hxxps://www[.]romsgames[.]net/roms/gamecube/

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
137s
max time network
140s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 23:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.romsgames.net/roms/gamecube/
Sample260825-3ph5ysbb88

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3500	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321748996794939"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{F4786148-2A85-4E10-8F09-93E4C9849D06}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{CC1D50E2-D218-47D5-846A-DF8130823A84}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5880	msedge.exe
5880	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe
4756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4756 wrote to memory of 3892	4756	msedge.exe	83
PID 4756 wrote to memory of 3500	4756	msedge.exe	84
PID 4756 wrote to memory of 2240	4756	msedge.exe	85
PID 4756 wrote to memory of 2240	4756	msedge.exe	85
PID 4756 wrote to memory of 2240	4756	msedge.exe	85
PID 4756 wrote to memory of 3596	4756	msedge.exe	86
PID 4756 wrote to memory of 3596	4756	msedge.exe	86
PID 4756 wrote to memory of 1332	4756	msedge.exe	87
PID 4756 wrote to memory of 1332	4756	msedge.exe	87
PID 4756 wrote to memory of 4976	4756	msedge.exe	88
PID 4756 wrote to memory of 1332	4756	msedge.exe	87
PID 4756 wrote to memory of 4976	4756	msedge.exe	88
PID 4756 wrote to memory of 4976	4756	msedge.exe	88
PID 4756 wrote to memory of 2968	4756	msedge.exe	92
PID 4756 wrote to memory of 4056	4756	msedge.exe	93
PID 4756 wrote to memory of 2968	4756	msedge.exe	92
PID 4756 wrote to memory of 4056	4756	msedge.exe	93
PID 4756 wrote to memory of 1736	4756	msedge.exe	95
PID 4756 wrote to memory of 444	4756	msedge.exe	100
PID 4756 wrote to memory of 444	4756	msedge.exe	100
PID 4756 wrote to memory of 444	4756	msedge.exe	100
PID 4756 wrote to memory of 2684	4756	msedge.exe	101
PID 4756 wrote to memory of 2684	4756	msedge.exe	101
PID 4756 wrote to memory of 5068	4756	msedge.exe	102
PID 4756 wrote to memory of 3164	4756	msedge.exe	103
PID 4756 wrote to memory of 3164	4756	msedge.exe	103
PID 4756 wrote to memory of 3164	4756	msedge.exe	103
PID 4756 wrote to memory of 2580	4756	msedge.exe	104
PID 4756 wrote to memory of 2580	4756	msedge.exe	104
PID 4756 wrote to memory of 2580	4756	msedge.exe	104
PID 4756 wrote to memory of 5320	4756	msedge.exe	105
PID 4756 wrote to memory of 5320	4756	msedge.exe	105
PID 4756 wrote to memory of 5320	4756	msedge.exe	105
PID 4756 wrote to memory of 5844	4756	msedge.exe	106
PID 4756 wrote to memory of 5844	4756	msedge.exe	106
PID 4756 wrote to memory of 5844	4756	msedge.exe	106
PID 4756 wrote to memory of 2276	4756	msedge.exe	111
PID 4756 wrote to memory of 2276	4756	msedge.exe	111
PID 4756 wrote to memory of 2276	4756	msedge.exe	111
PID 4756 wrote to memory of 5156	4756	msedge.exe	115
PID 4756 wrote to memory of 4204	4756	msedge.exe	116
PID 4756 wrote to memory of 4196	4756	msedge.exe	117
PID 4756 wrote to memory of 1804	4756	msedge.exe	118
PID 4756 wrote to memory of 1804	4756	msedge.exe	118
PID 4756 wrote to memory of 6092	4756	msedge.exe	121
PID 4756 wrote to memory of 6092	4756	msedge.exe	121
PID 4756 wrote to memory of 6092	4756	msedge.exe	121
PID 4756 wrote to memory of 3324	4756	msedge.exe	122
PID 4756 wrote to memory of 3324	4756	msedge.exe	122
PID 4756 wrote to memory of 3324	4756	msedge.exe	122
PID 4756 wrote to memory of 1444	4756	msedge.exe	123
PID 4756 wrote to memory of 1444	4756	msedge.exe	123
PID 4756 wrote to memory of 1444	4756	msedge.exe	123
PID 4756 wrote to memory of 4444	4756	msedge.exe	124
PID 4756 wrote to memory of 4444	4756	msedge.exe	124
PID 4756 wrote to memory of 4444	4756	msedge.exe	124
PID 4756 wrote to memory of 4236	4756	msedge.exe	125
PID 4756 wrote to memory of 4236	4756	msedge.exe	125
PID 4756 wrote to memory of 4236	4756	msedge.exe	125
PID 4756 wrote to memory of 5516	4756	msedge.exe	126
PID 4756 wrote to memory of 5516	4756	msedge.exe	126
PID 4756 wrote to memory of 5516	4756	msedge.exe	126
PID 4756 wrote to memory of 3368	4756	msedge.exe	127
PID 4756 wrote to memory of 3980	4756	msedge.exe	128

