hxxp://gemini[.]google[.]com

Analysis

user interaction
yes
max time kernel
1800s
max time network
1798s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 00:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gemini.google.com
Sample260825-as792a1vb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1888	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320913994042013"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{AFD4CB85-0768-415A-9700-A9C0069E7C0B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1079202589-886135813-2527035092-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1079202589-886135813-2527035092-1000\{65D9B5D8-FD3C-4A06-A52C-28DA59FE92D6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5808	msedge.exe
5808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 1360	4916	msedge.exe	89
PID 4916 wrote to memory of 4612	4916	msedge.exe	90
PID 4916 wrote to memory of 1888	4916	msedge.exe	91
PID 4916 wrote to memory of 4612	4916	msedge.exe	90
PID 4916 wrote to memory of 4612	4916	msedge.exe	90
PID 4916 wrote to memory of 4464	4916	msedge.exe	92
PID 4916 wrote to memory of 4464	4916	msedge.exe	92
PID 4916 wrote to memory of 5456	4916	msedge.exe	93
PID 4916 wrote to memory of 5456	4916	msedge.exe	93
PID 4916 wrote to memory of 5456	4916	msedge.exe	93
PID 4916 wrote to memory of 4616	4916	msedge.exe	94
PID 4916 wrote to memory of 4616	4916	msedge.exe	94
PID 4916 wrote to memory of 4616	4916	msedge.exe	94
PID 4916 wrote to memory of 5448	4916	msedge.exe	95
PID 4916 wrote to memory of 5448	4916	msedge.exe	95
PID 4916 wrote to memory of 5448	4916	msedge.exe	95
PID 4916 wrote to memory of 5316	4916	msedge.exe	96
PID 4916 wrote to memory of 5316	4916	msedge.exe	96
PID 4916 wrote to memory of 5316	4916	msedge.exe	96
PID 4916 wrote to memory of 4920	4916	msedge.exe	98
PID 4916 wrote to memory of 4920	4916	msedge.exe	98
PID 4916 wrote to memory of 4920	4916	msedge.exe	98
PID 4916 wrote to memory of 3936	4916	msedge.exe	101
PID 4916 wrote to memory of 4312	4916	msedge.exe	100
PID 4916 wrote to memory of 3936	4916	msedge.exe	101
PID 4916 wrote to memory of 4312	4916	msedge.exe	100
PID 4916 wrote to memory of 3580	4916	msedge.exe	102
PID 4916 wrote to memory of 768	4916	msedge.exe	103
PID 4916 wrote to memory of 768	4916	msedge.exe	103
PID 4916 wrote to memory of 5464	4916	msedge.exe	105
PID 4916 wrote to memory of 4700	4916	msedge.exe	108
PID 4916 wrote to memory of 4700	4916	msedge.exe	108
PID 4916 wrote to memory of 4700	4916	msedge.exe	108
PID 4916 wrote to memory of 5016	4916	msedge.exe	112
PID 4916 wrote to memory of 2840	4916	msedge.exe	113
PID 4916 wrote to memory of 4480	4916	msedge.exe	114
PID 4916 wrote to memory of 4248	4916	msedge.exe	115
PID 4916 wrote to memory of 4248	4916	msedge.exe	115
PID 4916 wrote to memory of 5808	4916	msedge.exe	117
PID 4916 wrote to memory of 2312	4916	msedge.exe	118
PID 4916 wrote to memory of 2312	4916	msedge.exe	118
PID 4916 wrote to memory of 2396	4916	msedge.exe	119
PID 4916 wrote to memory of 2396	4916	msedge.exe	119
PID 4916 wrote to memory of 3408	4916	msedge.exe	120
PID 4916 wrote to memory of 3408	4916	msedge.exe	120
PID 4916 wrote to memory of 1504	4916	msedge.exe	121
PID 4916 wrote to memory of 1504	4916	msedge.exe	121
PID 4916 wrote to memory of 3364	4916	msedge.exe	122
PID 4916 wrote to memory of 3364	4916	msedge.exe	122
PID 4916 wrote to memory of 4420	4916	msedge.exe	124
