.exe	117
PID 1256 wrote to memory of 2132	1256	msedge.exe	117
PID 1256 wrote to memory of 2132	1256	msedge.exe	117
PID 1256 wrote to memory of 4664	1256	msedge.exe	118
PID 1256 wrote to memory of 4664	1256	msedge.exe	118
PID 1256 wrote to memory of 4664	1256	msedge.exe	118
PID 1256 wrote to memory of 5548	1256	msedge.exe	119
PID 1256 wrote to memory of 5548	1256	msedge.exe	119
PID 1256 wrote to memory of 5548	1256	msedge.exe	119
PID 1256 wrote to memory of 5752	1256	msedge.exe	120
PID 1256 wrote to memory of 5752	1256	msedge.exe	120
PID 1256 wrote to memory of 5752	1256	msedge.exe	120
PID 1256 wrote to memory of 2780	1256	msedge.exe	121
PID 1256 wrote to memory of 2780	1256	msedge.exe	121
PID 1256 wrote to memory of 2780	1256	msedge.exe	121
PID 1256 wrote to memory of 4456	1256	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fission_receive.html
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x268,0x26c,0x270,0x264,0x328,0x7ffd0940c188,0x7ffd0940c194,0x7ffd0940c1a0
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,10145244692319284858,3483481066932934620,262144 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:2
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1776179126194516455,2854884395517498376,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2188,i,7224897415240531403,619875758344542247,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=3156 /prefetch:13
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,16639179653518203269,16318085643234162744,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,11256746539391592612,5953323936890506147,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,15755525187001263384,6652960057523265098,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,2339998083140168645,6176858428296262632,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:9
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,10390989190527288150,12554951460284108925,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,8042821686153225998,12792514612844441269,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,9788789160518859256,9727534495991134569,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,9788789160518859256,9727534495991134569,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,8947148804038477514,6652860780585332450,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,3209941252570538310,3016026611825915788,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:14
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,9776692370418743666,14044953541181245043,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2068,i,13979707619069202401,991696686848893629,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,4153929629502741699,1637064057223750318,524288 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6540,i,6249363833507768961,16509636104714156557,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3652,i,7512942195002950701,18328239363466448895,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5044,i,15853457312000249681,8510217627229618811,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5136,i,14223791689333514783,6415727162389744950,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4348,i,8160203422398475193,8337890672244777053,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6904,i,16903495645145664827,3314656684063562086,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6712,i,38360887260076715,8965827894164429791,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6112,i,16877231193018883158,2504341283295897529,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6796,i,3409040100138128611,3965236332497284623,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7120,i,16076151664831876882,15044185000453910244,2097152 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,9744700952789092884,15210442330695075750,262144 --field-trial-handle=2512,i,10399063494830442564,9823844176303754962,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2304

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:5840

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004F0 0x00000000000004F8
1⤵
PID:3988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2948

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4464

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:3968

C:\Windows\system32\SystemSettingsAdminFlows.exe
"C:\Windows\system32\SystemSettingsAdminFlows.exe" RenamePC
1⤵
- Suspicious use of SetWindowsHookEx
PID:2984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00003d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003d
Size 408KB
SHA256 c4cab840ca46892e7ce99ab3b91b7dd3d27d8d8f7566d8470c66fe13c370bb9d
MD5 1fc169aa115a19af8ef2a5f9fb4b33c6
SHA1 71a8a7828f1a08398ad8bc128e6f2e1b544c83a2
SHA512 2c1623e6a0f3fc9ab277d34e5ce2a224950059c0945de29eff3f81e14bf2861cf560869bb0889bf86efad7ee8fc9118ff73cff34d32825ab9b1cd8b8b4bcdde6
SSDEEP 12288:yQYsnxsG4GdF1ahaTsigfKXkbjwSYPtQw:bxs6IaPgkkYhOw
TLSH
T19A94237DA27D25D743BE20D9138CEA43BF2BE0964320ACF9185ED7858E5DB0824A7F44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000050

