hxxps://tungtunghook[.]cc

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tungtunghook.cc
Sample260828-cfp9sssemb

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
52	discord.com
53	discord.com
55	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2556	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323560938492920"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{47787E43-62A2-44E1-B66A-072D7D311EE3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{A76B9446-499C-44D5-A6C5-ED1DAB0136D3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6616	msedge.exe
6616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe
3556	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 792	3556	msedge.exe	90
PID 3556 wrote to memory of 2556	3556	msedge.exe	91
PID 3556 wrote to memory of 1704	3556	msedge.exe	92
PID 3556 wrote to memory of 1704	3556	msedge.exe	92
PID 3556 wrote to memory of 1704	3556	msedge.exe	92
PID 3556 wrote to memory of 4172	3556	msedge.exe	93
PID 3556 wrote to memory of 4172	3556	msedge.exe	93
PID 3556 wrote to memory of 3392	3556	msedge.exe	94
PID 3556 wrote to memory of 3392	3556	msedge.exe	94
PID 3556 wrote to memory of 3392	3556	msedge.exe	94
PID 3556 wrote to memory of 4440	3556	msedge.exe	95
PID 3556 wrote to memory of 4440	3556	msedge.exe	95
PID 3556 wrote to memory of 4440	3556	msedge.exe	95
PID 3556 wrote to memory of 1644	3556	msedge.exe	97
PID 3556 wrote to memory of 4952	3556	msedge.exe	98
PID 3556 wrote to memory of 1644	3556	msedge.exe	97
PID 3556 wrote to memory of 1644	3556	msedge.exe	97
PID 3556 wrote to memory of 4952	3556	msedge.exe	98
PID 3556 wrote to memory of 4952	3556	msedge.exe	98
PID 3556 wrote to memory of 2688	3556	msedge.exe	100
PID 3556 wrote to memory of 2688	3556	msedge.exe	100
PID 3556 wrote to memory of 5260	3556	msedge.exe	101
PID 3556 wrote to memory of 5260	3556	msedge.exe	101
PID 3556 wrote to memory of 2216	3556	msedge.exe	103
PID 3556 wrote to memory of 1520	3556	msedge.exe	107
PID 3556 wrote to memory of 4124	3556	msedge.exe	108
PID 3556 wrote to memory of 2452	3556	msedge.exe	109
PID 3556 wrote to memory of 2484	3556	msedge.exe	110
PID 3556 wrote to memory of 2484	3556	msedge.exe	110
PID 3556 wrote to memory of 2484	3556	msedge.exe	110
PID 3556 wrote to memory of 6076	3556	msedge.exe	111
PID 3556 wrote to memory of 6076	3556	msedge.exe	111
PID 3556 wrote to memory of 6076	3556	msedge.exe	111
PID 3556 wrote to memory of 4980	3556	msedge.exe	112
PID 3556 wrote to memory of 1140	3556	msedge.exe	113
PID 3556 wrote to memory of 1140	3556	msedge.exe	113
PID 3556 wrote to memory of 3268	3556	msedge.exe	114
PID 3556 wrote to memory of 3268	3556	msedge.exe	114
PID 3556 wrote to memory of 2628	3556	msedge.exe	115
PID 3556 wrote to memory of 2628	3556	msedge.exe	115
PID 3556 wrote to memory of 2628	3556	msedge.exe	115
PID 3556 wrote to memory of 4840	3556	msedge.exe	116
PID 3556 wrote to memory of 4840	3556	msedge.exe	116
PID 3556 wrote to memory of 3196	3556	msedge.exe	117
PID 3556 wrote to memory of 3196	3556	msedge.exe	117
PID 3556 wrote to memory of 2716	3556	msedge.exe	119
PID 3556 wrote to memory of 2716	3556	msedge.exe	119
PID 3556 wrote to memory of 2716	3556	msedge.exe	119
