hxxps://omnibase-int[.]msgfocus[.]com/c/118eCZ9ceWe5QKSdapCyw0OXlzQKFi

Analysis

user interaction
yes
max time kernel
299s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/09/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://omnibase-int.msgfocus.com/c/118eCZ9ceWe5QKSdapCyw0OXlzQKFi
Sample260907-2bystabf75

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 4 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	425	[email protected]	456	msedge.exe	1
Email address	556	[email protected]	456	msedge.exe	7
Email address	573	[email protected]	456	msedge.exe	1
Email address	573	[email protected]	456	msedge.exe	11

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
456	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134332935189390612"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{F1BE08A8-A94B-420C-A9F1-905625A4DDFE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3108	msedge.exe
3108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4252	5104	msedge.exe	85
PID 5104 wrote to memory of 2432	5104	msedge.exe	87
PID 5104 wrote to memory of 456	5104	msedge.exe	86
PID 5104 wrote to memory of 2432	5104	msedge.exe	87
PID 5104 wrote to memory of 2432	5104	msedge.exe	87
PID 5104 wrote to memory of 3540	5104	msedge.exe	88
PID 5104 wrote to memory of 3540	5104	msedge.exe	88
PID 5104 wrote to memory of 2232	5104	msedge.exe	90
PID 5104 wrote to memory of 896	5104	msedge.exe	91
PID 5104 wrote to memory of 2232	5104	msedge.exe	90
PID 5104 wrote to memory of 2232	5104	msedge.exe	90
PID 5104 wrote to memory of 896	5104	msedge.exe	91
PID 5104 wrote to memory of 896	5104	msedge.exe	91
PID 5104 wrote to memory of 4752	5104	msedge.exe	92
PID 5104 wrote to memory of 4752	5104	msedge.exe	92
PID 5104 wrote to memory of 4752	5104	msedge.exe	92
PID 5104 wrote to memory of 2464	5104	msedge.exe	93
PID 5104 wrote to memory of 2464	5104	msedge.exe	93
PID 5104 wrote to memory of 2464	5104	msedge.exe	93
PID 5104 wrote to memory of 4120	5104	msedge.exe	98
PID 5104 wrote to memory of 4120	5104	msedge.exe	98
PID 5104 wrote to memory of 4120	5104	msedge.exe	98
PID 5104 wrote to memory of 1668	5104	msedge.exe	99
PID 5104 wrote to memory of 3828	5104	msedge.exe	100
PID 5104 wrote to memory of 1668	5104	msedge.exe	99
PID 5104 wrote to memory of 3828	5104	msedge.exe	100
PID 5104 wrote to memory of 4688	5104	msedge.exe	102
PID 5104 wrote to memory of 4064	5104	msedge.exe	103
PID 5104 wrote to memory of 4064	5104	msedge.exe	103
PID 5104 wrote to memory of 4064	5104	msedge.exe	103
PID 5104 wrote to memory of 3752	5104	msedge.exe	106
PID 5104 wrote to memory of 3752	5104	msedge.exe	106
PID 5104 wrote to memory of 3752	5104	msedge.exe	106
PID 5104 wrote to memory of 3836	5104	msedge.exe	109
PID 5104 wrote to memory of 3836	5104	msedge.exe	109
PID 5104 wrote to memory of 3836	5104	msedge.exe	109
PID 5104 wrote to memory of 5052	5104	msedge.exe	110
PID 5104 wrote to memory of 5052	5104	msedge.exe	110
PID 5104 wrote to memory of 3464	5104	msedge.exe	112
PID 5104 wrote to memory of 3464	5104	msedge.exe	112
