hxxps://de[.]rutrust[.]org

Resubmissions

14/08/2026, 23:29

260814-3gwq3sbl4s9

14/08/2026, 23:28

14/08/2026, 23:28

14/08/2026, 23:25

14/08/2026, 23:24

14/08/2026, 23:19

14/08/2026, 23:09

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
257s
max time network
259s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
14/08/2026, 23:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://de.rutrust.org
Sample260814-3bbhysvsct

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
23	api.ipify.org
24	api.ipify.org
28	api.ipify.org
42	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3488	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312232129227030"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{AFC6728F-6F88-41CB-8A49-A25814D9C752}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2712	msedge.exe
2712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4068	4928	msedge.exe	80
PID 4928 wrote to memory of 3488	4928	msedge.exe	81
PID 4928 wrote to memory of 4436	4928	msedge.exe	83
PID 4928 wrote to memory of 4436	4928	msedge.exe	83
PID 4928 wrote to memory of 3384	4928	msedge.exe	82
PID 4928 wrote to memory of 3384	4928	msedge.exe	82
PID 4928 wrote to memory of 3384	4928	msedge.exe	82
PID 4928 wrote to memory of 4012	4928	msedge.exe	85
PID 4928 wrote to memory of 2964	4928	msedge.exe	86
PID 4928 wrote to memory of 4012	4928	msedge.exe	85
PID 4928 wrote to memory of 4012	4928	msedge.exe	85
PID 4928 wrote to memory of 2964	4928	msedge.exe	86
PID 4928 wrote to memory of 2964	4928	msedge.exe	86
PID 4928 wrote to memory of 1060	4928	msedge.exe	87
PID 4928 wrote to memory of 1060	4928	msedge.exe	87
PID 4928 wrote to memory of 1060	4928	msedge.exe	87
PID 4928 wrote to memory of 1236	4928	msedge.exe	88
PID 4928 wrote to memory of 2012	4928	msedge.exe	89
PID 4928 wrote to memory of 4528	4928	msedge.exe	90
PID 4928 wrote to memory of 1236	4928	msedge.exe	88
PID 4928 wrote to memory of 1236	4928	msedge.exe	88
PID 4928 wrote to memory of 2012	4928	msedge.exe	89
PID 4928 wrote to memory of 2012	4928	msedge.exe	89
PID 4928 wrote to memory of 4528	4928	msedge.exe	90
PID 4928 wrote to memory of 4528	4928	msedge.exe	90
PID 4928 wrote to memory of 1376	4928	msedge.exe	93
PID 4928 wrote to memory of 3512	4928	msedge.exe	94
PID 4928 wrote to memory of 1376	4928	msedge.exe	93
PID 4928 wrote to memory of 3512	4928	msedge.exe	94
PID 4928 wrote to memory of 2676	4928	msedge.exe	96
PID 4928 wrote to memory of 4684	4928	msedge.exe	97
PID 4684 wrote to memory of 3296	4684	msedge.exe	98
PID 4928 wrote to memory of 1532	4928	msedge.exe	99
PID 4928 wrote to memory of 2856	4928	msedge.exe	100
PID 4928 wrote to memory of 1544	4928	msedge.exe	101
PID 4928 wrote to memory of 4616	4928	msedge.exe	102
PID 4928 wrote to memory of 4616	4928	msedge.exe	102
PID 4928 wrote to memory of 3484	4928	msedge.exe	104
PID 4928 wrote to memory of 3484	4928	msedge.exe	104
PID 4928 wrote to memory of 4596	4928	msedge.exe	105
PID 4928 wrote to memory of 4596	4928	msedge.exe	105
PID 4928 wrote to memory of 4596	4928	msedge.exe	105
PID 4928 wrote to memory of 2640	4928	msedge.exe	106
PID 4928 wrote to memory of 2640	4928	msedge.exe	106
PID 4928 wrote to memory of 1940	4928	msedge.exe	107
PID 4928 wrote to memory of 1940	4928	msedge.exe	107
PID 4928 wrote to memory of 1940	4928	msedge.exe	107
PID 4928 wrote to memory of 2088	4928	msedge.exe	108
PID 4928 wrote to memory of 2088	4928	msedge.exe	108
PID 4928 wrote to memory of 2088	4928	msedge.exe	108
PID 4928 wrote to memory of 3512	4928	msedge.exe	109
PID 4928 wrote to memory of 3512	4928	msedge.exe	109
PID 4928 wrote to memory of 3512	4928	msedge.exe	109
PID 4928 wrote to memory of 3916	4928	msedge.exe	110
PID 4928 wrote to memory of 3916	4928	msedge.exe	110
PID 4928 wrote to memory of 3916	4928	msedge.exe	110
PID 4928 wrote to memory of 3540	4928	msedge.exe	111
PID 4928 wrote to memory of 3540	4928	msedge.exe	111
PID 4928 wrote to memory of 3540	4928	msedge.exe	111
PID 4928 wrote to memory of 2712	4928	msedge.exe	112
PID 4928 wrote to memory of 2856	4928	msedge.exe	113
PID 4928 wrote to memory of 2856	4928	msedge.exe	113
PID 4928 wrote to memory of 2856	4928	msedge.exe	113
PID 4928 wrote to memory of 2152	4928	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://de.rutrust.org
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x254,0x7ffa7d08c188,0x7ffa7d08c194,0x7ffa7d08c1a0
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,7462078435764039832,5952042107549834827,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,483720544609997789,17311243718573758734,262144 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,1723071922764949520,11431931169736198247,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,46518584005234075,7329423518135941929,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16936974637652141548,5007853882989818013,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,16078312356767112960,2990822945918996589,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,6230854608620897226,15954836734983513667,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:9