PID 3556 wrote to memory of 6220	3556	msedge.exe	120
PID 3556 wrote to memory of 6220	3556	msedge.exe	120
PID 3556 wrote to memory of 6352	3556	msedge.exe	121
PID 3556 wrote to memory of 6352	3556	msedge.exe	121
PID 3556 wrote to memory of 2760	3556	msedge.exe	122
PID 3556 wrote to memory of 2760	3556	msedge.exe	122
PID 3556 wrote to memory of 1528	3556	msedge.exe	123
PID 3556 wrote to memory of 1528	3556	msedge.exe	123
PID 3556 wrote to memory of 6616	3556	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tungtunghook.cc
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff90f3dc188,0x7ff90f3dc194,0x7ff90f3dc1a0
  2⤵
  PID:792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,10503230818244129980,16197905045715854640,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=2124 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1536,i,3984925152148672073,8017434142219361096,262144 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=1980 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,15423873068919377876,2287345032729605969,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:13
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,12056296833555143265,8067622699895812025,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3560,i,895438737747343862,10879903363759286005,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,4885119144190926049,7107449539974610409,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,13725258663063382880,15318082914109163819,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:9
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,16269546523762642558,9348269153656497951,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:14
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3495107588810003131,1453172272604455302,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12875198661042453928,12418460720027461347,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,12875198661042453928,12418460720027461347,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,13986277247217519839,5514738968242534135,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:14
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12043656492261691822,91970250238026813,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6684,i,11038309655094269607,11706507462730600232,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:14
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6608,i,3280391762898658425,14599614722069529716,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6648,i,4022916288546083681,4552323271551001606,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,10619806974401692495,8264354482873221648,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,10684838652800800171,2215216911885666282,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:12
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7620,i,1217903921481576970,1851693538965856599,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7632 /prefetch:14
