hxxps://riddler[.]app/dnbherl/players

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 08:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://riddler.app/dnbherl/players
Sample260910-kqevtaak6v

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
120	discord.com
63	discord.com
64	discord.com
67	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335036942193747"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{02C9EF62-C320-443E-9D17-7906ECD05048}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{DBFFB299-C308-4EEC-8D70-9C5DD8B4CC48}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1836	msedge.exe
1836	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 4252	3868	msedge.exe	87
PID 3868 wrote to memory of 3096	3868	msedge.exe	88
PID 3868 wrote to memory of 5024	3868	msedge.exe	89
PID 3868 wrote to memory of 5024	3868	msedge.exe	89
PID 3868 wrote to memory of 5024	3868	msedge.exe	89
PID 3868 wrote to memory of 1956	3868	msedge.exe	90
PID 3868 wrote to memory of 1956	3868	msedge.exe	90
PID 3868 wrote to memory of 1128	3868	msedge.exe	92
PID 3868 wrote to memory of 1424	3868	msedge.exe	93
PID 3868 wrote to memory of 1128	3868	msedge.exe	92
PID 3868 wrote to memory of 1128	3868	msedge.exe	92
PID 3868 wrote to memory of 1424	3868	msedge.exe	93
PID 3868 wrote to memory of 1424	3868	msedge.exe	93
PID 3868 wrote to memory of 3676	3868	msedge.exe	94
PID 3868 wrote to memory of 1880	3868	msedge.exe	95
PID 3868 wrote to memory of 3676	3868	msedge.exe	94
PID 3868 wrote to memory of 3676	3868	msedge.exe	94
PID 3868 wrote to memory of 1880	3868	msedge.exe	95
PID 3868 wrote to memory of 1880	3868	msedge.exe	95
PID 3868 wrote to memory of 2800	3868	msedge.exe	100
PID 3868 wrote to memory of 2800	3868	msedge.exe	100
PID 3868 wrote to memory of 1892	3868	msedge.exe	101
PID 3868 wrote to memory of 1892	3868	msedge.exe	101
PID 3868 wrote to memory of 1864	3868	msedge.exe	103
PID 3868 wrote to memory of 4696	3868	msedge.exe	104
PID 3868 wrote to memory of 4696	3868	msedge.exe	104
PID 3868 wrote to memory of 4696	3868	msedge.exe	104
PID 3868 wrote to memory of 1012	3868	msedge.exe	106
PID 3868 wrote to memory of 5068	3868	msedge.exe	105
PID 3868 wrote to memory of 5068	3868	msedge.exe	105
PID 3868 wrote to memory of 3928	3868	msedge.exe	112
PID 3868 wrote to memory of 2848	3868	msedge.exe	113
PID 3868 wrote to memory of 2620	3868	msedge.exe	114
PID 3868 wrote to memory of 5224	3868	msedge.exe	119
PID 3868 wrote to memory of 5224	3868	msedge.exe	119
PID 3868 wrote to memory of 5224	3868	msedge.exe	119
PID 3868 wrote to memory of 5324	3868	msedge.exe	120
PID 3868 wrote to memory of 5324	3868	msedge.exe	120
PID 3868 wrote to memory of 1836	3868	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://riddler.app/dnbherl/players
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe171dc188,0x7ffe171dc194,0x7ffe171dc1a0
