hxxps://cyberleek[.]vilenarios[.]com/

Analysis

user interaction
yes
max time kernel
146s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/08/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cyberleek.vilenarios.com/
Sample260821-e58hsagm6y

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
242	api.gofile.io
243	api.gofile.io
245	api.gofile.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3296	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317603648172111"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{BACE839E-333E-4226-BCF0-F8C64FA8B7FE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
5220	vlc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5736	msedge.exe
5736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
5220	vlc.exe
5220	vlc.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 5076	4580	msedge.exe	84
PID 4580 wrote to memory of 3296	4580	msedge.exe	86
PID 4580 wrote to memory of 2980	4580	msedge.exe	87
PID 4580 wrote to memory of 2980	4580	msedge.exe	87
PID 4580 wrote to memory of 2980	4580	msedge.exe	87
PID 4580 wrote to memory of 4576	4580	msedge.exe	88
PID 4580 wrote to memory of 4576	4580	msedge.exe	88
PID 4580 wrote to memory of 228	4580	msedge.exe	89
PID 4580 wrote to memory of 228	4580	msedge.exe	89
PID 4580 wrote to memory of 228	4580	msedge.exe	89
PID 4580 wrote to memory of 4904	4580	msedge.exe	90
PID 4580 wrote to memory of 4904	4580	msedge.exe	90
PID 4580 wrote to memory of 4904	4580	msedge.exe	90
PID 4580 wrote to memory of 4196	4580	msedge.exe	91
PID 4580 wrote to memory of 4196	4580	msedge.exe	91
PID 4580 wrote to memory of 1792	4580	msedge.exe	92
PID 4580 wrote to memory of 4196	4580	msedge.exe	91
PID 4580 wrote to memory of 1792	4580	msedge.exe	92
PID 4580 wrote to memory of 1792	4580	msedge.exe	92
PID 4580 wrote to memory of 4940	4580	msedge.exe	96
PID 4580 wrote to memory of 1944	4580	msedge.exe	97
PID 4580 wrote to memory of 4940	4580	msedge.exe	96
PID 4580 wrote to memory of 1944	4580	msedge.exe	97
PID 4580 wrote to memory of 4016	4580	msedge.exe	99
PID 4580 wrote to memory of 5052	4580	msedge.exe	100
PID 4580 wrote to memory of 5052	4580	msedge.exe	100
PID 4580 wrote to memory of 5052	4580	msedge.exe	100
PID 4580 wrote to memory of 2456	4580	msedge.exe	101
PID 4580 wrote to memory of 2456	4580	msedge.exe	101
PID 4580 wrote to memory of 2456	4580	msedge.exe	101
PID 4580 wrote to memory of 4156	4580	msedge.exe	102
PID 4580 wrote to memory of 4156	4580	msedge.exe	102
PID 4580 wrote to memory of 4156	4580	msedge.exe	102
PID 4580 wrote to memory of 2424	4580	msedge.exe	107
PID 4580 wrote to memory of 2424	4580	msedge.exe	107
PID 4580 wrote to memory of 2424	4580	msedge.exe	107
PID 4580 wrote to memory of 2104	4580	msedge.exe	109
PID 4580 wrote to memory of 2104	4580	msedge.exe	109
PID 4580 wrote to memory of 2104	4580	msedge.exe	109
PID 4580 wrote to memory of 1352	4580	msedge.exe	110
PID 4580 wrote to memory of 1352	4580	msedge.exe	110
PID 4580 wrote to memory of 1352	4580	msedge.exe	110
PID 4580 wrote to memory of 2124	4580	msedge.exe	114
PID 4580 wrote to memory of 4296	4580	msedge.exe	115
PID 4580 wrote to memory of 2192	4580	msedge.exe	116
PID 4580 wrote to memory of 868	4580	msedge.exe	117
PID 4580 wrote to memory of 868	4580	msedge.exe	117
PID 4580 wrote to memory of 868	4580	msedge.exe	117
PID 4580 wrote to memory of 1972	4580	msedge.exe	118
PID 4580 wrote to memory of 1972	4580	msedge.exe	118
PID 4580 wrote to memory of 1972	4580	msedge.exe	118
PID 4580 wrote to memory of 4036	4580	msedge.exe	119
PID 4580 wrote to memory of 4036	4580	msedge.exe	119
PID 4580 wrote to memory of 4036	4580	msedge.exe	119
PID 4580 wrote to memory of 5812	4580	msedge.exe	121
PID 4580 wrote to memory of 5812	4580	msedge.exe	121
PID 4580 wrote to memory of 6000	4580	msedge.exe	123
PID 4580 wrote to memory of 6000	4580	msedge.exe	123
PID 4580 wrote to memory of 2104	4580	msedge.exe	125
PID 4580 wrote to memory of 1968	4580	msedge.exe	126
PID 4580 wrote to memory of 2104	4580	msedge.exe	125
PID 4580 wrote to memory of 1968	4580	msedge.exe	126
PID 4580 wrote to memory of 1968	4580	msedge.exe	126
PID 4580 wrote to memory of 5536	4580	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cyberleek.vilenarios.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe784bc188,0x7ffe784bc194,0x7ffe784bc1a0
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,9080833736144014844,3796713158700748797,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13342087118530393857,11618380204282604195,262144 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2520,i,166400215830101358,13002382229428560886,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,13633333575030858633,1401177754111680428,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16164640455759413627,8743117109589805370,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,8997697791764675523,16888490108178179618,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6058134539657855222,18428887150128001541,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17909247978523055528,7984490717102291703,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,434213188204261291,938695559412757779,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,12823629308494940320,10652419520174102040,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,12823629308494940320,10652419520174102040,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4312,i,1179762260791532019,8950929700406380697,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6276,i,16471325210553140380,284519919329538301,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6376,i,1584893235457033061,16019345105336922219,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6396,i,11538019194044672391,16563507439818342647,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6616,i,17070074437526755220,16289393119065712919,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6772,i,9024411575161786347,930564668220519344,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,12033371637477431506,6611606614488285542,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7228 /prefetch:8
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7236,i,10497777627678071288,12667324211575137998,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7220,i,5319536505700084832,10750806365000161560,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7204,i,14107765007002623061,14507304431466856497,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7208,i,14466060112815783576,2573635971237015982,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7172 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7104,i,12579643287521857077,9077602493438878610,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,3313422469965902005,10267342351887084439,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7516,i,1706130274001478183,10198964866330401313,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7872,i,7762828310074632633,11669655385969485570,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7796,i,13817858125636326284,17957763137641519922,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5244,i,711736916665400716,5853305000512256348,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7480 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7776,i,5751405554711019818,18306314757049412515,262144 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7764 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8272,i,9225812690572217089,2932477448940901061,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=8072 /prefetch:1
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4284,i,3797107483908862230,18333630473931638096,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,1693444238612530485,17984596498848595416,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\taser.mp4"
  2⤵
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:5220
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\taser.mp4"
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,2314019113380548404,4651166346373630437,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7892,i,2218051872835772871,2383721210238225706,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7452 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7284,i,15225040144022148874,10704538470786812643,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7348 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=5328,i,2735441461294749335,10202470379637097541,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8456,i,8602283823775898899,1060638692598284688,2097152 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=8472 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8284,i,8072243723762288110,15112937693167349016,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,12122241849044863283,9924465568892736236,524288 --field-trial-handle=2104,i,12589696705275389440,11825922677456610849,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files\VideoLAN\VLC\vlc.exe
  "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Downloads\taser (1).mp4"
  2⤵
  PID:5148

