5f78b5fb7d26d8d75a867bfe0946d2da7f7e86cce7306273e897e8000be0591b

Analysis

user interaction
yes
max time kernel
898s
max time network
735s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-de
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-delocale:de-deos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 292KB
Sample260826-3dendsfg67
SHA256 5f78b5fb7d26d8d75a867bfe0946d2da7f7e86cce7306273e897e8000be0591b
MD5 d7d85650ef8e77f3b50d3a7e0ec045de
SHA1 b491db5940ec8bb2a20ab9a78695a29692121878
SHA512 1f152c8de69ce172756f375357a21d56c4b3ab214c533e90a9a6764ffc1818bb0abdaf1843fee34883ff3306bc9d74e2ff0a53c4239109a5e586196beecb8f99
SSDEEP 3072:tjAVVzq0sqbIymjSlLl7zNF63abjlqafIWWXvhy5zXP:tjAVVzqxCIymjszNFZHtfIP6XP
TLSH
T1B4546C766200743BA813DD90A6BE6F0E3C39E12BDC1B46F8A595E930CFE2EB5141535E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2592	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322602301263402"	msedge.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\.java\ = "java_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\edit	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\edit\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\open\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\open	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3611646547-550105268-947503007-1000\{C53524D1-6C23-49BE-BB09-8DB7E313C8E4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\edit\command\ = "%SystemRoot%\\system32\\NOTEPAD.EXE %1"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\java_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3611646547-550105268-947503007-1000_Classes\.java	OpenWith.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe
5928	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2080	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5928 wrote to memory of 3244	5928	msedge.exe	89
PID 5928 wrote to memory of 5940	5928	msedge.exe	90
PID 5928 wrote to memory of 2592	5928	msedge.exe	91
PID 5928 wrote to memory of 5940	5928	msedge.exe	90
PID 5928 wrote to memory of 5940	5928	msedge.exe	90
PID 5928 wrote to memory of 4512	5928	msedge.exe	93
PID 5928 wrote to memory of 4512	5928	msedge.exe	93
PID 5928 wrote to memory of 4884	5928	msedge.exe	94
PID 5928 wrote to memory of 4884	5928	msedge.exe	94
PID 5928 wrote to memory of 4884	5928	msedge.exe	94
PID 5928 wrote to memory of 3484	5928	msedge.exe	95
PID 5928 wrote to memory of 3484	5928	msedge.exe	95
PID 5928 wrote to memory of 3484	5928	msedge.exe	95
PID 5928 wrote to memory of 4140	5928	msedge.exe	96
PID 5928 wrote to memory of 4140	5928	msedge.exe	96
PID 5928 wrote to memory of 4140	5928	msedge.exe	96
PID 5928 wrote to memory of 3256	5928	msedge.exe	97
PID 5928 wrote to memory of 3256	5928	msedge.exe	97
PID 5928 wrote to memory of 3256	5928	msedge.exe	97
PID 5928 wrote to memory of 4748	5928	msedge.exe	99
PID 5928 wrote to memory of 4628	5928	msedge.exe	100
PID 5928 wrote to memory of 4748	5928	msedge.exe	99
PID 5928 wrote to memory of 4628	5928	msedge.exe	100
PID 5928 wrote to memory of 3088	5928	msedge.exe	102
PID 5928 wrote to memory of 2168	5928	msedge.exe	105
PID 5928 wrote to memory of 2168	5928	msedge.exe	105
PID 5928 wrote to memory of 2168	5928	msedge.exe	105
PID 5928 wrote to memory of 3044	5928	msedge.exe	106
PID 5928 wrote to memory of 3044	5928	msedge.exe	106
PID 5928 wrote to memory of 3044	5928	msedge.exe	106
PID 5928 wrote to memory of 4844	5928	msedge.exe	107
PID 5928 wrote to memory of 4844	5928	msedge.exe	107
PID 5928 wrote to memory of 4844	5928	msedge.exe	107
PID 5928 wrote to memory of 4204	5928	msedge.exe	108
PID 5928 wrote to memory of 4204	5928	msedge.exe	108
PID 5928 wrote to memory of 4204	5928	msedge.exe	108
PID 5928 wrote to memory of 6072	5928	msedge.exe	109
PID 5928 wrote to memory of 5328	5928	msedge.exe	110
PID 5928 wrote to memory of 6072	5928	msedge.exe	109
PID 5928 wrote to memory of 5328	5928	msedge.exe	110
PID 5928 wrote to memory of 5328	5928	msedge.exe	110
PID 5928 wrote to memory of 5900	5928	msedge.exe	111
PID 5928 wrote to memory of 3340	5928	msedge.exe	112
PID 5928 wrote to memory of 3340	5928	msedge.exe	112
PID 5928 wrote to memory of 3340	5928	msedge.exe	112
PID 5928 wrote to memory of 4716	5928	msedge.exe	116
PID 5928 wrote to memory of 2812	5928	msedge.exe	117
PID 5928 wrote to memory of 1132	5928	msedge.exe	118
PID 2080 wrote to memory of 2116	2080	OpenWith.exe	120
PID 5928 wrote to memory of 5732	5928	msedge.exe	122
PID 5928 wrote to memory of 5732	5928	msedge.exe	122
PID 5928 wrote to memory of 4804	5928	msedge.exe	128
PID 5928 wrote to memory of 5024	5928	msedge.exe	129
PID 5928 wrote to memory of 5024	5928	msedge.exe	129
PID 5928 wrote to memory of 2152	5928	msedge.exe	130
PID 5928 wrote to memory of 2152	5928	msedge.exe	130
PID 5928 wrote to memory of 4628	5928	msedge.exe	131
PID 5928 wrote to memory of 4628	5928	msedge.exe	131
PID 5928 wrote to memory of 4912	5928	msedge.exe	138
PID 5928 wrote to memory of 4912	5928	msedge.exe	138
PID 5928 wrote to memory of 4356	5928	msedge.exe	139
PID 5928 wrote to memory of 4356	5928	msedge.exe	139
PID 5928 wrote to memory of 2372	5928	msedge.exe	141
PID 5928 wrote to memory of 2372	5928	msedge.exe	141