PID 4916 wrote to memory of 4420	4916	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gemini.google.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffdb709c188,0x7ffdb709c194,0x7ffdb709c1a0
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,6905085554180789186,2553341594913779138,262144 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1676,i,14400336488298853066,16553997889152003472,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,7630624820584924075,8479162259746488584,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:13
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3568,i,755659130669121631,9804433027447726714,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,9879087222861386780,16674223688758409734,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4320,i,13030435040463378229,12813256582993374651,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,7036241704694940260,17497274306032389744,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:9
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3744,i,2743965573683085588,18146332234931334220,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,16774837860785550528,4676909260419367792,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,9042004446750978741,11919142870514941120,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:14
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,9093609769104510549,4084543319010000425,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,6490530743290988653,11522975124331229899,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:12
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7037303275119832601,2619771585344491080,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,7037303275119832601,2619771585344491080,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3872,i,5157535494030378300,2234666152792347973,2097152 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,6178035984947339065,11922497026405915261,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16770486687121517250,13057124376617008488,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,18250126283026664159,10571092694881034507,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,4174929274294629058,8320075063181595249,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5696,i,2143966891296883260,6790216504508565356,262144 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,14828512133188204619,7033558182865807774,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,3267867101639503704,6060609293487054020,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,15739429321313445258,11045700447329345242,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,2095820441516631730,6812284937340761115,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:14
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,8563768049786914554,12228554104166592743,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,12510756378996835897,10247041656085807815,524288 --field-trial-handle=2152,i,12799333286946339647,14129372198758546000,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:14
  2⤵
  PID:4420

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2348

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5692

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:5676

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:1748

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3164

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2d6015222f1312f2737e561f5cb789cba16ddda90131d3af679ca4d112ce8de9
