hxxp://rapidapi[.]com

Resubmissions

27/08/2026, 11:17

260827-nd3mwsgm9x3

27/08/2026, 11:17

27/08/2026, 11:14

27/08/2026, 11:09

27/08/2026, 10:55

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/08/2026, 11:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://rapidapi.com
Sample260827-nchlbstdqe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2296	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323029103287751"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{B3C3781B-BA87-44A1-B9E0-7EFE068A463C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2216	msedge.exe
2216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 4728	1136	msedge.exe	80
PID 1136 wrote to memory of 2296	1136	msedge.exe	81
PID 1136 wrote to memory of 3452	1136	msedge.exe	82
PID 1136 wrote to memory of 3452	1136	msedge.exe	82
PID 1136 wrote to memory of 3452	1136	msedge.exe	82
PID 1136 wrote to memory of 2756	1136	msedge.exe	83
PID 1136 wrote to memory of 2756	1136	msedge.exe	83
PID 1136 wrote to memory of 3700	1136	msedge.exe	85
PID 1136 wrote to memory of 1576	1136	msedge.exe	86
PID 1136 wrote to memory of 3700	1136	msedge.exe	85
PID 1136 wrote to memory of 3700	1136	msedge.exe	85
PID 1136 wrote to memory of 1576	1136	msedge.exe	86
PID 1136 wrote to memory of 1576	1136	msedge.exe	86
PID 1136 wrote to memory of 3268	1136	msedge.exe	87
PID 1136 wrote to memory of 4440	1136	msedge.exe	88
PID 1136 wrote to memory of 3268	1136	msedge.exe	87
PID 1136 wrote to memory of 3268	1136	msedge.exe	87
PID 1136 wrote to memory of 4912	1136	msedge.exe	89
PID 1136 wrote to memory of 4440	1136	msedge.exe	88
PID 1136 wrote to memory of 4440	1136	msedge.exe	88
PID 1136 wrote to memory of 1732	1136	msedge.exe	90
PID 1136 wrote to memory of 4912	1136	msedge.exe	89
PID 1136 wrote to memory of 4912	1136	msedge.exe	89
PID 1136 wrote to memory of 1732	1136	msedge.exe	90
PID 1136 wrote to memory of 1732	1136	msedge.exe	90
PID 1136 wrote to memory of 2344	1136	msedge.exe	92
PID 1136 wrote to memory of 2344	1136	msedge.exe	92
PID 1136 wrote to memory of 2344	1136	msedge.exe	92
PID 1136 wrote to memory of 732	1136	msedge.exe	94
PID 1136 wrote to memory of 2088	1136	msedge.exe	95
PID 1136 wrote to memory of 732	1136	msedge.exe	94
PID 1136 wrote to memory of 2088	1136	msedge.exe	95
PID 1136 wrote to memory of 2412	1136	msedge.exe	97
PID 1136 wrote to memory of 3272	1136	msedge.exe	98
PID 2412 wrote to memory of 2544	2412	msedge.exe	99
PID 1136 wrote to memory of 2940	1136	msedge.exe	100
PID 1136 wrote to memory of 2940	1136	msedge.exe	100
PID 1136 wrote to memory of 2552	1136	msedge.exe	101
PID 1136 wrote to memory of 2552	1136	msedge.exe	101
PID 1136 wrote to memory of 2552	1136	msedge.exe	101
PID 1136 wrote to memory of 4376	1136	msedge.exe	102
PID 1136 wrote to memory of 4376	1136	msedge.exe	102
PID 1136 wrote to memory of 4376	1136	msedge.exe	102
PID 1136 wrote to memory of 5096	1136	msedge.exe	103
PID 1136 wrote to memory of 5096	1136	msedge.exe	103
PID 1136 wrote to memory of 5096	1136	msedge.exe	103
PID 1136 wrote to memory of 3004	1136	msedge.exe	104
PID 1136 wrote to memory of 3004	1136	msedge.exe	104
PID 1136 wrote to memory of 3004	1136	msedge.exe	104
PID 1136 wrote to memory of 1680	1136	msedge.exe	105
PID 1136 wrote to memory of 1680	1136	msedge.exe	105
PID 1136 wrote to memory of 1680	1136	msedge.exe	105