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2a4,0x7ffdd942c188,0x7ffdd942c194,0x7ffdd942c1a0
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,4346591897627470803,7143760365135411816,262144 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,12676001831684646643,5230474616253123435,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,7935413248696217957,2181779166300398471,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:13
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,8555249285878274734,4408195132071610077,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,1484191925894537488,3842773353712194010,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,6883031751458147675,16524698925924203817,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,2069131987236488337,10071698268664280577,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,5053938179979309946,13489207950300786451,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,11116625983987752942,16157023009531344051,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12728348891474660370,1666458827240869465,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12728348891474660370,1666458827240869465,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6472,i,7333208676294550366,10134147885274398883,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6636,i,11553105588647531637,11180947085775085878,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4944,i,7024487501181404353,6368134166743689610,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3848,i,10213152640564936627,2067363122997987733,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3824 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=de --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,12577542648779532742,2846680820599898241,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7008,i,2273667570371992149,15716756815640131008,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,11749222703762443802,13790624439573755372,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:14
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7528,i,2954996973178903695,6797190996198082137,2097152 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,13819043425208767644,805011482856502878,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,14244505916257776917,3738829371015804947,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:14
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,11264115437922113317,3863704747796683260,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:14
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,14475175032782174556,2366152587602345916,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6412,i,11860128535776705417,10533155334205669072,262144 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,6485493600680583332,4442977494043188464,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,1134332804522258455,10677586330874742817,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:14
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13084730767915389159,3750061393311791064,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,10568035293137361242,16433533875778894352,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,4124431043772050519,3845279010300907661,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,10005074893634079928,14077177951413794151,524288 --field-trial-handle=2268,i,17828799876326544969,7183264628677135147,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5880

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3148

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\93ed7f3e-b747-40be-b0f9-b4caad562f4b_CrashFix 1.0.2 SRC - created by FSC.zip.f4b\src\main\java\crashfix\login\LoginPacketGuard.java
  2⤵
  PID:2116

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\3a880230-39e0-4378-bb22-2c56012a0844_CrashFix 1.0.2 SRC - created by FSC.zip.844\src\main\java\crashfix\netty\BedrockEvidence.java
1⤵
PID:4668

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\dfa0ef0f-cb26-43c1-8662-f14758de8b86_CrashFix 1.0.2 SRC - created by FSC.zip.b86\src\main\java\crashfix\netty\module\RawFrameValidator.java
1⤵
PID:4856

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\f2a4d9ab-f1db-40d3-8da7-affe9c63b778_CrashFix 1.0.2 SRC - created by FSC.zip.778\src\main\java\crashfix\netty\module\RawDataModule.java
1⤵
PID:2808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\546f4bcf-8bf0-40ce-befd-70783dc34f29_CrashFix 1.0.2 SRC - created by FSC.zip.f29\src\main\java\crashfix\netty\module\RawDataSession.java
1⤵
PID:1636

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\0d37ac8c-7406-4f2c-bc9e-3d42bfab6729_CrashFix 1.0.2 SRC - created by FSC.zip.729\src\main\java\crashfix\netty\module\RawFrameValidator.java
1⤵
PID:1812

