hxxps://wetransfer[.]com/downloads/8e89e27bbc2572be44d8ebc826e9479b20260819153900/3c9f7f203ab9489f6eef2b8fd205a04520260819153921/8b82d6?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 08:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wetransfer.com/downloads/8e89e27bbc2572be44d8ebc826e9479b20260819153900/3c9f7f203ab9489f6eef2b8fd205a04520260819153921/8b82d6?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01
Sample260820-kvsbpswvfs

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
360	564	msedge.exe
360	564	msedge.exe

Detected phishing page 1 IoCs

Hiding page source

phishing

flow	pid	Process
347	564	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316897505337924"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{F850E489-E46F-46B5-82BD-383A0A5F2E51}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5916	msedge.exe
5916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 23 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe
3212	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 1144	3212	msedge.exe	85
PID 3212 wrote to memory of 564	3212	msedge.exe	87
PID 3212 wrote to memory of 3292	3212	msedge.exe	88
PID 3212 wrote to memory of 3292	3212	msedge.exe	88
PID 3212 wrote to memory of 3292	3212	msedge.exe	88
PID 3212 wrote to memory of 4068	3212	msedge.exe	89
PID 3212 wrote to memory of 4068	3212	msedge.exe	89
PID 3212 wrote to memory of 3780	3212	msedge.exe	90
PID 3212 wrote to memory of 2036	3212	msedge.exe	91
PID 3212 wrote to memory of 3780	3212	msedge.exe	90
PID 3212 wrote to memory of 3780	3212	msedge.exe	90
PID 3212 wrote to memory of 2036	3212	msedge.exe	91
PID 3212 wrote to memory of 2036	3212	msedge.exe	91
PID 3212 wrote to memory of 2336	3212	msedge.exe	92
PID 3212 wrote to memory of 3988	3212	msedge.exe	93
PID 3212 wrote to memory of 2336	3212	msedge.exe	92
PID 3212 wrote to memory of 2336	3212	msedge.exe	92
PID 3212 wrote to memory of 3988	3212	msedge.exe	93
PID 3212 wrote to memory of 3988	3212	msedge.exe	93
PID 3212 wrote to memory of 3868	3212	msedge.exe	96
PID 3212 wrote to memory of 3868	3212	msedge.exe	96
PID 3212 wrote to memory of 3868	3212	msedge.exe	96
PID 3212 wrote to memory of 2064	3212	msedge.exe	98
PID 3212 wrote to memory of 2264	3212	msedge.exe	99
PID 3212 wrote to memory of 2064	3212	msedge.exe	98
PID 3212 wrote to memory of 2264	3212	msedge.exe	99
PID 3212 wrote to memory of 2836	3212	msedge.exe	100
PID 3212 wrote to memory of 2836	3212	msedge.exe	100
PID 3212 wrote to memory of 2836	3212	msedge.exe	100
PID 3212 wrote to memory of 3056	3212	msedge.exe	101
PID 3212 wrote to memory of 3056	3212	msedge.exe	101
PID 3212 wrote to memory of 3056	3212	msedge.exe	101
PID 3212 wrote to memory of 1112	3212	msedge.exe	102
PID 3212 wrote to memory of 1112	3212	msedge.exe	102
PID 3212 wrote to memory of 1112	3212	msedge.exe	102
PID 3212 wrote to memory of 2520	3212	msedge.exe	106
PID 3212 wrote to memory of 2284	3212	msedge.exe	111
PID 3212 wrote to memory of 2284	3212	msedge.exe	111
PID 3212 wrote to memory of 2284	3212	msedge.exe	111
PID 3212 wrote to memory of 3880	3212	msedge.exe	112
PID 3212 wrote to memory of 3880	3212	msedge.exe	112
PID 3212 wrote to memory of 3880	3212	msedge.exe	112
PID 3212 wrote to memory of 1772	3212	msedge.exe	113