MD5 c1a7f665f2c508cc6aaf2ab720e9bbac
SHA1 f10047340073ccfd0dfa0a1ac50f19824703c6c6
SHA512 3b4b2c7997cc3a8e382662b8ab84779147222db6dcf3b614fe3750efba14aade687800978cd24780f580eacb766daa34fe0e560c30dde1f463983613dda767cb
TLSH
T188D092693B904E08C5C4207228E0A6A6A2604A31B82E024840A2B23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0c59160a51f6f3c09faaf3593a45b43a14b1da3961c2cccaed8346e6543c20e0
MD5 a2b289a93fce671046a365170f24567f
SHA1 d545bd953aab467815db42a92fd1d54047d5e6af
SHA512 ce7bb8aa1a40366ad652feb8233f60cd807014cb9e8ca999c2c1931eeb40a4afa1dc2c94c60d58639e2cece8c73d3a46da7a30c651ca6da0834f57b890bd2572
TLSH
T1CFD092653BA04E08C5C4207628E1A6A6A2504A31642E024841A2F23CF8A5ED6073F4AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7c3537d7cacd021a460eeceb8e5e68c09d62beed6329fa3d8a12829ce9782c91
MD5 c2ed268316faa60123b575ccd6f9a210
SHA1 d96262e409a67ad2a4eb281cbdefe438991055a7
SHA512 2e5b8b795e182713b7345b64e3f254184c343b2105076f7f5d69a388aad1afe0fca2312e54874d22d0bc83b1a7dc0d0655e97ccbcde3d9f67f087dd79745aad5
TLSH
T1CAE07DA805DAC73FA654BCC79978734D82D0370AD2C8EE0A2700C8C87001858BEC67A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b52bc92b5673e58f5d96bc28f48ff59fca621d2d2c379f079358f89de2f59c06
MD5 5382cea489949933cf694c9fb8ac848e
SHA1 0cfb87384734c9e086024f47d73f1a48d451d968
SHA512 8f32628383060a7a6dec1eaa0a4eed236210ee743b4cb8c10c0b5278e909c85acb7fd01f3ade4e476df9a38a8906345700bbb2a4430c8bd7ed3f4e826b41ad96
TLSH
T12EE020A405C5D25DBB40E44B955DE34CC290360A96CCB9491B01848970010446386960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c5a16d4a7a426227b4d639b00af2703013eb4fee6aaec74b1d5c36874cd1f90a
MD5 a3bc9873de1881f4f76ecc917aaa045d
SHA1 d1408e6aae6efb016ed44e00b6808eb18f788b6e
SHA512 a1606441aba3ea4c9d0a54de19efe962b4e4d703303f803cc83be293077ad8ab57e52e5c99363ea9235b360fa691e4b33323eb9e4b74db26307328e383b64e8b
TLSH
T1F0E07DA415CAC23EAAE0B98B5A68770C82C0370ED2CCED4E7B18C4C97001048F2CA6A0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 53KB
SHA256 351ba345250baf98ce325b4017ac9b96c9498f6644937ef558dc5993af676f2a
MD5 1e2d4737305eea41ee9198e3fd3f59c2
SHA1 abff05d701173ab7eae355be60ad30cf7f63536b
SHA512 469723131222dec7ea745b528fe62586da62d02505b6904a4b97157259dd37c26bf0d7012538ec6ab999c4a82d44f97ad7a1bc526cea9e8ee1cd30ff218fbce8
SSDEEP 768:aE9HsQuRLPPTiTRi06pYSINz9AdaTV7n5qAsVUdRwRuIDzjYTXqq2emOr8d/cNPk:aE9HsHPPR06bIhedCaAb+u2veJ8KNad
TLSH
T1354302A0446EF3CA3E6FFD7D9F225D5124E22A354838CAF6103721793F58B959CC1A88
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 24KB
SHA256 0a4407c0c1f3dcb35e1b8de945d3ae4337dabfa2333c7bb30754651eff9858f0
MD5 2945d3717909b0919ce0e28645b22de6
SHA1 7cce915e57e91090f10ac7a593f511ffb844770e
SHA512 962a5eafcba1de9125ae20f5bde9ddebb291f6c177362e00b274a77b9cddaf75f92553b0776cef2cd301edaa0ced4e8d0b42a1bdce5a7ca6a36a969b27b49b1b
SSDEEP 384:QyAjDUoSDiGFnC8m5DDjgqcZJsyVD3v28fh8LHD9pJXZLsTbN72DW960MkuWyKOE:GDUu8GD31cZ1lJUHDnrGRsdLkuXVKX
TLSH
T1EDB2E1D00EB7552996B9D1DF8777856702A01D68CEF025A205E318D26BBF8677440CAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000058

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000058
Size 39KB
SHA256 48a98a7fa3ae4f2eefefe32809673ec792399ef85bf8305b0fd53561fb45a658
MD5 172a629dfe1796c736febcb4beb8166a
SHA1 3b78892a35abeb557523ce0999aade1a79e1ab30
SHA512 156857df483c672c7ae963dcebc08c3d67d2dc85af98698d139dbf8815e23ac0f6fefd39f2b3963c902fdf070c64e750c25a230d61f462ec2957d97848175d74