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\17669a1d-838c-49e1-99c3-218449cb7f1f_CrashFix 1.0.2 SRC - created by FSC.zip.f1f\src\main\java\crashfix\netty\module\WireVersionModule.java
1⤵
PID:5012

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\a6e4c137-5190-4543-a4f0-d5d7cfe6b7a1_CrashFix 1.0.2 SRC - created by FSC.zip.7a1\src\main\java\crashfix\netty\BlockedPacketException.java
1⤵
PID:1404

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\48b99ff4-e993-4950-bc29-28ab768e79a0_CrashFix 1.0.2 SRC - created by FSC.zip.9a0\src\main\java\crashfix\netty\NettyConstants.java
1⤵
PID:2460

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\6e738c48-f027-4cca-ba04-328293e9c0cd_CrashFix 1.0.2 SRC - created by FSC.zip.0cd\src\main\java\crashfix\netty\Session.java
1⤵
PID:2808

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\26d2f4e1-d03d-4c07-b207-ae6a075cdcd5_CrashFix 1.0.2 SRC - created by FSC.zip.cd5\src\main\java\crashfix\listener\BukkitExploitListener.java
1⤵
PID:5228

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3256

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee3af991fa1719733ca1e3ac746d5b605f4205e269bf244bd9ae780ceadb9bd8
MD5 a044f6413820c4c3fbd300ee9b379ebc
SHA1 94fc91536a25274f06d3a6e89322dec7fde7912e
SHA512 ced4374c54d7b4ea2b76afe4ca5d8841dfb55d8cb5db96de4ed49e64bd3850a817db5301787c268756641c94c0bf85eb4ee188f04fc891fa2e45ad48284985a5
TLSH
T13AD02BA433044D0CCE40203215B8A210720484209C49031A8D41B01C8C6FD4387171FB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 22c1d58ffa7df77a7e0440ce3b2c474b1e03f30b60355bbf5dd6392fefb641fd
MD5 b9f45a900b1f64efbf90731f41c6ad44
SHA1 0c28e85e464e328fbbc07373b05113d39f83bdcc
SHA512 132313545c55ea809da0e811d6d5d324ecf5b6cfaefadb3fa4a29df5e6266dfeca7cffa4daf21754b4b37771504d3692189b5660a468784b5eaf80bf92f59ae0
TLSH
T11ED02BA033044C0CCE40203215B9A210720484204849031A8E41F02C8C6FD4387161F7
MD5 SHA1 SHA512 TLSH