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4264,i,6112226721056373650,10084306618748423650,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4240,i,10645259913852513759,830917088531010166,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3668,i,13835826418784329915,10778754355024634129,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14841328210132102707,953313324177494042,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,16358332447500737546,11422919123641374078,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,16358332447500737546,11422919123641374078,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,7292762810167478268,7228072499843807420,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,5877093153065266609,8569739536066123734,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,11214699974431385116,17258653614898575191,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,2081461147469284986,251154056073949941,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,1587603056422259879,16653558514271838275,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,11642020940813977532,3419279689933478151,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6364,i,2405707048663666341,1818059858252229054,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,12865152101766709425,5971545328491114218,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4748,i,10333580526658872840,13350061997901784962,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7068,i,15235027274529760278,15144447440086162921,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7360,i,89920951794919880,13737243924985954350,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7316,i,17981081453289607646,10286137764707975730,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7076,i,11323847690217238562,14853854001977165273,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7084 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4452,i,12406905208002006723,3969177955958081932,262144 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7620,i,4007134506077579101,11326368455913461111,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7656 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7600,i,16187360639976253384,5014472823964139035,2097152 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,6160536465999234447,432726978498979713,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,9925076311711551214,6803596803241010789,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,5482359005790679119,3131578701929338747,524288 --field-trial-handle=2032,i,9683329916998673599,6519276686892712444,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:14
  2⤵
  PID:496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9268c81dd8afa6fbdc34d051a638b4dce94ab92618da951ddb0bc7dc51433fef
MD5 861a6fce0d87692d2b4a1303e56f1a25
SHA1 7a516cdc72a0f568ccf931e78fc08ead146d8e52
SHA512 9a9d6e902af9bba26e1ef6ceb054ca9a19ea9e7ea145a221d8fbe629d7b20cfc76340fd3acdcccde9af66986da13da0c4d8c84cd8ce7106f1212135992e9ce44
TLSH
T166D02B21B7CCD400C0E30031C018931041A800C4642B8944B0B0842D680B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 adf1ac7ef6ad2f467814611b23b5905d27bfbc301c113cc0f42faa887b0cf867
MD5 43cfaffeaf5c46b9eadeebb1347c22e7
SHA1 d96f3ed6add4b5fd08b00be076bd99ac8c96b6d9
SHA512 d9c942c219d1021105ade146c164fb4fff35ac9acd0e85af945085e82c7ecd2ab6e92dbb4acf30d22ebeb0b2a7a9788fcf0f1d01f75408a2ec7523fc3c62a603
TLSH
T1C7D02B2177CCD800C0E30031C018931041A800C4642BCA45B0B0842D580B030B3CC047
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 763B
SHA256 3eb6a8d872bf1bd7f9bd1bee289e84dba608030dbab95a4b8d6cf1e0e6d635c5
MD5 77a40f924b30b3d9533d76df9ad2c7a6
SHA1 e986b83985b45977fe9005d9a5f4cabec69e333d
SHA512 b6e89b585edffc5b7942c08dacae5e25925179637b2178df026754d9983596d654a59ec54234c12fc78de54d024e2183176afa3781c2a468fb0c16ff44dea096
TLSH
T1480149C742D5C6BF5E41938B515C622C5070B70EEBCCECC9724C5885B841446519A3ED
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 206KB
SHA256 d17e2eb7b5cfd83919a9d579cc764b788bb32ee652a66ec559fd3d0d32196e8e
MD5 05839eb21a1de293cfd130e08ca56dd9
SHA1 9967fc0d8fc1f063b3071f585493393696611266
SHA512 e46904590f2a2faab4055c7b5f51147c08704f402ab632472109997d84a97e5529de41c59f54a55215014002f06a839fdec7f880ebe412aafb2e510016efa945
SSDEEP 6144:IIlpl0vxZi2NQzS3wfeWmY0A5jZsClYYBhgM67oTk8w:bcJZfQ++yA5jiZM6UTk8w
TLSH
T1E62412B53DCA0311B34913A623DE34F91A9C37B760B4A6317DAD03479CAC054AADF7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 31KB
SHA256 106ea602d86cd4c6951371c42b3089b31a3fba5880a6d16a37859117b3377f99
MD5 f93066001bf26007dc70e34ef2ce4d19
SHA1 cbfd0c48194b042b3c4e3b50122b38994f9894d7
SHA512 617379970d3fd2779faa9af1372f56d3322cb681955227049afb2b7ab80f97dc8bf777001388bdc60ca87ecdc7697fd28075a1d74bfe20e08f159f9cfeafc8c9
SSDEEP 768:0xy0fS1F1smhTunHJPHeyxotOHIL24QR9V:sfSRZunHJPHeGHU24QRD
TLSH
T1B6E2F2881403234D158ED192D612ADA5518FACDF3182BD56B964BDA8CE8FFF905DF30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e9
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ed