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000050
Size 16KB
SHA256 790f401bb46296eab6dfc19654760bbb4d5381ca4e4105b3d2e273421d893e72
MD5 c87389488b3f8f81123b93a11e4d8050
SHA1 959fe3637259f06462183e854d1cb0cb9eb8cac7
SHA512 b786baae17a4391fb8691ea2ef99166f78c3eb53bc9c0338c5689f7756ab3cf8f07e2628571125bfffa058c88fba181032388e80384b622d534eb8f909ff6217
SSDEEP 384:hBY2AZuTIsgFL7orwn2qNVzlAgceYlZRlovjW0Of59nKUnpE5:hBlTIfF6AtVzl+RmrWPFtpE5
TLSH
T13672D028036DAF6AD89D383D57D8B026969FC4778CFF168490DF8C6C6044F56E07589E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 37KB
SHA256 a1b8fd310b65008ed8ed8dacab2ed69addd619511f51671ecfe5bbd082489f44
MD5 cf2ed8ab0f27489024edf36f95abb610
SHA1 a494bf7443bb487979c4e17bef96842403d65b3f
SHA512 da45ec536c2ac9e5372b880af9b27a8290e8777da1664f6b3a29b2613e4da4ba1a25cd318872857039c68ca3b6c0c08761360d9953e30d094cbcf646006a8969
SSDEEP 768:RhjoPXJAUqrFJj/iD4iN/WJat2hICxcVL3G7cHI09NlSklcSoH:cPJNqf/iN/oaOclGYHIINlSD5
TLSH
T16A03E13542F532A6F80F16967F315A1B2F726B5F2EF84E43C29B48A1D23730994220F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 16KB
SHA256 ce7e72fe9f25cf5a8246758e13b788c4971ccbf9f6229bee6eac639f3c9b2175
MD5 a93b3b5f92d0ee4ccc9b63ebe07af630
SHA1 324e6719f3011c43e4a5cd43f7aec31d593ea398
SHA512 45fb8d8dfa3fe6611857b49ebcf3f99e9caf3dedbd9a79d503a8282605c76efbace6eb39d89d275eb3ad897c219aae46b5e35574433ae8dd56854d0d82bd7d36
SSDEEP 384:ttUUmb+tgVcrjq3xzeC1iVE4zy4L+zoEVRfPKmsn9TDLB4R/dEZ:L3tgR3xifE4z7L+hVxvs9TDLugZ
TLSH
T1AC72D0CE92550209999DEE6C7F2A6F1F5CD381A1ECE37336230BD0BEE025C9055F4886
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 64KB
SHA256 49c44a97498af5cdc2abaa89ab61f43895326914e942068e4bcdd946627ea065
MD5 54c07aff64efbfa7cc409c2c39beee1f
SHA1 484508546a33fc90e6b97f6240601ecc135c362e
SHA512 39c0bbe4cddd7eb1b17c6690b580a650640a1aed61ab004092af6cc870286c13dbdd59df763b724b7b022d6d071a18f02cfa751710d38954eaa1eada5b9a1abb
SSDEEP 1536:xB3Y4uo7hjiARYSjFTG/EMsLZ+XvOqRTCQCQF:LAo7hjiGY2FTUEHZpqlCJY
TLSH
T16D530254E3EBCBC3CA9E0A554485D8309A87A8F287851EDFDA3CF4C74697E1C4E27509
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d57993f76d14aae_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\0d57993f76d14aae_0
Size 1KB
SHA256 ed23a608fd6fe268ee50c53368b173ab87a85683042a43fb52712ecaa303b759
MD5 776343fe1e0885ee49434fe7b4af9696
SHA1 b8637a004efe93a9c6430209be317e7c171f780b
SHA512 3915710c8770a217abc9e42528ada3a6741cee3ed2cc4fa60a5740716e926983a8ee32cdf7d4f3131eecbc2124b2156de1605f05fdece4ad3679a1a83501180e
TLSH
T1334110E2BB90ED15DF1A62FA49D68B61A312C1545FE4C14390D9BB782C6A3E70C0689F
MD5 SHA1 SHA512 TLSH