Submit Download

2cce281e-aec9-451b-bd4f-a2648e395f43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2cce281e-aec9-451b-bd4f-a2648e395f43.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9ce009f38fe1eb08f5193af93f11d33b76cd1d792d783d80b3823eb5bb9e723f
MD5 f7fea9c3299b21e42c20d2879727d4ab
SHA1 ca6c455dbd529ca147bcca0317a593904208a9ba
SHA512 b8fd16394db1ee1f6788098027538af8d8a5b5075f1137510c3597ce72724082e7e967f29968a3d68fdbc1ae244cf3a032839489bc98a25447caa55b485cedba
TLSH
T1F1E0208845C5C23D7504644F9298570C8381364FD3C4A9CD1B088488B0424C4FBD9960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ea9f9118cb8373630eb75f4c55c40465380ab71dc122fa9c084df5c4cabfb0f6
MD5 c9c0ada2dff13e0b91a5bc62f8278614
SHA1 cb559528ca7defc30f9ac33c94f684a1b5aa2e81
SHA512 c2c4812a6a316433c121d2ec64b858a5e136b8a70fae48e44f64631e954be82d5eceb021190ce3b56638586ff4cb7fb68a88aaa23cec0fd2109f6b7d3a6c6a69
TLSH
T190E07D9415EEC22EBA44644F59685B4CD2C0364FD3C8B9CE1B008488B109840F7D7EA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 cd9b5e9b4bfb78cf5a9b0b97d12d68e136df2e3b42fce5af49dad215733fa83d
MD5 3e5dc377ecb5be82476b255297a89d59
SHA1 7ba7d1dcd801415406f5338363d9657361cf75d5
SHA512 94c30ec9f98e3d5c7c58ddccfbc8e47a848fc223d091f7dc1a5e455ac7348ea64364a18d6afe06ec9afd03737ea89ed4e8cf08b07e139651593fe137aeeaba3b
TLSH
T1ABE026F404DAC26EB600684B5DAC470CE290365F96C8ADCA17048D88F005C88F7C6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c620b46dc79effe977f7b5fcc906a43299ca29b27a51ce7ba351dc75fe6f9656
MD5 c475518d6b5a3d0400fb6243128ceeda
SHA1 929ffc08ab5004b4c5a923dde139a2f9c24ff59e
SHA512 8baed990d08daf0bc2e1eeb9ce7f793256121cf8eaba2c13089e2eb7733a42b8479e5e3bc7f9ad324cec27ea8a7e02ec0431d8f20fe86509439609a709dc2d4d
TLSH
T199711E5AAFEFE891FF51487111D2198BA27CB84DD44BDF064043A5F821933A5829B2CF
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a4d56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4d56.TMP
Size 1KB
SHA256 0549a1125370555e276bdbce6b56c8f2e67a1a48fc08d827718d4c360138f48a
MD5 df23e128958529a86ebf1e09771e43bf
SHA1 0b687d674b8a2f6c8f742f390170d79afad6c62f
SHA512 9cdca8c05866c87d05cf717ff540f50370d7a08056b88e4309581ebed126facf8cad3cac289820b2f05688f35c45deac71f5907bfd6a807adb0d342da89b5c7a
TLSH
T12F417B6CB3FFDAC2F7655D7651E1659B323C7499C907EE514543E4B84B8731022931E0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 744af633092dff7d50958c700941bffcc5f73afa10504b282c6aac96181ef7e4
MD5 fc85b1b04fe312cdbc2ea68f42255757
SHA1 af49f4351bf3ebd80b885797d5c71ac0a4245620
SHA512 ab25bd6498681961f4bfcd5bca76ff8381b1810ded7af6aa7b012b24b1c34f1aa0407420818e89e93ae541c93de3318677940f63b3935b3723f24286445cf67f
SSDEEP 192:DsDjvcRmZraVaiaeUksYyDJgE1ujk57TacOtUGtb:DsDjvcRmZraVaiaeUksYyDJgE1ujk57g
TLSH
T139D19DF7C3E5862DC91192F0AA146F1BCE1D0555436C3C5AC9E4AE5BA3F2871E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 2c819bcc129d810a2850d58828b0cdbfdfbf662d120a365ad909ef3f3f084d82
MD5 7c1c653278938378daeed9759b8d3fcd
SHA1 0c706242f0238d9961eb1ed0dab1250e30550389
SHA512 783bc6bbd5d31778b446a1ddd20fa7784a510d9df7d89c32a9c72f9f639f952a55f55f5e11f8412e660a29ebd443b1e5aea1186aedc54971c26a6f243c58a573
SSDEEP 96:Dko/XLtZKdnaVaiZeULYy5gNm5/B1u5GOHzRW3cZt/GtcwBjGj4/3:Dko/XhZKdnaVaiZeULYy2Ngp1u57Tac2
TLSH
T170B19DF783B1866DDA1192F0EA14AE1FCF590412436C3C6A89E46E57A3F2472E141B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3e43490c0bd5e0ff074271699f200f1edaa7dd934ed5b98e540a7dec3fd7857c