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ed
Size 52KB
SHA256 4e5f615591413f374ec83f615b4532d9147d7276a557b642c8245618bfc8ec63
MD5 b1f06ad8088a140dd127c1c201b22587
SHA1 31d239f492bfcdc67f17b3106b4b5e7db9ed9ac2
SHA512 68bd5c5ae36ab952cd885a025078333567f00f8325bf5f239d6b251ee1a68d747d470b1a1c4a5b5f05d44184d050e48d8345260e24da419d2f150b8ee237177a
SSDEEP 1536:H4XbWdKo/wtfuIFLFs6nSLSUASmczAMsMNn:H4SdcrLeAS9kMNn
TLSH
T1943302CB603B57FAD0BBF30625B6381E89482D944F549BAE990B032C4E53C711E99F1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 5441387879b7104c2fccbabfc5c0cb71b81471e931ec9a40bdc4cf1d49c4f9a2
MD5 e7dd66e935bd10599066fc68a4d12223
SHA1 fa5bdf060aeafc5f23f5d9fb3608adcfe93c15d3
SHA512 459072aba76fa43a965814f01153a67cb7693c964b71332554730f9eb7a37368246097b8a258095850fd006d4c33194de19fcf151c7a7e4cd39e6c2352885643
SSDEEP 96:KtdDqa5oQrUq6d0LYyLg/Sp1Ol3hOP6pls/IYnyIF1HZ:K/DRPrQ0YV/S7Olxa6pls/IYh
TLSH
T134E1EC30ADE2A920EF5111B0C5DA1BDB3576866AE6B30FF716B54C3C1013BB1CADD429
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1d3f3d845e6fa72dbac7adbbafb32b424e3c6ca4d59d03a1ce1f9ddc0892645f
MD5 dc657c416cad02543f21c218ed16450a
SHA1 b741cb895833936cfd38a8f3ac46ff747acdd335
SHA512 2a2882ed18205a5d0689bf420518cfc6c3c966d3c2f46f7d20139cfaf3584232496168632601be9050516ea46e4d0413073efa9a5b94bde82c034d0aad35ade9
TLSH
T104712A25CEF2A871E35102F1D4E76BC378768475BAF31EA112F4887D22A7B219F26174
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d973.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d973.TMP
Size 3KB
SHA256 2927b83e50329b60342751502e7a6ad6d5f3af05a030a6536b1623e0e688108d
MD5 a9ac36a318b4a2c68b8988be856cd48e
SHA1 b5a19012eb006222dac2c87002f7e7c2c04f065c
SHA512 801f1e39f9ce168546b2d8e428f1d0195459015419a95472d06c1feddf2c36b1cf86517d5114f980a41ee7384cf60f5dfefbc9491f7758843072c49fd647a906
TLSH
T1EB712925CEF2B871E35101F1D4A75BC378758479A9F31EA111F4847D2297A118E26134
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 bb9ee9f5cf298e26a9f85eb9648ab8baf3ad5586b44f2c508d6be92569e1fdde
MD5 f39b2006445146ce06bb0e3e8e68df14
SHA1 bd5544e5f84f35003bad12e458f71ad3f85adce0
SHA512 1534fa1571bd48ac3659d80c8600f5686aaefc0fb174f2db0e9a04181d434a14b34dfa3f0b651497331d8672d515ae4b36cf2c830e23dac111b8e6e6a55799dd
SSDEEP 384:DgDKHtSyh5bWmIbALjjn9tBJDJff97cPpOxrk0MuXzOVmfPiShVRyaAG5775hHTq:1Z5nNhuf
TLSH
T14E629EF2C3D4862DC81176F55F283E1BCE1D096852A83D1BC9D5EE4BA3E2472E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b83920354e26ce7129f10e3a96efabaa4dd922eb4b4985afa6b9854e8130196
MD5 daaba497fd68f87ae6812d98b7645fe6
SHA1 87daa8486153d36b51d11b95904f87fc21ecfb43