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.romsgames.net/roms/gamecube/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff93c20c188,0x7ff93c20c194,0x7ff93c20c1a0
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,3046349079059730929,8366941491808062530,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,16322017088804794096,5813478211724914621,262144 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,4729278362785612413,201920475565288990,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,6832715865084839117,1980718091152967813,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,392465407250957202,15922329945110321349,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,832921504313500504,10744786004813227974,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,2750657767912633788,2025444023950974984,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10120027144965091074,11542160611543149887,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10120027144965091074,11542160611543149887,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5060,i,8052292302785279469,10802623362743944159,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,3106420853860260422,13717970098099530477,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,13784753696686576840,7945809851478647981,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4916,i,13516853318829076309,15970571739248750063,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6244,i,3307784993390830483,3533238444995477870,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3536,i,13458007802650035753,13716769710344784778,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3448,i,1648244204450493685,5111882373094124688,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3668,i,4071621224395905344,11190482349213019105,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,13307755907950943715,2442055855524853579,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6884,i,4066942494164871257,5045066712505700095,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6880,i,4404416783361136709,9402723757747289770,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,3634695422351953231,9054533588983749543,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6904,i,17662889806932742786,8292079675704660335,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7416,i,18231011221789310039,17005333324373520507,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7396,i,12078455923686524988,17064488215775886308,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7696,i,8092205414006123886,8376942051272163626,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7704 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7584,i,6186342553303958644,12636558961001643766,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7552 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7924,i,5040007800803500791,10043324109578876429,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:2
  2⤵
  PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,4920196578115011889,8863722844117855828,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7660 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7732,i,16002103212218108468,13104998846694575397,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7812,i,12588176171518868703,15666222082067755456,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7744 /prefetch:8
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,2738655671767112983,9590020659273379499,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7816 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8200,i,13591878237604481913,11478251218419809391,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7672 /prefetch:1
  2⤵
  PID:6124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=8376,i,16187906899913019393,1688083771423071002,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=8360 /prefetch:1
  2⤵
  PID:7788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=8392,i,6413502937772921492,6967059563680566230,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=8404 /prefetch:2
  2⤵
  PID:7796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=7652,i,4904117990866563023,4328359911550636601,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=8208 /prefetch:1
  2⤵
  PID:8172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=8564,i,9214487324337978406,8379449172751375871,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=8532 /prefetch:2
  2⤵
  PID:8184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7456,i,13604028771108008084,15169106973613064363,524288 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:6200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=3976,i,2206829573687169453,11462378532980927452,2097152 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:6624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7404,i,11771126324356313834,9520133085409047156,262144 --field-trial-handle=2368,i,10616721055745637429,16554048419320127499,262144 --variations-seed-version --mojo-platform-channel-handle=7696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 16ddcd6a48e050dbe4d352471502d80cecea57148874c30e081e0787a99f8013
MD5 98b2424317e1007916cbc39ba59563ac
SHA1 132058f868aba77139bdc97dfcbc3fe74d7cd409
SHA512 75fd7977ccc0631bb824c060e0421583d641783c26c9537a5ff7ad7b67a9b120f8ab15dde2433a3ca62f12636e0cce29fe7068aa73338ae4de2f3804e5ea71dc
TLSH
T1CBE02BD5CD61ED3708FD071C54540743E75003572B40465B373C5608CF7063B46CA86C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000ac

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ac
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 96KB
SHA256 6b414b61380bde87bd7966b8b24907a82bd28b193fc9521ba5d040b2f5ae3c70
MD5 1c44fb97e068fc6627c9a6c51e481c20
SHA1 ab890a67d727abe3f733783a3ff28a4cbd62ceb9
SHA512 26d1e08c4a5176179b82f9c00f5ee454e99e4e2eac4063941c5801188c41f937fc2538de73aea26fd3d9c5025b6c271aa8c340af5aaa2704b3cab7ab47b9bbe9
SSDEEP 3072:3B59ELLnZvhPeq+GeI1mES9eCEyYb10CEQIczEiMBekG064WmaUhEicJ:3B59qnRhP+GeI1uAHyYh0LcIigek7vE7
TLSH
T109A3020AB96350367F4ABB850722EF7BD97401E5A250E644DE520EF6C3FA84E07560AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 409KB
SHA256 7807a3d7b4cb5b00a5bca5594d998d4f679d25265cd03bb52666579ab7738fa1
MD5 6a5c9d471d8d7bade82f0c4709ef126c
SHA1 6dc20c885fe432116de102890cc6d299274969ef
SHA512 7be567e599ba7306bcc280fef514fe71e36d654bdc7695dda898d6ac59faab18e4e08da23189def7915fd269828200201173c266c1186fc039258843802f290f
SSDEEP 12288:A/moBnbb/yRGG//0TSh5X2IG4rJdMNv1E8QI51IP:A+oBbWM800X2dsJdc1P0
TLSH
T12494232DA2016EF52F07D7F929B200B8D567E4BE7F997448444B6F48406EB8786C0EF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000af