PID 1136 wrote to memory of 3884	1136	msedge.exe	106
PID 1136 wrote to memory of 3884	1136	msedge.exe	106
PID 1136 wrote to memory of 3884	1136	msedge.exe	106
PID 1136 wrote to memory of 3188	1136	msedge.exe	107
PID 1136 wrote to memory of 1364	1136	msedge.exe	108
PID 1136 wrote to memory of 4672	1136	msedge.exe	109
PID 1136 wrote to memory of 4956	1136	msedge.exe	110
PID 1136 wrote to memory of 4956	1136	msedge.exe	110
PID 1136 wrote to memory of 2216	1136	msedge.exe	112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://rapidapi.com
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffa0445c188,0x7ffa0445c194,0x7ffa0445c1a0
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,477699610613714892,1678825470001719569,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13818444767328597998,16474264980552563133,262144 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,17340010117869670545,606333010414290454,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:13
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12234561752738746696,16976747170870032396,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12555361067377082290,10583168761285793473,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15548820062643813298,11117626914962888297,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,111619199036804581,818337383958559089,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:9
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4268,i,6947242609151560400,166210954397667268,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4408,i,8546144078425636647,8222193734962872735,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:9
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4356,i,2611081841539269818,12010569598643113642,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,13531648539194040253,16900879198742132896,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:14
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,13824809421815698744,16974634863248727790,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9326989251204581098,9954680497985195621,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,17026696235965508412,11423779785515130699,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,9326989251204581098,9954680497985195621,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,18006073519610768222,9049786474065366553,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6648,i,6850297416329152248,13853480131066011665,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7132,i,13937788879523130615,11691809536704942376,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7084,i,1146164967116891521,15219184825613331497,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6648,i,13852507142246232167,16936288254264997072,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4272,i,17133038465773040523,18318869941110261078,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4512,i,3645045827191281083,14449591432124600829,2097152 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=7468 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,16285782549952350891,12796980775029839456,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:14
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,11188425258808689281,13244863074207374670,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:14
