hxxp://bit[.]ly/43b70kd

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 20:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bit.ly/43b70kd
Sample260825-zmt8navzhy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321646412719252"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{0C49004D-91ED-4B07-9370-2E6E9909A411}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{ACA19FF2-BEE5-4F62-A0A1-D07B0592683F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5508	msedge.exe
5508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe
2260	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2260 wrote to memory of 2688	2260	msedge.exe	86
PID 2260 wrote to memory of 2544	2260	msedge.exe	87
PID 2260 wrote to memory of 3792	2260	msedge.exe	88
PID 2260 wrote to memory of 2544	2260	msedge.exe	87
PID 2260 wrote to memory of 2544	2260	msedge.exe	87
PID 2260 wrote to memory of 3320	2260	msedge.exe	89
PID 2260 wrote to memory of 3320	2260	msedge.exe	89
PID 2260 wrote to memory of 3500	2260	msedge.exe	90
PID 2260 wrote to memory of 1492	2260	msedge.exe	91
PID 2260 wrote to memory of 3500	2260	msedge.exe	90
PID 2260 wrote to memory of 3500	2260	msedge.exe	90
PID 2260 wrote to memory of 1492	2260	msedge.exe	91
PID 2260 wrote to memory of 1492	2260	msedge.exe	91
PID 2260 wrote to memory of 3248	2260	msedge.exe	93
PID 2260 wrote to memory of 3248	2260	msedge.exe	93
PID 2260 wrote to memory of 3248	2260	msedge.exe	93
PID 2260 wrote to memory of 4344	2260	msedge.exe	94
PID 2260 wrote to memory of 4344	2260	msedge.exe	94
PID 2260 wrote to memory of 4344	2260	msedge.exe	94
PID 2260 wrote to memory of 4056	2260	msedge.exe	97
PID 2260 wrote to memory of 4056	2260	msedge.exe	97
PID 2260 wrote to memory of 4056	2260	msedge.exe	97
PID 2260 wrote to memory of 3168	2260	msedge.exe	99
PID 2260 wrote to memory of 3168	2260	msedge.exe	99
PID 2260 wrote to memory of 3864	2260	msedge.exe	100
PID 2260 wrote to memory of 3864	2260	msedge.exe	100
PID 2260 wrote to memory of 1304	2260	msedge.exe	102
PID 2260 wrote to memory of 3540	2260	msedge.exe	103
PID 2260 wrote to memory of 3540	2260	msedge.exe	103
PID 2260 wrote to memory of 3540	2260	msedge.exe	103
PID 2260 wrote to memory of 1156	2260	msedge.exe	104
PID 2260 wrote to memory of 1156	2260	msedge.exe	104
PID 2260 wrote to memory of 1156	2260	msedge.exe	104
PID 2260 wrote to memory of 5112	2260	msedge.exe	105
PID 2260 wrote to memory of 5112	2260	msedge.exe	105
PID 2260 wrote to memory of 5112	2260	msedge.exe	105
PID 2260 wrote to memory of 4392	2260	msedge.exe	106
PID 2260 wrote to memory of 4392	2260	msedge.exe	106
PID 2260 wrote to memory of 4392	2260	msedge.exe	106
PID 2260 wrote to memory of 3652	2260	msedge.exe	107
PID 2260 wrote to memory of 3652	2260	msedge.exe	107
PID 2260 wrote to memory of 3652	2260	msedge.exe	107
PID 2260 wrote to memory of 3532	2260	msedge.exe	108
PID 2260 wrote to memory of 3532	2260	msedge.exe	108
PID 2260 wrote to memory of 3532	2260	msedge.exe	108
PID 2260 wrote to memory of 1160	2260	msedge.exe	109
PID 2260 wrote to memory of 1160	2260	msedge.exe	109
PID 2260 wrote to memory of 1160	2260	msedge.exe	109
PID 2260 wrote to memory of 608	2260	msedge.exe	110
PID 2260 wrote to memory of 992	2260	msedge.exe	111
PID 2260 wrote to memory of 992	2260	msedge.exe	111