Submit Download

2f4680e8f8f8a14f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\2f4680e8f8f8a14f_0
Size 15KB
SHA256 5b2ac6f9d73c9ec74918a1585de70544bd67fb283f0e3637840236206e85f993
MD5 065e9364c5a9872b70363009ba8fb353
SHA1 4d51d58aac4a0d289d005f520f49eacf09ac774d
SHA512 05b66642fb1369da37a77ec0e5ff861c5a194c2212e6b57bfbc753ee96835f8caf5f65354e6d8a6547a8f4acccb8915b97a8724b545fb5439d4e4d525a930f89
SSDEEP 384:C38YV94MzoavU7DAA2IQwNBjg4Nf+Ex8/nAFVSpU+8o:sL3JoXL4wzE4N98/AFVSpU8
TLSH
T11C72D6D16B81EE1BCB4667FD1261CDA33A3049087F93D35322B0A7390C5A6D65E49C9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39a5e623cac641bd_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\39a5e623cac641bd_0
Size 9KB
SHA256 3ce04bbee0ead4e7607a4ae4a1997b77ccecb7c7345a3a1792b17322cdcb31fb
MD5 32f679887682dc99346feb3b9f5f3230
SHA1 e002514ff5af77d08088b0629461b13f32348028
SHA512 3aa0bcfa4596b2c037ae58007c75b214944b8e1636b7403e1772f80b3a11418ad044f28aca09e75f40c9c9577541031b5704adfe699cebb97b57685b451c4b40
SSDEEP 192:g7gzaFC4mAOoGSLgGTg8rtZ8KF2talerIoFYi/:ggao4mAOoGSMG7rt2KWIoN
TLSH
T1F1122E92A7809E80CAB627F102508FA6E7358059BEC3DB2360F8D37A2D5D4D64E54C8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e98e0aac7734b25_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\3e98e0aac7734b25_0
Size 9KB
SHA256 e73ad581f1b6dad4bcd9d8538cdbabb29fed676c7d9c2b8856415e175ac92db1
MD5 29fd8ead19af264c4f5ea29a01ae0aa8
SHA1 a486a857a11783b8063815198166c55e37b64262
SHA512 baf280dd78600d3dbc7fc454795551ceac7b1b707a92609e52e4f8ecb34fd4086e7c701cedb047c0fafe6b76210056d8f06950d24e3de4b7598161db1b8696c6
SSDEEP 96:KHJHlzBKoJTvT1qL5vsuo/2lemHphjdvWrW3h1xbNxv4fKGQ06Ekj+AG+mHT+Vs:aKgTJqhsR/ojHZvWrWBnkKhl+vSVs
TLSH
T1EF126359BB90ED18CBABA7F452C2CAE7B77040506EA3961370E4773B1E4E6C01E549CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61a0b4d20ae0e222_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\61a0b4d20ae0e222_0
Size 4KB
SHA256 ad4d518d24e8851a2c119523ced0487447f100ab274bdab8b4a0a09c3aa917d6
MD5 71244979865d3ae971f7f076028e6374
SHA1 6f4e47af2eac17e6794c711e3ef9fccd171dd544
SHA512 122264c6ba5ce20b577459c0fd51896b5f1c3970504ab8aa412efa654fdbf7f6a725ae3c880780327ba1dc48d75b3446e6a1fcda1e40281e2323458855298aa1
SSDEEP 96:jQkKHDejlW+BicYedOmiNo9tBka+ZW30JegCBj:jlsylIc1/+Zs0Sj
TLSH
T1BE91DB519A849E4CCBB622F046625F62D72A40DC6FDA972390E9F33B0D196C08E43C8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a6268d420b60dbf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\7a6268d420b60dbf_0
Size 1006B
SHA256 cae637a097b67358ba768e01ff87a28cde90cfbb8bb4b65c0f9ba86b68b9e572
MD5 5fb9410ec9585eb2edb66942f27b0711
SHA1 b5aeb46097bccf9bc6dfafdd8a5d00ab7f51a619
SHA512 401982f4272cf2afba33160b2dc781050f777ff04d3a65b4f85d4152e0e89b30f6b8d8752ddcfdd55bf701c4ee83f77c27996b92a73af2ee922305d18f69e19b
TLSH
T115111C6BAF5E1901CF3D42F8ACE9DA76D22351088F83C38B1164037A2C281F69B6A442
MD5 SHA1 SHA512 TLSH

Submit Download

92aa708729096273_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\92aa708729096273_0
Size 1KB
SHA256 8a89011b10f9458013a482aaf1a3f61c3ddadef740524407c299e2113c6ebbdf
MD5 fd3c5b8bd5b7c7e6938d1a1de6c1deea
SHA1 dc1d841988eb76b6f1db4aea3f192440674e886d
SHA512 0c2b95c3fb94bb463a262fbe0c651754237feb71ee22da838cf893f2b70c90f6e61707ef096e96ff9fb89daf0220bfd841fa1499cf36e912b8bfd6da91ffc219
TLSH
T153317193CB856961CC7892F082FA4A69D733C3286C839347D034607B3D0B2C11FA648D
MD5 SHA1 SHA512 TLSH

Submit Download

9c9c735c26decce3_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\9c9c735c26decce3_0
Size 1KB
SHA256 4b25ca75d2727ca24a983f65a9392f52ebb7e80a0a0a241bca55e5d80bf2b6e0
MD5 95ecaae32d3b189dce131771a80fb53f
SHA1 a61316fac2b8d1bf2e6ef6f2830aae6f1a68a096
SHA512 62bd7d85e1617d46dac92d9c2f5050279d9bec011613f657f00320a63a45c4b675d233b4cf1dfe884b27168754dfe10aed83367c84afa5a84e438db3a99cce8c
TLSH
T17F319492AFD17838DD5296F748A48B76A33AC00C2CE7824320A596311D092FB0DC69ED
MD5 SHA1 SHA512 TLSH