PID 5104 wrote to memory of 3464	5104	msedge.exe	112
PID 5104 wrote to memory of 2692	5104	msedge.exe	113
PID 5104 wrote to memory of 2692	5104	msedge.exe	113
PID 5104 wrote to memory of 2692	5104	msedge.exe	113
PID 5104 wrote to memory of 3088	5104	msedge.exe	114
PID 5104 wrote to memory of 3088	5104	msedge.exe	114
PID 5104 wrote to memory of 3088	5104	msedge.exe	114
PID 5104 wrote to memory of 1200	5104	msedge.exe	117
PID 5104 wrote to memory of 1200	5104	msedge.exe	117
PID 5104 wrote to memory of 1200	5104	msedge.exe	117
PID 5104 wrote to memory of 3104	5104	msedge.exe	119
PID 5104 wrote to memory of 3412	5104	msedge.exe	120
PID 5104 wrote to memory of 3184	5104	msedge.exe	121
PID 5104 wrote to memory of 1316	5104	msedge.exe	123
PID 5104 wrote to memory of 1316	5104	msedge.exe	123
PID 5104 wrote to memory of 4564	5104	msedge.exe	124
PID 5104 wrote to memory of 4564	5104	msedge.exe	124
PID 5104 wrote to memory of 4564	5104	msedge.exe	124
PID 5104 wrote to memory of 3108	5104	msedge.exe	125
PID 5104 wrote to memory of 4240	5104	msedge.exe	126
PID 5104 wrote to memory of 4240	5104	msedge.exe	126
PID 5104 wrote to memory of 3752	5104	msedge.exe	127
PID 5104 wrote to memory of 3752	5104	msedge.exe	127
PID 5104 wrote to memory of 2464	5104	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://omnibase-int.msgfocus.com/c/118eCZ9ceWe5QKSdapCyw0OXlzQKFi
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffcb86bc188,0x7ffcb86bc194,0x7ffcb86bc1a0
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,2872189238129747954,1818758698569972085,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,10660576186486997324,9490387820997730193,262144 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,18369747413467710740,5227551184883319737,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,8454990659741589062,3896247799251468043,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,242736529174382059,6062101212185987900,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,2991551440213458577,15545971867686557317,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,14036589572624433044,17453534208596838132,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:2
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3656,i,18416194872351712937,15783092751858314442,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8542221258303456011,7196260308948334991,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,9470574836245687000,17688529805640869670,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3777425745407754799,6590890375307695750,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,3777425745407754799,6590890375307695750,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3764,i,16654686737875804710,9855284665917358633,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6424,i,11462934801844495494,3789399001490633228,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3744,i,14837043748264111222,271216339082945151,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