hxxps://bytebreaker[.]cc/

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
131s
max time network
131s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/08/2026, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bytebreaker.cc/
Sample260818-s8lebavfnd

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
106	discord.com
102	discord.com
103	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
652	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315416838807284"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1679180529-4058988202-686829476-1000\{2148E8EB-65AC-48D5-929B-4D456BEE72E4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 828	2628	msedge.exe	81
PID 2628 wrote to memory of 652	2628	msedge.exe	82
PID 2628 wrote to memory of 1572	2628	msedge.exe	83
PID 2628 wrote to memory of 1572	2628	msedge.exe	83
PID 2628 wrote to memory of 1572	2628	msedge.exe	83
PID 2628 wrote to memory of 4804	2628	msedge.exe	84
PID 2628 wrote to memory of 4804	2628	msedge.exe	84
PID 2628 wrote to memory of 4456	2628	msedge.exe	85
PID 2628 wrote to memory of 4456	2628	msedge.exe	85
PID 2628 wrote to memory of 4456	2628	msedge.exe	85
PID 2628 wrote to memory of 1940	2628	msedge.exe	86
PID 2628 wrote to memory of 1940	2628	msedge.exe	86
PID 2628 wrote to memory of 1940	2628	msedge.exe	86
PID 2628 wrote to memory of 1680	2628	msedge.exe	88
PID 2628 wrote to memory of 1680	2628	msedge.exe	88
PID 2628 wrote to memory of 1680	2628	msedge.exe	88
PID 2628 wrote to memory of 1972	2628	msedge.exe	89
PID 2628 wrote to memory of 3736	2628	msedge.exe	90
PID 2628 wrote to memory of 1972	2628	msedge.exe	89
PID 2628 wrote to memory of 4660	2628	msedge.exe	91
PID 2628 wrote to memory of 1972	2628	msedge.exe	89
PID 2628 wrote to memory of 3736	2628	msedge.exe	90
PID 2628 wrote to memory of 3736	2628	msedge.exe	90
PID 2628 wrote to memory of 4660	2628	msedge.exe	91
PID 2628 wrote to memory of 4660	2628	msedge.exe	91
PID 2628 wrote to memory of 2316	2628	msedge.exe	94
PID 2628 wrote to memory of 1628	2628	msedge.exe	95
PID 2628 wrote to memory of 2316	2628	msedge.exe	94
PID 2628 wrote to memory of 1628	2628	msedge.exe	95
PID 2628 wrote to memory of 4284	2628	msedge.exe	97
PID 2628 wrote to memory of 2860	2628	msedge.exe	98
PID 2860 wrote to memory of 4584	2860	msedge.exe	99
PID 2628 wrote to memory of 1560	2628	msedge.exe	100
PID 2628 wrote to memory of 1560	2628	msedge.exe	100
PID 2628 wrote to memory of 1560	2628	msedge.exe	100
PID 2628 wrote to memory of 800	2628	msedge.exe	101
PID 2628 wrote to memory of 800	2628	msedge.exe	101
PID 2628 wrote to memory of 800	2628	msedge.exe	101
PID 2628 wrote to memory of 2196	2628	msedge.exe	102
PID 2628 wrote to memory of 2196	2628	msedge.exe	102
PID 2628 wrote to memory of 2196	2628	msedge.exe	102
PID 2628 wrote to memory of 2448	2628	msedge.exe	103
PID 2628 wrote to memory of 2448	2628	msedge.exe	103
PID 2628 wrote to memory of 2448	2628	msedge.exe	103
PID 2628 wrote to memory of 4144	2628	msedge.exe	104
PID 2628 wrote to memory of 1248	2628	msedge.exe	105
PID 2628 wrote to memory of 3200	2628	msedge.exe	106
PID 2628 wrote to memory of 3216	2628	msedge.exe	107
PID 2628 wrote to memory of 3216	2628	msedge.exe	107
PID 2628 wrote to memory of 2124	2628	msedge.exe	109
PID 2628 wrote to memory of 824	2628	msedge.exe	110
PID 2628 wrote to memory of 824	2628	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bytebreaker.cc/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x244,0x248,0x23c,0x2e8,0x7ff9a639c188,0x7ff9a639c194,0x7ff9a639c1a0
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,16751865580071245006,3710484367026526486,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=2992 /prefetch:11
  2⤵
  - System Time Discovery