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7384,i,3845165063706338225,5673956788367811555,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,15098169515004016539,10477326468398598001,524288 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7412,i,13174760813129776951,14948995097059778540,262144 --field-trial-handle=2060,i,6528841072117429926,2809702129332695044,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a7
Size 320KB
SHA256 4a2449802aaf50999f43cb76b7e52f94b4ad9ed629f0cf0f1c8d7756e8f1d235
MD5 aaf3d5e782d4fd86316609597ff7f014
SHA1 2e82b15ea1a7dcfdbb5035ed8ce44304c2d7230a
SHA512 ed3c22757414ed48c89e6460d1b0215b5ab9498c3245d9a2c181885be68a5da172c6857055ac19e3b0e774a59ba561690e381acf0c5801e2065a42e0684c269f
SSDEEP 6144:0AeLqKHr7KNb8ya/yx0vbqXXZleSH/+NL5T05Gsk+feSQ/Gvcq:0fLTHr88X/Jv2XXKfNLO53VMGvcq
TLSH
T1C3642325B563B6702B1CBDC6EB4D44585888CE9239E00BB655B3E49CCE316EBC132DBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1a737c33db20ad56d4f5f7f2a4b6307ee292f2ea4d10b43eb465c1d7d506d094
MD5 6b52b24abbe80cbfc3e4027430335d90
SHA1 cb22e6019b5ee044f82c5b76ed412da04a78bfdb
SHA512 31f88bd5b38dad3e6df944e17b6db5fcef4c16090e427dcbafe69d997384aa426415adfa8a720ddc05b486a5ee544d6487c2b6c21938f24bb8451d171458ede4
SSDEEP 96:qnO11dKZncttmEowCd5wo5t81DqQ5iihuuhNNDplg/s07tonPFCe:qnO1qZncttmE3Cd6o5UGQ5iihuuhHpln
TLSH
T1F9C15D6482E64031FB9A89BCC8A39A493072FCBD409E5ABA497C673E35C63BD5C15C5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 11e1b6d96bbda071d1768b0c107276e64f89853884bbe17f58bd0f8e25ccd87e
MD5 3699919dc3ab5b6120a18af394df2036
SHA1 0029893884d335ea9c75dbf4418475ebb3a2be37
SHA512 f0c2cdf40a247389f9994fe0bea463fd28a0b1bb5cbcea4f4da09db077faeb0eabdd2ec0f0aa384a850bb0c5c4ad9a0a8e4677d3a0ed97633d1a863f3c5618c5
SSDEEP 192:DodPBuKMB0J4bfo6weHQXmStyNd8CcklqqFNVRNpBbD+yrSVaYhhlBkjJ:DodPBuKMBQ4bfo6weHQXmSUNd8Ccksqr
TLSH
T1B412CBF7C7E4856DCD3252F0AA156F2FCE2E0954872C387A88D8AF5757E2030E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 70cfc41bce78fb388b57b4117ae98061ef8e03fce81e7ab09ae9421930956265
MD5 35d7b4ee88148a4b69abc364a4df52fb
SHA1 638f1bfa1b4633a0efbc36cea6d64d33b47e7593
SHA512 43c96048daec9be8c58046112f257d93161430974917729f276d62e884094bc3cd628ec4220b53f1645c92997c286d01b9602e015173db189c723be814c5aeba
TLSH
T147D02227674070B6E5AC7E81906EFC8FCB2622A40982DED724D0E9982535A6C850B150
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58e961.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58e961.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eaf7e456f127f98c5bce8dfc8aa6e32c66ddff80a4d083b8e55bcac0de616f65
MD5 6593d51decbe360ce2f198f6e2705d4c
SHA1 b7d7c660dce25dcfd50ca5b2068e8f4b78991975
SHA512 5503594e31400e309a0681127b41d753b73c6f165a0a0be8ff48d085bb55ac4475bccc11952cd46278fe74dc92db179ec7b2123a8e694d5612d97058aa8ff7a7
SSDEEP 192:sxZsR1yM/jK1Ml8MFU/f8sT7aOIdpr+/W6+WNpaQ/Y0YBTX+sIgrJ:sxZsNdU/f8sT7afS/b//5MR9
TLSH
T1EB52E901AA346D7BCCCBD219F955BF53D6F9147292900E44A9FCDA1C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fba8c63f49db5a10899571b000114a7038e78959b68bff30035d2ea199dc2924
MD5 3c85660cf72367c4dc35047ad8725794
SHA1 76e4850d2eed69e6e12068d7d7c079fab39b35f9
SHA512 0392f5c39c14eb9ebc9d4b60da97938082f5e9e71274eab79a51f0e2770e71c8c7136613ca104d8f3bfc175ecd9bb97b4009151f06caa2b768f08d8f2eba453e
SSDEEP 192:sxZsR1yMojK1Ml8UQrFU/f8s476YIdpNy+/W6+WNSXla4aQ/Y0YJgq+sIg5RJ:sxZs6qhU/f8s476pD/bjK/5cRx