SSDEEP 768:cGSIdc3+XQ7md79qZ4K1W7r67l70T5kEUtNA72LiQcQFS4LrEX083AV:tSD3+XQ7mp9O6rmlAT5k57AiLQOnEk8g
TLSH
T17E03F1796F49B0D40BAC07846D3B952A1F35EF8208EF03F4910D666979A2BD931DE94C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 60KB
SHA256 5e7cfecaa53f4f65a313fe89b0f389548126544a78fad8489510c70ae641a4a1
MD5 ad634768c54f6abbbec10908b55884c6
SHA1 a5e60ad13bcad32c445051a045b83ffc639c2dd2
SHA512 e238c3f4e791040b81a361fd91f68a92ecfcc67a5c623f80025b6cf8705f2adfb877e1e792b520625b88f461a1d9691174905fbb254d5c9ea18dde6a1d054620
SSDEEP 768:/+Tx5GhlVxaHn1bcNBSPgHACDG6QFA/30d3P7X64zH+CUpufOXXufYr0y8VukZ8p:/RXVxaHW/+wAcAFAH4CCLfsohip
TLSH
T15653021307752B91FA38DB3309D0EE3B63CAB68268DD261CCDA05B7B1D9764805DD42E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 87KB
SHA256 362f881dcbed95fbc7ed0ad1e07d798a47f9d2aa88e553289165a63ba545bd26
MD5 c6939530675bebb7d3df11470482aeb3
SHA1 4973c57209bf2e0075079667a3e908567bcec9e6
SHA512 b1cd754d11418b5692c1b708adf1e495cc160c9a3b6cb18fb92b4d82b059a79446051d92e011c12817101ba9b9d62538862ccdf528998eac80aafa27f2e01e7d
SSDEEP 1536:ou6fCxBrzHA1dAFnR4H6WzXp6kc62X4Ng2ZtezU/xl0mNgcuWr45gCP:FAQvg3AJR4aq862oNg2ezclpunzP
TLSH
T18993029863008A5315019765CFA33E16A306B8CA517BB0C3B11FA6CED7C5DD4879F9BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 76KB
SHA256 3172e307a35d05fc3d5a99ebdba28fb5f852ef3807154792d2e21c2bfef26452
MD5 b948ab53a65d03f55a219cfec5b64675
SHA1 cbed8b49e9d0d2ada15d3ac636bfb9a3fc32c942
SHA512 cbe16a17bedc4d7260e5a53606393189b9557e21f717041374008ba9713bdeeb46909eee58430c70d98dc74e98a6614ac2ce9107cac307236484cf786060f656
SSDEEP 1536:11E5c0RTCocvKMXwyEeOE22Rf/gmQUVq3QkENG1XjrKsrK4Tw5AZEDA3:11Eu0RTCwMqeOcwmQ0q3QkqGxSdO
TLSH
T13D730241A66AC09CEBC1C05B0D53A077A8873279374591DB314161ACBE39CABDF4EEB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 188bfd7aa7b081ae14fb3033360bc388902329c346d2be8cfe6ca8a4d1b49954
MD5 5f6d95a397e60188a87f60f13c653c68
SHA1 3b216042a26e778d6105a7c31f83f696582740a2
SHA512 f2e54f129896626e6f9bf6d49f1a7059ecf1fccd0e601ab26787c7254583132a8a92a2180f1891db42bdbd7a24e6ec690a4b4615f246e13e00b2c52615c125c3
SSDEEP 192:gkeAevH9mGNx2BHLeABd3tPzp/K1UtJn91qdjGq531VM:gknGTQgXR1m
TLSH
T1E6D1DA59BB6779C1DBA246F514F084593AF46CC93A0F5E39A0541E342D83FAAABC00E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 07d849eedcb968841c7cc173474d680d3209d2e8c98113c805306a4d84a6a76f
MD5 e2cb281cb7326633143c3eb9202c770c
SHA1 2761e3f5bde5ab279c57ab51a71600b2548dc481
SHA512 ff6234674ba41f2e2ea2f318136af5c1fabdbb779c2cf048efbc6998f6c42db37d18a24d59b41773ab162cbeb95333ed064c3d1614b42b923597f65deef2bc9f
SSDEEP 96:sK8Wk8x7D9ntJJ+e1vKi918RZ2nyg+bEG1ZtFA596fHds709GUGV5Ms+ffCM:sKOmD76e1vR91C2ELFA36fdA00Ui5Ifv
TLSH
T131B1C96EB7257991EBA046F154E0449636F89CD5360F1E79A0580F392D83FAEAFD00D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 6a59b2f04e9902d8c2c4dd1f70b4371da2ec3336e87a483eec6b6db1b63de708
MD5 428b75a2993546a3c3d0772de37b6b89
SHA1 a3b0bb03dec1ebd3f101bc5cf8d81cdec8743b8c
SHA512 b76ab9825b1be53bbb6a815c28c118d1fa4fedb37912ffa374ebcbf180a8c5c0fef76cef1ef1f328fa8cb2f24a0d54fcc3448e82ae45945aa18b97ecf6fbc60b
SSDEEP 96:HK7en+bVH99YgjAwrtRAADd3uXPpx/G0LjUIF/5nuJWIaZIEveHC98cUBJPwkds:Hke+bVH99fLtCADd3gPplNUMk6N07wss
TLSH
T1DBB1B86EB7257981EBA046F114E0449636F85CCA360F5E75A0580E392D83FAEAFD00D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 7f217d5b2d8b3cc1a619e704448d07d244ed5c068e7b56bae92a5c3f6ab90516
MD5 7e6003bfe3f90e8c343902b90c2daba2
SHA1 e4af2d246cb0f8a1fc19b19adcea39f34f3349f7