SHA512 ee39ffff00c242aaba4572039bfa92466109e0282d6201cdab1e4042590a5b6a80176ae06fe9cc029e0e7876a8400cef3bc5f942b5725b16417de99b0c3c7385
TLSH
T109317DF7C3E58A6D8A0516F09A146E1BCE1D0A15836C3C268AD5FF1B93E3475E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 3534d291d2242329089ef8e62cf64a294922e66adf0ad3665d13c52d5e0aa3b1
MD5 54671aa9152adab03a2c4c8bab1c3ab5
SHA1 fae401e143fae334a8cb4d89a9709461a23f2c82
SHA512 dee1dfd35e8bbe853f7a89746776b7c473524c5b92747b5e36576e6260537b15c685245f2e0139290bfeadffe859aad07febe1b2d42820539f706d1139bdadfa
SSDEEP 384:DgDKHtSyh5bWXIbALjjn9tBJDJ497cz4pOxrk0MuXzOVmfPiShVRyaAG5775hHTb:oZxnNSun
TLSH
T1B6629EF2C3E4862DC81176F55F283E1BCE1D092862A83D17C9D5EE4BA3E6472E25164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5e2f6dcaba1dd20b43d54858d3e8f244a60455f3de1b3de3e246c183a36550ce
MD5 59ddcee0eb7512e6f1ec70902fe45cdb
SHA1 c24ce580bd7823e24b4c3f1d93a583ddb5703fad
SHA512 5952e775732483ebc5aa43b6a14077b5460baf72108c026b51e7163022d9d5267a99706fc91ce6eaf78491befad43c87b0416de3b0d96d5f54e5d26e36e66712
SSDEEP 192:sxZkRZyM/jK1Ml8MFw/fSsGkeIdpFs/W6+WN8G66F/Y0YSxrl+F/IgrJ:sxZkzdw/fSsGkPK/bztF/5BrO/9
TLSH
T13952F8116A346977CCDBD209BA45BB93D6F90572A2900E44AEFCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 976ecf84999ca58d3eb1ae5ec99bf7e3c079e761ee0594623ab934e06b613383
MD5 8f56e61bee3674e90ba17fef975afdd0
SHA1 0ef64bf27a226a77526354036e4ef4fc470b15f7
SHA512 888056e6c804b32c512098a42d8b6e29521fa8382a1fe85ec836efff007ae1494d37788ce68a5ba9a6a85dbb28a168f73e0436562939684a6a517a41a7f91c92
SSDEEP 192:sxZIRZyM/jK1Ml8MFw/fSsgk0IdpFg/W6+WN8G66F/Y0YSxrl+F/Ig5yMJ:sxZIzdw/fSsgktW/bztF/5BrO/kw
TLSH
T1CF52F9116A346977CCDBD209BA41BF93D6F9057292900E44AEFCDA1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ea1852a8028f8383ada288c5de5772a7354681964f14c3b66556603693c8bad7
MD5 240a5b9cb2d8719ce9ed0be4887c3275
SHA1 bb1736d8e5288e4065bb0a626e6227eb3df3f38a
SHA512 0f39a1307f58536e466ca631fda61b52ab0f7845972799529d490409039159050db90e6c4023e1de0faaa81687029c01425fbb4e9f0f847e4140ef44e3a2babb
SSDEEP 192:sxZLRZyMojK1Ml8M8Ow/fSsgXt0bipmdp2sY3g/W6+WN2YAvZG66FqR2fY0YFM3v:sxZLWEOw/fSsgXLIv/bIUtF9f5fO/i1
TLSH
T14B72F8026974197BDCD7E219B945BB93D6F90072D5904E84AAFCDA1C04E2BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 43b7e5d30645a1e7e9870a0f2b52f20c2b208d7127ec112791d602ea4ef87c74
MD5 c2920ad5951c9c4ae6b811d52d61f6eb
SHA1 551f3dbf47d4514ccd23a795dd513a1394efc4ff
SHA512 4d5c4be0d297fabffe82ccaf3642ea640ebafb8851f0477309ece8347bbcc82252e5f8d57b3b6678b2653237c9e1d553971fe2b03f4ea2e73dd2a54ce56828bd
SSDEEP 384:sxZDnQWqPw/fSsgXtGmB/bNUtF9D/5kO/i1:srQ5Pw/fOXtf/batz5kJ1