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000af
Size 68KB
SHA256 57ecb506c734ba57aabce4caf54af9f01033e9f8f37b23ce45022204649c266b
MD5 ca473ea6706f5d7a9901fbf606fc4483
SHA1 4b0347feac391d01e5a6df48a650ec29cdcf33a1
SHA512 93a87e71f10f1582fb003cbeb0d4a73f1be5d220d8ad360fd682d6424b9ef72e321ce2de4c575090aab4486f1ec80daae8bca06105472ae3beab3043c877515b
SSDEEP 1536:I12nOBtWLUe/+2csdfbTKgeEffz0r9s9VlIx/o3LDfMHnWPIQ:I12nOtWLUArPAvEXqi9VlPXwnS
TLSH
T1D663127F9D3B1D0014A2B89A692131C1255BFF85C84D6F0F16A82DBAE727F221B9B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 b29c14d5aec9bbfcf7ffbb306ed50a8b6f60ec7865ca4cd3850dacac12689786
MD5 40f1b0570322a171233f56fc489df4d7
SHA1 82b2f14fe629e31e18a121c9cccad1ed915f9d99
SHA512 a7144cef398f54c500fb320ef0f6bdb67a0a09ddcdf20f046341140158f2479c29505be0ee5c851991ebc6f456c1d09c135254468dc07aff23418e8326d3ad49
SSDEEP 192:aoVj+WTnr4cbTt5J0ZUrz9TOO16AuRM87GjO4RMSI+:atWTnrdnjzJPRuGS4RMSV
TLSH
T13642FBB041CA1675CF75DC30E8D20A84B53A5AF3F60B8F7324A85A78544BFCC24B287A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59934d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59934d.TMP
Size 3KB
SHA256 e49a9fe4620b57d01e5499182d44aac37abb3397c5481d31c2dfb6485dd5d7d8
MD5 73ed83ce806709283fb23bc3a134f676
SHA1 9b07bffafc7c40220569fb2d173a8db2edc66353
SHA512 b65160c704591cc1af9e0a8708173525884eecae94acdf7e10b342ea521399ea080d802a61af0bfc7d329708e1df84207faec5175a039fec6bb3328609aa47e0
TLSH
T11171C2F902521FB8E7F3A131FCD1028A34B185F9FE179F2658E4A8B5A587FA0063645C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

147742b5-d054-40e7-b148-92a4b06234f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\147742b5-d054-40e7-b148-92a4b06234f9.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 07fe819377ee43e1e955ca75c679e2b73abceaea7da4ae5554f688cf615781a8
MD5 1244b4036a92707f89d7b221b877cfb8
SHA1 241da482ed2ccb75be3c398b9fad06758e7f32ab
SHA512 d147925b97e75fc327794b2b87982a66683fe823a032b1992af6d0f21a6a8625904b7562e335cf4f2ea858175cd0132b290d30e4fabb7bb7471d8c49099251dc
SSDEEP 384:D1eJRYjFsEOgPaE9gwBJEF0RiYRCpVaaGB1BusBV4wh3lGBrRnQ14ya29BOcpkGh:IWiKN1PD+LHxggFQWQdbjn
TLSH
T19982ECF383E9866DD90256F0AE146D1BCE1D091A436C3D5AC8E4FE5B93E24B1E142B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 a498e2b5ad9f214da987467811d5fc0df606bcf4056bc2f77f16d4caa3605a5a
MD5 057f185a64c90f88632cc84527b2e1ff
SHA1 1bf0a18402f818dd92c137f5c1c9536c8664052d
SHA512 34a8d6816923b36385f0dabac5480ef25a7d0391b748c97ecbf3b567306f1fb50b3ead498854772135423a53e0e049fb67369282c31407dc51b792d55cfac02f
SSDEEP 384:D1eJRYjFsEOgPaE9gwBJEFgaaGB1BusBV4wh3lGBrRn214ya29BOcpkBJf8qiucT:In1PD+4HxZV
TLSH
T10672DDF383E9866DD80256F0AB146E1BCE5D0919431C3D6AC8E4FE5B93E3471E142A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