PID 3212 wrote to memory of 4232	3212	msedge.exe	114
PID 3212 wrote to memory of 1772	3212	msedge.exe	113
PID 3212 wrote to memory of 1772	3212	msedge.exe	113
PID 3212 wrote to memory of 4232	3212	msedge.exe	114
PID 3212 wrote to memory of 4232	3212	msedge.exe	114
PID 3212 wrote to memory of 2888	3212	msedge.exe	115
PID 3212 wrote to memory of 2888	3212	msedge.exe	115
PID 3212 wrote to memory of 2888	3212	msedge.exe	115
PID 3212 wrote to memory of 5344	3212	msedge.exe	119
PID 3212 wrote to memory of 5344	3212	msedge.exe	119
PID 3212 wrote to memory of 5344	3212	msedge.exe	119
PID 3212 wrote to memory of 5352	3212	msedge.exe	120
PID 3212 wrote to memory of 5352	3212	msedge.exe	120
PID 3212 wrote to memory of 5352	3212	msedge.exe	120
PID 3212 wrote to memory of 5484	3212	msedge.exe	121
PID 3212 wrote to memory of 5484	3212	msedge.exe	121
PID 3212 wrote to memory of 5484	3212	msedge.exe	121
PID 3212 wrote to memory of 5540	3212	msedge.exe	122
PID 3212 wrote to memory of 5540	3212	msedge.exe	122
PID 3212 wrote to memory of 5540	3212	msedge.exe	122
PID 3212 wrote to memory of 5836	3212	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wetransfer.com/downloads/8e89e27bbc2572be44d8ebc826e9479b20260819153900/3c9f7f203ab9489f6eef2b8fd205a04520260819153921/8b82d6?utm_source=wt_sendgrid&utm_medium=email&utm_campaign=TRN_DL_WTP_01&trk=TRN_DL_WTP_01
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff81128c188,0x7ff81128c194,0x7ff81128c1a0
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,14302580231998423410,15132410430875176244,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Detected phishing page
  - System Time Discovery
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,11329055442533905493,7579515865785833647,262144 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,10200962333457621122,4150524948659765841,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5311790783763668580,15156785371309272872,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,8003491764806373319,8844299750602549792,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,9904176430128338096,3497435666018299142,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4380,i,10794839818540317068,11958401196235432910,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3488,i,11882856963924820877,9911604600223679758,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,4171966448398181323,8303153219608509621,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1122888040294710597,4194154873089547863,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3352,i,9025201070229790064,15134468493417209575,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5016,i,13958840168897126891,15352521215956191880,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6172,i,13115592443106232880,16263450737965904303,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8823862740171841928,17311058690931875685,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8823862740171841928,17311058690931875685,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6788,i,10702765269260184290,8818350364129156901,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6660,i,9918703662960850747,7747717062930377137,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6900,i,4218719693832176810,5412998022832354261,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6952,i,15832907902753309144,503732595866523835,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7240,i,7806647907039703911,11471560139034492811,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6184,i,17560728851798004269,9677666483402649747,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7268 