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7428,i,7642146567144396465,13765776966872412413,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,7100345925673553264,6801720007747597655,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7352,i,2233997340618447933,12338898710234062436,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7328 /prefetch:14
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5508,i,8087724510413534439,5938228482546336073,2097152 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7332,i,2944112721832137103,13848332267101239878,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:6220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,6834070802664757181,2489946983553363017,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:14
  2⤵
  PID:6352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,1524590605409744042,3653991802461830369,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:14
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8204,i,3853709534276229396,5177506617340223206,524288 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=8212 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5740,i,3405413065605205321,12955818825917823103,262144 --field-trial-handle=1984,i,17431976792595829403,9862182133172100680,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6616

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 f5e36080317aea131f4d217a6f461697aa0d7bd2adc8dd07f2ec2fdc9c9b805c
MD5 918d199bbcf2afdfe31365bb863ac3c9
SHA1 965f465f7e807021a6edea142ec733bb6d1e4499
SHA512 7a46f5ec5358c9507a9cd24d87670f1b02a43de5d6ac17eebf98dc3f0e82033d3099ac3c83ab2c1d4df682674ee7f341bb723c4ffd2cca6a6266754c810922e1
TLSH
T1DC21513447DE2A82E73D45B3C0D2B84A32F6689846436AC2CA012D75D50BFDD73C48E3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 49342e0d74ba0d60b8e90045b1c818647081e818e6a54b514dd3ba645504f6aa
MD5 cf5af9113fe6e7aa51c139a6b8befe09
SHA1 5fd08da241950c85bff0875d02386c6a3f5996f7
SHA512 96a907018b020f4655cd635a40091de35a9ac26f25d6349da689d0a0bac8a9bd46c2d58dc587061af388b95c25776e202ac622d80691d6ada33326da1b887a18
SSDEEP 96:/WfimMKbxYrBOuLr0skWoZAdd6UNpRMgkkEtAmNS+RC:MsK1YrBpLrX5o2pWAE+8w
TLSH
T1DB0270E54E9FD410DF2B2DB642D06C4535B9738033075E808BCC5A37984EF8AADAC99A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4999a45ea473c3314ed12226f9d6282789067a8285dc773563c8f75d6183bd71
MD5 1bd069e724bab1eda84b46318579b4b2
SHA1 3ad7bb9f2561ada22e446ed7579d86662b272b02
SHA512 16b08fa8e7bd5de7acef9a5879a94356ccaacd099a9871e162221370935ccb5bf5304a54ccc01723b7c590fadfbc403ddc24f647d339cbfb83fda21b16d6d598
TLSH
T16871B0F387F4862DDA1156F0AA147E1FCE2D0915471C3C6AC8E4AE2B93E3571E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 eaf77503a4e92b9dd41931c83b3e98cf1be66bfe578826663addfa6ffbe9dcb8
MD5 8e1172d933be189b3c8b5580ade09b48
SHA1 5fdb9ef2eefdf9feb31077e9655fe7f477087ce0
SHA512 7bf49e1f3032cc2013cb36a64dbc9716642138775b90d0f1c50ab695ae8c75c5c669a264fee8d0f0f42075323c92962c69167c4f38c1a21a9bda03ba375a7e5e
TLSH
T1EC81A1F387F8862DDA1156F4AA147E1FCE1D0915431C3C6AC8E4AE2B93E3571E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3b995f7b4dfb982b2ef101e3065de957f228e07c459c754acda2d1ebea2b5759
MD5 faf026999f215eaffe3fc4501801ba76
SHA1 1a779f2b7bbd2f5bec330f38b7a950dcc4ca56fb
SHA512 511225b78307504bff0acbc7bf3632e788871002cd1ec116903a726ac9632c70871f49646d09ac776d284b3769682745a524bf2a0d834bc6292d19c3d2b0baec