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5052

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 20KB
SHA256 57e12433622a0f043d950bc766a5bc423008d0468cab6497f3ead4e55df7c1c7
MD5 8bd8220ca4c1c9bf2756086b9cdd2737
SHA1 c4b09065bdb49f26cb911e6c724d49cdaa771b6d
SHA512 16c22bb9f89d11df3db453ab71365fd27de31ffe97b1159b5ba940932773b0c4fd02903d9ed55cb1f05eb88ede1b3561ee555e90a0a592abda4f826ebe5eb691
SSDEEP 384:BoikZS4VhesCQMQABVDUA+6SxKg8Z848u3eI2Vci2jRYxqEafv:dGcsCQMQCVDUA+VxKg8Zv8VGi6GPan
TLSH
T11E92E17988A32D89689D4E44A3FF6B5A5E09C94B1D2F05FE59181CC863D4E8BFC2C45C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 0a5a4b74ce00a1cdedc90bd54ff6c92c26d8a8df3e1ac53b27681824fb046703
MD5 d438ed7549f247279ce1df5f64f843bc
SHA1 e63085c372fc2a60646fd299bedb684db8507d59
SHA512 05f211a3c7b3894f6094d7280acd075880a39280d2762f380d098f573e3c5c73ed9fc1860a74c70202ba85acbaf34062f44718677d1acd7663c8cd119115bbc6
SSDEEP 96:hFGeoa+/Zmap2RBmzxp5eZmN3Prk+AxzjjXPHTLRSEB0Q+:zGpa+/o3RBOpoZZl3HTLRHB0Q+
TLSH
T109D1A4E1D5CD1767DB5209B0F4F04A26BD3686DC56CB3F860A9849BC10977E1FA2BC90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59d4bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d4bb.TMP
Size 3KB
SHA256 4b180b8a674d7539befc2d78425f60cf0e4b7fd03773bf464e684bd40da8fa02
MD5 e8f0ac60bf5950abd103debebb22f4ab
SHA1 1dc10a978e96e3a0ea4b3ea0479c8f52786611d7
SHA512 9e92a5846775010447d21766d895e8bf54e94d1c45b4bc7f18a9f89d3db929f0301e747d4ef8bd25d0059f3f1d38048767d61f0c379a2434c2f7feac8a022863
TLSH
T1E4612DF4C1C20787E32114F1F6E006537E318AD65A539E662E6049BD98E77E1F57BC88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 8cc4037fd7f43d1900dafa90afc76c64e910fea98b249429a95641980e0f8b65
MD5 d2867c18d3e612acb048d9713d3a4cf8
SHA1 a3bfed3628fa235c84fd3336805eb032021a2148
SHA512 e78bbf4170fd2e47d9efb5f504e3413a00fd4cd3487cc40661494c86349d8f292933959461a36b477c13ab50e93b295cced6c603e9967f0243ca69fa6b00b097
SSDEEP 384:DW3IxJ+wjwMoLMLo/JIJv/FJqSw1zcGj9fE7NqKQsi2T217HnYfAdqMQT4ji4qqm:M6DF82LIG6c
TLSH
T1C7528CF7D3E4D62DD82162F15A24AD1BCE5D1928432C3D6AC9E4EF4B93E2071E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 01f2e5226664ac1cd50e4f23c3e1f456a8d0e61e4cccdab7e3602e95ddfd31dd
MD5 cb3c2b073fd24639d314b21d4d76d71b
SHA1 ad5752a708f1f7b9ca1f335c254fdfffefd9c3ea
SHA512 fba3c8dd3c807b655000714a22503547249e0dbffe91ea3ee4ebb9d65695d7d5d3bf6cbc9fb5018091ffdc57992a3c17461572df498c09a49acc87a24829704f
SSDEEP 192:sxZ3RhyM/jK1Ml8Mk4/fmssC4IdpkeHW6+WNj7x/YLOsBLIgrJ:sxZ3HM4/fmssCJ3HbR/S9
TLSH
T14242E8116B389977CCDBE209FA55BF53D6F5147292905E44AEFC9A1C00E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 23194e6d982df6e5f01012daf36a11866850f1c1fd6621f86ca866847196efdb
MD5 c6d40d77eed8b8a6ccfa60ac59658f77
SHA1 3ec93099b1b85c6b32bb3e9eb1217ee5ed77897b
SHA512 322072e7827163cbb15b03d5fd7d75ee8f5851b912035e0c6794c4b0075d0969168e0815dbc94a3c1a2509d41837967b3eaf0ff04e94e550f247324331e47c44
SSDEEP 192:sxZuRhyM/jK1Ml8UQH94/fms7FyIdpD7lEATeHW6+WNCiBGgExYLY3BLIg5Xk8J:sxZuHqd4/fms7F7iHbV6xfKg
TLSH
T19F62D8156A3859779CDBE20DB945BF63E6F5147297904E44AEFC8A1C00E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 48000d5f0025f87841533dfa4b4c48e45e257e8d8ed99fe9e77f1abbca0ffdcd
MD5 ce01fd19c2ebbfa7c18bb6433f97f71a
SHA1 bd9a3d6fe1ee348ec3e86527a03cd0646020636d