,7961760414556173640,15862912839786188818,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6352,i,259434802389541296,9685966317924843121,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5220,i,3777113561230734129,10422164937278665675,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6284,i,6016125726196319716,14266620911927466333,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7212,i,5633475452659458126,10057830256259468257,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4936,i,11003911365369941774,14806284064823289440,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,6386603673651158878,6025669785789901654,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,12826033716435732448,12648281066000554983,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,10514186410221875251,15340119064212361013,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5944,i,11157658283385754231,1500824637441397672,2097152 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7560,i,11388461887237827516,16332494124708454904,262144 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,12130029121287105010,16447053292440344512,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,8031509758863442102,13468732594900067840,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,12827601209223873030,7983440161950605464,524288 --field-trial-handle=2100,i,12276571733523095135,11194686206224161661,262144 --variations-seed-version --mojo-platform-channel-handle=7708 /prefetch:8
  2⤵
  PID:2464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

106542bb-1bf3-4788-a3d7-61f3265581fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\106542bb-1bf3-4788-a3d7-61f3265581fc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 19KB
SHA256 90511c72b23499e7d9eed736d101a5f576d16b7883e4123f64d6c08bc099d4d2
MD5 38979db13a666909a08da3821da82ae7
SHA1 b9c7032943c3a786a9d57d26a496cccc5c540156
SHA512 2be133d93d9227c7cc8631b5dd49551f70d10ae0c83d53e113bb222e9fa7fd4f29826b17a46b38d33be40f44d79778e4fb1ffb3210b7b620a4e893b7e9711625
SSDEEP 384:odV6XEfWXR0ZciocHdM8pktb2J40L/gLMg2xH2xZjvdfYOsSeeBiQkI:oD60M0Zcdc9FpksyiWM5xWSOsSeHQ9
TLSH
T18892E1722B7418DA7A4F84117254B4189E8D8419E91FE83AA430DCBD4BC8B897ECCCD7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 44KB
SHA256 4540e7cdff1419ea12a1375620cde215627b56efb028d77dbc1e76443835fc0c
MD5 a2cae741d1425b1b10b4ff3f192a0570
SHA1 57aee0387b3fcfec18dd06d56e920cc3762e85ff
SHA512 8ac04865ba1357806c6205fc96abce59ab506faf79067df86f20ab2d9a6208ea9f02cd404f38ec3ebae56292cf32206795da6b2fecbb74fa0d05f19435e747a8
SSDEEP 768:bc9IVFimXUM6AFaufO+H9ldKSaV7S2I70gkOeA5R4ExccCXHBMkFAh:bcqVTU2FN9l1oI70BOr5RbLCXHBYh
TLSH
T10413F1ADA419F41DDE64A2D6615B30FEDD0ABE2D730E768A478E1C221F6D7503E30B81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 182KB
SHA256 a02bdc9d5877bef63729bb9a2d1b90d02987c27a477b556f1f2982276465ea07
MD5 a4494827dd2fe605d0bc76f5d63a82e1
SHA1 f25b84268e41392bdb6281789ae1e3fbbf28c43e
SHA512 f8d87aba96c00a5f585ea6ef1ae5296bb1c38e952137f1471fc5ddd14832daf1377315277cc6494b7c16cc14cb37553671bbe5c22872a394b0841f403aebe2af