MD5 6a332807e85eb143e9295c0a2b79129a
SHA1 098a20dd9ea8b509b992130cbc791d9bc6b63966
SHA512 5c3339ff2fb4ade699ab874d8dbe244cfe806eaacf7e16c3c232d12122a482b206f25dce406973abf58627aab4d1d87a62ec398243df86eea5ce8f8b573ded6c
SSDEEP 192:sxRu5mbm/fzsOZFEpq1zd8zoA8p4+S/g6+WNroZ/YGVbCCFGPIgIJ:sxRu54m/fzsOZFE45tw/50/PIs
TLSH
T1D742A8165968AD3B9CCBD21DFA557F53D2F95032A0912E58A7FC9A0C04E7ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a5959b12352a5f6d1766b9f7de7fba9ff850481e3f87110361b338b982005706
MD5 320080816f41ac6575efe7fedf6af4cb
SHA1 bdb3807efe5163d53f2643598a36f49eb759ab64
SHA512 0c23e9f9552f46c6ca1ed5a0adc6ab1b6c9e995888e1ef471c0bbe505b31bfe6c7bdb2e85a22d36dec9ad700c09bbf32bff9c39e5e831cb32d5a1564c957bd3a
SSDEEP 192:sxRuOQUnsmGPm/fzs5ZF/pq1zd28bxAoA8pJN+S/g6+WNXlVasoZ/YKHACFGPIgt:sxRuQnshPm/fzs5ZF/4526Tl/5+R/rIt
TLSH
T19862E71669645D3BACDBD219FA567B63E2FD5032A4901F48E7FC890C04E7BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c88047ab76fd65f08cace817ce8f4b4e63510d4ed0c1f3194d31def69c644800
MD5 a1703b061749ab6ccf219d86dd3d39ee
SHA1 8dc942ac4c0c6b4a3ab191cad44d0eb3450a73a4
SHA512 4e3125c62589759f25dda710563bd8b048edec007af6078a3153a05ff367247df2883cef034c4caec22062141067dd2d1ae7f634b981a54d36416e5d3d3bbfdf
SSDEEP 192:sxRuOQUnsmGPm/fzs5ZFEpq1zd28bxAoA8pJN+S/g6+WNXlVasoZ/YKVb6CFGPI4:sxRuQnshPm/fzs5ZFE4526Tl/5+R/LI/
TLSH
T19062E61669645D3BACDBD219FA567B63E6FD5032A4D01F18E6FC890C04E7BCE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 3c90822435f5d9519fa8cd89d02c93e5de6fd1d9d71fea0743b3f692e74ad8c6
MD5 f0fccf050e29f5d95808679e584b6506
SHA1 d610b4c6b434b3ab4b4f42b21f1012e478c01608
SHA512 1c3cf39c39cd4936b5ca498d9f67d19925103a86f73b10c2291b071fc54da31f6947402c7badb72e7156b64463a0185f0d7b058f599d1e60184a281d6d92ebcd
SSDEEP 384:sxRuQnshPm/fzs5ZFZ66sjqMpRiYnazAW8pZS15posJWeT+b452RVNE/5+R/VIt:sXsFm/fiZ4nnc7WeT+bPg/5EVq
TLSH
T184D20A069820C83BAEC39D18A83D7F33EAAC506265C5DEDA56ECCD0C019E5F96B07857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a3858a3c479df82ade6b2aa8f775847c3cf5f314cea6bb8fc6f419dcaa9c261d
MD5 bf73aaa2a54e681ef3f5a23c7ee028d8
SHA1 0e8ef15ecdb1bc269602d048ad7d590a7714c924
SHA512 edb891a5799d0d1c1832cb3edde81aa621039dee7c88211f407492ad85e49a1f693d7e3fc660951fde608c2038877cbf61ce880e1416fee5481b45b69e5a636c
SSDEEP 384:US5Yi0hfCtgvZFfxJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVDT9NHRIqrowas:UQYi0NWgv7fxJ8F1+UoAYDCx9Tuqh0VK
TLSH
T102B2FB3B604CCB7E9F800AADAC197FDB6D9802C796589D4047FE994C02C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4fda0add-7400-443f-beda-6deeeb9259cb\index-dir\the-real-index
Size 72B
SHA256 d55e51702c4b52bb1cea113cd31f2c73dd8d560489af9e83a803744c24b4898f
MD5 29d98ab3d1feec7e235fa3fe0476dec0
SHA1 a842fe47c3c465e336dc1957398b3bd1e9711978
SHA512 4bf4074b392d5b3b210c26621ce436c582e098ebfaad6937a50811126e7e8d2c0c008fb8fd62875131cc709f082c21182a4d0c1bd248e09b0ead32285fc6d075
TLSH
T174A0021402D41521C128037270810D97232EDD150601134350EB029CADF45994A23247
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a595fbb-54c5-47bf-8f5a-427e61b00b30\index-dir\the-real-index
Size 3KB
SHA256 27045745b048a0571024b11c911c8f3c28068fefb734ae974f94bd5f40bb98c3
MD5 700680528164c9af2d44a7f7b48b1b40
SHA1 a92b94c1383274b7f6174d43c55e8bbeef221491
SHA512 4e973c7b2a4306e3ac80fa2b8cc1935cf79b5e0729c2f826ba6879cb4f8c143ca0545540e26e4492402653b1fa243065f33058b86d58529be9469b989ca808b7
TLSH