da40ad30-44cd-4e45-b045-b6d0d135ae38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\da40ad30-44cd-4e45-b045-b6d0d135ae38.tmp
Size 211B
SHA256 f6068e6c2be329c636db05efcb3436de837ffb5f42255f0d2ff645dab42c7d71
MD5 bd1786287db27fd060ac4a17909845e5
SHA1 d8c20f08456cdf3427eb0c19516b5a28aceada26
SHA512 948642d28cbacfdee442d89d69de58d074a3350ea42aef4ad5fafa226dec59761311c8ed8ca3699b0d6f274fdf59c3f130d08b718335214713f018f14cc31152
TLSH
T191D02263120030F5E6AC3E85986AECDFC72710210982DDE850D0A8D8053246C561F24A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 3d2aa2f097f4413d73aae59a4720cdf5d4a5a3a7d1f1d9df747bc89c83407482
MD5 987bd3fccb893cf75f84d74e7b0368a4
SHA1 91b6ba2c4bb488960cea10a59b97b37947c435e2
SHA512 da033a5962cd99f31084801aa68ed8b0710d82aabfe1901b1027591632964115f7c09c7cd4935d423bcc0baa42d82846bf6214fc7f833b3db30852ea6a8de774
SSDEEP 384:sxZ7TqfmWb/fBsjaIIhM8fIEQHbq+P5bmXcc9cvECew4TECn:sTufmWb/fsaIUnXQHbq+OcctCewXCn
TLSH
T1F1B2D556952089B7CCE6DA19FE31BF56D7F914638D804E8C6AECC90C04DA6FD2207C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ef09bc16c8642fa575d1ea51ba2467057a0feb3787d0e9fba50f922246b95ccc
MD5 4ce71b1234babf4dd9af6747c4510306
SHA1 d4fa6ebb8b4c2127f444b57cd2e8ed0d45102816
SHA512 46e060fcccabf6c3a0bfc9a33a29cf538b437a92712ca1cbc60304697f68c2c69b18bd339798211780ce09ffbcd5e9f8425ecba91c5c43eafed0b5d9c7160e68
SSDEEP 192:sxZKRtyMqZjK1Ml8Mkb/fBsjS8Z5z/dzoYvEG+1ppu4itHW6+WNwuEHnA/YQ+P8+:sxZKWMb/fBsjSC5r9I2Hbp/bc9c+
TLSH
T18B72D7156A389E778CDBD21DFA45BF53D7F9156292804E449AFC8A0C04E77EC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 bc17016ddd7bc126a469fa9e3e13a7e9f8f53ae1622e76bdfec24563892cf2f7
MD5 5516f0e5b3dedd5dcbd05b2a701ecfee
SHA1 b971098c176fa12fd16c207fbb5f54aa4e55d2d2
SHA512 b8a569105a625712968515beb856c66c0140154c62d0e2daf23dda8d8755289c1c581cccb2641661e01ce87e5958e03b0daf023c8eaf2199f597acb602395ca3
SSDEEP 192:sxZYRtyMqZjK1Ml8Mkb/fBsbS8Z5z/czodph4bHW6+WN5EHnA/YQ+P8cNTIgjiJ:sxZYWMb/fBsbSC5r/EHbD/bc9j+
TLSH
T17F62C6156A389D7B8CDBD20DFA557F93D7F9156392804E449AFC8A0C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 44b29b32a6b35af38e1ce8eb4f750d3adcb3f1d3b9a3ca1c514db1019b936c5e
MD5 ad3966a009e0e7e4aec32acc17ef779e
SHA1 a45804628533a1091a8988a5eb77810a4b7042b6
SHA512 e1c4298f754cb6bdcf48b906c231c3600d2d2a2d1b355c367e4a76ed52a6f3d9c69bb50e8d4e7c3b6cd642434e5e026e163767da08ca3de3e3112893433b6f11
SSDEEP 384:sxZKWuOb/fBsjaC5riSBJwIQHb2K/wc9cvEC+:sSMb/fsaqaHbnwctC+
TLSH
T13B92D61656248977CCDBD619FE25BF53D7F914638A804E8C6AFCC90C04EB6ED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 23KB
SHA256 d566c9e8bc1e6336658db6732e8015b7dc155936e23cf17409f4d2f6e46d0968
MD5 29e140849213bf7b185f1b25561afd48
SHA1 7fa0007218a3709567a097fbe85f30e6ae25a194
SHA512 69c796dec01c02ee4e30898301a2cd7e01d3d85ab57cbd7c02cfa3d45bf060d9928c07d0562324ab72212d2777025c62b413ddf3968e4be3f087ff3af7fbe5bb
SSDEEP 384:sxZUWsmzb/fBsjaC5r7uPM8fIEQHb+UbK/Yc9cvECew4TECn:ssfmzb/fsaqQnXQHb+pYctCewXCn
TLSH
T1CEB2D5565620C9B7CCDADA19FE35BF52D7F91463CD814E8C6AECC90C04DA6FD220682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 22KB
SHA256 8a1809102ea49563c7f43aabf109f8c65c691a7f7e047b9e9727465bbb3cbb31
MD5 61fcdc1971765307aeb6377c844aa7e0
SHA1 4724ba102c647ce3151d88be4691ac8fe915c635
SHA512 1aa04dc3c85b2ab9b18aaf4eaa0aad72b3871eff2e1c70258a7dc9d22c8da7b7de0309068560707b699a0700ef7e24ba3f74aec83987762cf5842453cd63214e
SSDEEP 384:sxZkWsmzb/fBsjaC5reIM8fIEQHb+UbK/Yc9cvECew4TECn:ssfmzb/fsaqLnXQHb+pYctCewXCn
TLSH
T1E9A2C4565620C9B7CCDADA19FE34BF66D7F90463CD414E8C6AECC90C04DA6FD221682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 0b588d48b39ab2a41f5be309ba22e23306a1fb8df6b4f2e5580029435378fdad
MD5 fab7e96a3f5bbbfa8b288633801d284e
SHA1 1e84191cc7d3e5c8404870939fb280f2f6ca40a1
SHA512 7a8250bdb271194a85eb42521c4ed36a6dc07fbdbba65c49545b89ad6eba6c5b6943abc934c8148f9f97dadd0bb4729740e0916b1688e4a6e9955aca0956a61e
SSDEEP 384:sxZ7TcmWb/fBsjaIIhM8fIEQHbq+P5bK/ic9cvECew4TECn:sT4mWb/fsaIUnXQHbq+KictCewXCn
TLSH
T1BFB2D556552089B7CCEADA19FE31BF56D7F91463CD804E8C6AECC90C04DA6FD2206C6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b4034882-608b-43e7-9b1b-a518ae2c2164\index-dir\the-real-index
Size 72B
SHA256 c0989e4a601eb97e73313a6089aadc0db0b70a78e4ff7d15301e35fd0180632d
MD5 4b9006d408ab359cac8199b88fd33a17
SHA1 db7c863eda93b40f1977245bdc91e140d2d98cf8
SHA512 8c492bbe4f7e3b6e8ea9a649c14ea487c18db32f89aa13eb6e6a24bba166a58aa356476873dba32ac31cf3c258260496b3fca393dd0b36972b6eb37475c57808
TLSH
T1A4A00250DF800559C05F15B129A343513B01D9E03180130750911054CCA04954D4505D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b4034882-608b-43e7-9b1b-a518ae2c2164\index-dir\the-real-index
Size 72B
SHA256 9ec232807f848b9d2d92a0b2f6258ca4b3b726a7d7eca49b3e5b32eab57ae92b
MD5 ef783d6ac7af44ba53aacb3540b50072
SHA1 f42d07914267e9886338d24bf201cd87a75ace10