Submit Download

d79e0a2891fc014a_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\d79e0a2891fc014a_0
Size 262B
SHA256 d6aaa07722aac36321b6daa58e1421741c88ce190b48a41b5d598f0c4edee653
MD5 fcf21acc56921fe6f182397e6b5eea21
SHA1 f4bcda244fb23601fbb11f653d1c302e5f097855
SHA512 814088070914cd1c6bc12786a1f41b4071b03a7f04ceebc25b31843703966bcdffef434049b13dc864d363fde8b815e58e97207294d6890315ac600df9f13160
TLSH
T14DD0A777F4962843D94A90F1CEBDFA1BDA1244B44E6CC2DF0649927627360F3D2972A8
MD5 SHA1 SHA512 TLSH

Submit Download

e93bf8a6b9ea2225_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e93bf8a6b9ea2225_0
Size 3KB
SHA256 1eff710dae0b100bac89e4839043731388d267c28f9a29f4fc5a343c5591c59b
MD5 8c59e640a0f3f4cf4409dd14b2d6c8cd
SHA1 d49345a8bc26544ce0bdf3fac8877bf2e1d8d279
SHA512 9b3cf82f30b09d3f880766ea105ab5d5efb8a48dc0d4dcb940dd01c79be49845e86e39708e4cd7f437716f142974d7c9b21cd238b53c69ddd5863537198fa4e9
TLSH
T11B51F8934B22747FDDB816F804C6F6D6977606089FC7816F40227278182D3E29BAE911
MD5 SHA1 SHA512 TLSH