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6968,i,2573288819279159801,6644812812366919767,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5860,i,16649245955790385185,11834571513776718693,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6972,i,822677304187028217,18232818571685026768,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,4404733838910030338,5880982631580346008,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6660,i,16875483275991910586,6159592894481344640,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,4982821945745890954,4123165748465095687,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6260,i,12451228480685395810,11778817349642746528,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5788,i,12145980155584097796,5892764748196969627,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=3520,i,4510083288521513451,10640881265093629747,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7768,i,4780685765307242447,9553833191658785025,2097152 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7944,i,11475098043285095258,13640826951562159109,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7956 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7948,i,10558080890470423548,6788050961271065998,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=7980 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7952,i,2472957374127114173,450427776558070205,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,16371671695428766684,17601679577928039114,524288 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3600,i,343460617611050283,496285519039623652,262144 --field-trial-handle=2352,i,1657884199921356635,16038520281704783099,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8247aeca7b33f283e40bb306bc0f5d3f9484f29ba499d4fef16adb4f524d067c
MD5 b27475a4adc7a441cfbd4e10636bebca
SHA1 128cd1ea190d0ec80228a1924b99cc6fe4d9e60c
SHA512 0f3a31480c4406c56e8db918a4bf77c6ff4f86841313f82c28703b2711e4ea7b4057b1278f6ec66772d1887ce88d74f882ece97b27c07f9de109017c91044366
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T16DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 48KB
SHA256 2f8841cda416c1e1eb997ea721a77b270471f3b6715fb62a5598d4b3ee158513
MD5 153cc21a36f7f48609ed630c0e0d8c2c
SHA1 d3c36daa4d296b0045a1d3de0bec179c5540b008
SHA512 358c45a0b61c43810cb2f6c0af3cd5c404f8e8f7d71492f34170f06e53aeca76bdde068ebccab12efadda4ba30d177f0a38b9c354c09a90783fb14609eac399c
SSDEEP 1536:Wl/ktfxJS5qPhZnESufAyiZOz+olYT4SDmfGv0:WRktZU5WZnESufLion6LDmGc
TLSH
T1D123021468243DECBECE414C5A3528937757BA34D1FAA20491670FFBC8CA94AF146FE6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 247KB
SHA256 0920aea22c7821deb2d19dc69386f310cc753255f678ea50c22cc14907ed171b
MD5 b13cbfef0061ec12001e497d883c6f27
SHA1 f7b54ba7c45ff0b0b72f74cdf8c7a3940de5b694