TLSH
T1C462E712A6745D7BCCDBD219F940BB53D2F91472A6900E44AAFCDE1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 97176ef438f1e55034ecd7a41cf433f405c3f5b1784df83b06940dca3a640bd6
MD5 e0b5fc0c82a10c1219850bb23d5c3fc5
SHA1 7592cc62692ac00f1efc90b3e563f8dc763961c6
SHA512 d8af6575e101cdc3db7d87eceea7c97cc2a18a78f677aa2ea13604c7f821a6161c0fdef8689e2daf547645f4d3766822fe666a43f938cc9c2b403159254fb809
SSDEEP 192:sxZsR1yMojK1Ml8MFU/f8s476xIdpvo+/W6+WNSXw3EaQ/Y0YpLX+sIg5RJ:sxZs6dU/f8s4766v/bze/50Rx
TLSH
T12F52E602AA745D7BCCDBD219F944BB53D2F9147296900E44AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cb52e3f422f0ac28eb0cb58ec908d41e9dca3aa77ea257239e71c993445fc305
MD5 2de2e933e26af0da666bdd4da3e2e91b
SHA1 a217ebe5739a47f8c196e403e14ef40b31745bb2
SHA512 498555322220735480219ef429dc8525882bfca987d14c61480f0a08dabcb1802cb930956e92485e828d7aa41907db88a7c5a9dadd8acea27fa10c76fbb255c7
SSDEEP 192:sxZsR1yM/jK1Ml8MFU/f8s47agIdpvI+/W6+WNSXw3EaQ/Y0Yv3X+sIg5DJ:sxZsvdU/f8s47ahP/bze/5MRv
TLSH
T19D52E801AA745D7BCCDBD219F954BB53D2F9147292904E44AAFCDA1C04E6BED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 30b918b1c720a62d327b5255dc0e10f80faf7da6c55f4895e2922f86acf16778
MD5 d39ed9d34efa3ac3662d0755dc7e1c1d
SHA1 6e332f77d348c35740933fc402c686df49db1e8b
SHA512 3b65ac8e117a0a569ebe2f536488e9073e54331a4c997d6d402fe21345887110a37be20a265fb520ad43e8f7d16bba1ed84eeec79c1c801945fe30418e83b5a0
SSDEEP 768:c1l1j83r2pmWRmeKQDC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/R/roce:c1l1j83r2pmWRmeKQDCu1jaK3ALpCN/i
TLSH
T190E22C3B740CCB7E4F844E6DEC266F966ED801CBAA684D5447FA484C03C73EB511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ee7b720e20b5ad2c725532163ba23d946f6ccafb191313191f9ed8e14b5b84c2
MD5 5209d5109e7a02608891ad485f260e6c
SHA1 68b19aaea8ea3721710ba03c1550702336bf2be2
SHA512 b67668846580931797f5c2c5e7f87c0313f35ec8c51d31a6e3e71827dff9f9f1ecafd67aa0295b126747584265f4bfe17e0e5ccca03f9917c63769180c51bf25
SSDEEP 96:KkUgKtem4Ap62AKqxrWbsRuxK54RgxdYwTuqS2hKKSoieBuKSI6:6v4Ap62AKqdWb6uc4RgDYwTuqS1BFL
TLSH
T17DC1A40730BB02663C3D250DA39587375B4276A33058E86B3BA984B64E67E351DFC4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4843a505-9543-473d-86b5-cf6f1fcbebe9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4843a505-9543-473d-86b5-cf6f1fcbebe9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f5ba8fb6bbb951a782268d0d73bebbbf46af2f5b9aa42c5bc32ff5f48d40633d
MD5 d21566f6ce4ea94e9ef1b4708b6c36e7
SHA1 2a9e43a02620d86b5f5378d4c7c546af89b24f33
SHA512 83a468148f758f2bb5611edfcfccd26c66c3a15d804365c561a37703281bce2c1206a412c40f35c668d8d1549d9a6fb106973be0fa649d17dd51b7e33f997ba3
SSDEEP 384:rZcIP8N+UMppRjXoXgX532X8mUHtX55JrmEf+HBbs7gJ2oz:zPVpigVd55hmEfgj2A
TLSH
T139827D7299B8EC7759E2D156F58632134FF8802796C82F80D5FC7B2C049AAA9030FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 6b8a8811fb6bb4505457e8b9f9ea89891cd970845d80138342993b259e994f49
MD5 dd064f39c2d1c10cd60b365f75a9fb8b
SHA1 1884412be5852aadc0f525b4591a323b6d3994fb
SHA512 5b37d8ccd9362eef9aa2bebf1ca1038a4a461bcd9b0a88f2679f72550c3285f19c6f5ad31ceb9bb9515a929c13ddc1c169fabc8453cba73098c85a1cbfe0277f
SSDEEP 384:niFPZcIN8NF8TUNTUlIljppRjMPXgX532X8mUHtX55JrB9Ef+HBbs7gJ2oz:iFHNIwgfpGgVd55hHEfgj2A
TLSH
T19DC219F248D79876D9AE8743A77D2D024EBCC057B5846A50B3D86A1CCC465BFC30AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 02a387403371082ff81e04766709f83dd530c4a21247020ea4ca24fec7f0e1d1