TLSH
T184319BF7C7E8567D8A4145F87A182E2BCE2D0854432C3D5AC5D4AF5BA7E1871E28089E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f2d32a465bac2659f73273872412fa1f8aa1e68855c7f50f604761e60c1d3ec0
MD5 7a200ffc9caf059d9f39954ac9c82f8a
SHA1 c8871e78afb96698edba2f36f895721c76853486
SHA512 df472fc747c90ba1166ffa882e8f8234b2b697ca852c9084f9ff93a1cde567f8ca3c9177a63eddb033227b796b131c49b713bea4699b1a43b08e3b2d9935940c
SSDEEP 192:sxRURuyM/jK1Ml8wbE/fPsYvZKrjDQzoA8p3e/g6+WN/Fy/YEiPDKTGTIgIJ:sxRUclE/fPsYvZKO/5I/W5s
TLSH
T15862E7156A249A7BCCDBD218F951BF53D6F85533A1901F44AAFCCA1C00E6AED2117C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 a03164e50c4142cdf81fa0211a6307ec2dbcfbcaae0ad4723b1d6963f5d39fbc
MD5 99ce3c7a8f3faedd4e84aada23cfd310
SHA1 c375ed43789326b4afc33661a3ae2856ee8ebf48
SHA512 06a91738b1a5666e4f047cfc8eac0bc618e7b7bcf62f992c14bc0c3c2ffdbef522ec5736e82cfffd495d443fc48b74df0495815f366b049a49572d61003b1133
SSDEEP 384:sxR/cI9/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoZIsqoZn7/5wXB5U:srJ9/f3jfW9RC8wAefoZGy7/5WBm
TLSH
T17AA2E9059824EE77CCD6A21EF6757F73D6F5522682802E1869FCC61C40A6AFC7117C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 b63bf39696d81d2b7d991ddd40606a9bd3c9d8b28c37232902bcf12b356ded58
MD5 453b31ecd0341ab8d5cf771d7d50659f
SHA1 96b752163402b03414a6afdce2ce6fe2320f04c7
SHA512 25fa6f5a42f8609a0ed5073e40cc57b4e7677b2f89269b2ec2877158782e261ba4a1a51d9949a4ec59afc74538eb07cb7ff9ca32b5670de3dea68dd91cdab663
SSDEEP 384:sxR/cqI9/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoZIsqoZn7/5wXB5U:srrI9/f3jfW9RC8wAefoZGy7/5WBm
TLSH
T136A2E8059824EA77CCD6A21EF6B57F73D6F5522682802E1869FCC61C40A6AFC7117C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3e1fe3f46582100121e3be9c6695f29ed2fef77ac681fbd114a5da6dfa42b8ba
MD5 b1a5c6ed98092bcc065801762e5b28a2
SHA1 768eabc1801e5412a0d5c15569d6b1246d8f08a5
SHA512 bef71d6348178fef5b2461a41aa9a01a4b27940c586f3217fb2a7cb7e9d036ed1af628e3e9df897a449e2252e1d5ee54a14476cf29b324ec9a39a28721b158d6
SSDEEP 192:sxR/RuyM/jK1Ml8wbE/fPsqvZKrjDQzoA8p3e/g6+WN/Fy/YEiPDKTGTIgD2J:sxR/clE/fPsqvZKO/5I/W5G
TLSH
T16E62E715AA249A7B8CDBD218F651BF53D6F85533A1901E44AAFC8A1C00E6BED2117C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7a6410dcc0a91160c17b7754af110b13ae385f5a1bb68e0dab16515f462ca12a
MD5 9ab6eb513fa89d35b9ffa6c1d01fb7ee
SHA1 5fa22560f43dd5bf33bb1b0cafc2bccb66609b32
SHA512 46c949c96ba6ff0db05f34284c7d9f5fc4ff9c1dfba562e7c59e72d23a27ea3bffedcd7013c4044cf0d0c4ce187af81593ac18c1d612be356569dcb1917acd4a
SSDEEP 768:0UG/iiBaWgH7ftQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqWOV8hroi6x:0UG/iiBaWgH7ftQu1jafWI8ad
TLSH
T19AD21B3B140CCB7E4F845AACEC36AED76DD801CB9A588D5447EA884C03C77EB551B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7c52ffc33372dfe6d2999ca415c5c528aa668618de8752119a3e875fd2440f9b
MD5 5a48b3dc6db4c43b48e284d69b483ff8
SHA1 6364be596768e7068dea6f3f7046f1b7a7edb8bb
SHA512 7deeeeaaa80c4a3bdeeae4754f25364d88f39ca3481e0a688593ddec4a8bb02d508376c9874cda370052e76d6fb876bc9b8599994869854331713e087c4b16c1
SSDEEP 768:0hiiBaWgH7ftQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsOV8hro16V:0hiiBaWgH7ftQu1jaNI8am