SSDEEP 3072:67WpRAgSlXu950AVciN8fqElgs75mpVAGe7N/x0x+S4xi/vuhZ8I/FGW:iWOXKhV1tEl6ihxzXY/vJsj
TLSH
T12B0423B0EFBA09B97B1715E510CDF2AA798D03323F5E98AF48E4E8CA4731980534C596
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 28KB
SHA256 2e4f3a305dd06b32e403888be314c26cb857d870e6d946970385483e4f2c5907
MD5 8c11b8c00867df40a52a3c0e5e80499e
SHA1 c2c13a17a950110bb316c2603fc04f3d51539b14
SHA512 7a4b4f4b7bdc7c76c18238aca4cb45ce96c01c1b8beb7e9012a0243248d7b1d74ef0bdbaa79bbf7ae64119cd53ca24a476a22aae5dfdcebdf3bf5a2fca6c81e8
SSDEEP 768:9BYFSkkPJoH0E9lUaZbFDF5x7XFVqqAisdNe12ow/:9B0pkP+H0EYQF77QXR7/
TLSH
T141D2F1EFACF3F98E06A55D2AE496D221D432A884946CC03290F48F5DB974C4B1C78F4D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 25KB
SHA256 c3f813d19c76c3e4a52600755532822f2f2bc2f57d66c85885838e0cee0f85c8
MD5 a190c400edaa0aa76f352c5ee0e401f5
SHA1 cd004b4a610ac9a9d5defb83c7acf66ac4469289
SHA512 ba682f3fcf3c5ee2c9e8bade4bdd6f41053bb52f7b789058eecdae591a27b9ba4062c4a2e47b2b7b4ed8ac6398086c23f5ad97442bd823db97611527fd24d388
SSDEEP 768:dO0jtiZ6wTUmAWkLeF+21l5+5yn/sxxHJqhM1f:XteVwmAWksr40ewhAf
TLSH
T1F9C2F1E8F52890CE69D4BF7E76C1EE86D31A1806265803814FC11C2E5E5991DDBE58E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 41KB
SHA256 0b5c61ce25264012dbac5cf143d0c9b5f38a4f4af2d37e6a18547f512397df40
MD5 cbc383bc8fe61cbeb5af98f378cbb9f9
SHA1 018b394da927da823747da66be3fda718e9502af
SHA512 37b837c41959bc23bd6e64e771a1ad43c9fe4c81a50c49d93bba8f42f0674aab282445a2b9301604d482a5ffdd32f932ef78b46c2125f01018fa13c0204e08dc
SSDEEP 768:E//SAg80BY+NCJu3ZFfZsrc6QooVpFwPwape/a8bpO3vJZZLwNYsHLKwnz:EHSAgsFU3ZFhcclFWPwcenbpOfJTLwNF
TLSH
T15413F11CB94819BE2F54EFC121F3A419E79E13C3B5266BD15C8C4878AE47D26DF82C90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 27KB
SHA256 e7ecb338f0c2abadbf097176ede335c3a890215502382dbaad3a6fb125e77ece
MD5 c62d42df91f31d5ac7499db03a799375
SHA1 26fb93f38c74990ad79281a48008ac7c01b205bd
SHA512 aa77ae29768e8d4984600f2a8be7bcf7c1fa4841a31d205b85ee96682f791695052ffe4b509bbfd84feeabd708b9d555c4c17b9e5a2a93be6b1c5c8e67dc0088
SSDEEP 768:n3T3xyOLw+VGkzkrG9UWrbE3qEGRTZH38rgTAaI:n3EIw6zkrGOWHlzZX8kTAH
TLSH
T1D7C2E1CEFA10AA4F6EBC4E4BC2DB0DA2410DD875747D6E35CEC608874264692EF7428D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 22KB
SHA256 ae33dd02ec0fee5e629e4556aee82f97c717da3af9470c98d3aa64e1f13eb1f4
MD5 4efc8199e4b1e0fef5be3fdea0a5e3be
SHA1 2b29a29f8869560d3b6bc613e7654c2e4d6e441a
SHA512 248a0ef499d262391179e011afbc86c2706dc07a28fafcb3bf37f89187f8d1bf3cca19dbbe1f027e60181c605f94da58176404c567bdd5ed4f76eb42df914862
SSDEEP 384:T/wdMbE8ks9V9d91axhbsGMnHE+e2IuVFkWOqXCJou9cjo9GpZEAO0kXT9QqJBjw:+8zks391axhenHEZQVqRqXEUI+ZlmjLM
TLSH
T10AA2D04057826C403FAF07B191C9C4F8DE251863AB6245E0309AA71FDEE9F9818C2EAD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 183KB
SHA256 f1009f7c802115c84e8349cbb27d450b787e8131f50bd10b0da47d063156f6cb
MD5 98d447fd2c80d66645b1a7065c1d5f0d
SHA1 218709c95e3093ebbd139dda53e0bcd9756ce6d7