MD5 c71ca8fc7aba0e80ec4f966fe26a7c19
SHA1 b89557bf9cab545a84339188d9046a56efa9403a
SHA512 862291f48a31e5473fef7442d1048990037e2a93acdbe853bf80819e414aa381015b273643d7605b3bf787b1b0eb12f5d38b4281e2f4e0ef9ec7fdb812a82b36
SSDEEP 384:iZcIP8N+UIppRjMrXgX532X8mUHtX55JryJEf+HBbs7gJ2oz:QPFpCgVd55hEEfgj2A
TLSH
T181827D7299B8EC7759E2D156F58A36134FF8802796C82F80D5FC7B1C049AAA9031FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 60375dcfb3c3f878c8a88cba5253c4e8c585658e2635d75616b7ead00ac98117
MD5 b005778c907ddba62e51fdeba9c905f4
SHA1 eec14a64680470a8ae76d44b8065c31b5ca32abc
SHA512 db9ff764330a3c4f3ec17fff136da64999d9f20046d9955e57ff7c7556a545e546c5e6a74c444b96a0819192bc88b61918d2e97a0dc85b405bbbb35e12763235
SSDEEP 384:yZcIP8NEUjppRjMrXgX532X8mUHtX55JryJEf+HBbs7gJ2oz:AP8pCgVd55hEEfgj2A
TLSH
T191827D7299B8DC7759E2D156F58636135FF8802796CC2F80A5FC7B1C049AA99030FD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca70c83306ef5c603f31f199d9e21c3519baff846bcce91007932334e05e7264
MD5 2dce5e3de5094f675955b2a32341b95f
SHA1 5b754a613de0c58c998b63f23595f8a638c8a06e
SHA512 042f0296741065fe0e5d77fdcb153310adfab5e9fbdc631588fb0312f1604990178bd90749124431a78ba51ab87646ba82b8c80de9bcc87c6e8a7dd03d904ed8
SSDEEP 192:6GNX6i5fQmiUyZd4O7X5zPr2PjzormU8opylajpY22U6:6GNX62hqOO7X532X8mUHBCDU6
TLSH
T1E502D835B968AC7B8EA39E56B58637135FE4112BD9992F84DAFC1B1C008768C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d392480b95f863d6de24693eefea744b80261719aeab55d176d2c8ccea563f68
MD5 f26bd789412aa2e80f8a86333c8f8d0b
SHA1 bff5b39cec57efebe84d733069f256348b1c3cda
SHA512 606be99dee2eb11d2a9334110c7cdaf3f2548e7fe626f81f9c71f6bc81c967046989fb01e23332af8e50b97ec215d7054941b5d76d54b1da4ae95706248c21e8
SSDEEP 192:mGNM6i5nQmiUyl4l7X5zPr2PjzormU8opyEX5s3SJrxGQEWqDU6:mGNM62J7l7X532X8mUHtX55JrZEfU6
TLSH
T18612F936A9A8AC2B5D93A991B08631139FF45127DA8D6F80D6FC2E1C00DF69C030ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fd7f11ebd2222e1d83212bd0fc88d85cf40a53801cd33dd87d53aeea5e0d6e0e
MD5 7080795c9d6cc51e303d47e0a9a3709b
SHA1 1e84150b937d235f32ef0ec43329b7727d1da581
SHA512 9a7234f9a8a1dc81926a89e4132e003080642107d8a3785505c2d2e98bdeafdf5146e2212f4cae82760688fdb23cf0500e885b2f199c8a64d6f82289a233b2ff
TLSH
T17DE00203970440EBD0AD033000D7767836B3C0311793069A9D1041742C513402D21980
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 509f7dbbc3b873738dbe4f4c875b96f84a07e0e4ad04f936153c68513729f277
MD5 20662b1f5ddc79c061c0d3e3343c001c
SHA1 3d8981e6fdf35cd5063a65ed92ac5553b50abf81
SHA512 a47634202f8383520c45ad9c422c84326f13a1f9fa34ec46fdac20eb77f4db31e611805e00ca5b1fdb29262d923b95bb4c0fb3faa058e2bb0b5183cbd37ae6b9
TLSH
T17CE00202570440F2C08D03300097764426A3C02116D2065A991041641C513402C31D00
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f383.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f383.TMP
Size 392B
SHA256 5cca3a419c19da0e761ae567f1f551c86cc56de26b00420640310a81ef16e0a7
MD5 f54e0995525ff8367890e9fcbbf979dd
SHA1 485c8eb693de844880305871d31ff6e8dbd0f4c8
SHA512 aa4b3f53ff74ad8c849f0566e2b0049d6d275896f47b098ee45e6a1a32f8b982534e2c12e2cf66a1e7b623e34a85ba45684cf9f6ecca8137181ba362eeb53205
MD5 SHA1 SHA512

Submit Download

ed4fcb6b-5696-4739-9f99-be906a64bfe7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ed4fcb6b-5696-4739-9f99-be906a64bfe7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download