SHA512 73215cd4bcbec0edfc2965fbf19cce13e1712dc930b97c762a1f60a6993061e1805e448cd0d7f6219fa3bd7dcef2c644179e6f3365980842aa9a95fe278babd5
TLSH
T132A002694A868101C40217BCAAAB21A62310CA110201635B51A2C1C8CC7AD595D4111E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0ca5eeb-a345-4dd5-a4b3-1abaeeab9373\index-dir\the-real-index
Size 3KB
SHA256 0bc24ecfaf70ca20215a9d4acdc3876a66fdbf04cc0181b10b2bb6db1b4a0154
MD5 07ded74320a4cb98068028eded45a5ea
SHA1 a3fc07a08b60c71b04e31b706702ac5ae079555e
SHA512 ff9872e96b0ff2a3d04e23b88a17e0803b05912545b4c1de7c1d8836a337328bbe5dc3ed77199df49707fccdbb3c11b978d1e15edbc203090aeb252474078621
TLSH
T14E51C70F4D460E15C9ED02B228FF149437B9A8DE5740CA5B21DCA131F8CB37E2D2D226
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0ca5eeb-a345-4dd5-a4b3-1abaeeab9373\index-dir\the-real-index
Size 2KB
SHA256 26fd34212a905680e2b80a0c5cef18d6365db2e4a1fa8ec1b071979d7b0c8944
MD5 0e86398261b6647cd71c1733c0efb059
SHA1 25cbcd661bc25d266013b4468831e6d5d1ffef85
SHA512 a6df9470b238b2a95fde890de4261a1fb8c5de189ff51145420cadb343cab9236941007f670e9191bd4e557b28985bc1f550774698493e0e0329edfdc385bf58
TLSH
T1E951B84E4D549A2EE89840B315B364A433B098CC9650DA236CFC6131BD83B9E1D1F3AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dfdc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f0ca5eeb-a345-4dd5-a4b3-1abaeeab9373\index-dir\the-real-index~RFe58dfdc.TMP
Size 2KB
SHA256 5997a2331afeddb235a6d9d37fd775be86ec33a0e274f3e991fe64fa2bc459f1
MD5 c77a93d969f22444e98b67205bdd74c8
SHA1 fa8e6c0128b3832c6bf9e88d2c2c9fde9813d2c3
SHA512 5092548a5244d9c7c1267692d36daf4171487c1c3f50ac9caeeb5b12ec31a9f8300ce3c1af56be8ad50cdb34cfd2aa0c9182eb174130ee684b645a029a82243e
TLSH
T1FC51BA9B4D818A3DE89440730DE3B8B87336680087557F5378FC9635AD927AD3E4E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f396dbf5bf315505bb1348e298d75de53c48b4b4dd21614ea541d3fe24104783
MD5 e8bb3828ff4afecd5d6e88d0970ad3c9
SHA1 dae0ece120988ae94267e2948ccfc4483348db77
SHA512 8a4c9d6f8fb9cc35d8f85266bce02765894ce76a94d418e1402ef3473bb953f28a57e55ad7597b53db3f7c38d26e917e5ea961b29f22780a7ba95789e02f1fab
TLSH
T153E020776DE70924FC6FC7DA247150901641386596047E5F247FB6C385B23453489D75
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a32747c3e0d414ddcc38505993423d8651bad9556d61a85828127c3c9540d028
MD5 4d11c70a2fb410a650d7ed76f0a59887
SHA1 131045e80aacaa4e86c53b3fd7cdb976f60b3879
SHA512 304a13f5b80f5d3a55c60ada9942153492c2065e743fa3e1b1cbf5675db017c71bad037416ec9008210b4271df392d1d7d1d917a9124adc03a80bc503f07f215
TLSH
T120A002349AA9A811C8060674516E554073F04F990105934249D990E8CCAA58552C5D11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593500.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe593500.TMP
Size 48B
SHA256 c87e110ca0877beb0f8beec0f4453403fa55d78160ab3cd62a962a19e9df2c9f
MD5 fbe99776a7197b0007c4ac2192e3b9ac
SHA1 0ca0d84f8fbb553575986e41c77c732b80b4ada8
SHA512 f94a5ced98beda919215dd591ece5ed6750464eb9786bebfbaa2fde7e44ab7fe55f24f4b77e88198c4ac38eb297574bab9799cd76b3800d9d4f46ace9537e379
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 8928f82fcd2a08687503d692f209312d77444d516a157c923dc3891d1ba4f3b2
MD5 666d7cb84b19ea03afdb142f361148ad
SHA1 3348fcc4f861484c4f23922ecf4a586d83c9716a
SHA512 3cf3ff5792412d727a2af129fb0e9c8bbeb40322b22a806c534316d7343580cdae7675aa2ea44d3ee949084e85fe76bc35ff289f1492fafcb94121f3ea0945f4
SSDEEP 96:KY5mKicqtEYKJ6SOhCKiYZ7yKoAS+/yKosjfmKoYuqugKnKA1OKOACqIgK9KeJ2F:cVSnNDxZ9l3iZ3QxVl/1hVPSRb6
TLSH
T179A25916713A060238BD6D4CB3A69A374F4271A33418A5EF7FB810760E6AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ec155a14a53b8f4cb2ab2e83e45afb621efeeb6aa06ebd1d2a5597e44c440d0c
MD5 55e38661a188666eef4debaf2406a2c1
SHA1 2fbde294ed3a6bae9091b8d8873d848d35b0e96e
SHA512 04f060b4c561a8d5b585c7c03907db9f0669fe6c46aa90e19302104f7ebd3ee72b37c653ae3bf17b8d5014142132587c9de27997cfd4c12dc934a5b99103cf63
SSDEEP 384:nXiFiZcIz3sNI8TUNTUlI4kvJLo39CifbGo/Vy+nDmrMX41Y+HBbsT4eF7IgEoz:SFQz3pwgm32otZnDmi41YgPDY
TLSH
T1AFC24A72DC98C9BBFDEA8AD6B74A3603DEF04153968C5AD4E9C85E1C009B1ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 8c465bc8a64885d5150fe9a01f3793b2186953d0ff91a5b382fc93a129c37073
MD5 68a3caf78cd9664ea08ffe2e3e9ecc22
SHA1 0f3fec8be304cb89a8e60d04f2fe1d429cfe0cee
SHA512 207f97904315550957df12d558fec8d216e6df09621d29e4127a4a035a486cfb05f31d50cea9f0bab0f49955ebc547c83ddf03c5ef9b3adb14b1d737d82ce800
SSDEEP 384:nciF9CcmyWCs3sN28TUNTUlImkrJ12JCifbGo/Vy+nDms7XhkP+lFYS/S1l9F7Im:HFccps37wgECotZnDms7XhkoFYS/2v
TLSH
T1EDB25B36EC98CA7BEDEA4FDAE64E7643DEE011A785985AD0DAD81D1C00DB1DC1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a8b5a9e17a520d103a1addf66cd4384eb644c4d72c544e1132d3a426711c5a55
MD5 ea72e5c62d03241da351d4c80ee14445
SHA1 1c46d1c57ebf1c93e45a3c0607dcafc85c61cd43
SHA512 204af0b999da18686c07f456d5578ea4e48ae98e5b1e5ea4750d1c2de960425c3347ffbb757f68116b94251ceea45a382518fec327cd8fb0829508750c892829
