hxxps://rekonise[.]com/discord-server-47caj

Analysis

user interaction
yes
max time kernel
191s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 17:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rekonise.com/discord-server-47caj
Sample260820-v4tk8svyev

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
186	discord.com
187	discord.com
189	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317208004831040"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{37B7E144-2AD1-44CD-B442-B3E883FD055D}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B8A1AADD-051C-4E6D-B5F2-1B90DACBB019}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 5056	2172	msedge.exe	85
PID 2172 wrote to memory of 3440	2172	msedge.exe	86
PID 2172 wrote to memory of 900	2172	msedge.exe	87
PID 2172 wrote to memory of 900	2172	msedge.exe	87
PID 2172 wrote to memory of 900	2172	msedge.exe	87
PID 2172 wrote to memory of 1568	2172	msedge.exe	88
PID 2172 wrote to memory of 1568	2172	msedge.exe	88
PID 2172 wrote to memory of 4672	2172	msedge.exe	89
PID 2172 wrote to memory of 964	2172	msedge.exe	90
PID 2172 wrote to memory of 4672	2172	msedge.exe	89
PID 2172 wrote to memory of 4672	2172	msedge.exe	89
PID 2172 wrote to memory of 964	2172	msedge.exe	90
PID 2172 wrote to memory of 964	2172	msedge.exe	90
PID 2172 wrote to memory of 2672	2172	msedge.exe	91
PID 2172 wrote to memory of 2672	2172	msedge.exe	91
PID 2172 wrote to memory of 2672	2172	msedge.exe	91
PID 2172 wrote to memory of 4664	2172	msedge.exe	92
PID 2172 wrote to memory of 4664	2172	msedge.exe	92
PID 2172 wrote to memory of 4664	2172	msedge.exe	92
PID 2172 wrote to memory of 3180	2172	msedge.exe	97
PID 2172 wrote to memory of 4232	2172	msedge.exe	98
PID 2172 wrote to memory of 3180	2172	msedge.exe	97
PID 2172 wrote to memory of 4232	2172	msedge.exe	98
PID 2172 wrote to memory of 3172	2172	msedge.exe	100
PID 2172 wrote to memory of 4360	2172	msedge.exe	102
PID 2172 wrote to memory of 4360	2172	msedge.exe	102
PID 2172 wrote to memory of 4360	2172	msedge.exe	102
PID 2172 wrote to memory of 4432	2172	msedge.exe	104
PID 2172 wrote to memory of 4432	2172	msedge.exe	104
PID 2172 wrote to memory of 4432	2172	msedge.exe	104
PID 2172 wrote to memory of 2472	2172	msedge.exe	108
PID 2172 wrote to memory of 2472	2172	msedge.exe	108
PID 2172 wrote to memory of 2472	2172	msedge.exe	108
PID 2172 wrote to memory of 4532	2172	msedge.exe	112
PID 2172 wrote to memory of 4540	2172	msedge.exe	113
PID 2172 wrote to memory of 3900	2172	msedge.exe	114
PID 2172 wrote to memory of 3688	2172	msedge.exe	115
PID 2172 wrote to memory of 3688	2172	msedge.exe	115
PID 2172 wrote to memory of 3688	2172	msedge.exe	115
PID 2172 wrote to memory of 2424	2172	msedge.exe	116
PID 2172 wrote to memory of 2424	2172	msedge.exe	116
PID 2172 wrote to memory of 2424	2172	msedge.exe	116
PID 2172 wrote to memory of 4412	2172	msedge.exe	118
PID 2172 wrote to memory of 4412	2172	msedge.exe	118
PID 2172 wrote to memory of 4412	2172	msedge.exe	118
PID 2172 wrote to memory of 3896	2172	msedge.exe	119
PID 2172 wrote to memory of 3896	2172	msedge.exe	119
PID 2172 wrote to memory of 3896	2172	msedge.exe	119
PID 2172 wrote to memory of 1752	2172	msedge.exe	120
PID 2172 wrote to memory of 4360	2172	msedge.exe	121
PID 2172 wrote to memory of 1752	2172	msedge.exe	120
PID 2172 wrote to memory of 5596	2172	msedge.exe	127
PID 2172 wrote to memory of 5596	2172	msedge.exe	127
PID 2172 wrote to memory of 6428	2172	msedge.exe	129
PID 2172 wrote to memory of 6428	2172	msedge.exe	129