PID 2260 wrote to memory of 1884	2260	msedge.exe	112
PID 2260 wrote to memory of 1884	2260	msedge.exe	112
PID 2260 wrote to memory of 1884	2260	msedge.exe	112
PID 2260 wrote to memory of 4072	2260	msedge.exe	113
PID 2260 wrote to memory of 4072	2260	msedge.exe	113
PID 2260 wrote to memory of 4072	2260	msedge.exe	113
PID 2260 wrote to memory of 2340	2260	msedge.exe	114
PID 2260 wrote to memory of 2340	2260	msedge.exe	114
PID 2260 wrote to memory of 2340	2260	msedge.exe	114
PID 2260 wrote to memory of 724	2260	msedge.exe	115
PID 2260 wrote to memory of 724	2260	msedge.exe	115
PID 2260 wrote to memory of 724	2260	msedge.exe	115
PID 2260 wrote to memory of 4940	2260	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/43b70kd
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8f47ec188,0x7ff8f47ec194,0x7ff8f47ec1a0
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,16086219993635588205,10118286201909405793,262144 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,12553039439005192903,6343193155327509697,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,12116252753115556051,5388243603488717899,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3144 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,1463787115229614522,15109653243016918284,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,1608288477305117993,1711372420887426678,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,3485438234731225450,9036658570683044995,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,703365163132867381,15238192816976892460,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,9603072307799104954,15547363394952648661,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,10342530081593036679,2578793883159169169,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,9380187232780928732,9661304335415328074,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14177550319031076447,4852007641305699380,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,14177550319031076447,4852007641305699380,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6288,i,10329186663746488526,653309950920663832,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3696,i,17965184231038974361,7418348526375480890,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6560,i,8681176461756557880,7816645557198029952,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6572,i,12978738707777929297,11814061232148204638,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5952,i,3098156803171703201,14051662702496900288,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6328,i,965222819425816825,10397724631739673356,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3428,i,18203750064414717627,12607228702508031466,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15453232090055160117,4101085535555790495,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  - Modifies registry class