SSDEEP 384:ndiFiZcIdsNI8TUNTUlI4kvTQMM3m2CifbGo/Vy+nDmrMX41Y+HBbsT4eF7IgEoz:UFQdpwgm3mJotZnDmi41YgPDY
TLSH
T172C24A72DC98C9BBFDEA8AD5B74A3603DEF04153968C5AD4E9C85E1C009B1ED130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d18391e622669374a078834f65afefc88d179811e605a23e5b9ce222d14a9252
MD5 4759794d228d1014f579082a21da1031
SHA1 a124369bbc5473a346b5030566f1629b0e638416
SHA512 e22f58b275a74f9281034e74f804a63c2e1567259abcf0d616cb968bf7da843331f8e546a48ad7e84ebc7a683cbd524836ee394b11749ca52ace898f7f9d5039
SSDEEP 384:nkiF9CcmyWCs3sNc8TUNTUlImkrJCl+CifbGo/Vy+nDmrMX4kYhkP+lFYS/S1l9t:/Fccps35wgyBotZnDmi4kYhkoFYS/2v
TLSH
T1C7C25C32EC98CA6BEDE64BD5E64E7643DEE04163864C9AD0EAD81D1C00DF1EC5307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 d653e0e8abad1f0cea7bb9585d210c29ac2f39ba13697987b2d252ab9b5352f1
MD5 ca4575db1eafcf6f2251b24ce095ffa5
SHA1 40ea403a072f32aedb631708aefe4f57636bfe67
SHA512 891c26729ab6e3db3ba7c300ecf8196d4d36808aae89006463b28f8b3542418c57f8f28a958fe9e1a89bdbe2d8c25fa1543e5138537fd6ae57060c31ceb96aa1
SSDEEP 384:neiFiZcI1DsNI8TUNTUlI4kvTQ+NG3RCifbGo/Vy+nDmrMX1Y+HBbsT4eF7IgEoz:1FQ5pwgBG36otZnDmi1YgPDY
TLSH
T17AE2C4F298D78977E9AE4787A77D2D028AFCC15375885A90B7C81D1CCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 13e8a5cbe18a203857617572ca47e435b1deb97cebd3281750cfe9273f7e96b2
MD5 0a2aee47cc49864b40618f48231db94d
SHA1 2f63466d534356281a4116edf62c63b6e3f1cfcd
SHA512 1158db065803b94de020784f614fcf884b26d8664e42e8ac225c17ea49b14e39a0022b2645997952e5ab0293d41f37fd16589e80628dd18c6d8779edf4efbfa1
TLSH
T12FE00403D3514447D115033500C31F513FF3C01013171347553005743C313001D00341
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9d3554a281e30b9eeaf41ebb539185de5124f19ec4dcaac155529178e2ae0843
MD5 b1bac82470a4e8d226702b5807861be8
SHA1 1cc00bdee47d02dd2d23aeb7673671578da6d16a
SHA512 1956624b9cf8e1ab503c3394790ab51ebfcee1885b74e68bb9e94678a96de48ea5fc6775eae7a2827e96633f711f63e72187947e6898e9541cca703bc6fd3f56
TLSH
T119E00103935245A7D129437500C31F513BF3C02113B7134B5A3005783C263201D20B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9b7aa10024aec5202ba453081bba3c7c961c5482b0fe4cc47284e319cb8088ee
MD5 95399c0c82cbae3074ea4b383a0afa4c
SHA1 7dc2411058ba231c63779a84afc379c9627f6142
SHA512 1f2450c1a0496d4d41cde127de35a66462d6f6a3fe92aa6d2d01bea0d07361792421640515f8ea065132d430a1fd1c3bb087df37391527a973f5032cd1c29bc6
TLSH
T10AE00903935245ABD12A537600C31F613BF3C06117B7134B5A2006783C663252E20B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 52124df9938d1372d226e876ee55f863121454cba4c7a0c051f8fd51c459d052
MD5 7ac1c17f36ae486a4c09b3f02e387b88
SHA1 28dcb8733303e23e1fc7d672d9781dfcafabd0c7
SHA512 7af505d1c841ca6033d2d046bcb8b60acce207f804cc120667d76fff7b1f9ab533f03ec57f6c640ef5e8413d7801ef36fffa53fdfae8b046381a5a4f40a1ecb6
TLSH
T12BE00903975245EBD12A577600C32F613BF3C06117B7574B9A2006783C663656E20B81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bfc1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bfc1.TMP
Size 392B
SHA256 bcf271d6fee8ff10e5c16059d34c2960a8e98d35c5e1f2351896eb2d4cee661a
MD5 eb7e8e528f048aec3906a5e43407e9ba
SHA1 a0227f2e75322f3cda269c761500783ad6f5e750
SHA512 f0fd0673a97af1c6cda8121449f2293826ccc311c576f975711d9407cd5e88ed3572bc576e63a4c0f247f59a04315a7fe73963c8a40658c2665631be2fdbe56e
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ef7c2640d86f697733b17769512501dac0da223df6401401de1867d1f9c7164
MD5 bde378772bb21928d2ac0dd03f38f3fd
SHA1 26699db54f5d6ecff8bd75b9669eefff011441d9
SHA512 4ca694e397b1bdbaf741ac793bc6448709e20e86cd95d9812b429c8c2540fae2b6b64e9edd5d0eb0e34672131f57bee919670f98da1a7b2e2eea44120c410f64
TLSH
T18E412A58B6F91148B3B77E169BF7A86E487BB9772A0AD45D10110E4F0A22B40C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\_locales\nb\messages.json
Size 50KB
SHA256 97682d11390428ffefb190ecfb553745ca222dd3626f8183123f414bc0281e04
MD5 a873ec84ee2f394300100bba582e251a
SHA1 7471f619b8159baa62c30ad2b8e797e5b93b4be3
SHA512 36b1d105b4c7ae07c562c54d907d85219ff4bf7b2920ce9783617582939d1a90a39772174b64bcf903adde5ee3417e70a406c018990c0b752d077dfedc9700ee
SSDEEP 1536:MN8vd2skj6gfHwFycreUFeghMYs7wjBCIDDaBbkneEV0RtHdamvWAnt:MNyycqdB62
TLSH
T11C337706CD607D3B01BA022ABC64A745F36443BF5111984F7DBC918C5FB6AB3C9ABB58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bv.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\img\flags-of-the-world\bv.png
Size 122B
SHA256 638e1624f582db031b322834adb6b294e2166f0d1c79cb9e46240f6141693af3
MD5 738f193e16e354a4f9d70cdf4c6f5ebd
SHA1 b0a5a5ddfb3d04273d884bba12e9bf96452cb763
SHA512 deb0e4118cfc30f8b1ef87388bdc3436f8c709879e18a5c5c5f4749164b0f0376ad9454b1224993dfb6e13e284ac211ebd3697319e05e34dbc04a3116c02b599
TLSH
T15BB022E302203CB2EABA022B828C0022EB208A2C02A28E2B8000C22CA080000C288202
MD5 SHA1 SHA512 TLSH

