hxxp://of[.]blackhunterads[.]site/srWtV3?cpm={cost}&currency=USD&external_id={clickUrl}&ad={adId}&o1={creativeId}&o2={source}&o3={sourceName}&o4={sourceSite}&o5={sspId}&o6={cb}&o7={transactionId}

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
148s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
18/08/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://of.blackhunterads.site/srWtV3?cpm={cost}&currency=USD&external_id={clickUrl}&ad={adId}&o1={creativeId}&o2={source}&o3={sourceName}&o4={sourceSite}&o5={sspId}&o6={cb}&o7={transactionId}
Sample260818-ngsxvsstfx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315257745814651"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{CB0E72F1-85B8-4225-B818-58DD6CA3E62F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4480	msedge.exe
4480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe
2012	msedge.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 5000	2012	msedge.exe	83
PID 2012 wrote to memory of 2224	2012	msedge.exe	85
PID 2012 wrote to memory of 1360	2012	msedge.exe	86
PID 2012 wrote to memory of 1360	2012	msedge.exe	86
PID 2012 wrote to memory of 1360	2012	msedge.exe	86
PID 2012 wrote to memory of 3480	2012	msedge.exe	87
PID 2012 wrote to memory of 3480	2012	msedge.exe	87
PID 2012 wrote to memory of 5168	2012	msedge.exe	88
PID 2012 wrote to memory of 5168	2012	msedge.exe	88
PID 2012 wrote to memory of 5884	2012	msedge.exe	89
PID 2012 wrote to memory of 5168	2012	msedge.exe	88
PID 2012 wrote to memory of 5884	2012	msedge.exe	89
PID 2012 wrote to memory of 5884	2012	msedge.exe	89
PID 2012 wrote to memory of 3628	2012	msedge.exe	93
PID 2012 wrote to memory of 3628	2012	msedge.exe	93
PID 2012 wrote to memory of 3628	2012	msedge.exe	93
PID 2012 wrote to memory of 3312	2012	msedge.exe	99
PID 2012 wrote to memory of 5096	2012	msedge.exe	100
PID 2012 wrote to memory of 3312	2012	msedge.exe	99
PID 2012 wrote to memory of 5096	2012	msedge.exe	100
PID 2012 wrote to memory of 1384	2012	msedge.exe	102
PID 2012 wrote to memory of 4916	2012	msedge.exe	108
PID 2012 wrote to memory of 2944	2012	msedge.exe	109
PID 2012 wrote to memory of 5844	2012	msedge.exe	110
PID 2012 wrote to memory of 1560	2012	msedge.exe	111
PID 2012 wrote to memory of 1560	2012	msedge.exe	111
PID 2012 wrote to memory of 3448	2012	msedge.exe	112
PID 2012 wrote to memory of 3448	2012	msedge.exe	112
PID 2012 wrote to memory of 4480	2012	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://of.blackhunterads.site/srWtV3?cpm={cost}&currency=USD&external_id={clickUrl}&ad={adId}&o1={creativeId}&o2={source}&o3={sourceName}&o4={sourceSite}&o5={sspId}&o6={cb}&o7={transactionId}