Submit Download

e9c7e700cc3e33cf_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\e9c7e700cc3e33cf_0
Size 262B
SHA256 7f7d506cb956396a50eb0dda59525581adcdcb1d5cf2e6831413bada369c7a8a
MD5 2e59b372e01ffeab123b3d44820bb003
SHA1 4edbc31ad46467adc5fa67c085fd60badcc0ef08
SHA512 7f17feb92927299762ad9660f28d6012ff734e9b9724957c92641e327d8991d38db3f85ed98bc814d18f0d5169af91d79480112adb68b2fa8936be55d25adc14
TLSH
T1D7D02B5764167400C518A0F0A4F96B0FCB22A9D905C8C2960452304357219526533429
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 ce970c072e4f4fbdb4c6d3b400b1989d65d9ad5acf49232e4ddfbddfdc801521
MD5 a0172eda83db327aa8b6e1a7422027db
SHA1 90a2aff458fd5090cf2670b5adf312c0adf65543
SHA512 129e9044508b3933cf84677bd4627c12066c6120a7b0f03817b57bcc77dad8c209885fb4e4029312a6e64821e10c620fa2e0c3e48c334b9c08c8aa9778ac2a80
TLSH
T100316EB08F342AFFDBAF45B657E24A9C3371885B37072E512364AEB48A89377201001E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 b67ab23eb02b5e9aadd386847f4dc4baedb0dab4483dbec32c18bba6c6849340
MD5 3853d174ba2dbe653b0f2b6258831fbe
SHA1 bd3c5c9b8ba9118535833b6b159254782e0e3702
SHA512 59257e1a2d1bd6bb1613443a5b7bcecdd62e9407674f1ebfca7cc63fb89ca7ebf8dae715e389e772f3c231778716c2beddf2e11edaa694f2668ab962d0291fd1
SSDEEP 96:tZf5xaUePMwHsmaKVOtMZFQWLbCTshgKDKV9SGozmkMhVX6+p6:vwHsmpVOAQcCmsgDmk42
TLSH
T143D1EE745E9360BFFF4F58F15EDB0858327AA16677C71E2203C69C7066073A71198A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e3a379209dfd0b0c633ec9666b2a1420c08551e0ddaa9224b416bb318d07ea8f
MD5 eb164d6ea38dec462e76e300ff9ea05e
SHA1 c9d8f1daa9c619f04348c52dbc6d4a32a1cf146d
SHA512 1bd9cefa704dc18b6647cd009dfc9557a10c546b60b3b6bcfce3306fd991ef14aa82f6b6a1c3507c89bd0afb85bd232f09f83a97df887c934396bc11ee4c32eb
TLSH
T127418CF743F4867E9A0196F0AA186E2FCE1C0412435C7CA6C9E06E1793F3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 485c97a51f840a9aa3ff35f96c173e0fdef1cfd24bdccc54dd081cac29c360a9
MD5 70b13852734ec4f20c588dd06b94f984
SHA1 1e01e2059144c24edf7237ea7dc4b7bfc602fe7d
SHA512 341590564d09d5b12c1bb8cf6b0f7847e125f76b0d0ba3e7807fad9016924d9f25174281f0dc8153623d4985ded5daf147f5c6cb999822997c64514dd73da436
SSDEEP 192:DmJ4u6X6yEVaaiZT1ykjc752q3tOuEDt4IiQ3x:DmJ4u6X6yEVaaiZT1ykjc752q3tOuEDb
TLSH
T14DD17BF783E5826DE91162F09A186F1BCE1C0456436C3C5AC9E4AF1B93F2471E191B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 f1aa31818dafdb93701f57271bde83888da57b7ea359c82a9f32460ddfa6a8fa
MD5 6b7ea03113eb0728f23db93366111cfd
SHA1 9d82f3d1dd02f460860f350e19507b9a4cfe0b66
SHA512 c733b18df2158767ceb0347a622906efd284336038d107d06f43e4ae06fe79ee4320c22635fe5fda01373badaa62024cddad4308452c732428b1d762e30243bc
TLSH
T1A2D022A31200F0B5B56E3EA6806EFCCECB37006408029DE412D068980A7646C0A0B182
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bfc5c3042f72cbb1d24152b4c9b6049dfcd7c5f27d6ab3ebefad318c5467a27a
MD5 f1eb231669057f4532d113028a7b0966
SHA1 f869ef608db49383dbe55a7760ed7c25b3351d0d
SHA512 b4a010410051ca2e67918654d6a360cf86ef3175a5e6270eb247b264c6682545c8af6f1b8b4720301fb8f8dd1bc232fa6da01e37b472cef660b13e1e6c1b6025
TLSH
T1EDD022231200B0B5B5AE3ED9407EFECECB3700244C02DDE912E058D80A764BC0A4B082
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 86d526c09d4fb540c0c20e4a16b153aa56306554a446c4a05407a9c5544c10b7
MD5 183589a07600245f20a477b27da60977
SHA1 2e92d088bbf72c8f262249c912158013221b68e3
SHA512 b5a43370ba7a4fcb351a840515f5f6534867a6de71273285f4f70f8ee5e2ff76b504c1677e7e771be5d364ab16625b223c26878c90f41aca32560a8d336fc226
SSDEEP 192:sxR2RENb0/fcstPwGWzoA8p4l/g6+WNIYovT8YSGpIgDfJ:sxR2S0/fcstPpLg/5IIYF
TLSH