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1768,i,12113257436765587009,8795534267160258794,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,3433934111901758859,16858640792822615732,262144 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,17277401216303210294,14559071992432490489,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,244445935612347496,3687851095154432676,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,16379416364240013344,9006413712496237011,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,2280830205021738763,17520463613034127396,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,314753649757742592,14792733589497222539,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,1177417865339141580,8212833581285531555,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4477052885638086721,5094607511479869074,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15174698197971034839,8129311652747712415,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15174698197971034839,8129311652747712415,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6312,i,3103456673834331419,11697111506520355847,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,16994013473881290687,2667329198264691895,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,16506331609470356387,14623405635232237990,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,1785887781278859447,1585627645360581,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,4837734885926537892,13433038821845353746,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,8409978202563185279,14714968357053398070,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3076,i,1547339768253515274,15471612505306217647,2097152 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,15160378961318404960,13669789381356911340,524288 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5204,i,10587891900927046098,17932001890925002638,262144 --field-trial-handle=1784,i,15596305738613725992,4427898053679859780,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

8bf937a4-1bbf-42a6-874b-6a1d105405e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8bf937a4-1bbf-42a6-874b-6a1d105405e7.tmp
Size 27KB
SHA256 0b25441c27bb14b84a782e6ca1d480434b2eccca6b632e39c5e1a97ee3447ca5
MD5 31b453dbe147580234541813ee70062a
SHA1 b2b364a7b8c329b913c91d5893cfa19ba2eb983b
SHA512 c8711f0b54a15769247823b7ec4c78f0341b25304c40f5aa1a8199b8544e73e5c09612f5a22dcd75c7890cf259bff3b692d105475d2a9b662edf383cb2b7610c
SSDEEP 768:UQqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrLro1:UQqbUj+WvSCs6u1jaaZLbWr41
TLSH
T177C2E83B340CCA7E4FC01E9DDD5A6F972E9802C7A7988D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 39KB
SHA256 f5fb3ab333842b48310377aeadaac37f4c4b774c0744232a766f4899ef4fed1b
MD5 c29cf69c6f7633f9e2d7ef4011fb0fee
SHA1 cb6a21793a268f63c4c0a07fb477920ac0f31347