SHA512 2f8d8c457ac22b2fd2f13e337eda1069468bbfcf02c3b0e073672cf03d0bcc1ed076ff2db713a1b78d64a142a7145ccd5ad3e0c629dba98b3f4ad87fae0be90a
SSDEEP 192:sxZuRhyM/jK1Ml8M94/fms7FyIdpD7lEATeHW6+WNCaRERfZYLL3BLIg5Xk8J:sxZuH14/fms7F7iHbZiZsKg
TLSH
T10F62D8156A3859778CDBE209B945BF63E6F5147397905E44AEFC8A1C00E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d24062ad6b5ab1d1ad3d72acbca040733b2b086827dd3d7e774bc34eb60ab0cb
MD5 9fe3cab58d662a318ba4c5d429de14eb
SHA1 d1c83964dde3cf94ed4ed42756a0a312f8b92698
SHA512 d0d00519db9adb1fbb85aa3350f106aa139c625335010d522d63d0702ce902ae6e73e2a52eb56981f70e32e8efafa9d413905efd22e8598a0921f17c21231041
SSDEEP 192:sxZcRhyM/jK1Ml8UQH94/fms7FyIdpD7lEATeHW6+WNCiBGIAFYLaxBLIg5Xk8J:sxZcHqd4/fms7F7iHbViFDKg
TLSH
T12E62C85566385977CCDBE20EB951BB63E6F5147297904E44AEFC8A1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d893edfd748635db8dbcb75fbd7c6a5303f6b74817eb066305852a787aa6e48f
MD5 87da2531ef4c4d649b34d2cb52755b86
SHA1 099d147d5c31166feb3375e4ea630a1107ff8819
SHA512 99dc7d3af6a7f463004c15c99eaae49867ad97f2fc73295ae7764e6e41e4e9f15054cdeacc6fabcf39567d7c4cf55287c1ffe9824a8316eef3c29926b96d0c82
SSDEEP 192:sxZuRhyM/jK1Ml8Mk4/fms7FzIdpt4lEATeHW6+WNjdSXYL/UBLIg5TJ:sxZuHM4/fms7Fs3HbwXTj
TLSH
T11852D7116A346977CCDBE209B945BB63E6F5147292904E44AEFCDA1C00E7BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0507000bb70570d7f17dd6cbd1682992f3ad89d4b09b39bdd8188d975c0550f8
MD5 2e6292fba1af045590622eb3c1aeeb68
SHA1 46b5488d172e27fd41b7e1674e00d4f9112aaf10
SHA512 486ce84ac08eb960245d21d5dcf1de1518c01c75402f9eddf3a0a5544d6b4314ff525417bd28789b57f6076cfc5fcc4fde93bbdd81aa12ff7360a70c1ac10234
SSDEEP 768:rbs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNEroUs1:rbs6pD1WvxzWju1jahILIsNPB1
TLSH
T17DD2FA3B680CC77E4F841E5CEC2A6E967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3891ea3f55c9e709340a395599dc9eabf38973998b46d5c769392953739035cf
MD5 bd0dc06a9cf7535c86d74c4c4c040fd0
SHA1 688fb3414e13ae6775e76ad9a1f27448d13e2d41
SHA512 33598efeb94f276a5444757fad81976c6a5cbfb8be45037f75e42ec2e21aa65006418ba8182018b0c1433771f50e92d5a44228d5c6ebc6161359f5f9e03ed84e
SSDEEP 96:KUAAKtePubCKs8e+nCKQUnMgMbMiMOMgMSMyMxz:iixhRS
TLSH
T17B91151372B703122C7E690CC75597679A42B5A37028A42B3FED40724EA7E208EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599fe0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599fe0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 df5868848ac098e4fc0033dfe1dfb8dd188a6be201433fb80403a883a8270a67
MD5 ba919bbea5d45d35790123b115980caa
SHA1 c486d62de8c0e948fed866f92f7520f83d17468c
SHA512 b6200707ac31c53b869d77b264921b0d174d9214eecfdda9fa01384e9f7d4298db310152c6816593d067fd4da5e2ea0df8dfd3482cd388e845ee4c153182dae9
SSDEEP 192:u9m+xasuheOwQxMGsNhZQhPrw7+3vhGQmiU13VV4atb0b+FdFh2lSOh2l+LMKq7p:bZcIhsNhZi0jKa99dFMsOMpLivvujo8
TLSH
T165827C315C785C7759F7F145F94729278FB880279ADA6F80D4ED9F2C00EAAB8130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2a0a9cec8e0d0a75c34ec71aa634415c2d6e8b764e9a67ddc60fe5218b7cca1b
MD5 34d02f57221eca0ffe08ce1bd6ece2b3
SHA1 40973d6c61a3593d3abcbf77ae35d7dea2507d99
SHA512 57556379b233bb0a3add2d457c730f3d5820f71b459f23c5cf9c87da9fdae67ba0377b174c3eb4d2f25182dac7825f15d6d307f519a7b517993a2a1f0a9cdfab
SSDEEP 384:MiFiZcINsNz8TUNTUlIlEia3aa99dFMsOMULivvujo8:3FQNewgWbDELinujr
TLSH