T1C142A6166968A93B9CC7E21DBB55BF53E3F9503361D42E48AAFC871C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 7a52a9c812b04273f1a064d6936d66c82ccee7373566f03e547285bb4035602b
MD5 9255d7f9ccb46e7f7ed611a27f80c0d7
SHA1 2b3d7d15016136fe4bd162099fb99401ec79f9de
SHA512 ab458b2d1c4f3be4f42517cd35caf82444faa3ddc88f73ba73c36ed4c6223875371fed2fd034d58b0ceeeb7f0e2fa146468e8ca2b0790d93ba909ca40819519f
SSDEEP 384:sxRoRm10/fcstPpH+fm90/VmqiNUZEYJVTr:s8Rm10/fdPpe//4aE8Tr
TLSH
T13082D8566924997B8CD7E269BD35BF52D3F9103398901E4DABFCCA0C04EB6ED2207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f3e5bf3ed613af6d090db6cd666bfc3f07d793c931e87cc77006b7a85f6863d6
MD5 fceed593951a95ac71a0b62cfe918e02
SHA1 1c30b2a4a3742b33a59b78aae8b1756b3e5fb89d
SHA512 661ee1a224e6a7acfccc9cbb5437919ce71c09129a8c134c8d25a272759cb500242a09e12d8b93dad1e1124d2b58b68454b7fd96bc83c2d7f6fb38c58ac9a734
SSDEEP 192:sxRVRENb0/fcsJVwG2zoA8p4l/g6+WNIYo5L8YSGpIgIJ:sxRVS0/fcsJVprg/5I2Ys
TLSH
T1563296166A68A93B8CC7E21DBB65BF53E6F9503361D42E48BAFC861C04E76DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 800c3f367d4153b8acc0d50a8ce22181bbdc1b81e65525906195725fa9c5b852
MD5 267666fcff9d8ff99e0c443738818ec5
SHA1 0e3c66f3893483ebb3b4c052619fd0a2ec3338f9
SHA512 ddf9e327c2a1d037956ff37ed5caa6cd894b9b3f26238ee2d2e0e869e404b8ca064a46373e66781b206fd510130a09f6244ff0cca7d7846a084d44c3f57f3593
SSDEEP 192:sxR2RENb0/fcstVwG2zoA8p4l/g6+WNIYo5L8YSGpIgD5J:sxR2S0/fcstVprg/5I2YH
TLSH
T15E3296166968A93B4CC7E21DBB65BF53E3F9503261D42E48AAFC861C04EB6DD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 0704bf82feb48b4dfd26a958b545706a81074e69e8f8898f13c58703df908edf
MD5 22ae036d5545abdd675d689dda6a69bc
SHA1 c061c8f81b67903861d3c2fcc79f4ff989312a27
SHA512 c570824ed4ed38cacd5eadded55ebebf469cd48019451fac669ff8648376f398ab53cd752e19f0a08f97c1fa98980de9298011d05ec4ac71efee633523952faf
SSDEEP 384:sxRoim10/fcstPpHzmzQ0/VmqiNV/RYJVTr:s8im10/fdPp+/43R8Tr
TLSH
T11F72F9566924997B8CC7E269BD75BF52D7F9103398901E4DABFCC60C04EB6ED2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 3c400a1a6bcef508bfbc72a4cc65c35835dfa6937d7804e8437c55e6c09cdf33
MD5 c6e165e1cae8dfd67cd1e752ad9eb913
SHA1 8f10a0932109716d6e42c2bef82c7e1ba637f9ae
SHA512 b06c27a4fa9fdcd2b55444764908d1adb89e6095f4a644bc86e80f7280ac4850270f01f440e07fb00f97e0cf2e3b3e8638e047fbd7959663f26ec39e672e3ba9
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXMro98T:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vj
TLSH
T109B2EB2B640DCBBE5F800A9DDC196FDB6D9802C79B588D4047FE994C03C7BEA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8020bdca-6387-4f59-88de-e72d6edc8556\index-dir\the-real-index
Size 3KB
SHA256 716ac3577b296eb192f45a11e34f518f2cce75423a2e29ed3bfbde5330786086
MD5 fa1c85d0f27f1f1a403d6b29e3c6fff8
SHA1 4d61dcc0667476335183b7002622f56be4ae6dd3
SHA512 0d6b60a19bf0dcdfad92967705910305091604fc9f83a25679d0c13c5373a5820efe0633ed6592df5a4fecd278cde0cc1011eb08dd994c66a99b5595e7092b53
TLSH
T186511A8E4C491DADCE6E10725CFA188133763DDEA785CD1756ADA230BCC333E1D55219
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ba852.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8020bdca-6387-4f59-88de-e72d6edc8556\index-dir\the-real-index~RFe5ba852.TMP
Size 48B
SHA256 d4167259671ac71e53be3937d515e6b4e4ad31bb399ed6fc47579c49f55bdce5
MD5 a72e781292fe68c9605b3fb87fa27cfb
SHA1 b6b3eab8ec5862eb0a8923e4f9c77b825d12c948
SHA512 5abb0bb934cba2fea4ae7897f3ed3507f81f13e6b05d321b38037acdf102c0f30c37192699532bf693cd74659625f2b817c16059b3f98e4f3260d53f07a1ef69
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 1ca94173c3a2042148ce1dbd96c6ee35db0ceebcc0edda1929c37447c5dacbbf