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,5599919456117890221,18267986787663226566,262144 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2168,i,15644485560614060055,18409342412329436328,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:13
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,10800091911178955780,8038776861369719033,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,13462873229568494417,4904450806413089206,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8457602501487515758,16779072108962003846,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,10824840809049471461,3065125287890231795,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:9
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,1103786521673087205,13652416934541369349,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,13592643620152980169,2742853968679427318,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:9
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,17794516973709875880,14944627555236964314,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,16909038218985780747,12461689265162270272,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,87548290620690877,1762099293533970181,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,87548290620690877,1762099293533970181,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:14
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,225541775236782036,9434360901778811248,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6072,i,6425359273431168271,17665438268855338645,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4396,i,3126543723863571362,15692377978543205891,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4680,i,4854651393770396994,6735650761626294202,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7084,i,5689069191039471211,13829759401037911569,2097152 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,2115845435099866964,7995245389356590139,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,9608976088211232688,3295731379449844664,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:14
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,13728873780384670796,15339612461517472896,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,7943159806675374147,11798914792133062444,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4368,i,9172958630363258972,8022578145790113549,262144 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,7953847282415711702,3525783799458493162,524288 --field-trial-handle=2100,i,12920839878715435247,8725337965257389283,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:14
  2⤵
  PID:824

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 416537d5becea53a7c07d47e3d22673cb50daabf00e6e0967f57baef645377f1
MD5 c860b8b06e275df195725e212bcdeafe
SHA1 09de72d74336a87c53fba76894f2fe4f1c3c8ad6
SHA512 4b56abe64d606bf6507c6b8a76cfb2c947a57a358fc11c20ee6188748c5873efbdae8847ac15174cc0d54386b6ce7a3be61c2b7479971d7acb2dd9173c3d65c1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1F8B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 45f521737e34108fcec0f24251f1736a9124dca7794b71ae2966e26d8a05fc0d
MD5 cd7793cdfb9295f447572efb6e70bf81
SHA1 dce217c94f7231f2559527c77b17604e0c11be61
SHA512 14938c84baa985800075d40695a2c29c097db067e02c4e847dadba963bcb208d88cf963091e96a6bfb0bf1ee245e50457f5f714cbd561eed42d6bcb9f59219f5
TLSH
T190D092317F5AB451DA46123A9841872A2DA5444A2AAB9207A261888DFDA50A8A3C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b83d8b3b3bb64ff97dfd21017822c565c50fa4655623c882c9854229a2eb9fc0
MD5 2a1c26025a16af9770d1943aece12b07
SHA1 e99f200ab4b656082ea4283baf673ac37faaae9d
SHA512 c6a6b667c750c33f99946cd667b400c38692f5bf6c8cc28971c0ef5899c7166adba2ea6dda0f083bb68464d66d757a9fa633c1820e825946725f45a260f459cf