PID 2172 wrote to memory of 7152	2172	msedge.exe	134
PID 2172 wrote to memory of 7152	2172	msedge.exe	134
PID 2172 wrote to memory of 7152	2172	msedge.exe	134
PID 2172 wrote to memory of 2564	2172	msedge.exe	137
PID 2172 wrote to memory of 5252	2172	msedge.exe	138
PID 2172 wrote to memory of 5252	2172	msedge.exe	138
PID 2172 wrote to memory of 5252	2172	msedge.exe	138
PID 2172 wrote to memory of 5868	2172	msedge.exe	139
PID 2172 wrote to memory of 5868	2172	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rekonise.com/discord-server-47caj
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff9f3a4c188,0x7ff9f3a4c194,0x7ff9f3a4c1a0
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,4865458560660098804,2289825419758523939,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,2332756468882162240,12791716702110000347,262144 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,15464301560585932846,2519200710093989058,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13446734235284302282,1599673839283765213,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13612909453406723838,17125011831437602678,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,4694958432408982004,15134850342027618230,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17655556019235506911,10323427847070848887,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,7227220803520096005,3375315346109657719,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13019263666230260062,13524291467438373198,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3221547544130752399,314402299897881434,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,3221547544130752399,314402299897881434,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,14957522048306388619,5740051941421968493,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6512,i,11862832005824392236,12650353865422624221,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6416,i,4320109338269380822,337671780301994419,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,2792607262764273083,17820176292490768872,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,17921330098948584090,935236248779772677,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,15445362489085210099,17462679468746308023,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5864,i,736304050110813621,8950203474561990035,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6652,i,8245844105377366397,17745903063120045974,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5900,i,5545049564323178762,2811789072754447037,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5868,i,532553842188575584,6433294781996701254,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6940,i,17307418256260740640,1783440428546723217,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6828,i,9860068527745843497,10556844349683419878,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,2295785656810679208,10899740520358999230,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,6091013098650906692,12238562995445338600,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:6428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6444,i,1710549905889058832,4180896613817045544,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:7152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,643143712821028801,11051928419670869250,262144 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7440,i,10529722854279783164,1579968841671294130,2097152 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,2002080796342252434,15778586751240716174,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,10857785497773118463,5343970370143458367,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,6322356834096683641,11278333654927005855,524288 --field-trial-handle=2092,i,3113436792072917576,626728435651848454,262144 --variations-seed-version --mojo-platform-channel-handle=7508 /prefetch:8