SHA512 eb5aa7f61ac1bf1ca2a45be007f91b55a996586fa51a44e9f76559439442d9c5fb7a24d4823b3c72e2af5d51f7d1ba81aaaca899a1a7b9ba7b6f563e608c2478
SSDEEP 768:oJEw6FEBL1+aMbB+AF2/XFeFhB6T8IURcn7V5d6SlaE68IF7R5XjD/zFnWHM313Z:oJEw6+BLVMN+AM/XEHB6T8IURcn7zsl/
TLSH
T146030D9A6EA31108B847D4683FE66705F269C003990FDC757ADD3258DF8E1B869EE34C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 11KB
SHA256 209caed50647a9c297c3c05a7ed2d2c182e3f92db3a0f91a44da4e5948ed3bab
MD5 c15e7c90e04b05af5527234fa974169a
SHA1 74ac661014a43daeb11f34529dee17947967f300
SHA512 410b0a1ff3398605796c42e09cc73cc36b1c2b47faab007b173eaf6eebf3aec39719e50c8a43c096b480a915e1e9215b15dddb217da80b0cd3674ad17cd45f72
SSDEEP 192:/exqFzObeAtRWTw4+hThXGgk3PCkRfvnX3tWkiKShlK29+7yUQHY7AhkkHiyuS9C:9AFBQ6e3e9++y5g2bsIq48A
TLSH
T13832A674980334D8E31F86F35ED71EAF323282DEF9539E550061E53A9E51B71DA3A182
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe592d21.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592d21.TMP
Size 3KB
SHA256 3f50a9e44f5646651bf71677ae4253690b113640fbf02bc8991fd7368b081a16
MD5 4e564872c826271a66bd114867b55f63
SHA1 384838a1de92d8fc2e303f750679bd95c6403d75
SHA512 9a8ef79edefc8df5f4fc6bf2dc60a7f2a3f286b0487316e11ca4826299c86398c2f580406d2a4bb22838e9ad4cbe81293875d0755ec446ed51f101b5a5335f31
TLSH
T1AA816EB9424312AEE77D52319EE20E3C747382E8F9235F5B61A4D8B1ED957A3C2364C4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c7963d80befab1b06c210f154c2a3eb1b0657ef78f9020fa55940677cdcf78c3
MD5 0fdfd51cf5ce475e5ef970868a09600b
SHA1 9c303ac6d3be85f60825b47a61e32189f66fa278
SHA512 bc43af0d8635f679154e099406299e08e430308b2b3e67fac0c61dd8e61a82ea885315ea94cc4f4bbf0006721695299ddc94a53ac66c0873daddf84e8ad16359
TLSH
T1595179F3C3E5862DD90156F4AB146E1BCE2D0954431C3C6AC9E5AF6BA3E3561E201A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9cf3cb170255c489b79a1379115cea42a9ae17b24e35262a072f70a1ee497ea8
MD5 884813cbcd0e087fd22b1023bb86a6be
SHA1 ee6a1fb179f29c7640b8c4353c73913ec806e902
SHA512 d662277ffb5d32afacd93725b6068dc84cc58084abd1a3a2596393285eb526288f144bc6e2b9727a917ad5064cadd5cbed9028cb984f04d43650b9fbbb3ba511
SSDEEP 192:sxZMRFW0/fOsWiIdp21HW6+WNVaK/YCKlSM6IgrJ:sxZMi0/fOsWLCHbp/HF9
TLSH
T1E322B7116E28A97B8CC7D71DBA25BF53D6FA503291901E58EAFC861C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6540be52d7915367e4198ac918963acd9fd915d09b63af6c694efac5938212e4
MD5 34b1be6bce659ce5d049e27b7e5c0ac6
SHA1 ad133b7977797c51fecf4d17dae0c63b5cdc0f5e
SHA512 5bda2cb2a4f7ec96acc84facd4e0eb70e3ad8a01cc94641106f287ed4f03dbb0b065ee93892f8bc399502f5e0a1c5556847efa4df98ab116d06dc486c2d57139
SSDEEP 192:sxZMRFW0/fOs8rIdp+7zHW6+WN9k4Ed/YCHu0M6Ig5gJ:sxZMi0/fOs806Hbe/9Fq
TLSH
T1D632E8126934A97B8CCBD71DBA15BF53E6FA503291D01E48AAFCCA1C05E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 19280ca50db99ca2e670c0647d3348379eda0cc9066b09dcc2296b41fb1fb30f
MD5 73ae6e3e0ec0378c6bceb71a204ee64a
SHA1 95a4ac53f4b2f4083d566009984d364336b1afa5