TLSH
T1CE82F90265B4197BDDE7E215F905FBA3D6F90062D5904E84EAFCCA1C04E2BED722781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 ef7240e43ca30f6ef1e0333038b9bcf2d203424d4ad0610744ea859d4bab400a
MD5 e25ad794557c8af47e2a24be5e34d5db
SHA1 4d0ff7d3882a545873a85705e3dbe39363265765
SHA512 e0d0c868c0a886844984e6a6da010fedacac762730a7b501ca441e63d45f3784564a85c74e3d3d496745405700d868259017d3f7a0a5cf504139e861b883a5ab
SSDEEP 768:AFl1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/BvrocS:AFl1j83r2pmWRmeKQBCu1jaK3ALpCN/6
TLSH
T1BCE22C3B640CC77E4F844D6DEC26AF966ED801CBAA684D5447FA494C03C73EB512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\650dfd07-c887-4e02-aeb7-c5dba222e40a\index-dir\the-real-index
Size 72B
SHA256 5100bda4350630e10460e7efd21a8d24c4fa354389a03ae29786903340ffdea2
MD5 6efaf480713de877c40b6ba8aad702cb
SHA1 9a6621414f132d5af3c7050757677cfb0db3d696
SHA512 6dc78faaf1e52ba0a77387e0254dcd269859454078645a01fbe3355cc6e35500541ce3f6531b7c72cabe022e382234f8df0a00a66e1932e8aa0a819f8193cccb
TLSH
T1BCA0023C02570541C40626B4A18387D16318BD1652034399A2A007A69951D79C95D057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b38f76fc-0bdb-4056-95ec-6b53c77ee934\index-dir\the-real-index
Size 3KB
SHA256 d6a5e332af47d94f6a3edf3277c1da13ac36c94cfaee4a8150e531ad39432dd5
MD5 cac67f42b5004a4c084311bbfeceed04
SHA1 229fab2c612dc70735f7f34d7390591df4ee2aba
SHA512 7484720d9346ac6f9d67ae9823bc22af80d68eb0884cea5b59c2f7c9ce2c0c1ec1107d7829a2c2a499a626f71f169f5b868cb2875d0b3b3148794e8bab4701ed
TLSH
T16851B75D4CC61B6BEE69657314B6084033B535CD67898E23ACAC5034AD8323A1955739
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c050f42d-29bf-498a-b2a4-a91e8a56cc35\index-dir\the-real-index
Size 96B
SHA256 366a408d469e3587a9ff1782dfe0f55f9edfb172d057cf8dc8c54d623311a95d
MD5 9371c801bedeb5403b511c6508102ca7
SHA1 179194c2ed3e486d0ef7d3ea50810d37727e545a
SHA512 f7e5e567dbf6d73cbace25c6bbe15d702ac9c14215ccafed58d5331d4e31dcae6bfddae98dec1efe3064e960165f731e71482775c776f1c387c57b904df54546
TLSH
T1ECB0120A2A90D509F11F43700091C42171E80E913311333221D4063581043910381044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a800e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c050f42d-29bf-498a-b2a4-a91e8a56cc35\index-dir\the-real-index~RFe5a800e.TMP
Size 48B
SHA256 2871fb28534a9311be70ceea16afad4e1f27c48fa5790639a5dd72f7b87f66b3
MD5 b9ad73f0a82d361afed0ef465bff0526
SHA1 b3fd8aebbe95f4109ef8f4bbec4a149acb515120
SHA512 9ef057749a0ea85753e12c293c3c3aa88092d953bb044047e10f9df44fddb721cffef7fca408e91b244cbab5780eeae56325d0f4936b223be4fba56d692291db
MD5 SHA1 SHA512