T1A651B74FCD8A1D1AC9FC06B268FE148133785CEE1740D9872BADA13274D33792E1C55A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a0bd8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5a595fbb-54c5-47bf-8f5a-427e61b00b30\index-dir\the-real-index~RFe5a0bd8.TMP
Size 48B
SHA256 e82c812ea18a91baa70659f251f227f640f41c4e52872ebf27ec72d5d29b3a54
MD5 6bed3bb55fa42103e3e55e54e8d595b4
SHA1 ae0d6a0866ed20e9db66c15841575bc34793c6ac
SHA512 d93969989db549962df3ab1d07620e2106b88afd56f6661b8bbbf715145b613bf1a055ec3d0469d7f49fdfe4c69b699264cd91ef8d56a2c733bb2c30295bdd9d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5fa02a74-fbb8-4a37-a76f-1d854a71124b\index-dir\the-real-index
Size 72B
SHA256 5af72c3eebaa54dfb57690ff7798fc9f771658d26ec788e4f0a1cf38800c046a
MD5 6ded08959b1953d519cfac34e95189bb
SHA1 243e369410ad1f640d19683921cdd9dfbbd98513
SHA512 aa48a552558df6e32d13a0c0b0a780f557dd0a05f9ea05567ee0cef760342c84766230040df3645aa55f8570cfa98dee17fc3fde743db7ae1889ece365ea7bf9
TLSH
T1ADA0021281C47626E0000BB511D301C06314CE79810A17155BD3EC78ECD038971034A7
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a3886.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5fa02a74-fbb8-4a37-a76f-1d854a71124b\index-dir\the-real-index~RFe5a3886.TMP
Size 48B
SHA256 45a8fc8d1b46d1a0fa9fd6fadcb926c712462ea127130953223697e1e5f8f60b
MD5 349dcb379e0138d793f420b13840f002
SHA1 8823e33351830532123954f0d91ed3d578272210
SHA512 ac9b4fba3c30fa164cf113d830235cb0191955685f0cf174723060d74f2b17d335bb56b9de8a953f8976b6158cba51672d523e788a7af2505f983e0699f20ab4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\94f71097-cd84-4a4a-87f2-d49d184e7ce2\index-dir\the-real-index
Size 72B
SHA256 a585edaaa275059c28721115a0e186e02122d17272643e197eb7068dc21667f5
MD5 a10332d4d641c22d9d16fc0096ab3182
SHA1 69c7426976d5a0446768657acfb14b0c68d50674
SHA512 0918eb8bc9693fc09e6ad6a6e2c961f6046bd937918e7979570828a13565bbc912b732e5287d602ecbafedcad13aa5562b28896a6fa33574c1d4f3daeda46197
TLSH
T184A0022A05DC520EC05E83B8514302A06322E9664521035740940055DDA21575B6280B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbe4ddd6-0fa1-4fbc-92ec-f62ef785b9fb\index-dir\the-real-index
Size 96B
SHA256 31f9081d0446cc37e6bb630135a3cadba662282459bf782346f594ec6c78f5d1
MD5 7f34be0e92ffff53777540804dc9be62
SHA1 f6db19efc6115f370dbc99a97978975a586bb3ae
SHA512 3ef86eb5d1431c95f1596223d9f8b71f29b30364d2520aff3d724ba233988f8346b65d18bf63fcbb3845882f1e388b837ab17a811083685601ec1b46ac0e5853
TLSH
T162B011002003A082C0080BF200CAC288A2328C382222230B22B20238EA2038AC202023
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a39fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbe4ddd6-0fa1-4fbc-92ec-f62ef785b9fb\index-dir\the-real-index~RFe5a39fd.TMP
Size 48B
SHA256 78c92dc872b25cc53e35ab34afcfacb25ae5ac1976e697f4536d8b6f403ee4c6
MD5 7946eb0e5df5761b2f1c8c626841b7bc
SHA1 e614e3db4ff118b263288a83f634e1cdf50c8bd1
SHA512 3e490739c158d929f32f2932ad02ceab72a566e2534e758b2dddcae50eff283655657463f05e7f8de18de7bf151aeb342567e042d1108d4d755f161d63b43d3f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 c32ee8b81b924cc538484a93764ac6de8fa42bad10e449e97830048f0cda4d09
MD5 8fd0eefe74a5a07e06ae419a568f768c
SHA1 32a8c0a945fd9a8f7199980cd83b7b74e1e8a4d3
SHA512 c66758337d062071b06815bc007e7b5de6b509f8070b95de44297a8ed784f55506471391e2d0e1d59378e916f65e2691897527ecde77ff4985c7cb67e13b509a
TLSH
T1EFF028B33FF72854FDBB97EA547004780021BD08C914AD0FA4277197E0B2315145ACF6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 375B