T1A7C23CF148D78836D9AE9743E77E2D138EBCC063B985AA40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 18f1b497ef77ecce386e5bc6f00426c3237469612cf192a5604bf706c444b712
MD5 70e06ecbe330074e5d97bb30baf50d70
SHA1 a8a4862a08fd948ab3218d204625e26635fcf4ca
SHA512 bb20d52324c9221fa1a9fc74f8ef8a1bc728404b92649acd196eebe482cf07f5d3d5ccda565248e299fad519ffb36a9ca084b0d317974f42c4d481736eb1092c
SSDEEP 384:MiFBZcIWsNt8TUNTUlIRAiXyqa99dFMsOMULivvujo8:3FJWUwg4LDELinujr
TLSH
T1E1C23BF148D78836D9AE9743E77E2D138EBCC067B985AA40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bcb42b663542ea6909f8efaede17edba9613f111364dff5b6b191f8abbcc461e
MD5 cec39acf9d4753f46dbf4dcc6ed60b4a
SHA1 4ea669a0db8b80dea52e17f461272cd234995eb2
SHA512 6818dd948a19b3c1700e1824bb26c34e3d6c66a58067a11f2618ee34bf26e1d1b047cede9c41725d6b655c2e0244413bbcd4f0e0ee1bab1913be217418a77b6d
SSDEEP 384:MiFzZcIfsN48TUNTUlIlAirbNqa99dFMsOMcLivvujo8:3Frf7wgXLDMLinujr
TLSH
T102C23BF148D78836D8AE9743E77E2D138EBCC067B9956A40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 104dab73b1f9543ef32ae9178c5fbb64369773b52aa7c046586f2f02ba62da0b
MD5 ed7f19f6828711ad9e548b5eb179e7a9
SHA1 fa85dc3ee69d32c3996ba5687ae482defb9d21c4
SHA512 3832ae29244a7bfab561b26caa82f88edc6932ad12c5d47d3a0a9893d18d15e8c28e7806a75ce9e0720cc442a7b972c470e98c96562d661a8730d7fd2000fa74
SSDEEP 384:MiFwZcIlAsN48TUNTUlIlAixbsaa99dFMsOMuLivvujo8:3FOe7wgwbDeLinujr
TLSH
T128C23BF148D78836D9AEA743E77E2D138EBCC067B9856A40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 77f565c43f8cd1ed1edcc840175f81f63b2242bdc45d14d11e8f11c67bec66a4
MD5 5e308a7036da133ff97b7dbae317c22a
SHA1 e3049b3e5a8996a76f0ef1997281352f52e1fb51
SHA512 89cbd379468b54250775c26bcf0d3b845bca2432b4834e5631aaad80963231f286a5d7d462937cc528ee2a6029059082da8b8f8f8513562a536fa066cd568f40
SSDEEP 192:qONC6O7+3hQmiUyXJGttb0b+FdFh2SgG6PU6:qONC61eGt99dFME0U6
TLSH
T15702D8356C786CB78AF2AD0AF58737235FE5112BADA62F44DAE81F1C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 efd71cb4f497042b33362eb45d8cca1ead3478003aae9757ab4def5e13e44b0c
MD5 0b8a05b8a334b5d91255c51aaffc08d9
SHA1 6d1889e91aef775dff7bacf9db308dabc6758497
SHA512 9f302b0cb521a24e7310abe2a0537cb8b513d5eadb35faaa420f909a498984d7e8d95f2621f12965c9eebbab394b3fa17aaaf2eee0a6dbae2ea680ead9fde5b6
SSDEEP 192:u6m+xasuheOwQxMGsNhEQhPrw7+3vhGQmiU1LVh0atb0b+FdFh2lSOh2l+LMKq7p:kZcIhsNhEi0faa99dFMsOMpLivvujo8
TLSH
T12C827C315C785C7758F7F145F94739279FB880279ADA6F80D4ED9F2C00EAAA8130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5575c69373a1012cfda0b73da0226371ab792a9a727e2eb40b1f45a6e4a3c4cf
MD5 3400e27b3bb2d1fbfcb58c8ecf6d8580
SHA1 f555c25badbc8d2d272d1133bdddd58ec03d9a35
SHA512 5e8aa2a120daef6dbe93ee42853e2152c975d998049f7d44909d607f3ba37710fa80baaa8d7de718067fbde77398cead47db9572ec596700745a79f38dcd99fb
SSDEEP 192:u6m+xasuheOwQxMRsNhEQhPrw7+3vhYQmiU1LVh0atb0b+FdFh2lSOh2l+LMKq7p:kZcI6sNhEiafaa99dFMsOMpLivvujo8
TLSH
T1B5826C705C786C7758F7F145F94725279FB880279AD96F80D4ED9F2C00EBAA8130781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e246ea2b0a9a3db471fbb78ed0a05d5ad9b0d4dc5d201ac947b5922c328a4ac6
MD5 440db2a49a94e2a393fb4c9c8a4061c8
SHA1 b75dbaecbb71237badfcbf50e870f5a621f635f1
SHA512 69a4a269631377c85f3d98f5048e3a5386b687eccbf406703d023bd55cc22180f9d93f2b6bc4dfb6626a8d4c1c83dc7b553b6d631eed843a5ecf43d9f3b03936