  2⤵
  PID:6076

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 015fb3077970e9035a1658d1b1757b5f1151c502ca5aba72322677dd389ba262
MD5 a332e5771886514700151487fc0803e3
SHA1 fa223baa69dc6c50019b6b01c0dbdf1c52de150f
SHA512 98ff8ce5a74571dfbd8813fda54fa21ed146df8d130405d052cf93d1536c6572a6b23be98fc604180e5ec939533ad70e021ad455ebfb2f457b79ae2658f84ef3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7M:fwUQC5VwBIiElEd2K57P7M
TLSH
T1BAB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 408KB
SHA256 91422ec0ed6304445e08e0214372baed8697c99d2387cf195c39be19fde7e640
MD5 4b4f5c6ef54192cadc14b2d9134862b2
SHA1 753a3a225a9059703b0b721e0635d13ef580d9f1
SHA512 dd6af45bf2d6977d08bbe7ca1b0d898c492d7cf704f0840210a93f251120e30640bba770c6c8af32b9116f7a34fe33256ebb6f4448499fe08f4b3b39c652046f
SSDEEP 6144:LKJ8W+9OftFH8jY4h+7hRkMN15xm1end5h4WphUq+THW1aq6ipPAgSHb3pvrdwK8:ea0bH8jbS1xh4WYq5Hpwt5qz4aa75i
TLSH
T14E9423866CC3ABC1B1F04626DB4C25CAB6BE77ED0081DBCCA1D9ED05C5CCD4AA71869D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 68KB
SHA256 6bd6fbc2d91e889d8f33ec22b3d274ab002e8869ef6ef10a8e626e6e13b46eb8
MD5 c00b6187958635e5df556992cacc4ee9
SHA1 41d08b23468bba4f0080914df44a2b010fc76bd6
SHA512 109f56fffde1bcd982a016ceaf00c3ac2d406d0a1954f5437462c68c69781a5c0b689861ee6b4136dd6b237164642991d91bdec7cc2d34beb95306c6e6b35d11
SSDEEP 1536:Ntiv6MDLzeilHaYbk/sL8IonWZPCP3eKm2hH1XF/k+Tn8X2+B:Piv6weA6YbN1xe3eK5H11sG8xB
TLSH
T12D6302B73D27D456654B3464FEB74A1C5BAD64E80109AD63C2EBB3CC00EC0E96B2F54A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 10KB
SHA256 ede061540b8a0560c13e2b757fad3bc577a2d2e6b74bd1a93ad8ea55c0e65326
MD5 e6b944846357f78ba1fb6711ef1f6420
SHA1 ff902ebb9bb31c0c88d240aa6650cc516b1f5d25
SHA512 6b6c2be980fea75f4c71e2232756ab33648044634d82c3f4e41c4b0b4412e4415851e897d5c8e87aa9e5e7470f5971494c4b5ac6b3b780a6f92bef522a07b498
SSDEEP 192:2lWzs+vrRS4MDhrMnZgJvo9elYTDpr4h9gosMoi:2lZ+RMdrloAlY9e9gosMR
TLSH
T10E32833786AE0A41CB403FBE81E16AC4373AC9116AD3BEC5A1B654B26D0DB5DFD3C914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 850cc4279c7eefede881f9adbb0a123ae575c2d005bf6aeeb86b293b12c0e90b
MD5 ed069afa43e659e477b014846df14ed6
SHA1 1739540bf5e6dc12529ec443cdb35eafaa16001c
SHA512 ba20bff428a6d6adfb6f972a5317307e0d97118e9693b49e19247b7b71963234c5cd6be484914544dbff36b9f4b0a8b793ee0ef56f70af8c23ff94ba947b9b90
SSDEEP 48:7VP8nboqfu+yq/eKJlqfzjOVHFWB35ZQRx2tf0SluEzOREfK15u:d8Eky1KLqbqVHg35+Rx+f0voOaiLu
TLSH
T187813A28865B0E40DB902BB394D01BC0323191663BC34EC4F29854F71E1EF6D7E3D919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 03c87179a32983d8bcebaced6e8a161bef6e357a57c447d2e419c965e97fded6
MD5 74548320215799395436a04fbe6e1c72
SHA1 942fae85a4d8199b521bdc7e29213ddb3c1ba528
SHA512 106fe7eb3bb052be6b2a183f3535f459e33589708d2b87d92904ee0008c4e17b3bc99ae7a851e889d93f97cdc774852d80dae4007b3bb5f18b215432d862eb46
SSDEEP 192:hlWzs+vrRSOMDhOMnZgsvo9eOYTDprMh5gotMoZ:hlZ+DMdO4oAOY9K5gotM+
TLSH
T19A32933786AE0A41CB003FBE81E16AC4373AC5156AD3BEC5A1B654B26D0DB9DFD3C914
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 14KB