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,4808124863642370122,3837837418403153333,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6804 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6960,i,13145886360967667122,7548058625602015457,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7424,i,15926931910226160986,14333724561194309310,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7232,i,17543249791618682069,2849757498172395750,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7508,i,18281970531442807132,7687830314875579968,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7548 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,4048520083434878237,7660470116893219295,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,16283110716302354296,15638062312437912645,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7568,i,13992074910431958463,7273317052121044791,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:8
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7564,i,12163214445647842800,14053288156678399590,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7888,i,3466882880414698509,5949943257467753654,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7856 /prefetch:1
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=8064,i,5453682757870713069,17733194483951929102,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=7880,i,14768167300437566998,9122500117683569404,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7892 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7704,i,5868927521777455998,4836116722606374854,2097152 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,14873084251589394016,14572637647679128780,524288 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7768,i,17400600228119017953,9622627534714797452,262144 --field-trial-handle=2260,i,10238868390218095652,17919018327146397547,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5508

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 76KB
SHA256 4a8dd5bc483405a650e933737740b5a4352fbcd55373c99a98096d2796cb6206
MD5 19a3f7d7b9ecd34dab0ebcb362d47b46
SHA1 2a1d370a727f5cece2006e5193a88c7620dfff76
SHA512 e52c82d1b54b5dc8266c10c631a97d2a6c99ad5a44d0de45743d4c3c2e0b01efdbbb5ea6ffb47188e20b0c9935ab7c38a224e1d634891469b4731cc49e5a3fee
SSDEEP 1536:o4mOvxOrbpATOlx5xd2hUwgpeexOBKDG9tLNK8ARSndL+QEEEc:oMUhAT45xoOfEXBPARDxc
TLSH
T15E7302D567FB02823CEDAD586B702C5CE4CB91B3D85CD18D5BDAF5B92A400819284DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 184KB
SHA256 7622669fa6144b9c263aa10305dfc3c49cf7fb53e0a928c43e1e12408921023f
MD5 2709ef7813077a77802b2e24574c2bcd
SHA1 e16531882298f4fc58672e40a9500bf944c3b586
SHA512 3fa2a7353dc9acd81d3a6d9c99c51ec9eb377db1eefca00cb05648dfe60a03117eebce478aa7d542343722f4bac7a212a8acab6ee948d796b0ad5b76a87dc9d6
SSDEEP 3072:Z0tWdH9uUYWQxSveEH4k0Wbs5Fw9hNOIcHW3C/S72c3+NFDUZu0guT+PEZAXsJz1:Z06HXYtYrYktbs5FJIUYL7xuNFD0uF2f
TLSH
T1120423658AEFD4CE21CAE0F382976354F300F896C6B9CF4919597C51A0FB84D7440AAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000097

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
Size 33KB
SHA256 7b0b7abe7f4cc2a8cf9a1ce70fb3b5b355d56ec55617d89059b21bdc384fa320
MD5 af644b2a43309f33a734cb793673002f
SHA1 2a523d97c1abb65af88e5bb6394e9bf4c68c985c
SHA512 d83ef0260947d8c4f9a76dcce8480d7d875df58c7a1fa3205127b574c9f91d854b93c61498d480a8c6bec3e2c4d4fae329010f7d5e125a0daba0163a1d428546
SSDEEP 768:t0jypE37eSL3EDukK1WoJ5BRElIO1EtSJ3WRVxSi/B5X3EoD/:8FL0DXoJ5BRU1jJG3/B5H/D/
TLSH
T11BE2F24A7A167796D1D002C97BC573B699C6E3475DB080034A226E5CBCFAA0F072BEE4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 96KB
SHA256 6b414b61380bde87bd7966b8b24907a82bd28b193fc9521ba5d040b2f5ae3c70