SSDEEP 384:MiF3ZcIAsNt8TUNTUlIRAx4jyqa99dFMsOMGLivvujo8:3F/AUwgruLD2Linujr
TLSH
T17AC23BF148D78836D9AE9743E77E2D138EBCC067B985AA40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30ec267fa03833e2f2526fa5e7af3fa26df539bf128b7bb4ff261ee79d29ad30
MD5 69ba6460110bd40876822b58a62b329b
SHA1 fc45c1c0f6cb2e60b07fdeb885e2e5b762a121e7
SHA512 eb7d1ec0061aa348614fea2260692fc93e7b981ad5f885186a90eadb98a4cc79823a83d274c9966657ea887c25eb4d0464eb1b77806e5ae97c1b16d8dae232c5
SSDEEP 192:aON86O7+3eQmiUyKJWttb0b+FdFh2lSOh2l2cNKq7vU6:aON86clWt99dFMsOM5LU6
TLSH
T11A12093568686C675DE3B546F48735239FA54127DE8A7F80D5DC1F1C00EF67C134A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c64d94af33d09eb61b47af6ea774431d7333c00d4c47579d10ae7d6d179987b3
MD5 8e366bace3413b9b84b6daf890db536a
SHA1 c54accb0f7fa12139fc6105f82293b5521b7ccbb
SHA512 153af18773e288b2a00c5797e2276a1b7ece2f23b140ae87d79d10d796eec33b3c188b373bdfc8e1ee4b5b2327f9a1084676769cbc151581efb0e592955bf90f
SSDEEP 384:MiFPZcIlAsN48TUNTUlIlAixbsaa99dFMsOMuLivvujo8:3FHe7wgwbDeLinujr
TLSH
T10EC23BF148D78836D9AEA743E77E2D138EBCC067B9856A40B7D84A1CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b8479c3f837cdcff4d4caa54b3cc8ee962094ebe8e152516a30b8a4d2b097ca1
MD5 7f7653ab194ca93307abe8cf71cf5f09
SHA1 607593132bfae4cb132a82c646e12ee714891aa4
SHA512 29220e6f244182d9b280cf3a8588c4974220661626826242f0e971505e9a10dce925b64f10964810dff621309b9b217106d7ad1a94ae69181cd846f513dcedb2
TLSH
T114E00907AB0200EAD96C4B3550C72B287BB3C97092E307579E2801786D567501E28A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4bfa18a72665c24339327a5e150797b6bd69d81195b3aef66c64e963eb3f04bf
MD5 3e3c3cd967757abad3090dcaee501d50
SHA1 5ce0bb52498854c094fabf751958da00cdc9788d
SHA512 9e8c8e1bc97d6b7b199baf029b883017a25856a3392f4c5ab8eaa16860db260b273abdbfe724266a09611c5749740bdd81e0774ed790cb06caeae05775db2b02
TLSH
T1F6E00207530000F9C82C063010471B241BA3C13041E203479E34015C2D627002F30D80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 74c95d1ea7224e062cb7ac6133fe8491352246c12c1a09bc815b81889a66d0a6
MD5 453285b137cd6cf59d761c55e85f391f
SHA1 15533cef52b8d58b6dfa975790b3877c3e369362
SHA512 ea6638e657824f7b35a765b34f7f391f8267b71b010329020689620216b10ae4ac08c9c14996e7cee12b3e19baf205eddcbf80d814add7251c6c87d03c4ce109
TLSH
T196E00107630100FAC82C073010871B243BB3C53052E303579E2401682D627002E30E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 58dfcf57e50f54c5606bf6f1691befcf54fcbe6b63f2d3c41869b5c9dd1d464f
MD5 72d0bb98516d3b49b8de8624a8c0cd91
SHA1 295370fe1f94d2c14a3011f11691a635055b6926
SHA512 b57efcfff16712e2f2c095ab153503505fb0262c03880a633e6b615247ddb7ec36a1c30ffd433a8840db9ad12af0322312630220da9fe195bc2ad1e285e629e0
TLSH
T1ACE00107670200EAD96C073410C71F287BB3C970A2E303679E3801786D527001E24A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5937ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5937ee.TMP
Size 392B
SHA256 4106fbc1382e554894d86fdb74ff0463a3b3591a9fcc1cd5ddfdbaf7f13e321b
MD5 039b5478b067611dea96e97ea6829082
SHA1 d9caa43a0f86ebd42d4740c3b15387d87160c801
SHA512 d644579c0be70d6bbc866a204cfb0fd9299dc77778011edf5cc540baa84ed0142c1f92bbc8c9331c5bdc0aa6eccb853647362f5f3acfa290cf9cbc2101fd6621
TLSH
T1B6E00207530000D9C82406301047172417A3C13041A203479D2401582D527001F10580
MD5 SHA1 SHA512 TLSH