MD5 9f496afc0b83de28cfa06fb4a2e757ce
SHA1 087d6c0dc8531d180533bd441ea3e06fd8d104b4
SHA512 0a81230997749549bb7793d33b3316fde55b2448c268e42c869b109ff8eda14c153104e82acce5dde1b9c3a4f5f2f8aa6eb0fcceae265f8f7330aca7c28a237a
TLSH
T10DA0022512C00203C00211B236DA416352914955B340170D81900659C992577674300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 ba605a2c4cc0f2cb4475dcb10f1a658fa50076242b094727d3549ef4cc52fdfa
MD5 a7a3e80414cb0b8fc60350107b4c2453
SHA1 91a52d230598926a29806944f2503ae5c3ec94eb
SHA512 3b696c320c48c11fe8e02f0f198fd580aa70d50d231758543893c2ee9752668760677d91beaf067f94672e7ec407ca2e5d8c98d8ad8e2d82f12f40b1fc8d8b08
TLSH
T18BA0025402C10401C01B16B425D741A32B1089325362130562D24C5ECC50E9DC94201C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b0bb4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index~RFe5b0bb4.TMP
Size 72B
SHA256 f4d7a753e114b43f52c9f937e67ce82d6cde234567257eb9ab4c132310adfca0
MD5 d23c0b2dc375e1263122f40653db12b6
SHA1 72ec726ae80cb8660f777616fdce76218511463c
SHA512 a0c302ceb0ce6f7e88ea11d88d9a4cc64193b4c56aa1027153ab1e59cfbadeb615f4db325a571e30cba691299263a28ed4902a83bf9525341114f01b9192c421
TLSH
T1F9A0021413C08216C05211B13667C2417291C9501180130E60D14454CC928D26B4200C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 c26d14dfe5b77dedff8e7f44b816813e29b84fe2472cc51ff189032a58968b40
MD5 d20b75219c22049d91e16b9dceb7603f
SHA1 edab6c789848da60a6f900d364b0d0a6e9599f09
SHA512 30e9e6918bbb864a8d079fe46322f5ea542cc8693cf298a36530a30c70648c8aeac5f85426429141178f409e47a4b7ad04f9da77a1048a3c464b61a6ba6380ba
TLSH
T1F5E068B32DE72820FDAB82E55871A4940245BC54C405ACCF240BB3C710B1242786AC21
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 923c5f8e9e68bfee789a39e12abef72eb28b7cb48bde11a9e4830badce018e42
MD5 63141868e48c5ba37ee7258e0dbbe582
SHA1 de42ff46b7d7f7746ba21d6f91e598e981523a65
SHA512 04f362971b5d3180ca70614584c08b92814c116a40348d36f28772e00fef485ebd2c3001fb6e3ee665a4217dd963a9c0ad3e42c9b46633d9e7c5a6f625204caa
TLSH
T1DCE068B329E72820FCAB87E51871A4940241B4948405AC8F240AB3C710B024238AAC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 8cecc1e2207d56a6085b357e0deafaaabe6bfcf897c5cb8787e925e992a583f1
MD5 a8c3be8fa7cd339e9604f6d26b9b552d
SHA1 a71b94f954bd594de712e9b0ac4849d75e6a9c16
SHA512 954d11e5df197a24bf6a20d0408e3536771eceb0d0f6e39d26235bde704ec417267f7a8e6809a0cb84ed9032ba6ceef78b343874b33b905beaf31918f49236b2
TLSH
T1EEA00260DB53A541F48012F06A7362DC6221EED899552321C0E800A6CC651414185000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b6454.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b6454.TMP
Size 48B
SHA256 8dd22cc9a94a017926b3e5cb593049a2fa82b0f7799d9647dbfbe0a5ab1ad9db
MD5 d955ebced8289350638feceaed671513
SHA1 1a4bd61a8d1dcbf655bbf058c31fe95bef117613
SHA512 e6fbabcf1dd2c5a86104c0429d8700bcd35ea344e810e3675081fa9ae69851c8aca9b8408aa4a2e45bca3c7d0adee586aa5dffba08cca3781fdb2cce145f27a5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1effdd80cbd2acde430fa36c60a870f22de01daba1c3720cc5f8a33f84b12d2a
MD5 562542fd90fc4b6389fefe280180d25d
SHA1 5d5921056c06a6939dca7a87e61324f383c62d4f
SHA512 f477b031ea2bcde37e345d8f2fa971f70d509e6fbe60d66acb424ef91c19ac822a1ecc8db42bff2789615761d5d1c2df0d445e485830043f3197519290231700
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHm7KmgIIOW4tVgGOK47g0OcOGlkWPHlyLQ:C2r6WwYYZo9m22Lgkte2VUGfHm7KmgIy
TLSH
T128910621333713803C7EA54D91B9952BD2C171A23218B52B7B6803669F27E178DFF9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 b13dc522d300274ee51d2f419b2097cbf4a08d68cf27ff3066ff343f5f1975c5
MD5 a472cd4387f251b368c2ff8d122d6593