SHA512 7dd67194c41834cbe44faefaafbb5d733a9d31dc031c4f8f557e8f5b1bf4a00164826278c55cecacbccf8ae8095f68d4b6f8c4cd476df8753fadaa74dd0e5eeb
SSDEEP 192:sxZMRFW0/fOsKiIdp21HW6+WNVhuXYCtlSM6Ig5KJ:sxZMi0/fOsKLCHbyXuFQ
TLSH
T14622B6526E38A97B8CCBD71DBA15BF53D6FA503291901E58EAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cd7fa4cc78f82495f82af93b8d1bdb61b88270be1e91d7857f86d573231a4326
MD5 621141f7755f9eb1ef31817aad56f83e
SHA1 6cca7f95e35b8d382aa2b3010637a83e5d2a80fd
SHA512 807cd4c8316f229a9a17fe276933ebe9b50465dc682ec7e042fc58656c719b94b247a50bc090f00d87e3bbd7818227e8bace4f04d92f3fa4833d2b793703c992
SSDEEP 192:sxZMRFW0/fOs8QIdp+7zHW6+WN9k4PYbYCou0M6Ig5gJ:sxZMi0/fOs8x6HbGb6Fq
TLSH
T1F332D752693469778CCBD71DBA15BF53E6FA5032A1D01E48AAFCCA1C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 22a11c1736586e15cd6719a8e9f707fd3b801fb634197fc080782f4ab8f13872
MD5 97996872908afef466d2570d1f6eea5e
SHA1 d238e42832a8cb8109e1d208251363091d1eb4c9
SHA512 8ec5d87c7a882f3e94909a828586c339d17fbb8f7551d4d932e8fbbd9b3de2dfab943a26711f4d67949f0edd3d48f0e8a329af72851a577e4ec5aeab1bb2fcd7
SSDEEP 192:sxZMRFW0/fOs8MIdpE7zHW6+WN9k4VldYCLVSM6Ig5gJ:sxZMi0/fOs8VcHbVdUFq
TLSH
T18532D7526934A97B8CCBD71DBA15BF53E6FA503291D01E48AAFCCA1C05E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 87626db06aadaa92ba150c4ce110cd8c5723ccc801afe82928e6380a479fa307
MD5 8371aa196b54e7beb9dc91f184e67f83
SHA1 6a6ed4d206057eb84eee4343acc41fd4082209f2
SHA512 1568f6a9f6f233666391300d53f32bed3d6a5e8b36483dd6fe59f4de2bd47b10aabe5b06af663b03235951a005743cd9f7bb17a897de6da81db6d0d3cd12ddfc
SSDEEP 192:sxZMRFW0/fOs8xIdp+7HHW6+WN9k4Kx9YC1uSM6Ig5gJ:sxZMi0/fOs86SHb+91Fq
TLSH
T12D32C8526934697B8CCBD71DBA15BF53E6F9503291D01E48AAFC8A1C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c7913a192c113185b5ba463336d5ed8043c787f12a9ee22f42e72e6fb1f2e204
MD5 10bc97e385adb3ddf354df5d2351bd51
SHA1 69b7afb1d7cf94c7c60486d7de83f18f846de831
SHA512 da9bffe29294771f149855597c3b6143898ad5540e9ba09d47083f64ddbb2033cb6892f97c572f863cae00e2e4dbaa3998293359e06652aeb95b11aeb92f4a6b
SSDEEP 192:sxZMRFW0/fOs8UIdpEnmHW6+WNF89eVldYCLVSM6Ig5gJ:sxZMi0/fOs8NhHbCidUFq
TLSH
T18132D6526A34697B8CCBD71DBA15BF53E6FA503291D01E48AAFC8A1C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 2c75204db45d9be07d20eeb104499e1c6be7e5efa82cc6253a7ee9a9ee8dfc16
MD5 fd8d82e4f9b725a66cc31f070d55d3a6
SHA1 7147b54912356a11070d140f84cd49600298feaf
SHA512 d50936e5868bd9d27d478ba2a5f4a7cefd664a353c60c716e16add4da2a603c8c0f643f978dd34675c40f1dd525218f641b2401bf76648b8199f3f122dddc864
TLSH
T154D097ABF25B08C1E7B74AE10E22116E43322C8C5458808EE4123A2E64B0E43D231E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 8ab8e453995db36f97926d2fead8358ef7ee64ed7177dc07c12f2677eb4fd9ff
MD5 57390a9dc6ad89de878c54eb1414f7fd
SHA1 4f2cc415c6e7d435c84984b8ec38ba50594b5eaa
SHA512 5dabc7ee2b81fe9eac366a4d4274fc04e60544727070d7905b1b10c2a1366d795b15f372349c419bf365905c1a2967c161dcba747e70737d78b588aefcc6ff66