TLSH
T101C21C3B240CCB7E4F844EADEC29AED66DD801CB9B984D5447EA894C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 56f9e6b9a3086d55e2a13d748e6c902dea7b193db988ce49989312f2d612fc42
MD5 8d2347caa1e5fe8d52c846abcc18c0e7
SHA1 0ef861b1a7e032197511ebcc40d7f801576e696d
SHA512 498fc56fd89a9e8e782f616c3ff439c69414d4dcc4507204ba5221e47274ca8243ea03a31b6bc0b1854753a3224c81fa6326e323a93058d4224fdaa821a81dee
TLSH
T1FDD0975BF0580290AA6B8B420B31482987203C8868868009A2A2092AA425F93E305EA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 33e15935a209ea0896be0c19fbe28929809993914446d335c3d6c2f830eee93c
MD5 b8350a86e8986e86f9d6bf8dfd9a30b5
SHA1 24b26cf89d5c6415b973c795f9dacb572ec7c439
SHA512 ee6411651726c4cb1615bda72fa4b96a6d5fd2dd1f902a63fe3224ce7caa8aaf009ef8f9aaefe74449c95cdc9af8e22eae481970fa6f5f6543b899fc78549bfe
TLSH
T1A5D0975BF06402A0EB2747430B31486987303C886C818009C2A2392E7035B83E318FA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a0011.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a0011.TMP
Size 138B
SHA256 21851042dbd90b68355fc4e2f083a53056a308acd3fc3a594bae33e9facd3a5a
MD5 56cbecf8f2f7afea5579122ed3797e16
SHA1 e85490d4724efc3a58dd44393f77f3ab1649b828
SHA512 0e309ee0e2b9440a3b37867d2ba8a2da899445537c113e094aba269f315f202b6b3d8012c2174fb6fba3e9b82216acdb6d50a37239d4c90af43bed56ab5a0d34
TLSH
T1A2C02BE3F08413048B1503520332456C87152CCC1CC2844DB0D330193035E73F205EF3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1a2325fe5e2c5fd083116a97beeeceb056507435480251d4846841f875751a29
MD5 e4efb2d92a7e716a2c382eb031f3ba44
SHA1 e006522f65f0fb3fd448db91c38348b1d190e665
SHA512 2c26ac61fb352c1ede1db858b4763aa66baf954ebe6392cc51a339c1e85104c2b64addedd29cc2ca4d09d8bee5485bee1ee4d271d81860b623ec4d5a8c601688
SSDEEP 96:KRXAlhXVFJWx+EgpJK4AgnJcPnmZl6HDMpdLBB9WV6wgF9K48gr9cTrC1Ib2KokH:CXAlhXVFkx+VpjAgnWPnmZl6HDMpdLB2
TLSH
T128911E2131B702813C3F791C81F58A6FD68278E33459E82B7BA851E25B66E125DFCDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cbd5d736-91dd-48b5-a607-7454606fa762.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cbd5d736-91dd-48b5-a607-7454606fa762.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6da3690394eda3898c180660d17ada25b52114e049e5c7b5b2879ce52dc2c0f9
MD5 c40203f91b975022bc79a8b31c9638c5
SHA1 d40fd9adea3f0db8e9adf21038e32c8b1370dee9
SHA512 9719ebfdbef1ed4b0596cf3ddfbaedd122442228deee5343dbf5e921964db055037834b09c427f3b657672c0b95bc72f7378dfb2965079e50778800300a43d27
SSDEEP 768:Drv+4UNbdy31WqG/gDLiK48dHeByERRFzjK3YhEs:DbsbA3BGwLL48dHSyw/LEs
TLSH
T1A103BE71A8A8AE734CF7D189B5437A47BFF0811786C85B6491DEAA4E40CA4DD130FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 9671df659bc3a4adbd96753d5cf4de28e21a52f393d9981b29ebba42fe5138b5
MD5 c9230670e7cd293ad4d1caf9afaa9c4a
SHA1 835a4f8f603bf952cdf01992fe97271efe06f5de
SHA512 332eed942ff7607d4a74c4648e2a2dfdd3f0869d5bcbafcb8e5f2cecc191e9958f4661cb2752b3efe92d25f717bb38f65efa972e9e86b459d8cb16f6acefae49
SSDEEP 768:nrv+4UNbdf3hqGhKDLkK48dHeByERRFzjK3JhEeVH1SCj:nbsbJ3kGYLB48dHSyw/kEEH1Z
TLSH
T18603CF71A8A86E734CE792897583B617BFF4821386C41BA4C4DD6F4E858B4CD130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 17b1c61ea61bb826547dab528e5d5f6608419e7de5a52195faefe51f1a40634b