SHA512 a2d21749944fc280e41831ea504179fd12433a0f7651dd44e88543b6a7084358a2755d679d7f60b848bcc64b77ce97abfa13807cd8791cf66b6e8c1b62a80eec
SSDEEP 6144:00trq7LDUVtiQtMKq6BpesPmw4+1vB8TcwEsFL6X6LceNGk:9xynUniQtTq6BH+w4+2cwEa2XSc7k
TLSH
T11F442300B9918E23DDFBFC48A87B2B7A75F5296E60037945DC31DB42E9D3850AD81B2C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 16KB
SHA256 386e2ec0cfcddd5e2a59311de1081251de2cf70bf16dd52e8db4821ee061afc9
MD5 7b40547a18fae324d326d9ab0b1697a6
SHA1 d74d7824b69dd5e0965f2bb2bd8074765e4497a8
SHA512 ef652940054f074a197c4f01628966ffe19bdf85b0655b426c3bed071687a6b058a68731a58272612f7cf6b50d3f9f0f21768fe4a715c45cb609e6dd1770ee43
SSDEEP 384:ua9WPPYozN9ojZBAitmejpyge3S3DpSTOw/+HK:uacQozToTHDrD9iOYGK
TLSH
T14872E00D25C56C9CC17B05CBFF8A437AB471CB3AB9836CCFE495F56991478960242D1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 41956f1fb5a2ddee44be3cf2398b416ce12d17e8560c88e6b2ac84815aee708a
MD5 a19dd6fba593b6c6ebdc8e2f7a419061
SHA1 667364bf97be7a2afa83157002b41c5d20f134b5
SHA512 7880b1642a603621505b7a41b2b118af7a0f0790ea3d34d9890708e1a9a24eaf8fd0fe76b268c15077e4ab6032867d473c65f2a561ed1d9e7b2e8f3d8bc30290
SSDEEP 192:mv/cFELx6aaaja6QlyVWRTxFt2imHDw1KnYVl+vKq+9:MOEvFelyETn45H01Mil+69
TLSH
T14A021BF3A15913ACFB200AB15BEAD420B135BDC4F5073FBB109A6935292EBEC6857417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d08a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d08a.TMP
Size 3KB
SHA256 a82defbf8ecc2bbdae0684dc034a7c8b9d575e71451bc73ae779cd5ea938be94
MD5 436f012ad9767586d5a9d249c12287c9
SHA1 75c7ad9cceaebf7c7073e60f828d80d4f3814f7e
SHA512 7d6c37b73a083bf49a99cb7ee811376ed526fb2af27fcca20907aa298f5c5a8a0dcb784ce55bb51bf215af85055d465bac706fc315df3fe7a411720b5ba5ddd2
TLSH
T197714DF431111B6DF3300271ABEE02257538BAD9F4477EAA1064A836590DBED7C2802B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\000003.log
Size 284KB
SHA256 780fffadd112b8872b888a7d94008d7b3a3566562f29953f4e0b39283fd1b57d
MD5 2a940f5b3a58ff0ec20de8b0682833e6
SHA1 226eb075c91ce989c881b5a4affbba4489238ba5
SHA512 cd72f977f2c84bf73130a7c98f3d409a22293c39e5f3ba15789027d4ec542fffe4e6244bc66b150e86b2fc5d033675095dc21aecc0931a0314619dd881020d5b
SSDEEP 3072:bRw1WbNXzW9iTQxsQ5cPNkdtpCUhXW1pzAoRjvbkl3Xco/e45PtjqnWXT2oEaGzU:A9dxtOa93XT
TLSH
T10B541BBFCC44D97BC8B68439A1E92BC5677AAD12B8C45C0E64EF22284C327573CE594D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\LOG.old
Size 349B
SHA256 6d4d621ac11da9ea4d8c1bfbca3f0dd86905367ec0bac2c339437c6ebe8ca478
MD5 af46a52031591999e32d34d6dcb479ea
SHA1 50b9076005039ba584a28345ff3541ba92ca1f06
SHA512 be283bd12df7ab0bb94368d4b1f4a73be799fde3c04c021eb7f23c61f292b669ef77e43ad143aaa576f72bf8f1d095206bf389f886fdd2488712354da005f540
TLSH
T1D9E0D838CCCDC65F911462972974BB0D95ABB70EA689BD492F05C8547043048D17E162
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wetransfer.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 830414a4c7cfe26d6926d12d2100f89a4cd6898c09827f29e09034f18bb694e3
MD5 fde578e67e335ca026d03b5caa475d56
SHA1 e8d07f876956eba34ccd8a026246bb55e1ec9189
SHA512 eab57db469fa0641ad3010140c36df198266d5b4896d1147d6b89dab3692c5e84b7f487d39a6d31b939a4fd166c76a0991301cc1d3ed346b2c8104aaf89f7962
SSDEEP 384:DIAAHNeedsgbbjJ2mX9eh7eD/ceeiLHF0e8deGUKyFBGJxG9q16CHlu5C67F4xw3:8qUi60Lu7kWR
TLSH