MD5 1c44fb97e068fc6627c9a6c51e481c20
SHA1 ab890a67d727abe3f733783a3ff28a4cbd62ceb9
SHA512 26d1e08c4a5176179b82f9c00f5ee454e99e4e2eac4063941c5801188c41f937fc2538de73aea26fd3d9c5025b6c271aa8c340af5aaa2704b3cab7ab47b9bbe9
SSDEEP 3072:3B59ELLnZvhPeq+GeI1mES9eCEyYb10CEQIczEiMBekG064WmaUhEicJ:3B59qnRhP+GeI1uAHyYh0LcIigek7vE7
TLSH
T109A3020AB96350367F4ABB850722EF7BD97401E5A250E644DE520EF6C3FA84E07560AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 409KB
SHA256 aa78f1524f5cccfadf7598ab7c83484a6c5f27735427ca5f76eaea3c308fb80b
MD5 c48b60ddd2ed6dd70f63c7a829c18d9e
SHA1 9516ce69070d8a7fd491e940c4bb9c39931d2ef1
SHA512 4a891fa7a3af0a103f2140e6db5cb36c5914d1b1776a88d30d3214e6bf738de946fab4697699afd4069c08126333aef28712c79ed5ed241378267317f3bef75f
SSDEEP 12288:TxVIcX3625f8Qyfx/hurdU2L/jEUfRaw2AIy:jID2PyxJurVvEiawBIy
TLSH
T18F942352A290C7A278628B3054F78C2AC27F59379FD8509C85DDCDBFF66C4DA4482DB2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 68KB
SHA256 a2bb2a6d3c43792da9be787dd3b238b0c3cece22bbe16ccb76d19a744f90ee62
MD5 2ab91bcb4cd4e8a3e835c2170abf4732
SHA1 6d840c1015939e30bfe2009191d42cecb648f3f8
SHA512 ee7d6571228705170432bd9c7a818c7dcf2b2427c2a427f93c2b8a3d4ce479a970e160d8846e044eaa0ae900f9bf22bbafa9c9195d1ffb1935a91d8b39846c24
SSDEEP 1536:QpSXd1DbbJh1sLAnW+WYPEt0qdzlna0yqpAmgvXSKlZp4/:QKXz1/nW+WcydawpavXvZp4/
TLSH
T1FD630288AF8E614E272135DB50F623CFA18FD66D8D67FF2B31946280121E61F9CDD254
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 27KB
SHA256 4055c08923c81d63735c1691baa778c332bf680b8c4eb057d7b87e2c00c5578d
MD5 aa6a30350189be311d6f87b7d145d85b
SHA1 79d0105a90db8fe73876d31dc4f54bb9a194002a
SHA512 3563cdd2399d4ffe7f76a2b252800e2b767f7fc776fe1faf1bd385cc41ff9305c7a5367a2d28d6bcb46b9202461c23b86ad6f1f3cec2cf51ffbd181000651037
SSDEEP 768:Y+8X/NT0ZezFy6uLGsyvi7ssXAS39YGiE1TJnhC:Y/ZexL0o5X2k1Tds
TLSH
T1ACD2F104AD3D7AA06468E3D332713166FDA696A10B7702D2C615E625B3983F42BCBCE1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 77KB
SHA256 9d721b1e67a166230776d8b1d265cbec4e04c5580e20423c1d3706e671c72b67
MD5 b2156794213038773c8698a9dfaa570d
SHA1 688f67de0ee1e7e5dd24990eb373062c03481b71
SHA512 2829c4a53c0b0ddfd7b6d2a1425e524da32c3c683ca37549495b46f86a3e856d1e10ff5801ccdd762cce624a37419cb97860363fb826c464b83112ce1c30625a
SSDEEP 1536:6TgPdAnIfe8bAJvfBK8/X9MoCwx0rF+zso3XXuLBUyZcE378pRR/Gbh:ydn58EpoENMtG/zeLaYdWlI
TLSH
T1E5730260EC9919EAD0527C777019F388F96B5306EEB6B42AE25418750400FFABDCF2B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 60KB
SHA256 4437e1dcd8dafb0a5dfd8b47d3fa5e5ab46213bfea9f7417cd11ade5f0ff4fda
MD5 895b9352c5cdce4ee233bac3ea6bfdcb
SHA1 aee094c77e9791bb1d9a04944f4cfbcbf5f3e6da
SHA512 6f9eceb0b254236d9b54015422dcdda2c964efb8f6c6b7ad0e56cc4ecef073509234348961fb45e886344fa852a7e3c2493c8efaeaada34307c8236a806e56df
SSDEEP 1536:DJPe8skVtOw3txEZoHZSBA57hsDJeoqtfQ7WRaTUA/bFoWBUwq6c+LU:jsUZ3nEecYmFekqRp0Jo0Uwnc+I
TLSH
T13553026EC1F520FB1673B418495EC3211C8DBE9F2B8F9E95A22145E038A83ED678CD57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 72KB
SHA256 47412f5c6706d5fc8103b319dc23306277efcf30f957c7df5be4562242e2b976
MD5 4d70470e0485ccb21dd0504e00f756e5
SHA1 4eceb9a790a8870e08d03a995df6ddbbe204ebd9
SHA512 c2728c39b53874ced49a98a74f4740d397c3688704ddf456601ec60477031aa3fd6ffc8ec616f7dca3213415cfe4c5c5f6e40873df5cf1b2aa0b02e708ccfd42