SHA256 b5a670d6db12bb3d66af6fd1c7259bd36ae529963a5eeb9ce7202576174bed28
MD5 598e5b75d11ed542ed541db2322520e2
SHA1 4aa1982223275116669932d3b0c5f4ce23bbbba5
SHA512 19ef8b6d0c071cc9712277bd3afdd0c22133345cc26e20a27f17a0cbf4f91fa7e5d79a746af8012bce065bba7df24076fd49854902814be98d5294965ae62cbd
TLSH
T1C7E0C0B62FF76810EC7F97E7547108640002FC18CA00BC8F602770D360713152057CA5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 47da2dd90c03d355e0beb594893fa482a526d02529a008aaea2e3352083b0826
MD5 ea9ae7a05cb7f4b69b439d588628d70e
SHA1 6ef09b53c2bf1e3211f50cd2a09862398f69e350
SHA512 1afc922a514b4cb17a8b49c2068931248a8590abbc1bd72ad7c17b4d4ecc79c3327786ceebf6e4c5e2ba46b2e03c88a0d7d3b0a1b3a426f8c06823b189a8815a
TLSH
T1C8F0E2B73FF72914BC7F97F6547008784022BD08C904BD4F642BB09B60B2756645ADA6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 c8990154239b498918c20a53bfe7862606ec324bb7417fbb494d7ea06735ae32
MD5 ebe8cda55eb113ce7c19b5ca5960bf06
SHA1 6cf529f2e736ee54c2105505ba5ecd91c5578c88
SHA512 b1d2856c23e95c53092f3d32c0a00394690ecf1314cf300e5cdb54adf2a868bcf8bb35a5a9ba72d9a95dd96d971bcbb5b410466b2f99f8e42987a628caebc98f
TLSH
T15DF04CB33FF76854FDBBD7F6547004780112B948C920BC4FA4276197D0B2315145ACA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ffcc127976cdfd5414338d3afc160f4c1a22d0e8ef6167f7ca5ae658af9a496c
MD5 e0a342ce9154ac225617d460538ccb2c
SHA1 038bba38e24d1d43c44ece1d514a617127c21b92
SHA512 da2b4a3ea6afdce176e15a7ad0781852aa7eacbc7ac5501ed4b0ea6fc10fb48fdfda24f0f0b493d1164f386d23d03de6e5b75a2472aef8c8a843783607ffa855
TLSH
T127A00261C943D005C1C843F1277101EC6E14CE9D8A052325C5B880DECCE26C07186106
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dedd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dedd.TMP
Size 48B
SHA256 af9ba095fb37e991e83c1ad2dedf32de1cc85584b5ea67f4fee9891c952a2b73
MD5 a2ee4fe02171bd8c8bdc73d9c2653f89
SHA1 fa6d6433e250d892771f2e6ba288fdb508e7d043
SHA512 3a9a2e956a11ee5fe933bbfc971ba4f061aedafaebe659b50a9ab1d78a6100769502874a4e7c7833602675a2eeec512ab0a428f1ec926413bcf81f0e3e967f16
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d704ff8536301dabcf4e54ff1cbc01e7b99f05de6e18980b24c8c4be21e7ecbd
MD5 b2c681763fbd267084692ad149683f3d
SHA1 8fe393b8e8b3f6720c2ed35d408f4b5d3e036795
SHA512 667b8ee9ec6509798ac1c9e7b7b508519b170bdc71dac20f723c25c5b71c852aed5f889b9ea89b2414fcd67b699958460299671347a1642876cc9fac84036ee4
SSDEEP 96:KRm7KmgIIOW4tVgGOK47g0OcOGlkN6zn9Xr/WzoWgv/K4ugR/cVtgDbUHm7KmgIi:Cm7KmgIIJ4tWGm7g09OGlkN6zn9Xr+zp
TLSH
T1E3910695327F0240387DA95881BD952F92C270633118A87FBBE852625F67E078DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a378c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a378c.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3ed888687077125bcd8ec41dbf02db1c86030b4377c8e9271e00805dd66c7fb6
MD5 40e6d20867bb3ed43038133d28057783
SHA1 bf4f60f65bb5aeeddbea2deb37e4e64ea978ff26
SHA512 af135fe047be1e4714c6f8e3dc2849d6ca921527590e1d46701cbebef5ad8cd957b278f071782fb494516fb465998eb4e2cbd3b5953e5a9993f68c89d92be7e7
SSDEEP 768:5rv+4UNbdS3uFhlYy+VE7Hucys6BRvi82oP4/z6himo6zW:5bsbw3uCx3imOz6ImowW
TLSH
T15203AE31B8589D73DDB78288B4463B537FF45263458C2DA0D5DA6F4D029B9AE231F823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 058464e72fe5c8597d724696b29214f01bceabfc9f12ed8f07ff9107b513ec74
MD5 ec31fb54bb7caf8b8f2bea8dd1387667
SHA1 c29b29d23af6a044041f2543d22299225c3c0f69
SHA512 2147295c42320dc9b986280ba14613f9a251484b6a7815c651e7b77f93421b7a5ec21f84e4d91c63ea0e3e8f917fc2129acd2ea09a55e2e3b8442ffa1fa2e403