Submit Download

623cd082b6202da0_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\623cd082b6202da0_0
Size 60KB
SHA256 99c1be560633d60acf7a7a305916553681fc49ea26c9d2d9734cf8d1f745c30e
MD5 f178d49a51bb8669a0b97ef1132cf4e5
SHA1 bfbe598cfaf6893244294190b657b0997f784216
SHA512 220e1bc5c28bce491ac46f326bcd41c1d887e31287278e4414d293c8c242a7aa1e39b9e2f82522a7d5a37e0924f148e0b982f31423469ede9de449c788a2e909
SSDEEP 1536:kmtwcA4JfCS+ksYyiApR+M0DpbarcVEeZnv5HPwqpzG4/A:Zt448bC6Rx0DNDJh/A
TLSH
T19A5329A7B262603687AD21D5A49A7F00F11B17561844C9EDF0BC66953F08E8B53B3BFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 a556f43f536e37f713fca5aaa960fb23f1b78934d20e29156df4629ab2196bfb
MD5 1fa562bfe3826fd885e297c0a0a40bd4
SHA1 34a5244be6ffc7337ab85844ff52fdb63289880a
SHA512 3add00f86670abe596dfa4e3a6caff8651546f097c411ea93b23b7587b8b2e771b549a1db9a7204c31357c0f124ff6c070d00fe5fa37b0b4144775dc8a6d7440
TLSH
T144A002140790464BC11A63B115DF13817300C8305101671B59AD2059CC515508D4601C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db051936-6c70-47c1-b269-fb19c118fa19\index-dir\the-real-index
Size 72B
SHA256 4496fe648c579fc39b094b87caf58208058db295b77a11459001c2aaa1df75d9
MD5 df7e8f6b765445c1c1ad6eeefd6d5a9d
SHA1 084b9eb35aac4aa93a15dc4a475193c01cde50cb
SHA512 8821c531366bfe96be6522dabd04cfbb784ba99a37b4cf96d1f14e2a067bfc7539218aa1bf5d33ee3f22b9fb80518bd8f843da86361b843e85bb171933bfddff
TLSH
T1B0A0021432C20041C72717B1399602AA3263CA248205170781922484D87C97AA5C180C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f51523bd-4e04-4a64-af46-d823761040b7\index-dir\the-real-index
Size 72B
SHA256 7425eb43e7f1d0d46c51bd515e69d97fd7cd0eb49f7243ddf527716cd9156f4a
MD5 dbf495804bbc3b1679dad07d7c924d0f
SHA1 81acfcc5b2b777b3c7944f4475d63ff53337815e
SHA512 99d28997641358a32841064015e5000dd6e5b817cd442f9a2ba090d1878e7160f4af90051eb347f7c83139661693134cac4ec76f02c03c4141ce9d79a5adb81c
TLSH
T15DA0023D66445256CF0203719253E5B476394B957285432740E70996CCB4370418B149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a800e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f51523bd-4e04-4a64-af46-d823761040b7\index-dir\the-real-index~RFe5a800e.TMP
Size 48B
SHA256 7621670708f123c5dbd4b35e28619fed0fab76d7e62535853571e334abeff32a
MD5 839a4d04903d5b8950d431f4cf777390
SHA1 113f68615a19787672fb2084b3b13e7eeaa85a4f
SHA512 0c23392d182f8cf1593c2c0cc91dc9ea90598632e14188e4e0a4158f24e13c9042d104a13de3916a0c9284bef508cee13f510d31a267bdf785cc26f526906c34
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 f27f5537efe6eb849ac79b6c483ac541b2c3b5bbdcda6a042a335b09990f218f
MD5 9ea04d056184889fa636b75dc5654ea0
SHA1 49a2fb8e22ede0a7f0ed225b8a9d10ffed65a3d4
SHA512 c15eeffb67c1e8f74230da08d5fcfbc535281239ce6e518a616edec51d36937773b29594240f0fbdc78a912bb2559b251118394106fe5340a84f5dbf535d92ad
TLSH
T139F0E9B23EF75C14BC5F87E510B4449951597D04C908BC9F2197A68625B23516069E72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 8e1ece849d167c8842e419aa2c484721ec043a2c2574fa04029a00aab92e86c9
MD5 c119da2c232bba3f72b10bb2b637f7a9
SHA1 e6bcc5215324e88484bdeb8a5150b2c3553cc2d7
SHA512 2fbc967ab35f5b9b036451be3510de603a4b6bbf457903738b0e428393445d498b44ea4eaea493e83822bc7094dc99c8e2e8b0a0913166e58dcfbd8550a16b80