SSDEEP 1536:UKLQQ1MFPR9vabxIaXJ/IE5+dFF+zeTetVx2UPM2/Mmq4LbuNssnT+Uu/E:TQCKR9CbDJ/IEA3aeyj26MgRLbulnCUp
TLSH
T19F73028CFB1D59ED489604E1216F024FB939743BE5D244B6B1D899C7CC83E0DEA8B09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 0bd8dc2bb5ff4c62d1fdf300e09631662998bf53ef7ffe20fe341a10d2385aa3
MD5 9c793f5f9021f6d9a69a0a3dabeef763
SHA1 d4a43b2d8926dbf7033f2ff4bc1d37961a7be63b
SHA512 cc9ab7a9b623a26b24baf50db2146904807be3be1dfb11e46b7affd73f670c5d50f7e7a97b26299fc9f58a74329452dba999d466e4ace9abe43b972136ef94aa
SSDEEP 96:s3Vc5IPZ6bZ9V12BXi/uutGeuRRl7M1yPAbF3aw7QxW9:s3VcpRMXluVuRRl7MLbtaw7Qxi
TLSH
T182E1DD70A284909AEF5698F368838EF3353A68C5FC5E5F72108D5E309C637964C39DB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 18KB
SHA256 49a4ea804226c8d4d4efae11225a9a6df30422596e985b36fa41e28c519ab2a0
MD5 3a2e87b14932f1a142847ea9f17eb2b3
SHA1 bfe488d989035a0718c692114e7b789a535dcd59
SHA512 9624c38383b5327fbecdbaf32676a61a6e74339a9f7ea38d09472d86b44c36366262c73d6fcb22f6d6ee6e25bb751fa4986bce87092a55d2430fe90d208ff0dd
SSDEEP 384:DobFea5aEUlCtOJyXJfeTV6rDOmGE8jyqT0EXmj0nViVvNGLa5WBb8IpASU8/hgp:WEBlgXijKdtmJ1KF
TLSH
T1FD92ADFAC6E8867D981112F1EA24BE1FCE1D055A436C3C0B85D9DF8BA3E1471D251E8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 61144a2f9283f72e4fce5eac7ea667c981104a05159066ed65e6ba945ffdd913
MD5 73e49865e578144e7bd29c56ac8f17cc
SHA1 10ee86bc37c7cbc33b5d2f08b01b2db37ccb7ffd
SHA512 4019ab3c5449b3bc43fd54d766667fdb2509cc5b58444ec6dee6f6db91fc5bffe641fa841d3b2dab38c82e6fb6db79ce004e48207f86574e0015ed9eb045808b
SSDEEP 192:sxZeRTyM/jK1Ml8Mkt/fTscd2Idpr/HW6+WNw73/YI7Nw+jIgrJ:sxZelMt/fTscd3zHby/gu9
TLSH
T1DA52E8116A34A97BCCDBD209FA55BF93D6F40472E2900E44A9FCDA1C04E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3be5e501101503b4f4a426e5d5f1b995e43dab4b2bd190e3189cc40ea1bdc063
MD5 5889a49b54abec7d7f3dd3d7126995d1
SHA1 748e88ab5529e68d11e17a76faab0eb85c1e897d
SHA512 a1b016b3d249f96a231201fb91d8fe8fb52a1e0e41a0b619e28075e428fb5d035feeac5f2faf442d0755ea1afb0d54a3da95682a8aa3ed5e3e7be065058553b7
SSDEEP 192:sxZeRTyM/jK1Ml8M9t/fTs3rzHEKIb44ddpmeOQHW6+WN4TFFrFCYmLhSBV1/YIX:sxZel1t/fTs3HpKhHbijAY/5nu4
TLSH
T1A672E70266345977DCEBD219FA44BF93D6F84462D6801E44AAFC9D0C04E6BED7207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 4974df286b5c73a4b2557c66a296d88be2c4d2b3ea431c9428280d33dd5cf4bf
MD5 bd4222a46ef55684f92a1ba4ef127899
SHA1 06d3dff9db933fc418ab6bbf1ab0656aa9db2254
SHA512 96e5a16798d9de99090f6f49d47f8795d76e339ba488dd090c90e148bb7cb1b44384a52bf3ff2b0f202a0709c6937458eb54db12656c07e0df6b40e19a64fbb9
SSDEEP 192:sxZeRTyM/jK1Ml8UQF9t/fTs3rzHEqzb44Idp4NOQHW6+WN4TFFrFCYmLhSBV1/8:sxZelqPt/fTs3HZ4jsHbijAY/U7u4
TLSH
T1B772F60266345977DCEBD219FA05BF93E6F84462D6801E48A9FCDD0C04E6BED6207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e7f6c466b03e2346a846ac2eb2c462decc540dd86f30b21a5d7841a18d0b24a5
MD5 11a854f0847393356f70effff9858780
SHA1 8424dbd38a1abca44e19655dc063f83f2ceb7989
SHA512 8257357ef8fb86455d3f71d3086582a6be97215675345327f762a867887741b244edc3fa3ac7855c1a1cf3907429a29cd0eb7f74f8d70d5de553c08e39f16efd
SSDEEP 768:IusqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Lroklo:IusqxXlWvJD0Tu1ja54LAs94k6
TLSH
T1EDE21B3B694CC77D4F840EADEC26AED76ED801CB66988D4447FA880C03CB6EA11165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 6bc07d194c354c47e9f864763d765e7facceb242ea5e8526958584591d54dbaa