SHA512 d8ec09b62584a9eee77fd68c8b87b85b3ecf45ebf6a42b110461e5a9b6691863b18873ce8a0da5fe71f2289087448017d7fcceaf52ae6593c7e7ef82490269d1
SSDEEP 192:LkrGmVvH9mGNx2BHLeABd3tPzp/K1UtJJo1qVPjGqWj31VN:Lkh1TQzX+1P
TLSH
T12CE1CA5DBB6679C1DBA246F514F0885A3AF46CC53A0E5E35A0541E341D83FAEABC00D3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a4c7b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4c7b.TMP
Size 2KB
SHA256 f3c24fd6deb378da41bb7a535c4d1b19b1d509b62f1609b824306dd5e1ff10eb
MD5 8ae204bb8c269df92751fa35d19dd42b
SHA1 665156a891565c7257453f435e04af4e6312378e
SHA512 89db72bd380eb7f85d88dc330fc13a6de0cfd2b80f0f2f8ac54077058ff17438fd2805607953621c6bbbfbf2ad6b5385f1d05927d3907dcfdbb19d2234e98a92
TLSH
T1F6510EA5F7290DC1D7E488B168E0544B32F8849A370F6E38A1141F784A87F9AEBD00E3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 26cc8f3a8b29a11925c5b33664adce0f7c2f4d5e6294eb28a355d117b964eba9
MD5 72fc270e9702fdf0dedba50476ef1435
SHA1 ebb985880280e3398091fd6668b47d86db132b8e
SHA512 ca16b65ac5ccafd8bb7452996f551437bf88f974e9e85bcee76486cbd31e1e72caf19fd0c8408edd08f0a66c7cbbd30b039462a34e4e8fbfc8ee84d00abab025
SSDEEP 192:DWturRo+N/Hsz6eUty4uU/3i2aaiZV1XjRywVROIMj45h/WF3KdDt81KznZOIuTu:DWturRo+N/Hsz6eUtvuU/3i2aaiZV1X1
TLSH
T1B5328AFBC7E9822DC91156F49715AF1FCE190A18432C3C6AC8D8AE1BE3E2471E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 69b216c6877893647e786731329434b63e527e45650d159336780e52d861902a
MD5 9d58e2fcd511bdbbc29c142c030d8eab
SHA1 9ae8921875b66eeef1c5dec1975c5208e6047b4d
SHA512 e05c0d829ace6c3ced268bf828114f2e9265281f80a3f79cd41ea41468e8af5891c74511d14b42a535638c00bc1c1187435c06f2d56e2837beec16703451088d
SSDEEP 192:DWtuo+5/TsUeUtR4KU/3ieKucaaiZV1XjRywVjIMj44h/WFWkyj9K/XV0RNedH1M:DWtuo+5/TsUeUtyKU/3ieKucaaiZV1XN
TLSH
T172328BFBC7E9822DC91156F49715AF1FCE290A18432C386AC8D8BE1BE3E2471E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 f36d6274c01062fa17fc39c29fb1865c11321850e9677464568d21434017fa4a
MD5 a7f6f0787981eb3d6e6cebb0ad929707
SHA1 d7e2cfc5109177c21c9b74a619e60bf51e5353c3
SHA512 d0d3728bbb6be80c6fe943a930201a7d6fc0737f336c71bca0f22e58b13f68eb58576b8eb1da3cb35c3e5407816a81cea65338f7b059620a7c04ddf5f5f57a15
SSDEEP 192:DWturo+5/Hsz6eUtR4uU/3ieyaaiZV1XjRywVjIMj45h/WFQdDt81KzkG50/fdcF:DWturo+5/Hsz6eUtyuU/3ieyaaiZV1X0
TLSH
T1E6327BFBC7E9822DC91156F49715AF1FCE190A14432C386AC8D8AE1BE3E2471E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 cdcdcf3d505ea1ec2396a00a5ff4c62c24da5ebc3960dbcb11cf02728ce8f2cd
MD5 f71b54cffdc937f4dc2baf77b99e7a1b
SHA1 53efe28d381b598e59b6957ee2810d029661a063
SHA512 38c25bcb766e963deacb1637f1d526b311a4249f059cf44f5ac5b0105bf2fecb4bc076632e54d26a16696b95dd062e72cd39547467b4393f7c8da42489505860
SSDEEP 192:DWturRo+VfveN/Hsz6eUpt4yEaaiZV1XjRywVROIvGj45h/WF3I5yBRRdDt81KOk:DWturRo+VfveN/Hsz6eUpt4TaaiZV1XM
TLSH
T18C228BFBC7E9822DC90156F49715AF1FCE290A18432C386AC8D8BE5BE3E2471E11575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 5abc1486bca631c864e42b20f7f0ec826eeb268e6104c3175c93cbf56a49408a
MD5 03f828b631c4d5fc69654e18eb3bc4d4
SHA1 60065dd95026353824966afdb94d6556cc82b3d6
SHA512 30db503f41d83e2e20bf59a8ae3a34e172d609e4e8596845c8eb0de73af1ce5fe235ce057f0156b76866dedb76ac531267e81736f147e859e518cc8518588aa0
SSDEEP 192:DEA34bZVH3VI+Be1b/aaiZC/eGXjR9vhRrZwV1djdW813tkj5iPEesB0qGR1y/Xc:DEA34bZVH3VI+Be1b/aaiZseGXjR9vhm
TLSH
T1202279F7C7D9822DC91156F49B15AF1FCE190A14432C3C2AC8D8AF1BA3E2471E25575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 da78e37cd5f8bb9eadff6466252e8efee3b3d081bc4eccd9bed10bcd1f91b807