Submit Download

cf76d2b4-7188-4763-a6f5-383519ecb65d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cf76d2b4-7188-4763-a6f5-383519ecb65d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b9b5a37810f8696583980a62beff476067d697ca87c7539e020ea8011ea0fd28
MD5 e0ae0eae0309dbc572446803be7fb748
SHA1 94afdd11f86f1fabb6218f2f98d91a864f702399
SHA512 7b1889b0971931a808c38953110879871ab36643a7286fa2638cf87d3ce633fbc0fd92b7111a2e74d79d1c5dfcc7d1a3d1e38f93a7ff77749251a329e2e4d883
TLSH
T1DD412958BBEA1148B3B77E5A9BF6686D487AB8772F06D45D10110D4F0A33B00C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 73B
SHA256 d8a61156de34b97a9804517ce01824fb51da664ed9c52bc00548de3e43e465b3
MD5 f060be6a3cbe2efd71234b7f6c0b33e4
SHA1 f3c846e203c765b271be06e05c5c322bb807d0d0
SHA512 fc476f4a782f81ad6076ebb4f464baa2a2694ec2f496659c3b57d02659f9cc76d37626b5da358181b651b65dae45a2d362b1902ef0824f46d1f084b2afa21abd
TLSH
T1F3A02200008EC22BC3E000E3022C020B2032F022A808F020EFA2A8888230CBBC3C283B
MD5 SHA1 SHA512 TLSH