SHA256 552f13756ebe825a5cc16bb8e89d22b52712e9a0133059750878450e86ca2ac3
MD5 278574544d564b036e7ff933c13dc0d0
SHA1 8e504be5a42c15e3b8248ca4ed210e4fdfeec350
SHA512 300e675c17118bdcf06deab83737eeb129c064a36ffb032e14c7d11ddbbf0f6e4866fda57504cce538333bc30b1fab1cd152967509031277b4742c0b5b640c04
SSDEEP 192:i/TldKcMsvrv1hNgMGhnNc/nZCEUroMejea5DQyvrHhGgHTffg2c//f:i/TasaM+q2opj7WeBGgDg28
TLSH
T1AB52D727879E0945CB00BFBA40E12AC4333A85417AC3BED6A1B655B26D0FB9CFD3E514
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5911f8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5911f8.TMP
Size 2KB
SHA256 6d382ee0167bea7deafa82039952c2a5a5c2ab52911fd9deeb6cad3fa0119dc7
MD5 185b451985a9a0721b0b7ac3d07075c9
SHA1 91a3f4bbd99cb8cb3ca38f95b37c7f056caa138f
SHA512 0e0c08c8f57b758b24bab673710978b245c057e58c8de08bb0c27ce0a78d8f61477c86eab90aae4cc3292b445a580c82dac0a132d384e7a0fe0776e7e84ef20c
TLSH
T1F8514C24C3520D91EB911233C0D02754367AD6983BC76F94F28868F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f1aeb374dbe8eaf803a5e231bcdfbe8422e3f8e85542868e6d450e991834c820
MD5 29f088bf62d13c97bc232d938090e190
SHA1 c3d9f1e01a1238093ae9bcfa6d468e4d318ab8e4
SHA512 3111ea730f3ee1a1f7e8b3eba9691be876c6a33bf8bda280314b1cd36cb602080b054fbc5c2b8c9d3d698171d0016e1bbb01b3da53b0f839840fbef7538865a0
SSDEEP 192:D/5C5k535p5YJ5PJ5PJ5vJ5HNNynb515a5Nv5lV65Iw5k55P1/5kB5mP05WPiwEt:D/86p3qrZJNJ9NNynbnEz/V6ewuDt/2n
TLSH
T1EA029CE7C7E4863DDD2212F0AA157D1BCE6D0924422C3D2AC8E5EF5BA3D2470E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 2a0bb9a483338e9ba875f453909138687f9c062bf3a00220ec79764e1043a36b
MD5 f1f5e0272ec374082b0f7639e4514fe8
SHA1 1cd60d9c355ad1b5742b1ee79319a50432dfd481
SHA512 416db3ab0d8a8bf1728d21c8bca45219839fcff2086ceec2e1054813886dcb02fb3a67a4b58a5990f6e926357ee6a38be0de9d9a86a0f8e4a94b7ffc9257cd75
SSDEEP 192:D/5C5k535p5YJ5PJ5PJ5vJ5HNNynZHP3w7Ti/515a5Nv5lV65Iw5k55P1/5kB5m0:D/86p3qrZJNJ9NNynZHP3w7Ti/nEz/VK
TLSH
T1AE327BF3C7D8862DD92222F46A157D1ACE6D0D2443283D2AC9D6EF5BA3D2071E241A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2f2dfad8acf7a6a6d324ef54049dacf14dc6555275a888f81ae1cfa81899b246
MD5 ebaba66c55814996234e0d5c3f6187d7
SHA1 58f9b666cbf7ccc8d432bf06e4d3c547c77b2615
SHA512 d504292d1a8ba94870f735376cb90439fa975355547bdba5e7023e1b445eeef57f8ba684cb1f65f9c95efe6ffb6984bfd85f56e9da075c0647eb1225a8f14e7d
SSDEEP 192:sxZtQUn3RsyMojK1Ml8Mkp/fhsw79HIdpeLFCfA7mUNHW6+WNvh2IbMu6dY9Ij0x:sxZFn3pMp/fhsw7CeRCsHbAQ0dLZkH
TLSH
T17462E852AA345977CCDBE218F941BB53D6F9147295905E44AEFCCA1C00E7BED222382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5aa2134191843f2804d1d5b1cd184efd26880bd8ba12c40567860bfca6fbe690
MD5 a786fa2d5ea624bd52100eda3132ba37
SHA1 06e13516980102b9a939cb8c584dfa21bb6de0ef
SHA512 41af53551c5bbd81260ee3bcae587192466458a8c557fcbc38d58298fe241f8855516d64791f3ed61285d157484f33ae59aa3aef59d7873c4a5bc8719e5d9ef1
SSDEEP 192:sxZtQUn3RsyMojK1Ml8UQ6kp/fhsw79HIdpeLFCfA7mUNHW6+WNvhcI9Ou6dY9IV:sxZFn3pqJp/fhsw7CeRCsHbmKqdJakH
TLSH
T13A62D852A9345977CCDBE219F941BB53E6F5147295D04E44AAFCCA1C00E7BED222382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8b85772d22b40541072c9c8a1c01d34c03773c580f92e12d06aaf40de4246f21
MD5 385fce7903616361a96fdf412be12c13
SHA1 06da2b47a6c708061212cc78ae62798952dd9a90
SHA512 a1fbc1fd00205b448333940b56896c6057c9494914abcc48fa613feb1c980c437ca5357cd6562e8c5c16f042972c09f2e41ef50301626f9f2894e0d145d58967
SSDEEP 384:sxZFnhpqLOp/fhsw7haseRCMHbmKD0dHkH:sNhwKp/fZ7h0RCMHbmHq
TLSH