T16A82B3E7C3E4872DC81516F06F142E17CD1A052872693C2789E5EE9BE3D74BBE28164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 07c01b8fd9bbbf169f292c66692380d1f91f9e1fc7bbddb3e630ccabd782a5d0
MD5 86c9d54fa164c6645840ef03d0e74290
SHA1 1727f4f06d9e04cc9d892a9d3b8f95e3dd1a97bd
SHA512 3f62719fea9c4747029874b17b1bbd6f5df8c69a9166cbbdbc47aac95a0d620e487b508bec334c9c227f2ca98e1ca6ad3a981f6825f4be23fa391189aa5948dd
SSDEEP 192:sxZWRiyM/jK1Ml8Mkp/fns+PFrVLIdpPjHW6+WNvcmA/Yvf993wIgrJ:sxZWYMp/fnsuFe7Hba/kc9
TLSH
T12252E7126A346977CCDBE209F951BF53D6F90562A2901E44ADFCCA1C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 372c1516f8946e89819bdd85e3e11908647168de24e685f8077a6c9a594b5c48
MD5 1c1387602e839a49c7cda5ec05abe6c1
SHA1 73eb2a25e5650876e4be8273c5555bccb63139c4
SHA512 fd9f80eb5c7a826433f87bf7398851a5f84015e2f6c2aa8a1bc269d94e80148fadf589d84cfa51f0335f31eb4d9abb28b615ab0921435f94498107e8602f692d
SSDEEP 192:sxZWRiyM/jK1Ml8UQg9p/fnsuqPadVhudpH3pcfZHW6+WNorAcelXYv20A3wIg5i:sxZWYqWp/fnsu6aUeHbfXBcw
TLSH
T10062D7126A346A77CCDBE209B941BF53E6F5557292901E44AEFCCA1C00E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6978b96ee81ee74d7bc651b4d2129f4f10d91416647a9da3a0aa63b984e8ba6e
MD5 6c9e55c2ef88da06d88cd5d1fcee52bc
SHA1 139b9de1648940c57210729d8956c2ffaeabb1fd
SHA512 cec3a4b605f3eba823328e87b84f23771a3c8908723dc21d3f1700491ebfe1f7777bda7e3e421b9caae276318c651d9baa0f161f1ef92e281cd76406f618101a
SSDEEP 192:sxZWRiyM/jK1Ml8M9p/fnsuqPFgVhudpd0ZHW6+WNvcelXYvL993wIg50J:sxZWY1p/fnsu6F7OHbfXEcy
TLSH
T17C52D8116A346977CCDBE209F951BF53D6F5156292901E44ADFCCA1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ab670d60e64abff3854ca5cda58683b4a0436ef36dcf542394ec3e1c8d972b6f
MD5 7c49adcb52dd643f146010d58fb3fc45
SHA1 a6cac38dac57ed9573382cd12bd984c72c97b84c
SHA512 47cb907647aacbdb4caf80eb777e07af5c6f93e88954fd5a88c7bcdf39ad4aa24f2af88041a433f827ad721871b98233505abb393091b7834d74123932413480
SSDEEP 768:VBseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppiroFD:VBseJ3xWvhfynu1jaVcL88p5N
TLSH
T184D20B2B680CCB7E4F844E6DEC266F966EE801CB67984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 65KB
SHA256 f25826d6b7ecb526dd40a27a77657a10d08af716b8a8087d267069dd8c4cdfb5
MD5 ac753564c25f6e5f3bf102978d5407c8
SHA1 aab18cce992595b508091292a7bc3b19235b5ff1
SHA512 714177a8a6ff2bf811224b3c171c4f9975e68d20542366e5702901d4ca82a2bb66e2035bc2f6e5b4dd6c83f507652fd1e604bb8bd867eac64d54f4fc7b9c29e8
SSDEEP 1536:kwaGJUKEXr6EYQ85iwMAJXHWgH5sM2Vho/gkU0nIjNjHWJvkAbrNTM:g+XHWgZANjQbrS
TLSH
T177633BE3341B10A20FE776BFE856E9E5BC33615D6CCC8958FB30492D1384A7C166B998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba23d8ecda68de77_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_1
Size 111KB
SHA256 eadd927cc33902fb1a7ffeee24d30761dd9e87b0927e6cb345b33b48d6550ddc
MD5 247c894fd96ac0f1edbbf7aee1d593db
SHA1 5ddc970c8982838c326f834a7990ec0c51f732de
SHA512 d580c897ef79d57079cc3d3dadcf2a7a22efd5e83baff8a8941a2a99dadfa0deb03ea7344f06512e3e70277e9d5803a015ef355b2477ab9b89a414a32334453c
SSDEEP 1536:Yp7LRx/huv3FZpg/If2lnjPH952PSNBdtckbbRs4HHCDOcLspFAO+e+Cysjz6s+:SLRzufFZN2f52PSkkIrLWF0QzB+
TLSH
T197B32EC2AF8A77E1DFB7217E14D2C297BDF282CF1FC1D126E561A209184826916F705B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 ec9ffbfd070c5aef4fb7a0ab49d40f5c0784d769ac01fb5678f083851e6d185e