Submit Download

vlc-qt-interface.ini

Path C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini
Size 126B
SHA256 ff1763dc1d7e95e1e5ef6ca0018fd0fbab492d915aedd032c1a9e2659fd29042
MD5 505a0bfcfba6348653a09e1fcd5f1caf
SHA1 5c7f7e2ca1c5693dacf65000edd20e049c1b426a
SHA512 0fd406d11c20410d922d8c580caf5073657684bc3375a5f81784a204d85ad1f2a83fcb35de126efcca1636d18556e8bfe00a41b5fec30e43b332624eda6d02a6
TLSH
T129B02B000085842DF1940581006C12073023E0153454F11057090ACC9314D764ACA83A
MD5 SHA1 SHA512 TLSH

Submit Download

vlcrc

Path C:\Users\Admin\AppData\Roaming\vlc\vlcrc
Size 94KB
SHA256 ec45f6e952b43eddc214dba703cf7f31398f3c9f535aad37f42237c56b9b778e
MD5 7b37c4f352a44c8246bf685258f75045
SHA1 817dacb245334f10de0297e69c98b4c9470f083e
SHA512 1e8d675b3c6c9ba257b616da268cac7f1c7a9db12ffb831ed5f8d43c0887d711c197ebc9daf735e3da9a0355bf21c2b29a2fb38a46482a2c5c8cd5628fea4c02
SSDEEP 1536:XJDiGWjxYmJPHzV1vC334+DmV3LrCE2y5h8LwgLgG6H:XJGGWjxYmP1a339D0XCE95aLwKgR
TLSH
T1B393A4C46C6020940897884735D5F180B91A712A9EFF1AFAD1FEFC5923848DAC5B9DFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

taser.mp4

Path C:\Users\Admin\Downloads\taser.mp4
Size 26.9MB
SHA256 785697aa8ae852aed899588ccf7d705b43addbc50e5ac690c7df9a1c60972287
MD5 92c97b54211d6d08cceda9ac62a10ef6
SHA1 5d51153818628d52bbc86c7887fb2cf9a73f83f2
SHA512 f2a05f50c09f6e274fdfa46beaf13e49b51da27c89d01183e9e8820cc7a9fd3274044cdbb9bccc7cd58e1022a7fd527ca6b7df6dcde8ef68fe9c4515e6e6b09e
SSDEEP 393216:7ukhIhBQnz2pgu6tipEmbUIgrtErDUo22VscuesEVnxSCNZcRX2+2fVuvYC1U8RX:vYGnyuz4pEk8mB2qLVn/ZEhu4YSRHJN
TLSH
T1D8573384F338544EFF3C473985C307957DB2E5A80B4B9387A23972692C277D06CA96E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1904-830-0x00007FFE78590000-0x00007FFE785BF000-memory.dmp