T12482D912A934597BCDE7D219F901BB67E7F8146295D44E44AAFCC91C00E7BED2223C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2418d3a061bc70531bfaa9ea475f05dbbe2edae8e9e997122e9cb74eda18825e
MD5 fda2f4af167931b4be9b7c5cf8f35ea1
SHA1 c0d1c845b2cab47037ba75b53f48ae6c3437c984
SHA512 0b5f144a40a6d53361cd4d92eb934db7cdbdf27a4048448c6ed494b299d617013aaf228e8377f6160cb8d25c46b0b01d282e97947f32e7a35658f087e448aca7
SSDEEP 192:sxZCRsyM/jK1Ml8Mkp/fhssn9HIdpOaHW6+WNdN9/Y9INIE+PIgrJ:sxZCqMp/fhssnCNHbd/jk9
TLSH
T19D52E7126A34A977CCDBD209BA55BB53D6F9447392940E44ADFCCA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f947d9231faa6cc4aa1eeec6b9e2108b7a7af6f75c1a587cadfd741290cf6600
MD5 c5bf52e5bb633b4a24b8c9ee4246647f
SHA1 5effec70f236bf558568b7d7dd16b8e5b0f98624
SHA512 6b239c90df7377e818a83bb07fc2f9f7a2de0ceb6c4e11fc4b66b4bb83ab3e3208518db742c8462022d78c9d10200519e3e036b7edcda145ee6d162e58220101
SSDEEP 192:sxZtQUn3RsyM/jK1Ml8Mkp/fhsw79HIdpAA/UNHW6+WNvT5PZY9IQcE+PIg5XJ:sxZFn3qMp/fhsw7CQHbZZgkH
TLSH
T10962E812AA345977CCDBE208FA41BB53D6F5557291944E44AEFCCA1C00E7BED222382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4bf4af707a5e8d46108255e2761ea3b3f110c1caece2fe87a0b4316686e53413
MD5 1bec2923fd3dba9b3c523b8644224100
SHA1 4ae371feaf96fece62660b9ffed0fe04b6f0fa97
SHA512 1c4d4f0adeb58373df1627be1f96d281e114846d410aec67c77ce99b04e2f2c71879072d92ba6cc6b9371a025c2e3a6c116f8d5f24779d9b5e7be152032da867
SSDEEP 768:aXcv21wWvu+z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNproXg2k:aXcv21wWvu+z+u1jaeFLeRNCXY
TLSH
T107E20B2B280CCB7E4F841E9CDD2AAF866ED801CB57988D5447FA484C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2604dd1e-a3fb-4e93-969d-11e04bdef142\index-dir\the-real-index
Size 816B
SHA256 a5b663ceed1b2d03895761861b47b96a3853327bf17f97d55d52efa7cfeeda3d
MD5 cf641f8d69ca2fc8bcf9e7570c7f5500
SHA1 111f76776157f19dcbda9214844a2e1e1bee605d
SHA512 3a294f42f2dd7c1445d57dcc0d10f6267e699781985c0c327f31558d6dfce4f52b10bf6b2d24be72716b749613482b93d54eb3d7c8b61517f25f4d9c232a4e11
TLSH
T124010C025EA14C1FE86102BB25B6B0F8B3304DCC9720E223A82C12262E3A38A28571CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2604dd1e-a3fb-4e93-969d-11e04bdef142\index-dir\the-real-index
Size 3KB
SHA256 f9c5c43b4ebb090155989dec009d4c17cadedbd30118b5bb136249032f7f5e31
MD5 179f68b09fe44d44a1c8769e13aad09b
SHA1 14ea791b1101138abb60f1198893c80eb26902ef
SHA512 5890a21de340fe36910cbd17b997a5b33cbd5a4a4e77951a0ebb80d78c556a9a77c30ddef15b0fd21d85c2f05d25963017ce3a966b0719c656016d1f0691c9e3
TLSH
T1F651A74E8C8E0E9FE97D12B298F7045133B455EE56784E0759ACA379BD8332F2C08956
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5aadd5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2604dd1e-a3fb-4e93-969d-11e04bdef142\index-dir\the-real-index~RFe5aadd5.TMP
Size 816B
SHA256 938e7b016bffeba2f143e23343e521afd1058c134a2391e5998e9575badcb9ca
MD5 8f9df7973973d4fc7ce1c48749353ff8
SHA1 a21bce86e766dfbbb9272687ee8ef6ce23369743
SHA512 5a48ea6685e75115e0dddd1511791bda30f13187575193a2cfb8bbd19f3cc7a271b002c89397ccd39611ad842bbb374ba8157406ab6f59c39e3c5c7eb2639c8e
TLSH
T10401E1578B924D5FD44411BB2DA5B0F8F2314D009322F7A3A42D253A5D3ABCD0A070CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ff8443f0-b80b-4019-a383-a723492ccd4a\index-dir\the-real-index
Size 72B
SHA256 298c8ef6d20db9b1e1b1494a99baadc4967836d0c4b66b99a78e87e1a4a493ab
MD5 337962353cba0f6074ea86a82f4ff34d
SHA1 6077b6e66ed9fa8d0f488a06021681aea8695ea3
SHA512 9e333eac6724a18ced09a6a835a04b2e202c7e4f161aded65d8a70d62ae337a879fc5b06ec0e46bfabcba9238b6b67682b764ad4a1d22942728177fa04d5efe0