SHA1 6034179eee46c4c2e212fc18361d8aa1e8137cc9
SHA512 75e7c67227d007adb4bf73cc71277ef34f27932dc26866504be93d55e7962c216736d5fab30593f46de8f4f637c29a482f6f5deb5afcebe11d0b99cf5d14aadf
SSDEEP 768:OKrv+4UNbd83iCZM/TBOW773njttONXyer1IRCzni9CeVH1SK3:OKbsbW3iLZSIqn5EH1R
TLSH
T19813BF32A4A89E334DE2E3D5B14672437FB85057C5840B90EDEA2F5E069B99E130F91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 443bf336130c27485f98644781d22bd0705de9dc72169d2a3bd0b93515bb58bd
MD5 e5d61b33317afc8fe68aa583539a0ca2
SHA1 5ad02b06822e7a65b96ec8a44a7560ce844ff5e6
SHA512 d5895f9ae5db87ffc1da43febdc32f594ca19c03177c5760b67b46560f023ae600641538fdb5f90e228ff3cce1ebf2d5c00fce9a2cf63dc642bdb6e6d7d09f03
SSDEEP 768:hrv+4UNbdz3Yns+/TBOW7734ONXyer1IRCzniBFeVH1SK7:hbsbV3YrmSIqnmEH1l
TLSH
T15503BF36E4A89E338DE2A3C5B14776437FB86057C6840790EDEE2F4E069B49D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e3887f0b1323f7c49d49baa73f75ccfb63cb506a09f5d81f4967f76aae03297d
MD5 bed9b8ba6560d1067d366bd3fe852129
SHA1 23b8cfcc21a3ab9e97b922c428346d572a7787c1
SHA512 79177b79e1d87283494cab3f824a5c23d15fcfcead7c585006f83eda728ecd703ee2e7663a1ca63fd85fd52e4fafef75d04fc717f21d22b315beb494f3c19316
SSDEEP 768:EO/3LCZM/TBOW773njttONXyer1IRCzni9CPi9Pw:EO/3LLZSIqn5P7
TLSH
T15EF2AE31E4949E634CA2E3D6B6467343BEF85063E5C45750AEEE6B0E06D796E030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c684da872452c8a06e56c250192a78f07d700508f3672dfd64f35403edbf2881
MD5 0bcdf471a6bc823016f909b9bcefe2e4
SHA1 63449d3d27f6287ee46b411d4e0a7f1aa2d0929c
SHA512 9164992c41ec026def763e80a577795bb28967cd8751aa6d56d0589ba38bea7291af0391937e8dfde89988744d4ccadada6279046863200f7fc8e17258766681
SSDEEP 768:8SO3RCZM/TBOW773njt+ONXyer1IRCzni9CPi9Pw:8SO3RLaSIqn5P7
TLSH
T18CF2AE71E4949E234CE2E3D6B6467343BEF85023D5C45B54AEEE6B0E05D796E030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b00af7ca6916787c90edc0deec76b42ba3dbe469b80704a8a6d0c619f7678cb7
MD5 6541b7d464bedf7cc14c33db2082002d
SHA1 608c44a2bcd4f711ff091324b6be123b721c6d15
SHA512 3c63a0280f31cfb59c10c66870ce4438c21649f0a9894353154e17d8cc989eed363ce1e350522245d9aca38c5b8bc484d7c642a6d9692f9345bfb8977fa075a0
SSDEEP 768:8CU38CHJM/TBOW773njtAONXyer1IRCzni9CPi9Pw:8CU38TkSIqn5P7
TLSH
T184F2AE71E4949E634CA2E3D6B6467343BFF85023D5C45B50AEEE6B0E05D796E030B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 386a616eaf4ecfd8476482651c0867663d377c0246ba43070af5fe276227d4e0
MD5 dfb38cab2bc25a521a5eda705fb72d37
SHA1 2d116610fd493b4647e3cdb832d3ac6c7f954e65
SHA512 ddf7921f0b451da8e91f6e964ae1c6184a296bb2493722d03d38ffbc375c2ffb502b5caedd71ac2a7cef99317f031b55c0c526111a6a1757a1e59a470a5f2805
SSDEEP 768:r4rv+4UNbdz3PnZ+/TBOW773njtJONXyer1IRCzniwCeVH1SK7:r4bsbV3P8VSIqnuEH1l
TLSH
T13303BF32E0989E334DE2A3D6B14772437FB85057C6840B90EDEA2F8E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 00ff3fd14b2726269d14a4d00403ade3551c86998f0099d8882d6086f4c72013
MD5 b52943c4036bfb021f3c193b034fefbb
SHA1 feffc461b8f872f8f5f08853bb3667da10ff8599
SHA512 e6a043beab82b3814a60fb3e002a5d68dd0e7b4b6ed672afd521a1587822e398c0dd58fd73469dea7c27017efe8486e9921a7a4065fe2b1010db9c33862f70e8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5b3044.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b3044.TMP
Size 392B
SHA256 55fd95481ecd92eb9775e808299fc441206cc64f7a16e96c128390603760b381
MD5 5de239cc2db4021e6fbc8edf2ce1570f
SHA1 6c6eac7c7c1038e7c6e27f176930c3bb6abac5cd
SHA512 351171b2575638b1935749c98023db1801430db472ce3d3115593fb753fc01cc77eda8cce43ec294d976519d798f9224a0f5d1d990a965594242bf7d47e6b73b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download