MD5 85a247256c7bf88967a41268c8baed7a
SHA1 e78b1006cabd31815bc5b94ef92559bdf6e5cec7
SHA512 001f0003e69f6feb062b53618d68f5e26984657e5521dde3c5d549f49573ad6c6776343743fcdfe0b39821187770017e3367bfb6a76b63651f0e4d68c3ec73ce
TLSH
T18A51A74E8D0B2F6AC9AD02F324BA0952337634FE57444B57299CB47578C33296C1E629
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 7c211bb35610ea68a1377f3bff310bc5c0c43b380d3794ec6bb03afdd7b21e39
MD5 6d2ed5998f39bc117ffdb4056a2d8057
SHA1 14b56f0854452209889afa55fd9590d2b9d24c88
SHA512 39acbd57af9e4900bcdd020fd9738a2d446b9f9fe8009ecc2d931dc6e2e090b985088a7a95305589c2fa0c99fe89c3c0c75a73cb058c502f61aa838a3026c318
TLSH
T1A82121CD4E91595FE9A589B20036A0E03370C9CC6B15E7130C7C72772C223992A0B1C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a7a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe58a7a5.TMP
Size 1KB
SHA256 7e7ab1fe27109f8cc18be15011c5f6db41976000dd3ff82bddce325a5e9aec21
MD5 01cdabda373b0be73a1d4b7859829403
SHA1 d5a17bc4316a1a96980fdfad5488c98ac745cce4
SHA512 833da59d12fe18fe11e20a8e2c62d8759782e3670b115d1c6556b12063f92b080c92f91b1424b935b6a5fdb20a3575f0cc1b472777ec5a69840119d65719a0af
TLSH
T1D021408A46924A0FECE041B60543B4F43370C900A322B383A839273E5C3478D5E4B1C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5187cc74361575cae005d191ed6fb4ddc977e2b29236dfaa09419b92526416be
MD5 186a0fd422ba978c91bd2fff4cf4c109
SHA1 31582870a880b53277023a3e016b67a213c77466
SHA512 12182de5a0e8838f82ab80aeaeed205040b28d7ac8c1f5bc6eba33884b765009ef29d5cbbc2fc9636dc3d439a96cc4bd1dbed05a1b4c315a4474f2f579be9114
TLSH
T164E06FBA2AE70800A8ABC3EA087344A64810F828C891EC8F0029968310622A02826C2A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 22ac621ae629119f9bec2579ebca796dda37dc18fa2093038f9ffc312af3a324
MD5 97d0e95f74d994fde4bd781d4ecd8a88
SHA1 27da1c128094d5f8ae29ec7c16f543a0da59121c
SHA512 96d48f56e7e016117d0f3e2477d5f5fe2796bd9af2aa546cee485b9df4fcaf94f8f6dc5fe94a2c7776640a32ebb65d08032fa332f6544db91901ca3d890e9da5
TLSH
T14DA002A08D4DE205F4000A7220E59AD8336048D915661223C4E892F8CD9265065C6545
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5930bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5930bb.TMP
Size 48B
SHA256 a6a898370259c23b3c229b44caf9ffbc47af6fc7afbb3ca2e3d27d3f62df5598
MD5 3a5309c5c43bb9aa9a0409a772bcc95d
SHA1 762d366dbdc4df91872c0a1b5c4a116ebd9a4079
SHA512 7569e110b089fbd60969fa097e1017463b29f74cc2e4adb6d4d6829734754a3619fcc16995911f1963fced9062464a657da1fffb6ada4adc99dbb3d5457b4f21
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 8a18ffabee99a2ee5a026b1a18adb307e9001a9e928f0e5660892117a4d7332a
MD5 a0a2878fcae728e12b0104ef29176885
SHA1 ff358d22902a37fb9a52d38edc3e85195164a06d
SHA512 bbd83c6881a41cd3e84a9f4884618237562e78aa6567fa9af36057c88cb9424b4965ea86cbf943953f35feaf9493d0ea14eb9cab071627b07eb63f7e3d2a54e3
TLSH
T1ECA0022041482185C425C2741E8101D1631959111753165164E6124A889C597859124A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 dcee1f17dbd499f746dc8dfd6565b9e2ebb02b427c4e3d0e049d1efa77aa702d
MD5 fcea4bcc333227370e5f51bbb84d3337
SHA1 cbfddbbfdfa4ac38680d3c2c08bc53d582b821bc
SHA512 de1532e4c3443652480acb4c0d3b86bd22a65dcfc3fb3d4cf5e22e5074e4e37b5ce060c395502651e8f99ae3b60fc0b48c69a00749a24de321390caf4f1d3dab
SSDEEP 96:KYbaKYIKRktgESKK+Ea7lCk+KqLCe+mckDO0f6KQK/6u6ucKnq2:ExV9/7P5