MD5 38786bdea2fb16163c16bfb372ac5076
SHA1 c27ac9db60420d2880a8774cb53c494cf3da3645
SHA512 96acbd19adee0b14d44f3500316d6967f8a8dd7ebd80cc380f080d17a92ccb0b6f745d5d0bd392ffab792cdb70305bebdfe2aa55b55876ba78d41c20cddbe4fb
SSDEEP 192:DEA34bZVH3VI+Be1bbpP82aaiZC/1XjR9vhRrZwV1djdW813z8SGOIRfaT0Ew1lE:DEA34bZVH3VI+Be1bbpP82aaiZs1XjRi
TLSH
T1CE329AF7C7D9822DC81156F49B15AF1FCE190A18432C3C6AC8D8AF5BA3E2871E21575E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 1KB
SHA256 b1f194885f683b86579658c4e4a5ae77045b3342f4fe67813d9dcbaba23350c0
MD5 c77a42633007c30eb602315341a7b3b8
SHA1 3953ff1b81ce96ee50a21385578e931252501f78
SHA512 ce840de084042c21689cad08968fd3da846a38b2297ec3c47210715a3528d0c8f7aa7027d7386db8d9364f271d2c94e9f08bb16e0080737a3eec98478843aafc
TLSH
T12531AC63D27FB86720BC4D7F0D48BC0678BEB832068168F4CA97927CE0815F30B16426
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe6c3f35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe6c3f35.TMP
Size 1KB
SHA256 8eddfebbbe314294e602a9db37f92be6eb9cf3b9623b5e0718e69452a48167ab
MD5 3576598618b8de0db5d4e255cbfaafeb
SHA1 f3f79d6c6006bd41911507c3afa15d95689ccbf6
SHA512 f322c5a6df12378f8d0bb3be8a2bd47cfa8d75b011e90cad7e7d8203134b61e2a76cdc081c8ff2af844ebf4b5fc84ac8664b37d760f6fde96c1bf1cbef5087f8
TLSH
T12C317F63E17EB82720BD4D7B1E4CBC0668B9A8361641B4F5CEA7917CE0855F30F56426
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3338a77e5ad143faeffc297e24cc90f855e417b06e4e9bfb7097a0a31277791c
MD5 e5e287601fc0ddb5ef85b7187c030d96
SHA1 6c1a0a29cbf97e5b39d41ad108151218c17fa267
SHA512 9772288cdc9fe310801d30a723ff55def367a2943e8ce34e9150296228704662583affa40252f4628a167088d7e729b8fed40a6f25674844d3336587d7f53836
SSDEEP 192:sxRcRrbQ/f3sY5F7HFSaezoA8pWCgcI/g6+WNZco0mD/YbCCNZ6SjG2IgDDJ:sxRc9Q/f3sY/7lSaDLI/5qe/a6Sf5
TLSH
T16242C7566A38A97B8CC7D21DFA55BF57E3F81032A1942E48B7FC9A1C04E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 775216b9b7c841b538409e5a9c1ef3a0c34a74ef9da9c390c62c894c526f6919
MD5 5b62f5b504b632f293b76013a925fe64
SHA1 079e666c3dc0ed5dc1753495249f7b983010a25f
SHA512 d72672e80f67f18651c465d929c2c447b86980c4081e3848fd9f5baeb8968b016e260ef1f943e19379b4d0ab94eec70c72d0bfaa974fd1d4bc0532bffda71a0b
SSDEEP 192:sxRpRrbQ/f3sY5FSHFSayzoA8pnQ9XuaV28g6+WNTaco0mD/YbCCYNZ6SjG2IgDv:sxRp9Q/f3sY/SlSa/cB5Pe/D6SfT
TLSH
T1C252C653692469778CC6D218FA55BF17E3F9103661D42E48BBFC9A1C10E6BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ae6fe71c209248344ed88eb508683052599b3ede25ffed8556c01e965993c2eb
MD5 7ff995625434abdda7233a7dd998797e
SHA1 8f14655d5bfcf1efb191c304867bb6c0157c1800
SHA512 c9414d36d6fbaad3c949630de7d03f388904aabcf5b382213166c5d572c058ac1e1b6f98499db420c6d6cc0aa4571aed259795250063919313365339b36d8ba2
SSDEEP 192:sxRPRrbQ/f3sf5F7HFSalzoA8p/g04/g6+WNZ0mD/YbCChZ6SjG2IgIJ:sxRP9Q/f3sf/7lSaIA/57/Q6Sfs
TLSH
T17F42C8166A28A97B8CC7D21DFA55BF53D7F92032A1D42E48B6FC961C04E7ADD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0ca1381b875cfc824bdd0f9a4887b0e006a07192e4343bb6433ee9156feb8636
MD5 eb7dfee77cb284da124f927f875267e2
SHA1 c6d3bf51226c847bf4748219e9bfd2a6d1597e09
SHA512 88c968ce71ed944c5a67769bce4664aacf7aa9d1eef833c17efe48a21b29a33ea7344cf3bc7bfbc47819ef0c828da8df251b40941f1dd4ff636613e4c9fbb60f
SSDEEP 192:sxRKR4bQ/f3sY5FrHFSayzoA8puQ9XuaV28g6+WNTacomlxYbFYNZ6SjG2IgDFJ:sxRKsQ/f3sY/rlSa/fB5P3x76SfT
TLSH
T12A52B6536924697B8DC6D21DFA55BF17E3F9103261901E48B7FC9A1C14EBADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 27KB