TLSH
T1A6F04CB33EF76C14FC9EC3E610B8586510597D08C81CED9F3553A68765B2315206DD72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 c7cac7b709037aa48b68c1e0bcc69f73ec9fdd83afedda1aa83d8396fbaf64e0
MD5 a79bbc955a62cbf70893f53e407373ef
SHA1 a08d53365ea8da6e5682b7027e8f8b44035a53ec
SHA512 acae36d177b7ff9951772905e02951fd4148e0d3738a1a0f6f3ef8ecf4b2b0eb5f9f5c677bc32ea58b32e40f6936ac24efc0aa2369c16678fa2ad6cd13907179
TLSH
T1CEF04CB33EF75C14FC9EC3E610B4586915197D08C918BC9F2153968755F2314207DD32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2335410e695db7a7db62a47f1be2024b1c74fafbbb3489888aadad21d00327a0
MD5 a78195b7d2ab556784b3fae8eca4b72c
SHA1 cc2b6fe21ed45a4ec2ae70009c19f4366ce96907
SHA512 331bab2ade8d33b0f0300a2f3ef09579b9f6be557ad3f3d79f1e2320bba675da98fac5d433c6bf642fbe32084af1708d4a276152825a927a86549ac2eb301cad
TLSH
T127B022088808B0CAE8380338C8C300CC332C8CE80F8A28A2C0FE20BCC83230203EF08C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7be8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a7be8.TMP
Size 48B
SHA256 51d752befb8303bf72eefcfe66c53a1101e4273d68bea29d57195fa5d6438d24
MD5 4d9a2901aa7df41cf2eaa39c9df6343d
SHA1 6ea0ee238af9bd0d7d295341e31c48f0f353b34e
SHA512 2bcf5c1f2998aca63524e255c9f032df8a9a719f0c0e8e5c0f5be2f7b8765447fe1c20a4dc354388966a9b095c1a6f92882ecf9e76be9e792fe3bc97b88409d6
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ba8c7941b7baec59548badd85dbe1db43d77e5e2ce0d904869d6cc1c1eddbf4a
MD5 91f5c3cfab40bbda723a5c560db63554
SHA1 b81a28728bc749bff0d10f15d36072ccf508aad7
SHA512 bef4b7546ad3d4e3540e5a66a5397e4a4a96c9e808601d6a5750112e93f914f614d1760edd9c05173b3313a0ab7a715e516718ebd29fd5e781a37dc7eef8cb5c
SSDEEP 96:KkUgKtemKaUKP6GqgQK1CSEx+NhfTHMvDUX15MK9Z1HMRRhUv4:6vvDnvEx+NhfTHQDUl5FZ1HwRhUv4
TLSH
T165C1474230BB06413C3E6A18A2B5872A4F8276633568E56F3FA940F54D67E340EFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594423.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594423.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ab717855808fda9693227f27ad1de3325756a866e7e43fed06d93de03df0e54c
MD5 f791780e8068d8871d4641b7967a6fe3
SHA1 8cc9b1c8b7ba3786ca944a56a87e48a95532e653
SHA512 12eda6b8687801e74c6ce15108ab218c0dd91be1e8a88d29c31329da80de0594d260691fe3437e4c06e502402e35e3f8aa7554b85253b13b5836a3006d1ba108
SSDEEP 384:PiFiZcIS8NT8TUNTUlIlRC1RYVjgX532E8mdH2EX5rqySllYJTfY81F/FiBu/:aFQSOwgsyUfF5rqZuTHNcBu/
TLSH
T103D22BF248D78836D9AE9747B77D2D024EFCC067B5856A90B7E8161DCC961BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2f176428abbe9e378972c0fd9332fdddc65773e2c6271a5726626cbdc12f9066
MD5 8d6a5196bc057079bcd1a72c3d427737
SHA1 98636e5cfba6cdf6012af7ba6932cbda5d93c949
SHA512 c0601833d5344019af8220dd01a01a5b0d3d3699ff6741ad2806b85465d4ec60d20f9d9eed06235e8ccf27894e24ab11ba01d2f1231d11ecae42936f9c7c5123
SSDEEP 384:KZcIh8NOURC1RYmjgX532E8mdH2EX5eqySllYJTfY81F/FiBu/:oh1RUfF5eqZuTHNcBu/
TLSH
T114927D7158649C779AE7F55AB48A36038FF8817B828D6F8499FC5B1D019B6AC031EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 56f45c456ced6b4a3658b3a7400ab00367e7568ab5631a25caa73ccc6d346a39
MD5 b404b69d59b120264230815300845c56