TLSH
T1F7C1031A31760A1339BD3988B6A6C6361F4136733018B46F7FB840654E6BE125DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 95B
SHA256 3e46e8026ad32460ec56446df4496086a31d4936956371a206ab35ac6132d91f
MD5 93ac6ee0acc223b23db53ebb984062b4
SHA1 457be7fe40baf3613578d7b465d3a4c478adcabc
SHA512 c673b0488bfd4a0be96ebb6b625facb0471b21695e4398a5c4b81f747da3903218f25aabbf16cdabc401bd161518c780a22fbc50769c634c641cac6936bcc141
TLSH
T144B002FB4445D9D55E7138E7414533DDC57273DC5C85FE8DD4752059322057F5011E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 182B
SHA256 96c066baf76ccbb2b3019fd912fc9dd16cca23d7dadfed3431df60ffd63bcade
MD5 bf62f0d99a9108e760c1a46d602a876d
SHA1 e11f4fbaca1b0e9d27008985bca8fc1be36efa3c
SHA512 d3a9304ce60991b80ab692c1d3a64703cac93c4ca2d2ac60937756eebe19ef1855ad290d16e5be5cdf876037e0db64cc76c296fde7ecc9fc5ca1d5b742427a82
TLSH
T11CC012BB4880EA956A2138EAA28677C8CA32BFCC4C80FE4C98213059323086B6015A24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58604b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58604b.TMP
Size 182B
SHA256 b7c8a664e8318e9fc68efd39206fd83f2f8514af1d65d59f6a28a6541021500d
MD5 09d34e861dad745f93c158de4d49ed0b
SHA1 d978d3aada653febe23a9d64bbd6b2248323e1a4
SHA512 895a04c98a283d55a7076901b2d9bf369fd2cc02629428c36b5e0d142ea981492f78e226ce4c508d79dc8a6dc7de69f87751fb4f0a2b4def39a971a0e8e0e1b5
TLSH
T1AFC0127784D19A513A6174EB415132C9C9727FE95CC0B94C44623049613092E0448630
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fb53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fb53.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f85e38002e5afc0802b71ae3290dfbf9e219adcc29e2d9217428613514d20c9f
MD5 b67b7ee43e95fb97d95350958e833a32
SHA1 57bd115d7e8efbc0d07e39b9ea06b7706b622621
SHA512 17eeb085e8a86effa43ee5b71f564b86ebb0e88730aa47f77f5351b495664dbd05e6d02b25c87c8078125844c312267b706c73aea46f78e08106b32cc295d556
SSDEEP 384:YiFiZcIfsNh8TUNTUlIl9TC4OAblZKJ2VRN5dc5sJrB0+HBbsTOoa:jFQfowgpKJUH5CmhB0gwOF
TLSH
T1D3C219F248D7887AE9AE5703E77E2D034EBCC067B5856A90B3D45A0CCC965BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f8f105d1cb39a8ce43eb866a7eb71d73f1670ed6ff9f173b59fd50091791860e
MD5 6ba3d42ee8a6d337e5bcde3c7068a82f
SHA1 445e7b0a5ec8012aea20ff73e8db21bd1db16c0b
SHA512 95016fd23e009aa99fa6d97390d28c7fa164c3999ca2e7c690cc049f6e877d4c92684a0d4580963ea807905117da2f359fbd25a317e4c10094f3264fd97a8bd8
SSDEEP 192:tONnm6JkRtQmiUy0XW+RNW+Fd102owh3xRJ7U6:tONm6UrPW+RN5dcQJ7U6
TLSH
T1FA02E835AD386CBB8EF26D0AB58737175FA4217BF9952B80D6E81F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6faa54ae6dcae8827aa8eb9ecf3655ab1cf798b1cb0a0cb5f68f5fa7fc1bb5b3
MD5 d9e067b0060f1de163277198eb579790
SHA1 e46ccb610c04973f3e4f130f061e1277f17a1283
SHA512 5b5863aaa0a41702314eb9252e93a4748bb04e60b0735418c125dfce019b2e24b9586dbd72f380ab792d5d1cfbab88b3ead26a744e23bee84dc1d7a579f29ffa
SSDEEP 192:eONq6JkRuQmiUyBXZ+RNW+Fd102o1U2tSJriSVc9qg+U6:eONq6UqkZ+RN5dc5sJrQ0U6
TLSH
T1F012F9356C385C7B9EE36446F48735135EA45167EE8A3F90E5ED5E0C01EBAAC230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 d69799c6e08491195ef7cbae76c913defa72d65caa38e1251e2bc15676ff0af4
MD5 4fa3dfd1186e69665d2480af300e2459
SHA1 fbc3442a6ab3220a4ec65c7b22d8d3cd45f154cb
SHA512 3d157f9a0e8775d094cb40c2286beee46e5fa305b7ea9b6f7ffd00c089a3c8f6a2137afed410069c7697bf15493a5b798d2d7d0f2a7c679bbbc108f7399410c2