SHA256 4828db736cc0cb026ceea84dcca8cf3d459f7aa1b37553d0b890200497f429ba
MD5 09c1dfbfbbf925580d4b261799d35b45
SHA1 7c49f9ac3735753d1ed214492dc63a8b1e302428
SHA512 cbb42a3b0e0645715c4080cde7a448fdb334364925c682cf4084ef91df7b034dff406ed2eff8a664faadecb2fea0f2bf74a1cf53076269e01ea1d02a17f318a8
SSDEEP 384:sxRKsQ/f3sY/c66s8qMpRiYnazAW8pZS15posJWeT+rlSa/fB5Prnh6SfT:susQ/fl/c4Mnc7WeT+rn3B5zh6SL
TLSH
T161D2F706A824D8779FC39D18A53D7E33DAAC106222C5DEDA66F8CA1C019D1FDAB4B453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e10822f18810accd3d240ec636dc9a6139322d9d7de3123b9d47b29febcc1759
MD5 9ab99ce0bbdcee794a34c549117f1f63
SHA1 e46e81ec6c4b164b5e44f5f60c7dd5b72a5c7f56
SHA512 aaf78de8c32b262dde2a2598785cef257f0dc5b2f19fd92cecdcc682990364b316c7f9094bf1ae97c9797851649d5b5fe157b730e6129ca2092797e2e616bba4
SSDEEP 192:sxRpR4bQ/f3sY5FSHFSayzoA8pnQ9XuaV28g6+WNTaco0KXYbSYNZ6SjG2IgDFJ:sxRpsQ/f3sY/SlSa/cB5P6Xk6SfT
TLSH
T18852C6536924697B8CC6D218FA55BF57E3F9103661D42E48BBFC9A1C10EBBDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 522681611ed0bfbce7590e09301e50a1ff79da3c14d252c3e992b9ae5348574f
MD5 2c57b8e065a14fd9c1d6e4c6eee0736a
SHA1 368ecc9e674740df83d444ac36e7079ed11378a0
SHA512 c58819a865f881b1b183f05971d4729d239006dd477e02e47be3e9f6f586ad845df9ba420b0cd74ca4db5a5f1266bbb0a90954e369bd4ab7a93881631822ccba
SSDEEP 384:Flp1pABfCtgisFfq4KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnz98ERFkroAoY:Fb1pAtWgikfq48F1+UoAYDCx9Tuqh0Vn
TLSH
T1CDB2DA3B600DCB7E5F800A9DDC19AFD76D9802C796988D4447FE994C02C77FA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7de85f6d-5247-4182-a40b-8a89df2bf957\index-dir\the-real-index
Size 144B
SHA256 7fa05fdf53ce5a160b7a5587fce4906870774ca9551075e558aef96f8f82f37c
MD5 8ce0ec649958da4933f9179e4199f9a5
SHA1 6375d7b697ed6d3307a0ff4bf800d1edcef424ed
SHA512 19454f46aaa1f46d5a67fbaba15a3f27078566f1c831a2a4e7fb5200bc6c04fe75866efadb4902bd1f5f1ec83d2db17ce82d3fea99a44ac729b981b2589d1d51
TLSH
T109C01202CC5FC5A5C9072671217710A82B370AFD29567F2A10DC598AA4BB969C0D7805
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e10c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7de85f6d-5247-4182-a40b-8a89df2bf957\index-dir\the-real-index~RFe5e10c7.TMP
Size 144B
SHA256 84700dc3e435fd9a54fd2c844707f21522311b4bc96a6d7bd53e78eb9b3e02e0
MD5 98666cdc6790cb384a0021d03fc251f7
SHA1 f0d6b515450bcb53178b7fe0ecb8ae599eaf0815
SHA512 e2bd64e26c75422c44fcc94be6673d8c783b5c7535029a97cc18d5bcb137fd37d32f5739bc4ea3a57e97bac5f56440cd2c98f0a41ab68a83e11dc1c6476a7142
TLSH
T1F6C01213C556C9B0C40B65B01043821933BF4C301021B73B60DF4A6F58B28CCC0C7904
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 67cbe1426ab559fbd755b8c26128b2250e11a7500d94ae0a076b4e36bf5b307b
MD5 bb7ffca55084f017ef4778642f92e016
SHA1 30bbbf89042d7582dd1f4482469f035bc61d71b6
SHA512 55c6644b0db5c3078feef4641a4cce000c4b0f428b417ba5ec8c9c7c9bcfedb6ee552d41d07fd0798330c004e7cc12f79e85d460bf5cc239fe2a492c54ff503e
TLSH
T112E0D87A2DD71850BC6F97D61875C4511902B56C8A52FC8F2416E3C361B2365381AD22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 aaf4cbc240242cf86025aecd9b70b997731b667f0bd24d72e7bcfd011ac27301
MD5 31e12d9ad1ef933f49444be2639c73e6
SHA1 86dcabf65e672441edf4b880ec14f97e071c1ea6
SHA512 129bf3adf1bcb80168253b9a67e99dd057244625cf24541f18d4de89c565f51ec49ff7a22875149dc4fd030737af092868683ae738cd0ca978164fdc4053f119
SSDEEP 96:KR2r6WwYY+Wo9lg2+K4Lgk+ce2VUGfHfItpfd9xWJmsgRxK7owKRee2ni7H9l12m:C2r6WwYYZo9m22Lgkte2VUGfHfItpfdr
TLSH