SHA512 cd5842805508bf6d63073eb69aaa309a574e08b38ecfab7322720983727bf6aa75cf82dca70de960a4c940788cf6c18f239c9543defe4c641a0ab4e22a71c5b7
SSDEEP 3072:XN15/bfzQrUc6a3+wG+Co9OzeRvERJI1mTrU+P6/L+FJITuIccmtohNaiyN:X75//QplmbEOKRcRJI1GY+P6T+oTulcM
TLSH
T12C04235235BB9806C446932C0F9683C64A42EBFE8A1E74E3EF1310B7F54AC4FA255776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 18KB
SHA256 12ec549df3a375fe4c58a0fdf2df39c4f43a9a86257d695e6a444124d27c842a
MD5 b9500eb1925f4570937e21b99c563c46
SHA1 d263f6d43d4459e26e01b04a0667e5582aa5db23
SHA512 dbd7b7e29892d0cd8b74623e8b8e1c6e7165846d7306f6cbf90211d7f54d0b5a857523c9b7fe2ded80a4758eac1cef507ef402f3c4bf9672cc6238ed2165a95f
SSDEEP 384:2NfFmZVzPWYYQsKUYa4H5D2/S9ccNY1BjrdG0GGJvsowGLIUhxHAT6StrC:mETjWkU1W5D2KKYQH80H1sojLIUhxhgG
TLSH
T1EC82E1588CEEC89735641AA421B357C32457F79E0BEB19DA8F8DD0E878CA771454C2CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 e666f9185b869b17a33ade8af8a357e135548de95df80c4f793dc08dc5c3b6f6
MD5 5499675d9713b0e4927adb2c55582af2
SHA1 810b4b99dd6d7d61c5584ba1637bef7cbc4fe58c
SHA512 d939b2ad6fd058c4c23f8e46bd0103353ed2762040044dbf965b234acce90cf43547ec093207876a6164480c347688d73ca0b28873d6aca32d9380780c3aab33
SSDEEP 96:POTik462LY7eS9XcDdE9goXnhrQIHyIGkbRe3xuTE/nx:PCikKmdcxE9g25zyixQx
TLSH
T17DD1DBCC5151F8C1FBA425B0C2EDA52279F1BD1E3B735E926174C8BC6406FB1672AAC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 efab4ba587f12d8833f7c95ec90b4c14be121a10305330ce2517fcf83b82ed3c
MD5 c76b1cc05112edbdba895769bc6d0f1e
SHA1 ba150e4e2c3793dff8013229b433d73bc619bc23
SHA512 d679f32810dc927f955c80951e0888498884584082bf0c03034ba38f9bede9be5b5ec5c9556e91420e435218af26f1023a2ef075bb57e82a2ecf4a09918d9947
SSDEEP 96:VHRIkF6sJLYTeS+EDd0AuoXK1hUZQVHyIIWFW3xuuT/n+:VxIknR++Ex0Au7AuyZWRg+
TLSH
T129D1D9CC5145FCC0FBA026B1D1EEE96178B0AC1E3B635FA22174C8BC5406FB2676A9C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 ed72d18a08028264cdf747e69ba0f75d67d2a04db356ae2ad80b788f628fc668
MD5 e415c163971f6b173d6b8800b76ef823
SHA1 ef13f8d0356cdd043d0b0440d1c351c44f9563af
SHA512 c285bfea55f80c7f2b197618ed4c305d092ed88e3a3eb295003dd144cc49a9487884ea3cd417a1cb69f46137fe4644dfce572922debf6b7d94d0ad936d82ec06
SSDEEP 96:UD/oAk46sJLYTeS+QDd05FZoXK1hzZQUNHyIIWFf3xuQ+T/n6:2QAkkR++Qx0577HbyZWiT6
TLSH
T179D1EBCC1155FDC0FBA426B1D1EEA96278B0AC1E3B775FA211B4C8BD5406FB1672A9C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593e67.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593e67.TMP
Size 3KB
SHA256 5ba9a3484eceedb50a59af8e96f598b2d7f1298240193752c70739e7080cbd9a
MD5 5d089cd91eafc4011bdcc4ecfbe47ecd
SHA1 fbc8da61a724a3dfab0f8fa5669b48e3de0194b3
SHA512 30dedd4de80b17522686d023b3ca2df9447caf3f5b910ed3f2790263bcf61571b34837607ba5f2e99723fccaf35de118248c91c27f8754e123deeb28490ae501
TLSH
T11271270C0112CCD1E3E256F1C0F2F245B8B0B26F3B779AA12274C5BC6519F726769C0A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 adf780e3789f027747d972987ce39d982a87077996759d3f78b04b393b93063f
MD5 0ae8ccacc48accda0279940bcba5e525
SHA1 dc1a04f3f378c0712189a708e63d69cb09fb9e07