SHA1 f544df0b9f211980eac1f5fcb64c39d2a76d4b53
SHA512 c82a638ed4cad953fe2aa4ef7619f51fc01f01999ec0d9118f91e82bc83e8409780544271b939039d0b7fa4bb22784a044ad907d35c0443853ddedb5d5191e44
SSDEEP 384:YZcIh8NOUIC1RYmjgX532E8mdH2EX5eqySllYJTfY81F/FiBu/:mhGRUfF5eqZuTHNcBu/
TLSH
T1F4927D7158649C779AE7F556B48A36038FF8C17BC2896F8499FC5B1D019B6AC031EC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a89a245acc6e2e321ffdd0357f9fec83c5b807ceeffd3cd98f43713fefe5699
MD5 692b01fdd8d82c3e6a812c50f8ceba2d
SHA1 8cee6092d86e139342e7c08ce354facbf540707e
SHA512 f0b6e951f8399cbcaf43bdde318409d71a47f54ca2c6e7cef9a1ff3b7a517d4d4725c8a56cded4f31cbc4897fd989e3e5aff07720ead15e4e82aebe2906b70de
SSDEEP 192:6GNO6i5fQmiUy1dgpO7X5zPr2Ujzormd8o2oaj3rzU6:6GNO62h+MO7X532E8mdH2dbzU6
TLSH
T19A02E935A8A8AC778FE39E46B58637179FE4116BD9952F80DAF81B1C00D768C1306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 787cc1698ce8a0cb4c275764c62b10bcf7d964316cfb4db9b7638312f3162c59
MD5 6082d1acdcc0cf3f8f1c7d9493127dac
SHA1 5f87e50a314f449d1df177c015b685e8c15289a3
SHA512 02661501d987eff5a6ab3ffb95934c3c7ca0f2b11996dc430682565c51518da8c972c9cf37387bd2510d62c977ce996a26435cf5134a0f56ce2d9ed6a3ef4f26
SSDEEP 192:NGNE6i5fQmiUyagpx7X5zPr2Ujzormd8o2EX5roTnnGQBqvU6:NGNE62h4x7X532E8mdH2EX5KqU6
TLSH
T19D12FA35A8A4AC2B5ED3E595B08632139EE44167DA897F80D5FC2B1C04DF69C530ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3c95089f232dd7189871a3db5c6c1b78d062d377739a1481c7d432961e7ff48
MD5 ddbeb59764cd5a838e0d2de659743c81
SHA1 748457c9259c7ddab788c5ffd67fd3ba398cd8e4
SHA512 324cf5c7bdd356bd1d8f27ffd5d63e4d428ba584c90d7e1573260f49afdb83cbe02854ec70d7b5ebc09b3ec2443d8b35eb37d83d25fe20f6ec3498a722fa2d1c
TLSH
T120E009A79B4440FDC138033010432F301BD380B126B10A8A5F75459E2C373003F21FC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e9b9ef50b99c9e221b9e68e1da67b4f046a347f700abec17843cfeab573f711
MD5 987bdecaa233021e69f12c483fd96eaa
SHA1 a511c4517fae40cceabee98860cc87424ea5b5b7
SHA512 98cca34c40e1bc4ce8fff3cf28700e314e457385c0fcea4549fe57e52e17ff55f626dd8011c457a1fb8e34beaeb4a6fbc95d28db850a8c4c02bd7d7f594f4991
TLSH
T1AFE00143974400EDC034033000031F300FD380B1127102865F34019D1C373003F20BC4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 26c56799c3a7fedc7915063da45e5063595780576c77201b05c5f684d26e2498
MD5 075a45fe153eabffa7867e8719cbcf2c
SHA1 1a63331d4d2ec8757dd1e28a2750dc9fe096d130
SHA512 3f233ec5643dc2702b335d8cc834ee844f5693accbb6ccc0a97341691eca2fa5dd8df0216f5921d3d093ff6e20197a60ec2dab8976fad3612d5efce6148cb0ea
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a1fed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a1fed.TMP
Size 392B
SHA256 3f664f86bb6161a71bba2a7121efcf370f294f3fd1cc7dc94a9ce0c915c88f4d
MD5 53c0257fbbb2e00c92057b6ce2d87cf6
SHA1 2b0207bdccc37b19b75fd52ce6136f51b04aa0fb
SHA512 91fbf60952d2fd10722dc7dd08f8657cb2f359818f2e980d59829e2aa2ba9aba63174a0d20ff40364749bde703a06ef736a9392538e45f035ae6f26c2709495a
MD5 SHA1 SHA512

Submit Download

491985d8-77d6-42ae-b693-f80be4db123a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\491985d8-77d6-42ae-b693-f80be4db123a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download