TLSH
T1C1D0A7ABF15E58D1E6FB8BE11E22116E4321688C546D809EE5110A2A98D0E53D222E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589de1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe589de1.TMP
Size 138B
SHA256 1628d60b7c8d572a3482add78018da2956da4d8d34ecc1011c742b03fddef419
MD5 488076170a22a8fd709620598332c30f
SHA1 e17a902d712e424c8f4b829c4d6b6de6346cb8cf
SHA512 2e2a32d95cfe0ab7d5cdb6121ad8748c239e5cb916b0046ee1262fe36c88d3ae492980d051e8c390c3a4ed16ecb96b796d685413c4aed9cefc5d1eb5cddd9666
TLSH
T113C02BAFF11D1401CB1602E14733081C83212CCC0D8EC0DE701338296170E236201ED1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bd28855651f91feaf2082a61131ee2507083b64c5c30504938c8d6e526f2bc2b
MD5 d82cab188821c7f16088cb53689ec4ba
SHA1 012cc9221dbb957c48e70e1625580b8dcd593b0b
SHA512 8a26d4ce8fed2d924780b2ca8fcf3a96531dcdcb01f2e0725438e649e1f12c5a67b5bc0132bb7fe525e1513977dacb9f3e47aa5e2778b70e21279af8a5512ea5
SSDEEP 96:KlkdQ0uS+gyKHzssgK01s2gA8s3WEtGZiKCopWrYEWoIx9ktsDsxK74D2xfeGVsm:2kdQ0uS+DKHQsI1s2r8s3WEtVsWrYEWN
TLSH
T1DB916151317F0605387E391892A5863A5E82B1A3361AB6BF3BBC40B15F27E119CFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592d02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592d02.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5d88d0231872a15c4d3abfa83d372c0439f778d66c61c8997fcf5ee078807591
MD5 2a7ea870edd68e9ac163532199fcfe01
SHA1 01b9f850cef1c0a4abf9ea751ffebdfeef7034c6
SHA512 eae0fb467f74d0831134128e9f10ae41c025b063450611f5872a6bca6f569ac1e7609233484aba7cbacc4361d907adc36a33bbe943981304945213f83c9b7671
SSDEEP 384:VZcIhsNsUPr8AlE1Ea+mOByuv++zf8sa+VY/ooT:th085WabOAqxzkhg0oQ
TLSH
T1BF827C3229789CB65DE29785F94B27178FF8816786CD6E90D5DC6F0D00DB698130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7336fec069fe256a26d39b057df5a6c9bca24a8add0d5ff185367e500fd92ead
MD5 aba0d2ef283db8b3d1d59c83baac313d
SHA1 4243f2589fb0d6915efafc8a1dd6733e0e166df0
SHA512 cc45159fb9a2e015a9b65f601a9e93dcfb3ddb3d32fea85cb8fed8b3cc75252687e09e3523ae0ba166f738e348038875a3c6db04fdb9920d76f8f2067dfc9f5b
SSDEEP 384:JiFiZcIssNw8TUNTUlIlBPr8AlP1Ea+mOByuv++Yf8sa+VY/ooT:gFQspwgD8yWabOAqxYkhg0oQ
TLSH
T168C219F208E78876D9AE4747E77E2E138EBCC057B5856950B3C85A0CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 85a5b3ff6a54590ff47e5326c44cb6a847fbc29adce8d5cc65db38628c027edc
MD5 9a82a54746925286de4013515bd030e8
SHA1 49b26a95410810f1a765cf090c05ea3559828e57
SHA512 800d72264e743a803b1001cc3159d61203be7a729bd38690ce237e4d7ddd402cb69b7593b25699f27a0651613ae5469cfdf96c152cbed1d48cbd73c8219a2f4c
SSDEEP 384:LZcIhsNyBPr8AlE1Ea+mOByuv++zf8sa+VY/ooT:Th/85WabOAqxzkhg0oQ
TLSH
T11A827D3229789C765DE39785F94B27178FF8806786CD6E90D6DC6F0D00DB698130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a71f41971a92df9ae4f6ec8158485e12dcaa96f60b6206223e7baec519c2d71
MD5 15b4a15f53be3279eafae24211b43534