MD5 7c3ed17a0e1f5c97457c6aab96a7029d
SHA1 1fb9393a4ee858a3aaf751dcc4caffc7bd072b60
SHA512 ec9fbe934c19a5e6b63888df916a534c4673c32c2be75945c078bc2db5455fc8cd37a1d9874c5d51fdee5e37b1d037f47078b5b996de6206cfd6ed2228476ffa
TLSH
T1CBB011028AA00202C8A202388AC00088B0A00CA0020A222320E0003EA8222282303083
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589872.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589872.TMP
Size 48B
SHA256 df95febf8d80eb76d991b4cddb497cdb2a88551bd38a86b89c20fd51e7dc9944
MD5 d749b2d1cbc29319e25d07ccafb5fe5d
SHA1 515ea5aadf908e972996daa610ab7362410e185e
SHA512 e14747cd90c6e437b5590bdd051b4f97e6481b9403ff64abaa21b60c0d4a53d26e1afc10bb2c0556e10014cefde763143b1dfbe6ad7f521eb6984edc6edbedfa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 bb44fb9529ae7c3fb43b8e9b4cdddc745ba137c4a9588de1f1e1909e06cf5b79
MD5 a35fc1793599b05dd4b6419ad879c9ce
SHA1 d9dcc8f1100fb4e0b7e99370c024c44186b72ec1
SHA512 b94a7df168a9c61d1e2cf9686d5020b0b1b297bd8514a7eb8d7d5486953c86d369e38617dd979fed8d7fcbef79542e6f07befbada8fc71660f9787f0d9427259
TLSH
T172A002111785044BE400167424926F607B14C8520501532786A5414CDC551514A72605
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2eb215aec3759318a6c50ec6dce09c9174b4d0f3a5fcc62759b89a7abc8b2945
MD5 1c0b6fc8fcb997541c3c21cdee4b2c33
SHA1 cdf8785881adb3eca30ee3a2d6be49ccbde32453
SHA512 a6f739ba3ddd7ea6deb8b74332592c53030c34ce1a19dbbd7a7fd2118fd11086c19effe45a705e6b9ad40a23053817f6d387a419e6458d457b1b3d7ff5c6be06
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EP:KYHIhKggkXyBcIHK5W8Ty95I5KSEct
TLSH
T1B7914402347F12423C7E294DA6A196364E4231E335ACB4AF7FF800A51E66E114EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd0e869a-43f9-48e6-b236-7628eea200d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\dd0e869a-43f9-48e6-b236-7628eea200d5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ba030b62f276892e8a8a765a885c30a2508546a25cfe93153d13916bbde738f8
MD5 a9b32b16afa8d7160253d0d6cb988fd0
SHA1 a886153832067d1051b8daa65b0a327282c85319
SHA512 de76e6a63c11ff25f31754e27086bf50866f8aac4eb0f2dc0cfb806ef5a38df565a6709612e2f5aff8fb4b56e3902dbbce150ff38be2a2135fb6fc10139cc0ba
SSDEEP 192:uJm+xasuheOwQxMGsNz0QqB4JcM7AmDQmiU1zAas4MTFp+FdLXKxzSJrg8z1IqSI:zZcIhsNz0v417T1yajldLKoJr5Mdu
TLSH
T1C8626D316C789C3BA8B3B186F54A37134FF4916797C42B94E9ED7F1D01DA668130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 a03d9e4958be283a3c76815ee1ab21255a1bb235f358781e6df25ecd9c6851dd
MD5 d2b5569a7b2c6d219f0e507f6fe4d39a
SHA1 05e7c412503de0d9522c28a3a02094cc77fb02ec
SHA512 00526b37c6515db41fdc5908317752f75babedadfc2271d45c380ddb753cdd6ae6ef78f28ec46889446d14805cbe8473de889b1193f4b44efb9a5a2450bd09a6
SSDEEP 384:TiFiZcI5sNN8TUNTUlIlxv417Tbv++1aE2ldLKoJrhMdu:+FQ50wgQz++gEMlhhMdu
TLSH
T156B219F24CE7893BE8AEA747A77D2E024EBCC067B5806650B7985A1CCC9617FC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6342d0555cd23cce3191173952033f3842ec1ad601677a9c36448b03ba4c41fb
MD5 9dc59005c4d0e5b77e3d815996d9f9b4
SHA1 c633978a576527f890e91735ebb1ba17eb8c6f73
SHA512 dc728c1678d0e294e6cd3791d0e08f5f1854766c4ac283623f868aeb88090d621342b97ac462b2ed7c696ae098fd285f8bbee74526f5f9323e068579e58bcf88
SSDEEP 192:uJm+xasuheOwQxMrsNz0QqB4JcM7AmELmcmiU1xAaE8BMTFp+FdLXKxzSJrg8z1z:zZcIEsNz0v417TbwaE2ldLKoJr5Mdu