SSDEEP 384:7sNAU9y4OAblwK4VRN5dc5sJrq0+HBbsTm:7tKuH5Cmhq0gwm
TLSH
T172624C366C349CB79EF36102F54735135FB4416BAA893F94E6E85F1C01DA6AC230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c4da226e0e9d06c7b8fcc24f3775635fd8da97dd04224ecdc352a6217b7fa9ba
MD5 0ca10458a5a01ef2dcea390a87b9db6f
SHA1 2d8a37113b6adaffcff6eecc456574d700a57cfd
SHA512 23f8a9a479a27534986941c885b0a2658caf316b3b85b6b7b5a109fd3fd428859a11829041cd6b6e681499cab2dea5bf441e4d92c0378e180fca56d766b624a7
SSDEEP 384:LZcIhsNAU9TC4OAblUKJ2VRN5dc5sJrq0+HBbsTOoa:ThVKJUH5Cmhq0gwOF
TLSH
T116827D725C349CB79DF6A102F54735035FF88067A6CD2F90E5E8AB1D01DAAAD231BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7b83fe5e10d814f973d60a80af79988ef949a03a5bfab0e8b3531f730f857344
MD5 4f79a110b512eccf65edb83059509290
SHA1 eb2c28188a111e97a28888a6018d26cb55a2bf23
SHA512 31b6e30a8acc451bd5ef061ea374e21eff32c13022f6619bbffccc09d98e10ca872a1e1d246731cf450c274703871a9449aebbefd6fbba9eb7cf429a24d5391e
SSDEEP 384:4ZcIhsNAUqy4OAbldK4VRN5dc5sJrq0+HBbsTOoa:GhZKuH5Cmhq0gwOF
TLSH
T12A827D325C349CB79DF6A102F54735035FF88067A7C92F90E5E8AB1D05DA6AD131BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 421061e77574cb2cdb6968ce90ebedf3c9963ae4eec96f462dc055fa73d02c2c
MD5 969ffac5ec4994016e41643b7cbd4601
SHA1 6289fd663cfc1510c4346f87e3fb93fe8ae359a9
SHA512 0a441f8f98e61553c59b69007c9f5785a8665bdf7e31506c1deb60b3a303a68252eeaed28fbe41cc535b8f7649db4ebb01a521978bf817c58bad2823b8bc00e6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2c5b3747158962bd339a91a4f28c9689b5771bbf582c65df1f9425c1bb81508e
MD5 f576bc33bc81a051d7eb4bdf25ab401a
SHA1 7e224e10e8c123e743b506c4511e9254cc8c6294
SHA512 32a63ada104781a5f3690d0dc38d676d0bb1dd2f1248494bfd6e79d59da234e90506e5b4967a212f93c81a86864057962a7d7f250147b500cea9ccfbe1057acc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 dd002ff5201a74cb526ef1426118e8e1dbb550fe7f17b8b618103f41eee5ae18
MD5 51d8626372cba9a9ede277a5dbc366cb
SHA1 f6636ce67a81ed0a578bcae423ad0f165cf96709
SHA512 159209625626f2d13d0e5df96f82ee33ede4c1b6c360e239833f46873d85048842d9737e54d5633cd8a99804e5c2f4152082b8cb21c8cbf93fda625d3e1fa484
TLSH
T157E00146974000BDC13C133000032F600EC2C06040F006865B30018C6C777403E30F94
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe587c9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe587c9d.TMP
Size 392B
SHA256 e1e53078c4df128df7bb9a1f194ae1b08ffad5bf3dc3b03ef7c9bdcbaa0f6042
MD5 93ecef7f0c67f7c05194d832561811a4
SHA1 d8e6c5c06cc31fde22c4da14b416c9727f9d1850
SHA512 f3505bff8bca06f0d507b67804ae947a3919264eee5952fb60192b9f9636675d461aa292214edb1fba6365d9cf2967e4d3944a0585007f999cd1c5c30dc5070f
MD5 SHA1 SHA512

Submit Download

8679949f-3838-41a2-bd3b-70e956d488a8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8679949f-3838-41a2-bd3b-70e956d488a8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 585c165d5f675732a4b8c5a4cb0b392cbf0fd8192cfbe34c0c3c61d1c9c7805d
MD5 0560e5481b6fdce4bc58f865cd77c381
SHA1 c1d8e46d1fccc3fe14fd22b92ee2d43d4dc9534d
SHA512 b7afd28bba5e97e154a0bc188393705d0ddd0cd46739de80b077aa79b7db36dbcd82c78b0d9af39e4cdb2de7faa01af860c7486ecd479e36f81805504dcac753
TLSH
T18E415B58AAF51108B3B32E5A9FF6A96D587BBC732F06D49D00110D4E0A62A40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download