TLSH
T189A002570384211DD002B2B035D601B53392EA134305130742B00098CC92945BF6100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b052d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ff8443f0-b80b-4019-a383-a723492ccd4a\index-dir\the-real-index~RFe5b052d.TMP
Size 72B
SHA256 22806318fb3a132b6eff39bb63f7d1d793e5eeb3ce6b27750456d40c0b55555f
MD5 beda88d3e5f465dac571bb20d6c58d86
SHA1 6ef66f2415bc9c5573170af4ea34e070043e027f
SHA512 3bc18d6b74c969a19d10e57c1ed6089edf92d14a66a3dea698f6893a9ebb4779a38bd1b87fc6176801da935070472d15289c13e66b287b090885d2491e78090f
TLSH
T14DA00220CFC0401EC07211B2195343551300CCA13210135740950084CD654504D9520C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8357f9cc3d4c0bc0fce416acfd828dc19e42cab99ffac63ff831891793e7fbd7
MD5 5e0b1a03053e128453440047334183a9
SHA1 6443ee47b146f1e5e87fe0140efb7cd699a682e0
SHA512 ce5be305877f368180607ba405ce2b23849fc9e3b7bed1c05da58b49bb09e27a861d1a78569e9d6886380ec6dbff50a6db72d367701966d3cde7c82d6b80c699
TLSH
T1C5E0C0B73DAF2814AEBF53E92431C4A440013C99C408EC8E101FE1C730F0315388AC60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 e13af2b4c962cb751c325796a20df36aa5a1f4cc3ea14d4eed2ae6b94071820f
MD5 889ed774c21973640e776386789a8609
SHA1 89b489e5f348c89c326eddc5f2262a405c319f2f
SHA512 78a2209e2b1a8a6498b8a24de94b015bbe84a1b194356da55bec7341ac3b8e9224e702567a4c1de419e378a6417bec5be6fde8051a97bbee176004bdedfb157d
TLSH
T196D0A72BF11604E4FFBB4A628633619B4A293CC81489948CA542295D6478A97D312EB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 1c76837a02d5a34c9d20769304eab8e4fdde7461d93eb94e45d349253d805a7d
MD5 3840e68951e9583d73b74f9a69658eeb
SHA1 e31a82d0e0eebeb184950eb76235417718d1288a
SHA512 05a247e31366c262ff27feea1c4741689f53eab27eb4c8efe46b6ad51df28261845779f3f95ecf09b6360bfe73210c2439781d44044e0d2be6e6178b46c9855c
TLSH
T1C3D0A72BF01504E4FEBB4B625623615B4A193888148D948CA54209599898A97D202EB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe595faa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe595faa.TMP
Size 138B
SHA256 af3d46447434647561f564e63c0dea7b51b16904bb56e34ad518f80c965dc83d
MD5 7c110acca921254b3b8e2c6484e183f3
SHA1 e38af24215296dc5543e107c0a2e59eafc9255ec
SHA512 c594a42b39b23422515187ef611519789d868ac52110f3b96c855378c0a40bf4bb8a36eba6d93c9a25218a23e5e25acc0c0cd5271def548605bccf525891d7ac
TLSH
T15AC08C67A00404A0EB3506528223824C47083CCC098985CD600334183078E236206EA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 81f8be087f3948b227c5a05af67d4c49fe2afbd066062483c8d30e652fc301c1
MD5 1a1d78d07dc0d58dcab7c1bda3948387
SHA1 a25727123206204da85448d1730338549c763042
SHA512 746ad000e524b4a52ef329e8259d57845307db1783c6ea98883e73ba36a1975190bb07284b50e13cc937f8f6854d4ec0a5357e59bcf9b5813c68f7de01664165
TLSH
T14CA00265CA49D017C42006B050ED919133E0CCD905AA1A2174EAD099CE93F5061C1105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b04b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b04b0.TMP
Size 48B
SHA256 12db5423ed6d87ab657f4343048bf2af5589682675398443d0e4f66535209d25
MD5 fb5d57e3b21c0a92cdb8113c67f4a9b2
SHA1 188adb6e4651fbf7cb16c5af95089d373821e4bd
SHA512 6a3a1ccf932d68cf4ea887d3f355eba376f90abd71af308495c9a90219f0a97bdbb979c13b25d23e4aecc6ec480d150333377ff6c218d8f09b3f2e2b29e0f084
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8de17e536f6ebc7ecb385c19bcb1ff51cf14c345c21c8fa26eafce1bf66360d9
MD5 1c924ab18732b9a78ec658670ebfeb9b
SHA1 4e4fb949913f66e238412125b558d89b621e4ae9