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcdc6ac188,0x7ffcdc6ac194,0x7ffcdc6ac1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,6310493282072919483,17455317588755678092,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,4148409791204639804,11679715381661535020,262144 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2664,i,14614082363761723719,10722695351711503845,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,10518116187597720516,13332094560640222349,2097152 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1415891678960981194,4853885611476250997,2097152 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5032,i,8453059884495919199,1941654642167809294,2097152 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,7570438284983328709,631139664585776694,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,2243046236014783703,15218867658591625789,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4214114728334979643,7993372802517256133,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,4214114728334979643,7993372802517256133,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16584182971821359675,6861650748143096204,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,570776212757705,16095434108038009187,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,17992306018737496981,5081604968045559196,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,11213453296005614189,9450234806925135506,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15466480231024475109,17022598385839823491,524288 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5560,i,10157694911503517838,8720985041636995595,262144 --field-trial-handle=2268,i,1337627792511653024,8954809907948170214,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ebb9c1fe23a5315897d9dcfc9ee42a905cd04f33fe6e6e65cf50954c3d9dc520
MD5 a47ee826ab20cf221bf0e2111cec15c0
SHA1 10f907f187ae0cc732f8e2aeac1c43e71cfcf548
SHA512 6093eb97fdf8401c102eed0f079094968b2dbad683bc2ca170845425eb6bad145b20ae4a7a0ac2d8e9efe70dd70082b7ac7a9b92e47b0d3a099404f3f6d52678
TLSH
T1E7E0E5AAC921AC2708FC1B2CA4190B46E75413162A41956B3A3D910D8FB173B1696D5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 edb2ac21139a6a73ba8cac3c09da0a49a971edc4ea49f991507b4534117f4b7c
MD5 d0f550ff0d368d94aa2eaf19cf75a0d1
SHA1 a1975083e0d389c3f2b1bd4c7b65995c6a98a79e
SHA512 c8bceff61fb896d1118da8a88c2824ec95d0852f53105ca9af56d2816ead47c36367f5e802ac08128725982d13feb73f3c07f9379d2c1506df27238b56befc7b
SSDEEP 96:5uP2jVYZ4veb991hUwfiFQg0htgzCrmrjTo1QuOL1gZf8KoKebYOXtLyBLMKaCsA:5qmYGCFh/pkPst2M8p3g
TLSH
T129F1702500A1F5C9DBF3C2F064F30B37797ACD3686964EAA9B979F6074133D590A3844
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b4a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b4a5.TMP
Size 3KB
SHA256 d68baaba662d103f677b2d4524391b2be2128be44387e9e58a72b73379d3277e
MD5 9881840cd12a7166b52caf019c9b8623
SHA1 f76ddd3d09cd6549c3b4d41b35be0f85aeaf42c8
SHA512 c546919fc77a71b7252c98d198cb30f7e56c15c1983199cc294a17dad22d2402f25c4f037bfb1ea230ad54ec1b4da266d203ed62682a06b6df4a9c1a301d1a1b
TLSH
T160713954016229ECD323C2F1B4A34274BE7DC6B54B670EDD2FA02BB075203E2A173D48
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bdbf6e0cc1ceb2b3c9d439b331274322aa00ff00de9bd1892f01a7d1745f83a4