TLSH
T15BD09B313F5A7451DA451235584087162D554445155793079151444DED9509493C60A6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 84fd1f8843ae9ec9235159d0e43d1a16260304e4146e4256b55130997f5f37a3
MD5 52ac43008d5c9a1543f6ec29df13e8cf
SHA1 ff87e035a31c080f43e00fc3aeec992fb9b7e4d0
SHA512 0f9d27718b65f6b41ab21d68809dc6c634f9abb2e3cdf496c8595268bcbc8be0c06948c204bb918c43316bcedc1741f01f572f15355b70d9f58ecf5932791c4d
TLSH
T1FD71711502517E9BDF74033084D0A33F3DB281A8DDAFDE86344878BD6652BE2E119C79
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d1d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d1d2.TMP
Size 3KB
SHA256 080dc58f0fc171385498e3f165d57edb5a3fe117b7f263a8e7c7f46ffa3ec867
MD5 ee143b106c443d41e02c6343c2b24998
SHA1 092655abd35b6f3c85a64418aa0e31896774598e
SHA512 2424a2dc02972b4504e9f009f45c05d1a676654b90765bf6ac3be8d10b2c3baed6b4913649474dafcfe92141010c79d7029795d20b550c495abd18699a32c65b
TLSH
T1B3613E1502627E9BDB39033194D0A33F3DB281A89D9FDE86354878BD6716BD2E11DC34
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 ea6bab924c7fa3897fa00d1970282687d3bd81a45eee349db8f749ade48ee991
MD5 83e6b65a19cc7d858f271f260c84a0d8
SHA1 850a3a44e56d926073893bbb10927fff26ab2539
SHA512 14c82834f6989219804ad52b48de5dc4c6c11d721a627e4eb0a5f518230f8a0fe6422e81b6c462098d8fe2ca108fce2624bc5b8aa072b92b5c6b8d41b24834a4
SSDEEP 192:DZ7+7t7r7/7c7wx17RI7L7M7k7C7u7U7b7k77f7S7a7m7E7jZGemAvPhq7B:DZ7+7t7r7/7c7wx17RI7L7M7k7C7u7U1
TLSH
T1DCE16AE683E5892EDC115AF19B152E2BCE1A0529972C3C2788E5DF5BE3E34B1E10164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 28f2e85c6df6055fb597bec264bffb67501c9de357ac62255f84047668e8f2cc
MD5 912075c8672761b6e6383a7864f36762
SHA1 86206a550dab58e02c6db4898c8e700692bcbc8a
SHA512 a28021efa6756699e9a53dabbf83d8ec2a0995d9146474bef760af9505924fb1e871d0e9a4da69c461356d995c56fe3f0884e6d3b999170e89a91b0df201fcbf
SSDEEP 192:sxZPRryM/jK1Ml8MFj/f+csvzJVmIdpEC/W6+WNGe9/Y0aLA3zIgrJ:sxZPtdj/fBsvzJVHX/bN/599
TLSH
T14252E711AA34A977CCDBD209FA45BB53D6F9547392910E44AEFCCA1C00E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 11507a82d4de1a69b6f93032b8b62323be005cf2732e11b7be35256ca4b2b396
MD5 6fb031f3853c5fe050cb8ff2da7953dd
SHA1 07eed35d6c5844326771d99af35031ca9f38a2ab
SHA512 f3c1c7cbb16886aa58f055a82d6f38ba4b9f3fb031f4107ebe66b46217e47a7ed15070977ea1191dd663a68463c02d8bd21435cfab7d3f2b8a85cc640dbee1df
SSDEEP 192:sxZPRryM/jK1Ml8UQToj/f+csgzfVOIdp0oxh+eJ/W6+WNv1HVCAGKR/Y0aiDizW:sxZPtqMj/fBsgzfVf9//bveAF/5sW
TLSH
T11162E951AA346977CCD7D21AB945BB53D6F5546392910E44AEFCCE1C00E7BEE220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bd60f62eeb9f377ae9af8777517cfb524ff947d19ac75efd0044be071baedfaa
MD5 2ff52c5f3093c7525739a78a16efc1bc
SHA1 471bc2463a325cc19751770df5147a0bcbe0ab2c
SHA512 264fb2b06b1b1dbb7a2a8a80b49fe627f2ccad0eb75e5cd6fa0d24407304fda787efc47570299ee84c6e0e4b8a33c1243c4c67f42b2d1cc7dadc02d612436c33
SSDEEP 768:9o/zh8dF2PkWRmEcQhw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3WjLl/2c0VI2roSq:9o/zh8dF2PkWRmEcQhwu1jaKWjLp2tVu
TLSH
T15DE20A3F280CC77E4F844A9CEC266F966EE801CB66584D5447FA894C03C77DB521A59F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 56ba9b1bc435e3b6787dcae79ffd16c445be508ed54f8da3f8ca619d290f1ea2
MD5 8f8a9772e821e5261bb0971d552ff44f
SHA1 004a7d4f1ac0779cb80723ce9b234888fe4dc505
SHA512 858cfe7f9558c067ddf0fbcf9d57de1942496a9ed7b69c1ebf03f018fde866210a7739544f41a58379a5b2b5884301cf2c5557ffb6242fd3865f8f0a3266e981
SSDEEP 48:KEWIHKvDAIfK12cryReIvKfK07yn32jXltt+X9UlIS3+KNLVB+5fucsxQI3ko5:KEWgKvDAgK12ayeYKfKKSsgKxmE
TLSH
T193B1379231BA06423D3D260DA665975BBA41B1633255B92B77E801720E2BE305DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591081.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591081.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 2ec9211f84c2145bf7e59e488b1ade3872ea17edc38a05b232ca27e21b92d145