SHA512 39a468e620ac3e62454fadac9722558b8c1c365564f72fbda395f3d9b9e5b948046ccd0ccd5859865a6407c031bbc85fbef878775e02efe3c68ae0c43869fefe
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFeGKUKnKl:mTfLRl7WW
TLSH
T160D13016B17B4641287E680CA7D285378F8631A7741CB4AFBFB800664A6BE115DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 91B
SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
MD5 471b1d93ed8d51f89e63ed5fb3908826
SHA1 7eb6ceead5c1abf3c63bd654f1021303916cf35e
SHA512 435ceaa9bc23e45012e6c72d0c3437862945f0a2a4cddd2458b12a7a04a6d63ac30fcc7e7f470d0c0ec7dc6c38796f7adec849b6ecd006fccb61f12f0b656825
TLSH
T168B002BB504259D55F7534F7014731DDC56633CC9C85DE8D9472205C321457F2001D65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 1a26c39bf11d2beb156d585d7306df0e3678b7791a8bc574c86440fe1fe6e3e5
MD5 7189fbe3876c8ee94e42d29884676b13
SHA1 cd6e67b5923716dd0729eaf76ace6f36e9f49d1b
SHA512 fb685f82127a2149feb0a559866e77bb97a0ce8d7dc69a26f9cafc1db78d8ab9cf0eaaff1becfca235e424f722d1c760e6967d63e880067fe696bc384dca7efb
TLSH
T196C0807F508156D17F3534FB511631DCC5397FC85CC0D54C4451301822308571004970
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59de6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe59de6f.TMP
Size 178B
SHA256 0ed242f6db6653dd4e0b9d6aaf3ec3aeae1b06de90c8f637530a5adfcb8335a6
MD5 f0e9e8a59a3798147266c1767d8adcf5
SHA1 9f3d11854aea7b6cb75a4b0a14c9b8e357ef7d8a
SHA512 4e971d797169db53181df7b06bbcb62be8f9291931528a60c37fc4d3bacf6b351574e48dfa11a6c97d60803d1aca535d676e949e22e9592ed1a1850ba8577062
TLSH
T14CC012BB70D155912B682CEA524632CCCA363FD84C84964C68127049223096B2400A25
MD5 SHA1 SHA512 TLSH

Submit Download

c2cb1436-16a2-40bf-9895-b432625fd952.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c2cb1436-16a2-40bf-9895-b432625fd952.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 80146df1e8249d37aaba9bb81a6845e846afcf101a1f1f1f675aafb1388f74d7
MD5 299c599372e08ad4d80060157757a4e4
SHA1 99c3594d3a9fce5d2d29c774ffbd103d53c77865
SHA512 68b3e7f4242b79b117c44c69c0d93c99f628d3408698d6d4caf466272d260a893c548d088d1cebd5e56b72cff1d7ca36be41423ce8f441a3e8795cfb7f57a044
SSDEEP 384:ujiFiZcI5sNv8TUNTUlIl1GqeiziLn/2e+CzO4eyf2IivzULof:uOFQ5Swg5e/BrOXyf2IiQc
TLSH
T191C23CF208E74836DDAD9743E77E2D138E7CC063B585AA50B7885A1CCD9A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a3a56e28a6fc0988110534b58cd4b90a0815145b468f870212497c86437fbb8f
MD5 8e6f81f237b23f45ebdba5a7071ee9eb
SHA1 c5c8e13660f48bbfc69c84441eafa98b0d3e03f3
SHA512 ed094cd49afcd20e31861a0638fd6092d4cdae5aadd2ae496ef15e8775bcd5247ae7f7bf27d2d7610c911f17d97af17d09b1ac52cc23ec4e02e8d0a14c027114
SSDEEP 384:mZcIhsNKUhGqeiziLN/2e+CzO4eyfLIivzULof:0huc/BrOXyfLIiQc
TLSH
T1EC828C312C384C765DE2E181F68736179FB89067E6C96F4094ECAF2E02DF6982317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 898d1d3672edb1f6bb240dc881822592182c565b4dce5429ac1d5ec1ce52cf82
MD5 4f4b627334c41e34f3d31478bfbf14f7
SHA1 703b680ebd4477dd83a38ad62c41bf6e39cfa3ef
SHA512 7d3b67d1ca02b1be8cf0f7b8a834a6ee8f62c332cf64309c037d709251d0c0de8c99e184b290cc62cd219a694fda0a5c3e26708a061d1204e05c33324541832d
SSDEEP 384:ujiFPZcIBsNw8TUNTUlIlRGqeiziqn/2e+CzO4eyfyIivzULof:uOFHBnwgJr/BrOXyfyIiQc
TLSH
T151C23CF208E74836DDAD9743E77E2D178E7CC063B584AA50B7985A1DCD8A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 020c2e946fbe84a0d1535e75e58bfa2afdeab45254d166f2d7000a5a68cc8506
MD5 700a2acb976d29e61aca0be5f7caac07
SHA1 0d5520e4738f64abe7ff1f17f6cbff3e78cc7ae7
SHA512 608562af3d6026569e9cbc06579037488d5747668b4728b60c6c0884a58b67937da9e332e38772f9f26dc5893047a6b03ed5e0e17ba3c64772785d9fe9140c18