MD5 d089e03234cda6cb598c4db7f671e295
SHA1 427e4753a07086757bfd79eb095ce2a0a5c88192
SHA512 cb152daee182bb306ce6d29e1479f0bfb182462a7491dcc4632bcc1566f8c7040076127166cb738db82f1f790133e4ddf57156af2244450fcf552f78a0b963b5
TLSH
T1A68169F687F5856E8D2191F0AA157E6BCF1D0420432C395A89E4AF6793E34B0E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3a5040355216656f79abab9585ab6527a5853e940a255eb80af891483c0dee38
MD5 620a9c592571e53f962d6dc3fa2fcc30
SHA1 5b0dd3e880a04e577f8dca6d9d269bfd936a240e
SHA512 314664f2a0492bcc44c2480a97092c673a16eed93f8b1bbf970349c503c5e351196decffdde3f32993d121286bdf1f9569151fe9775aeddeaaa87a1972a6301f
TLSH
T1D331AEF783E4856E8A0196F0BA18BE2FCE2D0514432C3D9AC5E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 9ea5c543e7534bc95de56bd2513b6c49f99dc167eaeddc4b20bb72687fc4af7e
MD5 f3d08097fcdbcae694f9b65047490e6d
SHA1 ccbcb1e12827f5d5ce525a1bca8d117ccc0455ba
SHA512 ec6735f0e1f390dd76db9e0b2f6f714f69b78f2c0bcbb07f506660f6bfbcd82bb52689a6c9cbe7650ecbb1cc126663e240dcf9045857e63e5a8b4dffce1b6815
SSDEEP 192:sxZfRyyMqZjK1Ml8UQBkmk/fVsM+63duo4FgWKzodpQLRTHW6+WNDwSb/YXMMW31:sxZf7qSf/fVsMH30XY1Hbhb/DVVz
TLSH
T1CD72D7166E24597BCCD7D719FA457B93D3F94423D1904E44A9FC9A1C00E7AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5aace72f99ce4020bab24573655bbef7b3dd197c5e59ea86b66d64ad149e60d2
MD5 199ecbc215509c4f8410230945cc0c50
SHA1 eb9092e938143a5001ec8f4db6d5ecfb682254c8
SHA512 2ea934f27545f1168f689401736d56fc28f78cb15bbaa70398f21680eacabdb134632872de7e5610169e032b1a523cc6288d8da2f1a8d9893f1ce5e9cce36c78
SSDEEP 192:sxZfRyyMqZjK1Ml8Mkmk/fVsB63uuo4FgWKzodpQLRTHW6+WNDwSb/YXvrWMRxII:sxZf7Mf/fVsc3NXY1Hbhb/uX9jz
TLSH
T1A262E8166E28597BCDD7D219FA457F93D3F95423D1908E489AFC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 33a391965bb825fae1d2497f21874e02decd5b8ff9cdf8aebc5e72f48bfeb07a
MD5 f507ff5bd5c06654fcd9e4a6ca28d6b2
SHA1 a6187c5652047c7037e91a584b1ca96d7dade399
SHA512 3e724b626826c7c781641fa2a424bc9a18388d5a8173091a2139547486c15caa5137487bd38922f981006881decfd8ac7a5b0db4c5c85de6a406a6263478b5dd
SSDEEP 768:/Zk4PXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OViiLl42vJ4roWpN1Z4STU:/Zk4PXDWvXt4hu1jaHiL+QJDWpah
TLSH
T1D0D21B3F680CCB7E4F844E5CEC26AF966ED801CB66988D4447FA494C03C77EB521A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 bdf1a47a058ef393eb13ef77c9949159ec66235eff67fb189ee886a5a011e1d4
MD5 7e2b33196a51e2fd2c08b51f9a682544
SHA1 bedb9859f0bc56f8397bedc721b779071de491f7
SHA512 3590a42370190fa75734e8c60fcc6eae5ca4667784e48a53a7e5e7d3c1c9ee3d51cded748b7592d2ceae374d3b85c32c2bfecce1163cd7af0f66e7698a6963c3
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU1SZ70g:EJGnYNSv9PpHV/qj8F0g
TLSH
T100B20A13717A03423CBE2909A2A686779E4231B33019E67F77A904B64E67E124DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 be42e56e59254a5577534fa68daee90b2a885279b9be0718103901f362bd52ce
MD5 849df14fe3d36eb2f341dd6517d54e6f