SHA512 f10b2f15fa9f2d3abae00b81ed26681b5ed6f906ba43dab3977ed9e4f1440b9ed769a3ea022440862194dfdffd2c090617a63ee8ccee82829a65fabdaba0d809
SSDEEP 384:DA3QaiQuRsQ8B6ezHFPQtex2tyF1XGyDtfdRE2jZjwJY28216ohhym7aUaPf6C+x:4oXORqnvr1
TLSH
T1B2723CF687F47A2D8D22D1F56A2AAF2FCD1D0824532C382A85E5EF1693E2470F50175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 17KB
SHA256 2976fdfdd752025a851481189ac608b63d257dac6894e8411c9e7fc0c7fd7df3
MD5 b2e9a0c37e041dd218e30567f401eb5e
SHA1 e30bf4bd4b4361e440f68e020ba8da456cd50730
SHA512 f563f5cfc58049befa3e7fc7bad628c91e9f46703eb5d7126366709e874d70d4c94d4f9aaef3ff15f157e3f97c21867935d95d9bf510207383a9c2ca1e335b5b
SSDEEP 384:DA3QaiQuRHQ8B6ezHFPQteS2tKhQ2jF1LdE6hm+OpSl++2S5Eb+yRDft2GYQpQgK:nLuLduGS6B
TLSH
T119823CF687F46A2D8D22D1F56A2AAF2FCD1D0824532C382A85E5EF1693E2470F50175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f4890c3348479c3da630f116ec477afeb0cefe774d92d4c07b1f766aeb181c7f
MD5 95fb3f341fa1a98ba0a979551b798925
SHA1 bb3f535fb9172f30189c7d7313f9974514dd8522
SHA512 eef53abd7be2cc279bce11b0ef39e397c7db41be88ee1b8bb6cbe06953ed5f7c80e3221b6f7d9a230c0d36e8352f4a69792c048416ad889da408bbf53f25f4cc
SSDEEP 192:sxZcR5yM/jK1Ml8Mku/fRssAXIdpgjHW6+WNfKY/YLzeU+uIgrJ:sxZcRMu/fRssA4qHbR/+n9
TLSH
T18E52F9116A34A977CCDBD209F955BB53E6F904B3A6900E44AAFCC91C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 494b56b12abb108267f4a0be053c52757651599dc7418c4645135c239636fd5a
MD5 77357f1a1d65645dd8227878c3fe4d90
SHA1 a6faaa9767b05fa88160a2275eb99320dcb3ba1a
SHA512 560e2b510545c968dddfe03426c69f52d9b193d868bd331cfc1d4b6bd5e122be3a333f4d9c8e2d9ed903b49fc954fd9cf6ef482d2cf8d823f42895199c7e5a6b
SSDEEP 192:sxZcR5yMojK1Ml8UQvku/fRsSSpIdp2PHW6+WNf5/nYLIlO+uIg5hJ:sxZcGqcu/fRsSSikHbxn+n1
TLSH
T12B52E711AA349977CCDBD20DBA55BB53E6F504B3A6501E44AAFCCA1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0b17a9aba708dec852d59aca52c1506562545883b771986761fc56649baccc2a
MD5 736031ee470f5b44e026732479da54a7
SHA1 9b78a2fc1e8c41ecaf78e9ff33426ef69256ef27
SHA512 e6435573ca64a86ddbe75d97e8534062aeedcc1617c6ae1089315799c4d660823cf7d642816f58c875931bcdf4acfa2e1683623f8cfcbc30af1345d25fe56436
SSDEEP 192:sxZ+R5yMojK1Ml8UQvku/fRsSSpIdp2PHW6+WNf/nTYL2lO+uIg5hJ:sxZ+Gqcu/fRsSSikHbXTMn1
TLSH
T13C52D8116A34A977CCDBD20DB955BB53E6F504B3A6501E44AAFCCA1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 aec77ed863389e8a74dac769ec5c358943bdaeed592cdaecbfa660f73c5aa261
MD5 333295344aeef36a3f3ce1b6e69491c1
SHA1 ffb510ad1c15696fa56e1be6749b8de14a015bea
SHA512 08e51416152da4a4de4b6dbb719432c70db55679a35874766e9ca559374f502a172323826683f4b203006f76f9cb2e03a0397a8813e489640c395773fed8712c
SSDEEP 192:sxZcR5yMojK1Ml8Mku/fRsSS7IdpgVHW6+WNfZtZYLkKU+uIg5hJ:sxZcGMu/fRsSSkkHbTZFn1
TLSH
T13152E8116A346977CCDBD208BA55BF53E6F504B3A6901E44AAFCCA1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4506265946b2a0ef006f662f13b46939eb4cb129d123e4a5a77a0bdf79ca50ab
MD5 5f02b1e25d92f6333508b8aa10f71cbb
SHA1 e87312b0edb095068218ee27183bc78d2480ad50
SHA512 6647bcd203c7e1f798800afec3e227950e9980d28cc51d19bb1b226134ac0168c69cdd44526e3ff3dbf9af619698205dada87ca32299abd0663ae2c565ad0671