TLSH
T1DB627D716C78AC3BA8B3B186F54A37134FF4906797C42B94E9ED7F1D01DA668130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 009b6f62dbd463e8bd4e9e54d7f4d6424c6b162d5c3e529fdfaff719809021b9
MD5 a4df8e7a881c43273a898d1e0282a104
SHA1 bf01aebe54c74a5a30d4e71fd075928f26b453b1
SHA512 95f3396bdad470403752c452e4616d45f719dcd6917cf8c4d1cce754300845e62a3322bee5024bf298183d89f735b1c9fd1f3e0f825ccc1986155f431ecdbb2e
SSDEEP 192:u9m+xasuheOwQxMrsNzxQqB4JcM7AmELmcmiU1xAaE8BMTFp+FdLXKxzSJrg8z1z:7ZcIEsNzxv417TbwaE2ldLKoJr5Mdu
TLSH
T105726C716C786C3BA8B3B186F54A37134FF4906797C42B94E9ED6F1D01DA668130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fc4b9c9c601e1628e730c8fd33fdaf500f248186e13f4f88082e31257bfe353
MD5 57155a39376887451bf0173acf298eee
SHA1 21bdecf46f35366c60b69850bb8b313a0913abbf
SHA512 d7a86c17d4303a1c1b55fd0e97647ebc9ce8e8809227d9df64431b066fd4a718463c779fb94e7466804c5ae8a39eb7524bf3ecea10b60b83bbccee3c34ed89ab
SSDEEP 192:lON76vMtPQmiUy7JThTFp+FdLXKV847YFU/u:lON76UtROTOdLK1sU/u
TLSH
T1AA020935AC786C7B9AB3BD86F58E27175FE4216BE5D01B54EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ed7736ff438b3320b89ae5f7029b621fd7b5f658bf401fc5493ea58544754edc
MD5 24d4bafc1c60f503727f5faf93214685
SHA1 b39943c4e6afafa24fdc59ebaa5869e1c7c23884
SHA512 1200e9f2dbb939ca730c86fd0e72015665cfd5382795126cf50353266c52dffa46c53b94cee00730fbf8f87eecaa6523db746e50726c14e932e157420fd95059
SSDEEP 192:NON26vM4PQmiUyUJxhTFp+FdLXKxzSJrd80IIqSU/u:NON26U4RzxOdLKoJriMU/u
TLSH
T1E9122C32AC689C2B6DA3B585F58A36135FF0916BDAC46B50FADC3F1C01DA65C1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dc364ffd11d1aae92712116d0c1871f4689f48e9f348309ab595ffe0fb2d20cc
MD5 bb25bd9e17086f4bec7afee74bf82286
SHA1 aa1d8bfae175b3ef6b34076db4a0241d4fa12d77
SHA512 c78d3049a67d5fc9a78653ebefaf934bf4c75f97d60c6e37f91f555ed3612105e10d64f930f99bbb058b65479fb4c1f27f3c0946b2b026c076e27ce6dbf99b3c
TLSH
T1F9E00202D7004445C8281630549327652692C0E40611624A5D1601682D513812E40240
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f55b076595b4b41de6b019cfc092dd0dea7f58702da3420db4cc60b89b708333
MD5 85f8c3809c2b820ba31d08c50482995b
SHA1 ad5fbe8b0418187d4feb964f223a2d84fd70bb29
SHA512 1dd769a84170af902ceb18e886ed5d9d6a3d111d366329fa0c0c49c3eeea080bbe426dbdb88ad1667133dbf24f855247cd0b32056d67c891ee3a06bd5c5f9e30
TLSH
T16CE00203D74004D9C82C163414D32B7937A3C0E80652634B9D1601782D603816E10680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5874be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5874be.TMP
Size 392B
SHA256 8f4620609686cda5cbe56a64f75328642c8560d8341fc31dd079662a90279ea3
MD5 2788b864e4a23729fe71b15e166e6b19
SHA1 b9730ea07cb3c6c75cbd350599eb2e857feaccee
SHA512 1292cb5859fa51bc97d21806fb5641f7e28323cd954907082285b1a9dc4a0cb49d5a273f7c8435323cff8d9084d21b65c1a0a9bd836452825c50f9df3861f8c6
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 32a32b4dae10745e9433a0e45c3238a8b5704ee67eebbae58dbac9442b277ced
MD5 004726060f6577ce24aa31690fd225e2
SHA1 d79ba9c1c37a474b9c066f32ea769ddc1d4a875e
SHA512 b72670d438963cea91f982cec25395cd58d3d7a7826e6225a7a0bc15861335d9c2d91127c29cd3436814586836eaf8b95724a3ab1072e03d34245fcb9ffa62ab
TLSH
T1BC412A4CA6F91144B3B77E5A9BF6A86E587B78772E06946D00020D4E0A62F40C971777
MD5 SHA1 SHA512 TLSH

Submit Download