MD5 2887a3719fb83c12a98df91838b8905e
SHA1 99f385b38a45448cbf89a303a777db10c9dd1571
SHA512 8fa54a1240da0367a9ec2b514fd938d8fd699e7328dc94fdb63fd2e7610f6fc846cee71af27cccfdc68b82eb454902b951a51ec0d4e9a7a3ac6fce4358899fdd
SSDEEP 768:6FQf3zwg8WqGGJ3gDLVK48dHeByERRFzjK3YhEFN5Dy:hf3cGLLc48dHSyw/LEFNBy
TLSH
T142F29FB19C949A775CBBD789B6577707EEF08163C5C8AA6092DDEA0E00871DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 e78edab8cc2c929a6992104c4ded7d4f94cad3158980fc39c20aefa942bf7f37
MD5 3dd4611a3fe53c64599b807c6b8922b1
SHA1 df58f3633675d3370338ea636ba9304dfcaddf98
SHA512 521b7f0e76ca8627720b6730c7edaca80a05740c111f05cf87b4e22be916e0dc05be03615c97211f0060164b11687430857bb8441613d5d54b37e2dd44b45154
SSDEEP 768:5J31WqGNgDLiK48dHeByERRFzjK3YhEFN5Dy:5J3BGiLL48dHSyw/LEFNBy
TLSH
T11EF2AFB19CA45EB34CABD28976537707EEF0812396C86A6481DDEB0E44875DD170BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c56f1dda45af3a096dd42481c93ed0711d39ae88c5ad3a8c9bdb15ba784e162c
MD5 90468e4d5220fa6e9fdbf7e6a61fb10e
SHA1 8f72864cde8e610dd778a77e43ec9013340dfb81
SHA512 40711cda3db25559156fb24f42e7de0d003f487ebbb82135ee6edd3653f72f928ab2a75e54d56909049d3f14698a76b144154d7914d6dc97977d82565e59b735
SSDEEP 768:VJ3oWqGG3gDLiK48dHeByERRFzjK3YhEFN5Dy:VJ3WGZLL48dHSyw/LEFNBy
TLSH
T155F2AFB19CA45EB34CABE28976437707EEF0812396C86A6481DDEB0E44875DD170BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 e7f9c0bc279bceae57a579f51dfcdf0d476f6ac42cfc105ba39a257680866bb5
MD5 2e3eff387d0c2144ed18fd3e394cc6bc
SHA1 cd189d9db3fd377ce0cbdec6ad828b6e1973fa51
SHA512 629f7a361b01a4fad14617c9368a2acad91dcf33249c7d7984832d3afb4acfcc0d3cf41af89a8dbf916bd304ae5e45ef1fd60eeaa8dca60d9000be6e39730678
SSDEEP 768:Qrv+4UNbdf3lqG4ADL4K48dHeByERRFzjK3YMeVH1SCj:QbsbJ3AGnLV48dHSyw/uEH1Z
TLSH
T1CF03BE71A8A89A734CE792897583B657BFF4821386C41B64C1DD6F4E85874DC130BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d7c882e30597092d506712204d55491f57a0d33bc5126ecec64c84ca82330ef2
MD5 6bf830bb430675e50494bce48160810e
SHA1 3e9835ccbcb4293f99cd951fef84d7e5d44e4560
SHA512 4b3254229ab8cbb6eb7f5f3de0fd5bab1dc0b201d0245a6282f5b6b279bf64e70b64a3c541b3ed1765bd4193ffe2ac2ef7fba4e5c2e79b266056c8a4dc772d8e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a6e1d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a6e1d.TMP
Size 392B
SHA256 84511e94d2fd35225833f27f71e0bf22548cbbe81088a3ba14a80ed3aec4bf3b
MD5 59f23447ab81862c4c6081d34a40573f
SHA1 f08344c358872349f2938186e1014b79612af927
SHA512 8b18fdabb6b93c6bcfb9a237a38eaa35c1474833000ba60453333cd08816a04106c87b442e47d9a35ddb57894c1d722905239bdc96cf899fa3fe9bcfec6bd7f0
MD5 SHA1 SHA512

Submit Download

1b583a10-9140-4a3e-950b-7a8e96c1a0df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1b583a10-9140-4a3e-950b-7a8e96c1a0df.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

eec4a13f-cc2e-4fb5-82d8-e017054a4cae.tmp

Path C:\Users\Admin\AppData\Local\Temp\eec4a13f-cc2e-4fb5-82d8-e017054a4cae.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3556_1440845097\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2216-176-0x00000253F1150000-0x00000253F150B000-memory.dmp

Download

memory/2216-185-0x00000253F1150000-0x00000253F150B000-memory.dmp

Download