T17891735530BA12907CFE7A1C94FEC95B628274A3B158E42B3BA901A14FA7E014DFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

0b4cbd39-2bc7-4660-bef4-1a8243b75481.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0b4cbd39-2bc7-4660-bef4-1a8243b75481.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 a390b3bcff404da975c18d30f615072356654a12f174ac375918e1274eab9834
MD5 8cf39ce4114f1473bea8df5ce4bf4079
SHA1 eb83b7399121164208853b33e730e45b768e864b
SHA512 754d6c7ee8bc4119c175572a168281f336a329cd5efe9019f34505bfbff9e2fbfade8046365f72a364d7ecfd3955d9c265c371d9c9e521529fe2970678668c27
SSDEEP 768:Jrv+4UNbdC3W7KBqobGEDejtZu4aWADIidy8LbDeVH1S1C:Jbsbw3OjtZzaNsuVLPEH1d
TLSH
T18A03BF36F859DE739CB65284F187790B6EF8926386890AE088DC1F8E45DB4AD130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 1700a72adca26a76669b44ecda761a7f5017a32a4f501829e5474049f37c9fdc
MD5 b8f47f1a329d73f3590932c6a9583ee0
SHA1 752d9ccc1fd1310aae25f7989b7bc9ce345fed3a
SHA512 810c183b1106a37b1516b44cbe163caa58242ad9cfc2980265d5ea12be167551dd276d0aadb19c3459f85a06c821fde96fae3cb6b9e3efa40b41f5469c7a2d3c
SSDEEP 768:qFQv3mwgoSkABqobGEDe1tZu4aWADIidy8LuD/vmdTr1FjOWPf:Rv3Rx1tZzaNsuVLA/o7rH
TLSH
T122136CF6A8C38977D8AE8787A37E2D069DBCC163B589559077D81A0DCC860BFC346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ad7ea71ac7d18d115ea32c9e098a00950fbe125d389062e51e50a3717836deab
MD5 d1e48e81d87a6b4d59f715e51e592dc5
SHA1 89d3666d229700456ca1aa8647b5c45aa7ed7713
SHA512 d7d4eb724fa8d54da33b6db5d4a65badb079093d3cfe77c8ac25f9b80263a02e32597eb0dcaaa921af3b71488c07745e85f8a8dabd693273a6d4dd3b54996c78
SSDEEP 768:Jrv+4UNbdO3gSPABqobGEDeBtZu4aWADIidy8LuDR31:Jbsbk3gGBtZzaNsuVLA7
TLSH
T13103BF36F81A9E739CB79184F1873907BEF8915395C90AE488DD2B8E01DB4AE134BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9403444cd066b2c602548cb0ad2a2e822aae5ca6e1615a92a880b039b0055292
MD5 2d4dfaf20188b10b2a2c491d9c2de53a
SHA1 79f51282c19ca0a7d3c1d0e2b4e1372bfb52ff61
SHA512 989612273159561b0e48e352b3af0fb4b29e1b01ffdcd43415cbaf96d26defe2e4b6bbac3cbf73664e0a3736b9a48a0c0ee97c6ecfe9bce22658534c61fb1176
SSDEEP 768:9rv+4UNbdC3oreBqobGEppZu4aWADIidy8LqbeVH1S1C:9bsbw3/pZzaNsuVL4EH1d
TLSH
T12103BF36F859DA779CF79284B1877A0B7EF8926386880AD088DC1F4E46DB4AD1307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 826106963cd4887e35e87653e9490bc112ceb663ab95ae95d79469c8df336152
MD5 89ee9ba0a370191e98147b3cb8a935e0
SHA1 7be56110ff27e9a4c3a4e209e4c8d132061d944a
SHA512 22f17f7eb2f82749d8fca8b22b0984d59503b583ed71f3986183e9ea582c9e9700edfd52fd327e4daa78a1471e728bc2b3ee9e1649bfe5368ca6a748e01aec35
SSDEEP 768:2p3HSxABqobGEDe/tZu4aWADIidy8LuD/vmdTr1FjOWPf:2p3HI/tZzaNsuVLA/o7rH
TLSH
T138F2BF79FC559EB79CBA9284F14A3A07AEF49163D6C949D048EC2F4E00D75AE0307C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 eeddcb3a303ac43fc94fbdcaca7e8575ac08a779b1a5c114add5d9912a81dbd2
MD5 4db7a95959012978450010ca4263f87f
SHA1 d423d6e39f476c5732ad33a6d00f5a841056e5f8
SHA512 22bbf324d7d15c9de627be0e8a4e89d9650d790a6fe2b4d4902e710a2016c03a3400ef5c5e05f275d8035c979056d5531e00ea705d93244a3ec3b65da8938ea3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe59f0de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59f0de.TMP
Size 392B
SHA256 84a6ff75ee6395cdae231f49266966e050ecb906956731e7dbd8b6affa7052f0
MD5 b3590cbe0776c91d2048c6ed5928fdcc
SHA1 ab19d0e81ccdbd931f6cc52db375804ea9dae14e
SHA512 285cd1424ab6476a42f093c7698fb5ddc95b5cb9b9557c8740324c846c8833009a3eec3e7d2c24bdd78081d35aa311dea3354df9584133c068a36d5e38ea4f26
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download