Submit Download

mf.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\img\flags-of-the-world\mf.png
Size 104B
SHA256 36205cafac511e247037dd09011fd9b94cc2bb0d724126f33001aa3a2f881795
MD5 43f7a094f3d9985b5a991f153a6e6f57
SHA1 488b80fed8e4e7e50fac9a5bfd4bc4229c32c8e6
SHA512 a12a528f7b17e5ee751754f6001b1446bca0d38f35eb15f87ed274cee2483831b6349d37810f4fe00f9115313713e83d954693099d405b6d7d7265ec4b8f3cd9
TLSH
T199B092E38650AD2689A616F362C41082A925A10D4A2A88879C09E96A1322040D1E4E25
MD5 SHA1 SHA512 TLSH

Submit Download

us.png

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\img\flags-of-the-world\us.png
Size 539B
SHA256 94fd8fe9e14e5dfc64014bbbeb458be24047f8053c38a6cd1a05f64c6d4ec7f9
MD5 f5c73038cc497ac72a66ea2805acd591
SHA1 8aa24809988d278834127badcea890f0da89129a
SHA512 59ec3e89511167ff23b5f64c9ff8a8c49db9013ad1e7f93311e57db1e2ba03510093b1d5838da266a0ec389f77ac53f024f275f47f21f2ada7126272f3891700
TLSH
T179F075DA0F123132FE14A594087013B6E9C0AC540982C765241D0EFC32633D865D4EAF
MD5 SHA1 SHA512 TLSH