SSDEEP 192:sxZcR5yM/jK1Ml8Mku/fRsSA7IdpgVHW6+WNfKY/YLzKU+uIg5TJ:sxZcjMu/fRsSAkkHbR/knD
TLSH
T18952F9116A349977CCDBD209FA55BB53E6F904B3A6900E44A9FCCA1C04E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ee17f2a8b5f830c54046c80f281d146259f5be5929239e6cca680617c1c20e46
MD5 37c9e0460a62b153c4682cceacb46587
SHA1 1252451ac64693ba8be7f8b2f80cc87a34015c93
SHA512 dfe2077b00cf73cfb243dca450e424fc544310f9c6829215bd441fcf1cea3703092686180a24f1a6921f387750d8a0d03f62b2d8cc20df829f575a1d5d1e3f63
SSDEEP 768:P/s6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNNroXn:P/s6pD1WvxzUju1jahILIsNmXn
TLSH
T124E2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB94895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 bbb1141021e44ba44d4683eb73e4ed2503ff3c22d966036c902a27494a24065e
MD5 9e1d5e396bf5e01218c32777c3c0b202
SHA1 96e34fdd6fd5b4c75efdc2b502690f1c70c452e0
SHA512 3f10ac604ca5ffa676d41be04a8fdc3f78bd2c8fcba099fca3c1e2f015b370fb738dc6c9c9c0840d2aa5d9092d0e66d38a85cea2f50722c73d3b74485e82712a
SSDEEP 96:KUAAKtePONWKuYKaq4KHqQhyKiQCWByKCkw:ii9J3aJxx
TLSH
T181E1F11232BB02523D3E691C935987676F427AA33418F52B37AC10B21E66E344DFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5969dc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5969dc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3e648f5879aa7c1fc67f84eadec350458a979fbaa129643cff3bdc2a7eaf0dcd
MD5 ea565126adc7043110dec3adbc063c77
SHA1 2f069d5fec7aea407a5bd904a10eff374f314665
SHA512 c6f58ffaf50c009d455e7149d9ae355d8a2f8dcc1c24ddaaaca1ab2a0302dfe4752cef364d11bdaf8250a7b6591715ddd00b8a0c3765a52f417db69ede8a3e58
SSDEEP 384:oZcIhsNAUE6l0G4DKa9ndQcMTs7O6R2FeoDh7Uwo8:WhAorRGDs7TRaRv
TLSH
T1F0828E716CB86C765DF3E145F94736175FF880A79ACA2E40D5FC9F1D00EAAA81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c317caa7bb428c0a5c7c45e128acee2a64f9cae0a98a1594b4e1559bbdbd8bbb
MD5 67bdd84b196e3b0a8aed5423f53b12ee
SHA1 9dce3614c4a357a4aafae0502d39671553f6e475
SHA512 167a762b3f7326d60dd0e58d0d7c979c4100c47c336073f2f5429a0b7f63ad8be04fc3b4b98255f2293cbd44401d8eded9dd3d768db06e057889b0be72e5faad
SSDEEP 384:/iFiZcIysNh8TUNTUlIlv6l0G4UKa9ndQcMis7O6R2FeoDh7Uwo8:KFQyUwg0rrRGSs7TRaRv
TLSH
T1B6C23BF248D79876D9AE9747B77E2D039EBCC0A3B9855540B3D88A0DCC965BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 414643a5788fd37e24094319cbd8465ab7d67c3bf98f0f972d35482feffdd2b1
MD5 41b78c3a0246e3e8c1c7ce08ec1360fb
SHA1 af407a6b50979a1996059adf4919f26c438d317d
SHA512 51538209c49015b3ab100595945c6331604d5c8e92c140785952491c96dbc8b1ec7fc3753ca0b391b0be8870224327e7c2e8bdf34e3d92c11ef4915a5d96b4bc
SSDEEP 192:qONa6O7+3hQmiUyXJGttb0h+FdPougGLCU6:qONa61GGt9ndQwGU6
TLSH
T15202C7396C686CB78EB2AD46B58727175FA8117BE9962F80D6F84E1C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f4574d4a211ceb4fadca9dc2db77059d1d9a1eb5445c79b7a155fe024bba06a3
MD5 bb172c02c217a244a2a6fdf1d70da4ac
SHA1 186d51cf1cdc1fa3444e89ef78b35dd329fae008
SHA512 2191f0a3c1b62aac755479b628a955bd1b58e468d78759d7bd28b91790d32ed05d23938ac44a86873187b2760f7aede2dd4027730dda12711fd715a866fd4a33