MD5 15b343e2275aba3bd55cb1291d788971
SHA1 e8b3cfc0d31eb987d3952093b2f1a3510411105b
SHA512 21265d754161d53625702ad1924e1126428cbb4258212cc796ea73479e0e46696266e02a54074c4ac677b7b2f219a39784d37b98a88b534e41155bf074886733
SSDEEP 384:8iFPZcIE8Ns8TUNTUlIlsLkuuR25m2ns3v6Mrn1ulg84UKzEZUs:nFHEtwgujDmKsyMrnwGgQEZUs
TLSH
T1C6D22BF24CE7583AD8AE9743A77D2E134EBCC0A3B5856A40B7885E0DCC5A1BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 41608dff831d2ad8209ee1d8154a9295de945c542ee25b7be3adbe69e5b78f83
MD5 640a37bd4ea5541eea21161ccaa17334
SHA1 d1fb99626a55dab1eae1748aecf85a7d5cdd81d4
SHA512 1d2b83a0f82e2c10a1ff22c4ac4a5e6f6957b8b183c1074c3eef9decd545137cc325906c8a1de61cc17c686c2e2d3a7fbbf10a9c00827f9b92d4e05dca8da3d9
SSDEEP 384:ZZcIx8NknLkuuDLI9ns3vrMrn1ulg84UKzEZUs:xxHj9RsjMrnwGgQEZUs
TLSH
T1F6928C725C756C3A58E6E141F48A36134FF8D0A7EBCA2B8099DD6F1D00EF5AC131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 dd4d0d5e80a8263f811998da1bc85c645aab96c95f58bff7d0b135d161d089d8
MD5 30f4eff0ab30020c6ef92d6240cd9af4
SHA1 19fa2434a22d5bfc58f2abfa893dee88ef4cf146
SHA512 e41a84309596d063104af1876686adc0ded96bfcea0b5c9b0e8fb2518443ac312df0375028b812183cc336f271ff3ab03c1ec916fd64f89cb64199ca22ad4c96
SSDEEP 384:oZcIx8NkbLkuuRL5m2ns3vlMrn1ulg84UKzEZUs:WxLjwmKsdMrnwGgQEZUs
TLSH
T1A4928C725C756C3A58F7E141B48A36134FF8D0A7EBCA2F8099DD6F1D00AF5AC131A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c572667a3b825d5924739031c7d68e8e25c8dad341e426d0a9752d62ca7113a4
MD5 136d89bceb7bd87afeee7bcfadca4443
SHA1 ab8161f9a6bdc92af8c8b0d3880516ec48bb896f
SHA512 fd02339cb715790e54a28e2fd3314bf53f5ac21917170e943fb62ef3eec21d6f424a41fd0772899c2a80ccfbe6f37ca497d9ac10ef2c3f377253712de84f291f
SSDEEP 96:8bqGNkzQsjpfN2dYXOR95ih/cIPURHl8h4otop5z1ISDlBYP6vVjhLcgz00rg6MY:BGNz6P2UOcQmiUyBIUbqGv0W4zwSTyU6
TLSH
T1A802F9796C786CBB8EF2AE45B88737135FE8107BDA952B80D9E41F1C00DB64C2346936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa021e732f50d7e82e2ee86e6a2a67cebf872709f8aa7027e0f80eb0a1a9ea0a
MD5 12f4d77755f799a0290c8b08e9704d93
SHA1 418d603ee606fa8210f1a7a3f25f69fb11127d9d
SHA512 7cbff24e96788eaf30cd8de74fae2d28209dc12ef74b1b284f367d46be103dbbe377ab4cc0ff6f39048b67c0af3623094c57e449079a9f62c79ebe9d096ce0dd
SSDEEP 192:/GNl6P2UPQmiUyWEbfGv0W4vS6HtE0Boq2U6:/GNl6ei/YfGs3vZMU6
TLSH
T1C0120A76AC686C7B4DE3A540B4C732035FF84167EA8A3F80D9DC2E1C01EF69C634A526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 70128d5d49904f8180878e97b207b2a8e73d1cf4a05d7194be56df722c50c826
MD5 6c1aac9a9b20a356b1b5e396017ef9d0
SHA1 91d3a425182f9efd11689a317f00e77e92139565
SHA512 d6b1b0e769bcfbaf97a4491526b10fdcaa6d47e21acd1e7a4095277216caf446e799aad0f68f2c20e8099b8af0611504559451c2a9e1cd327149c3bedfac68f8
SSDEEP 384:tZcIx8NksLkuuRL5m2ns3vlMrn1ulg84UKzEZUs:1x0jwmKsdMrnwGgQEZUs
TLSH
T102928D725C756C3A58E7E141B48A36134FF8D0A7EBCA2F8099DD6F1D00AF5AC131B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4ef5bf14baa765603dae077fc92ccfc1c9a3f634a1e007add4426653eb50eca9
MD5 df0e7468fcbfe24f71b8aa96a097b9cc
SHA1 e9a7b8b0543fd5bd98c79b4a984fa58244ee2049
SHA512 2185e8d280491bbf328ec964f20745c5aeca74ddb2c6bf93a7a54f9466c245a3dcec1bec269779b0d5d0ad475cb7dffdddcd3e8d7eee95a1b6c31d52796d2c1c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5917d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5917d4.TMP
Size 392B
SHA256 1e358f6c5778f44fdd5d48faf49884e803b6cd1d902bdbf027506b6a2dcf3e25
MD5 df3ffc3daeadf2341c6f21690d355a76
SHA1 58d068cef7d37c62fee81dc5585fdcce713380c9
SHA512 0c3d30c2dce3589dd48da2f6bacdcd606cc00b977f076444ffcc2b81eab3938e514a61a1399cef8f01688b43c7d3d258c35e2a5f9e2d245b2150c5d843963cd3
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download