SSDEEP 384:pZcIhsNKU0GqeiziLnee+CzO4eyfLIivzULof:hh/aZrOXyfLIiQc
TLSH
T1F2828C366C384C765DE2E184F58736179FB88063E6C96F8094ECAF2D02DE6982317C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 636f75674cd2784f2452a03f5054f4e26da481bb40e89d10f744e7566bd2c938
MD5 86384b4b418865546ab35d7cb61a3c76
SHA1 db5536d9b30c40f4653d3caac645971951b56737
SHA512 bee7dbbfe3e77c6932795f7beb7722bcf0459e9881a16ceb1d126b806c01ab1f6e65a3c4e601d23a052e81afb1d5396d3e01a05f150facdd9742af8d0d90ab30
SSDEEP 192:JONW6v+YLNQmiUyNZaZh+CGSO49oQusEtU6:JONW6vz/rZh+CzO4eG0U6
TLSH
T10102D83579385CBB9FF2AE45F58737279FA82177E9912F80D9E82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb1146b0a178d205f5175057e7bc220ec444a502bd590579a3142a65a51ee195
MD5 fc099566943b872874ffdfae210fed71
SHA1 fb173e3e79f670db6fbb44fe8f808dc265339bc0
SHA512 8a62eb6c85943f89ada026ed50d3be1c7f70fde4d664e0a17eb830151740e0ea7033bd13dc7a6cc838dc3b79ac2c839b989465dab78c654c242b18236ff83ae8
SSDEEP 192:2ONQ6v+YLzQmiUymZaah+CGSO49oyf7CH2qUU6:2ONQ6vzp2ah+CzO4eyfIIU6
TLSH
T1C9124B3679385C7B5EE2A994F48736238FA85167E9857F80D5DC3E1C02DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eb9f080cb4971930cfb664ac872ed3a04d9e4b9d3c6beae5940bd4e02da264ab
MD5 9ce8455a9be1e38d8ccf6b200809d83b
SHA1 e3b03ee776164244fb3efa28c61f5bb806e0723f
SHA512 47eccb67ea23c145c00806389955b1a4fe2fccc6eff799b9dfd13005bb0935b41c83814982de021a955ec8052d0cdc70c40e81169a0bbb514c9684370bcaf36d
TLSH
T10CE00201E3005031D40C533004D7AF012FA1C06002D20347EB70016D3D717503C71F00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 de09eeeda1792ef1a8cfbf477c764fa00981105832b653d5f302c32783ef8e76
MD5 7530e0f91310c865ce9e49e14b613b0a
SHA1 30470c3b238e4f4b0c5d3a689703240786eb766d
SHA512 cb9721e52e7adb668e62a046d1c0d87806237dc2ac55112997dcd006bf5e8d91e564c5518e2364d6dc7c846bb27a3860fd109bf03eb065d0298bcd6225564cf7
TLSH
T1D1E00102A3009026D828573044D7AF113FB2C06002920357AF70017E3D72B503D71B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74d04a50ff76b51b4484da268f4f7f6be51a52ff0fe07e0ff3b91c52af188ff3
MD5 33de9193c77ef70402f9adb32c26fd94
SHA1 cf8cf218e03a53bb2248eb4d9125635566a67b32
SHA512 a303c81e1a8e9ba7d0ae642acb105e23dd540bd76615370e3f3f4f51b2206ce9a0ca1a0b4a20f197859e03fa0d34b0d76a6d49883731072d744c42ec2bc97396
TLSH
T128E00126A3009079D82857304497AF213FF3C07002A60357AF71056E3D63B902E71F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59425e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59425e.TMP
Size 392B
SHA256 c0a5931a3c24860869aed044bab3ec5f05a10f3c8d41b264344d73a555e1804f
MD5 5e9680b2e7240159ac6051769d43fe49
SHA1 949484e2b4f055f84edb4feade0bb2a8df51a0b1
SHA512 9922509520ac3a74f57c55bac9062ae9c36cbad1ae44ef83b992833de38fb4a73bdd08f6f499ca1309ba582cfae1e039d4a4e5b41ba3c03e45f99fce22fd45ac
TLSH
T1AFE0020093001031D00C533004D3AF012BA0C05002D20346A66001693D613502C71F00
MD5 SHA1 SHA512 TLSH

Submit Download

63e59036-2081-43ed-8f69-2f85fc6d8568.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\63e59036-2081-43ed-8f69-2f85fc6d8568.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef245211242549c9554f693605968b6da25665984bffe31924ec266d42d2fd4f
MD5 b2ad355c2093f26eeeab1e7db11ae936
SHA1 a70e9289b01ff8ad32cecef363d5f384e86b4ab9
SHA512 93736ad1121715676ef5fa65de7e8f94e352b7558ec86d220b666c2b36897b872787f8983bf050aa767a2d9179e56f1ca0b2e85525eb0131be9acc577ec83432
TLSH
T188411658AAFA0148B3B76E56ABF6A87D447BBD372E0BD59D00110D4F0623B41CC61737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download