Submit Download

contentscript.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\js\contentscript.js
Size 44KB
SHA256 9a4405fc2fa2a7c7c1564f60927b403db9aec5853900f384378996c10fcd6f76
MD5 1c8ad048a6bbfc962b39dc4bed8cce4f
SHA1 b9c69b327bd53a39ee804584dac2f0a2f9d6b8e6
SHA512 48062e586aa3187c5a2fa90fd3c6a6fb599c753b4ed0d96bf74ba8c514fc773a75337bb92e49143f91f16aa1e52886dc587c702ee58338139deb6dc47e0ec926
SSDEEP 768:g75Yl8k0J7E/l6isAOJ5DLwTBSMJAgU6JrfSVvIfjVAw4a4XzdjdDFHjYVq:r8k0JQt61AOQxscfSVvIfjVATa4XzH4q
TLSH
T10F23648946FA0C2559A3317A6F9B51C1B23080033109D9ACBE5DF3989F5E86583F6FDE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

subscriber.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\js\scriptlets\subscriber.js
Size 3KB
SHA256 2652870d0eab411919fcfbb18e7cb0b19cec908c98659c4390aabf86a84212f1
MD5 b717d0213e305097754645e6f1d89af4
SHA1 27a093e13855dd31a9c68f369b713c507b467c2f
SHA512 207a3daa3f2105f715ed43c8cc9c5493ce820116dbd30b76f04b0ca2cf6fd8f38380919787de1770dabefff2c96141658d839743f05c535d743661f5e69346a5
TLSH
T1E57142DA6AB14DB10A9134B15CCB75D5B23B8163A04DF44C798FB3558F0DE6C86B3AC4
MD5 SHA1 SHA512 TLSH

Submit Download

updater.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\js\scriptlets\updater.js
Size 3KB
SHA256 7caf67327ff66db1b9dfd90d8dd5e3b13cab424c1aeebac515dcdb0ccaf39da8
MD5 43a3b57e1c3ab07f53e1649b6b90f627
SHA1 0151bbdc258799ba3298a9fa7d7b893dddbaa413
SHA512 1bf0f9964188091b386006109a5f40b847e4429f36ee3bf7bb70ce63d4c9932f0493ec432e856f6b6662f79becb10b1de134d6c4c362507a0cbb6294249cc911
TLSH
T1BE81B78E52E18E7101B130B4998B50D5B23AC063705DF09CBA5DB3489F0DE788077BDC
MD5 SHA1 SHA512 TLSH

Submit Download

vapi-client.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\js\vapi-client.js
Size 7KB
SHA256 81936018fb422f4e3ebcc139ed02e3e72bd5a47099ce71c21ef36eabfe94f8b4
MD5 9be86a54a646fd757ec2a85a8e7a60c9
SHA1 5ca00ed1ad2a9fe1cdeda4d9c7ed7c26f1f9086a
SHA512 84c512a95f7a97662a69398ca6e1b64b6d3dcfc625f662377f4e95121654c94bee0590d2550d699c834f5ea8046cf197441835a207d79b84dbab818148ea39cd
SSDEEP 192:I7ZZcY0w+6wQKHJTBCFhjeXj2c7Cz1i4yD20X8eBAb3BCVHtyL/TI/mKz:I7s3v1PLIl0XxuA7mKz
TLSH
T10CF1629A22F60C298AD271FAAE6F11C56236901F6109E81C3F1EF3D44F0E96551B2FF5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vapi.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4756_236600497\CRX_INSTALL\js\vapi.js
Size 2KB
SHA256 31e664456e8d53aa89a49830f48d44afc124ba8cb81323fe3a0e876f0ba4de0f
MD5 84421b0122e2d19a0d91c27db88a9bef
SHA1 4fa7f3add09053be3eb4193dd379cc03d86d3d2d
SHA512 2308419a1062cec6d4046db4cdebeec3cfd0415d242f54a65951c032bf9c1441d51bfd1bda90d2cb89bbc3621d738c09b6876aab7d59ffab4dc2fec9ea49a255
TLSH
T15851739E42A08F330E810AF0B85B75DBB5678517F58EB888B49E73144F4EB9200E7EC4
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 d471216eea0dd088ad08bad6a5b467551995141a2651e85328347370ecf2416f
MD5 af5084f0c736e29d68491e876c2b9ba6
SHA1 551dd667dbe16cde5fbb8bbca08977e5d695456b
SHA512 e469e90acecd1982561432124a8c7de789fc18026ad2dddcbd0866a343ac7c941541f27f35ef17b5be91464deb5262b4ecf54f83142cba143e14f01cc58fe5bf
SSDEEP 96:5ZJoJwwZBwJQe5wep85JyufVOJruf7AbJnIufR:bEK5u0Sw5S0BISR
TLSH
T1B322F0547BE61A46F2FADD72AAB27711AF37BD015D188A1D018082090C72F05AD7BFB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 10KB
SHA256 e820bd9814429f61203ff8c5439998f6af21daffc677860143484175f458ba97
MD5 d8a82b2e3a22b2742068e829ab39d5cd
SHA1 f68838a2e84f3caf5b82b149f879da3089fe31e1
SHA512 66d8242b30168ad9cc92cc713f8b167dd5b94bb0c613b66cebf7ea103120c1effdb03aea186375ca6eb2ebffc002ae6249eb60da9919ac1628233f81c1332ee9
SSDEEP 96:5wJLSHSDwSXpwJoJwwZBwJQe5wepbOJruf7AbJnIufR:StCqiEK5a5S0BISR
TLSH
T13232E0547BF62646F2FADD72BAB27711AF36B8015D198A1E018081090C72F05ED7ABB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1736-411-0x000001B100000000-0x000001B101000000-memory.dmp

Download