SSDEEP 384:/iFuZcI8sNX8TUNTUlIR7/l0G4UKa9ndQcMAs7O6R2FeoDh7Uwo8:KFM8qwgVrrRGws7TRaRv
TLSH
T151C23AF248E79876D9AE9747B77E2D039EBCC0A3B9855940B3D84A0DCC965BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4d79c590332a1da67a75aa14ff7c7857487656051e36893ad80021c262e5ed48
MD5 ccb119f8e955da5b1542f15e9f3e857d
SHA1 7c687f51fc7980d9824f6863b7ef980d4223127a
SHA512 a57e9f8490bfd7eacc40718dbc862ec93c31b385b0c441ea51ea4f82e8a02a13694de2d6e0c26c713d6ea76a7906ec5857145c2f5cd2dcf8da5d77cf5bf972b8
SSDEEP 192:zONS6O7+3LQmiUyNJWttb0h+FdPoYRh2v9cN0rq7CU6:zONS6fiWt9ndQcMSsU6
TLSH
T11B12E7356868AC675EE3A485F48736139FA5417BEE8A3F80E5FC5E1C00EF66C2346817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5116d291c0a4f27477657f34e74547ead1bd7782111a4ac1ffc1f64eb15b4771
MD5 b97bfa7fc6792403ed2c118a7a7ad86b
SHA1 b434e3f965a23cc41f0375db4af276530fc3b6a2
SHA512 16e70f64263cf8e4b2f1641b3c3100e5b1297e6081264ec904cef853691b7713ea54adab231b3d9946f634a6f855415a103050dea00ee025c93ff31344d58ca6
SSDEEP 384:JZcIhsNAUv6l0G4DKa9ndQcMTs7O6R2FeoDh7Uwo8:Bh1orRGDs7TRaRv
TLSH
T132827D716CB86C765DF3E145F94736179FF880A7AACA2E40D5FC9F1D00EAAA81306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bb888b41af2d02114bf68985d24526569c1cc5cf801914ffd3cc831d145e8d2a
MD5 b521a5aa59f58b9b6a655e6adf796e43
SHA1 44497c56af5f07f56a0e7fa5c21ab7876adb6bb8
SHA512 826ad64b03d94a92c5422301da1f0476d7021f53386efd4d1d812e5aa4a22eb2fff927eb9ef431fbb85040a2a19658d2d687bef33c78520fbb7a88d34f163e3c
TLSH
T1B1E0024263000059C035033500431A211FD1C511067103475620515C1C33B003E11780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 03d7a90d50e815eeee6698aaad30a535544e1d8d16a56491758484efa608f823
MD5 a0c4bb786ffae3ee01284266f6b3c7c8
SHA1 d1fa65df0f5bfdf4d2e82ed3af62d9e55d32cbd6
SHA512 7409ab9514973f0efc539a0b19bf449617917d84caab2d1171904635624a50f6f4c79a065d202d0a9488dd91f9b4b888f534c6747fe7c5e44230328971b1f4fc
TLSH
T1CBE001426300009FC035833500C31A212EE1852107630647562051AC1C37B103A11AC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0e1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0e1b.TMP
Size 392B
SHA256 dc5c6d0463d1a4ce11d0b891be263017a4854419c887560eb7f2a35c447323c6
MD5 568eb379bb6d1441019bbafdec63c421
SHA1 7e69d1fcea8ab1e76050b1f84b6c181c012a5e58
SHA512 afee3635a9a266870892284942b82d10dc830683ab462855dbd4d452d919eb9594ebfee2b0179898c59f083b3a9ab028f3cf48a95433e2e6cd174bdfa6f55aa0
MD5 SHA1 SHA512

Submit Download

332e9e33-edc6-4058-a78e-b24c74739d00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\332e9e33-edc6-4058-a78e-b24c74739d00.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 51d69fdaff62dd945af255b6e387bb69f4d60c863f78a48db0feea8860248b92
MD5 44f80710e8a14db5559b830d784b65d1
SHA1 5230e033d94fbbc87e05adb2a8c18f91c6019500
SHA512 96edb0d16bdf96ff88806839fbd5d401fbeed95db5fd7d57ce329bb74502adf86b50b67d3cf706ffd18d99fc47fbf3d9eba691f21109df2389e0c08e14dffd56
TLSH
T1E5415B5C6AEA1148B3B77F4AABF6A86E587F7D372E0BD45D10110E4F0622B40C962733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download