Download

memory/1904-822-0x00007FFE688A0000-0x00007FFE68C30000-memory.dmp

Download

memory/1904-840-0x00007FFE6A050000-0x00007FFE6A075000-memory.dmp

Download

memory/1904-839-0x00007FFE6A140000-0x00007FFE6A18F000-memory.dmp

Download

memory/1904-837-0x00007FFE675D0000-0x00007FFE677DB000-memory.dmp

Download

memory/1904-846-0x0000027505780000-0x00000275058F1000-memory.dmp

Download

memory/1904-834-0x00007FFE72EF0000-0x00007FFE72F0A000-memory.dmp

Download

memory/1904-833-0x00007FFE6A190000-0x00007FFE6A1BD000-memory.dmp

Download

memory/1904-832-0x00007FFE71860000-0x00007FFE71886000-memory.dmp

Download

memory/1904-831-0x00007FFE78910000-0x00007FFE78928000-memory.dmp

Download

memory/1904-842-0x00007FFE69B30000-0x00007FFE69B4B000-memory.dmp

Download

memory/1904-829-0x00007FFE785C0000-0x00007FFE78601000-memory.dmp

Download

memory/1904-828-0x00007FFE69BF0000-0x00007FFE69CD3000-memory.dmp

Download

memory/1904-826-0x00007FFE677E0000-0x00007FFE67A76000-memory.dmp

Download

memory/1904-836-0x00007FFE71280000-0x00007FFE71291000-memory.dmp

Download

memory/1904-835-0x00007FFE72BD0000-0x00007FFE72BE1000-memory.dmp

Download

memory/1904-827-0x00007FFE6A1C0000-0x00007FFE6A2A8000-memory.dmp

Download

memory/1904-847-0x00007FFE5D7D0000-0x00007FFE5DA15000-memory.dmp

Download

memory/1904-824-0x00007FFE78930000-0x00007FFE78941000-memory.dmp

Download

memory/1904-820-0x00007FFE7CE70000-0x00007FFE7CE92000-memory.dmp

Download

memory/1904-817-0x00007FFE68F90000-0x00007FFE69246000-memory.dmp

Download

memory/1904-818-0x00007FFE7F290000-0x00007FFE7F2A1000-memory.dmp

Download

memory/1904-815-0x00007FF72A650000-0x00007FF72A748000-memory.dmp

Download

memory/1904-823-0x00007FFE7CE20000-0x00007FFE7CE34000-memory.dmp

Download

memory/1904-819-0x00007FFE7CEA0000-0x00007FFE7CEB9000-memory.dmp

Download

memory/1904-816-0x00007FFE7CEC0000-0x00007FFE7CEF4000-memory.dmp

Download

memory/1904-821-0x00007FFE7CE40000-0x00007FFE7CE6B000-memory.dmp

Download

memory/1904-825-0x00007FFE78610000-0x00007FFE786E2000-memory.dmp

Download

memory/1904-838-0x00007FFE69B50000-0x00007FFE69BE8000-memory.dmp

Download

memory/1904-843-0x00007FFE69B10000-0x00007FFE69B22000-memory.dmp

Download

memory/1904-845-0x0000027505370000-0x000002750577E000-memory.dmp

Download

memory/1904-841-0x00007FFE69630000-0x00007FFE696DB000-memory.dmp

Download

memory/1904-844-0x0000027505160000-0x00000275052DA000-memory.dmp

Download

memory/5220-873-0x00007FFE71280000-0x00007FFE71291000-memory.dmp

Download

memory/5220-870-0x00007FFE6A190000-0x00007FFE6A1BD000-memory.dmp

Download

memory/5220-869-0x00007FFE71860000-0x00007FFE71886000-memory.dmp

Download

memory/5220-868-0x00007FFE78910000-0x00007FFE78928000-memory.dmp

Download

memory/5220-867-0x00007FFE78590000-0x00007FFE785BF000-memory.dmp

Download

memory/5220-866-0x00007FFE785C0000-0x00007FFE78601000-memory.dmp

Download

memory/5220-864-0x00007FFE6A1C0000-0x00007FFE6A2A8000-memory.dmp

Download

memory/5220-862-0x00007FFE78610000-0x00007FFE786E2000-memory.dmp

Download

memory/5220-861-0x00007FFE78930000-0x00007FFE78941000-memory.dmp

Download

memory/5220-860-0x00007FFE7CE20000-0x00007FFE7CE34000-memory.dmp

Download

memory/5220-858-0x00007FFE7CE40000-0x00007FFE7CE6B000-memory.dmp

Download

memory/5220-857-0x00007FFE7CE70000-0x00007FFE7CE92000-memory.dmp

Download

memory/5220-856-0x00007FFE7CEA0000-0x00007FFE7CEB9000-memory.dmp

Download

memory/5220-855-0x00007FFE7F290000-0x00007FFE7F2A1000-memory.dmp

Download

memory/5220-883-0x000001B8404C0000-0x000001B840631000-memory.dmp

Download

memory/5220-881-0x000001B83FE00000-0x000001B83FF7A000-memory.dmp

Download

memory/5220-875-0x00007FFE69B50000-0x00007FFE69BE8000-memory.dmp

Download

memory/5220-863-0x00007FFE677E0000-0x00007FFE67A76000-memory.dmp

Download

memory/5220-865-0x00007FFE69BF0000-0x00007FFE69CD3000-memory.dmp

Download

memory/5220-859-0x00007FFE688A0000-0x00007FFE68C30000-memory.dmp

Download

memory/5220-854-0x00007FFE68F90000-0x00007FFE69246000-memory.dmp

Download

memory/5220-853-0x00007FFE7CEC0000-0x00007FFE7CEF4000-memory.dmp

Download

memory/5220-871-0x00007FFE72EF0000-0x00007FFE72F0A000-memory.dmp

Download

memory/5220-872-0x00007FFE72BD0000-0x00007FFE72BE1000-memory.dmp

Download

memory/5220-876-0x00007FFE6A140000-0x00007FFE6A18F000-memory.dmp

Download

memory/5220-877-0x00007FFE6A050000-0x00007FFE6A075000-memory.dmp

Download

memory/5220-878-0x00007FFE69630000-0x00007FFE696DB000-memory.dmp

Download

memory/5220-879-0x00007FFE69B30000-0x00007FFE69B4B000-memory.dmp

Download

memory/5220-880-0x00007FFE69B10000-0x00007FFE69B22000-memory.dmp

Download

memory/5220-882-0x000001B8400B0000-0x000001B8404BE000-memory.dmp

Download

memory/5220-852-0x00007FF72A650000-0x00007FF72A748000-memory.dmp

Download