SHA1 8405721a037899cf0b7981e65a626ef8f6e144e0
SHA512 0a3fd9b88787b6e6182f232ee4316e998e31fed914722732fae9662237666c5cbb7be3ba415091b3107ef14dece258939a8cebdc20b6488c1a4750a2ff657074
SSDEEP 384:nhiFiZcID3sNd8TUNTUlI4kTzoNmZ2eyifgVIiqB/XwkBXNKySllYJTfY81F7nHk:IFQD3uwgbOnVbqBT9KZuTHRmSfBuh
TLSH
T148D25B72DC54D9BBEDE79FD9BB4A3A07DEE48253C29C9AC4DAD81D1D008B19D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 642c33ff3634873d01959f45e577bb66b22a87a70e095bb119dc883ed7b3082e
MD5 954cb1b8fa73466620f0510f089e7e10
SHA1 4e2cab0610b9a2aae44df6f5fafb0566728c6651
SHA512 f9273c7bba4f36423d8fe6b78d6ade3f2ad2ca2b8ffa06e6d0c00bb24b8656478343d6b37b698216f4c20cdd935704f6f03d43cb2e93ffd896dcdb85135f8fba
SSDEEP 384:npiF9CcmyWCs3sNZ8TUNTUlImkrzoNmF1vyifgVIiqB/XwkBXVQ6KhkP+lFYS/KJ:AFccps3+wglFWVbqBTlQ6KhkoFYS/c
TLSH
T1C8C25B32EC98CDABECE65FD9A74A3907EDE04263C68C99D4DAD92D1C00DB1DD470B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9bd8baa8aaa891cf0d7bfd483884ade58d00f16a61ccdf228bd3a45a733dcc93
MD5 9e20393749cd35d806d938402798a548
SHA1 260cd7ccb571e01c38f58aa841f38b78c453f814
SHA512 d68b64d0c659508704ea981be390aff384d75b45392b72161d5d23cb28a176ed424ece56c5c772462ed18230ba9bd38603f276ba37683697c5ab02f980372ab7
SSDEEP 384:nmkiF9CcmyWCs3sNu8TUNTUlImkrzoNmf1vyifgVIiqB/XwkkQ1aPehkP+lFYS/c:m/Fccps3twglnWVbqBOQ1nhkoFYS/c
TLSH
T167B24B36EC98CDBBECE64FDAA74A7A07EEE01263819C49D4DAD91D1C009B1DD0707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 17820dbf76b11dce54e7ec1b4b3d515bb22b21612a70aa11355b1446e9ef5496
MD5 4ba7ecc0da672a2e4a972a014f3cc6d7
SHA1 e7ab4e7787eca341c474e074ce2f5b6aa7a8faec
SHA512 dc73bd236578d4b5546e9fab9f9611709b8698bc7765b7059aa4aee97315bdac12ebeff7842f3650f4ccbb7b6f5a787c9171519bbd94717e201869a6f7abf939
SSDEEP 384:n7iFiZcIi3sNd8TUNTUlI4kTzoNmZ2eyifgVIiqB/XwkBXVQ4KySllYJTfY81F7E:WFQi3uwgbOnVbqBTlQ4KZuTHRmSfBuh
TLSH
T10DD25B72DC54D9BBEDEB9FD9B74A3A07DEE48263C29C9AC4D6D81D1D008B19D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e245e8557dcd8451f2ac8ec53370613ff2ade0bae963f90fc0e3f1e1457bb296
MD5 3ae3a0dea44444b64b95a33bfa975fa4
SHA1 d80f3aeb4c24394dbd85e8e5472334a1db87c5b1
SHA512 6ab6731bb1e4d954f7b46d089e519d4837b01eae94bc55b3f9d32b85074fb5553b4198f45768a3fe5397257e29ebf8fe2359594d6aa9887ce026bb71d069b042
SSDEEP 384:nfiFiZcIi3sNd8TUNTUlI4kTzoNmP2eyifgVIiqB/XwkBXVQ4KySllYJTfY81F7E:qFQi3uwgbonVbqBTlQ4KZuTHRmSfBuh
TLSH
T1A3D25B72DC54D9BBEDEB9BD9B74A3A07DEE48263C28C9AC4D6D81D1D008B19D030B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5375f50d66bd2c3731a2ee511d568203bec88103554d73c1e86a24c0fd9a54ae
MD5 5b2583b042e8aca495e803ba24c302a1
SHA1 c7863a01c8969a004f0df63f07b4bc42c652f5f9
SHA512 1591238444b2a13de1dc2cfc7378effccc128e3b0a7e4d027b4a908f62fcd1705ce24d1951edca2b1c3d2514cbb780223bda768d42edd6f366ceba2e6ed9f3d0
TLSH
T1A241075CBAFE1148B3B77E56ABF6986D447FBC372E0AD05D00110E4E0A66A40CC61B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1384-507-0x000001135B930000-0x000001135C930000-memory.dmp

Download