SSDEEP 768:xGrv+4UNbdS3trdlYy+VT7Hucys6BRvi82oP4/z6himo+bt2bwn+h:xGbsbw3t0a3imOz6ImoW0w+
TLSH
T18B03BF35A4589D73ECFB8288B44A7A633FF4526345C91A80D5DA5F0E429BD5E230BC63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 8e49737d5d554f1be28d92355e0adae1a9ffd82bc9029f52af98f9ff39c939b9
MD5 4a03de9614cc10ebbf4c33fea6627cc3
SHA1 9bcb203c069d87c204c57b0af1f7c4cf23dcf8b5
SHA512 206537a73918294bc737c9fff664a7ea742152a6293bed7fffa5b4302569e4d6a7c77c2e3fd699c89bbe96e43b1e1d52014730ec7106b7c0538f1df8bc7dd9c9
SSDEEP 768:srv+4UNbdS3znlYy+Vp7Hucys6BRvi82oP4/z6himofz2bwn+h:sbsbw3i43imOz6Imo70w+
TLSH
T1BD03CF32E4589D73EDF78288B4467A933FF4526385C91A90E5DA5F0E028BD5E231F863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 765fd6cb4e8dfd2fd340392155d1a33e21fa728abec67b6e2fd7ddd14dad1368
MD5 c4f98c100be6d4b7a18c22231e6830e1
SHA1 0448408c3814ff7a0d0a4b56b3dce9d0ddc9e966
SHA512 1a50e28dc277d64064e985f25743cff222c3e3d1f6048ec2638ae1c8d193087324793c5e9b0ff91c35e06b494c53c93f0479132c0328787160c329e573d621a3
SSDEEP 768:Lh3HGXBlYy+VE7Hucys6BRvi82oP4/z6himo6zFN5Wy:Lh3Hrx3imOz6ImowFNIy
TLSH
T14BF2BF71E8548C77ECBBC288B5463B526FF0522385CC6D90D4DAAF0E1287E6E131B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 201c5c4344b80ee6b9ac699e08c451b00acdb367b37c35f92884fb5deee4ebcf
MD5 952317bcad9f915ef8918133469e4fec
SHA1 f274f5ae7fe5e7e0074d8d167eb0fd05abb8e486
SHA512 5b9d5fdd6eb95acc26f89be8b3e40ad82fc7d175d07582dec6b95441d45de32cda8101076db28da28b62ffb356b540df8f6119828ece3a19d18919ec1bfb44da
SSDEEP 768:sF0s3dwgmZXBlYy+Vm7Hucys6BRvi82oP4/z6himo6zFN5Wy:9s3imz3imOz6ImowFNIy
TLSH
T1CA136CF288C78876ECAE8387A73D2E415EBDC163B4886950B7D55A0DCD4797FD30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 f47e5e9bc08659bafaff6995551d5d731dd0063614d7e734e51c167caa7cc5ee
MD5 6cdabd821c65ba4b28ad6b0bb70a3e6d
SHA1 02a0cdded2849954f5d76cee398237d61c292bec
SHA512 11e1813c56e50eb6e46b6a21f2d87587915ec13aabec3ae9a41a150e2488048e6e22ad80951f00da220ae46803d2ad67050103832a053de96d87eb6df3a13216
SSDEEP 768:Rp3UjXBlYy+VE7Hucys6BRvi82oP4/z6himo6zFN5Wy:Rp3UYx3imOz6ImowFNIy
TLSH
T1C9F2AE71E8949C77ACBBC288B5463B526FF0526385CC2D90D4DAAF0D1287E6E131B832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 1ad46201a84963c8970cfe7acc9b3959762a15993bad275855981587d5ababcf
MD5 8c6862f4817b8425826e42bc4269f96e
SHA1 75c81f048ade0d4ef46af0cb18e158a937655054
SHA512 05942f6ccf87287927c894b9e206b91e8714a070af4c270f8ec324fd04758ff551d51f576241fb5f779209853d3367e787f86c4f3db1aca6eb7f5072bfd6bcd8
SSDEEP 768:qp3UsXBlYy+VE7Hucys6BRvi82oP4/z6himo6zFN5Wy:qp3U5x3imOz6ImowFNIy
TLSH
T121F2AE71E8949C77ACBBC288B5463B526FF5526385CC2D90D4DAAF0D1287E6E131F832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

CrashFix 1.0.2 SRC - created by FSC.zip.crdownload

Path C:\Users\Admin\Downloads\CrashFix 1.0.2 SRC - created by FSC.zip.crdownload
Size 155KB
SHA256 03cd9fed805a087dcaa1c42ffb7027dbf562d24cd2dce2c6edf51c3d037e4328
MD5 b439ef0c108df1267e71b9e9241708a9
SHA1 aa28657b8cb7ab02dd1795011fa6943e1747b184
SHA512 4c8fe2b642ac419750ca35d66b917dffec27b7d8064b9767b691766a47a0003cbcf20c98f38eb8e50296697d0bc98ef7d6cabeba34f10b6ebd2b9f0aa83e29ac
SSDEEP 3072:ju9gknE4uUi3ltRzd/Rv8HQ7Xmh9zZFroFz:sOkiVtP/RCumh9zZF6
TLSH
T169F34A79C21C187AC27FD2B4A43EE6A2214C55367917FB0B74CC5B46B6874889FB331A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3088-256-0x0000019AF01F0000-0x0000019AF0226000-memory.dmp

Download