SHA1 f214538dcbafade14b13585f739f9d9845f0df1e
SHA512 cd905f09a9cc666ee9aae194291b092099dcea471e8a1df227c00b59a78daee928f36f6be6cee53f231f9d59f2118e27c49981ada160b4cbe193784416da9a2a
SSDEEP 192:vONx6Db6QmiUy8EHBa+jqOmWtm7RgSIU6:vONx6uiHBa+mOBHDU6
TLSH
T1F102E83969786CB79EB26E49F48727275F95107BD9962F84DAD81F0C00D764C230B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a2ded4129c26e2b066d964d3bc03ca2a703a461252109737c644189f41fdc4a9
MD5 c2222ac596137467a87de06d9215be25
SHA1 2d3fc34af3d46e0c2f0e1712b3e06816494b7729
SHA512 5b40e1956a2823c342b3125f98d6fa454d6d4503e7cea7b0dd9cff23f5c87a66a40ed529caba7546ec0dfdcdad0da38d6cd8c8be19f7a60fb007e0183d909316
SSDEEP 192:nONd6DbYQmiUy8EHBa+jqOmWtmtuv++eNzpqEl8U6:nONd6QEHBa+mOByuv++Cf8U6
TLSH
T12B122B36647C9C775EE26A84F48737179FA9412BDA8A7F91D6DC1F0C00DB65C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b6422066063a557232a658d78e61cf70beff3f9c9b6cb8c98690c00ab1348d84
MD5 02281333d7535488a9dd0476dd95636b
SHA1 a8821bb1d15b9cb56d5b8ce86e7b2bc95e06ce95
SHA512 45717b8bf222ffaa34a2507f17a46b03a4321a23092d4b21260a1cd824356aefd8d0678f6c7afddd352ac93e1e1cc6c273c50b920134bd259d660af56a9f5db7
TLSH
T14FE00103E74020E9C024073101432F255FE3C4390171078B5E31425C3C327407E60680
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 da5b05f79536a3c0e73588b0758e3c564f95b3003e4f73f1fea4c2d2ffe3bb80
MD5 a73269b350c4839d67c1c13b2cd17e67
SHA1 c204f385cdaea24b9257392ce81dd4a331d62bc5
SHA512 b5926ac46ed95bc4c1032a90e67758d05325ba169caaa990748e21ec2222424ec8cd1268fd5dbe9a616df7fccb1ed528a604addebc9a0f59deb2b5c134658f1d
TLSH
T180E00203A74020E9C018033101433F245EE3C43901B1068A5F30425C3C337407E60740
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 39ee1d18d118cea2bd5b99537f60a3a6095930523b589a1db12bd440244a2f8b
MD5 b3376627723e3dd131801fccd5e1217a
SHA1 09aba9b27692244fa617938b91cb08bb74426b7c
SHA512 1e92adbc6c20bc952d20a5576e4d376a5b12ec3fd792ba7aee949be1b50eeaf31d9677c322cf437268b7222d6f056ba0e5715d6bd7d3f31b45bfdbff4bd8a46e
TLSH
T144E00203530020E9C4280331004326241AD3C43401B102895D1042542C137407E60780
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c0ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c0ca.TMP
Size 392B
SHA256 cdccb8d6a55d145bdd27388ab60dc140c60657cfff4a2025bf271ce28b837484
MD5 de5996e461556e0dbbe5226a02cf7b0d
SHA1 f872743854a6dc4d47d6d34fc6afca34b2573aea
SHA512 9b743325d07742ba8575091e0d3178af3ac515bf6729e08686ba3519a8ad345f3134db16133770bb92e0b624c8b7a1c4787de65e73c93dee8874221828338f92
MD5 SHA1 SHA512

Submit Download

62f70d27-5137-450d-bd6c-d9cf64494b06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62f70d27-5137-450d-bd6c-d9cf64494b06.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7222927396f22421a442c81dfd82fa8851b09d4a189b5994e801f00316619d0a
MD5 aa278be4a7347fbba02f831bd5f730a0
SHA1 d8b5759eb38ac2a43148ba444b542b9afb3eada0
SHA512 3b603f9d8c0b5baebb5741094f6675028baa6cb586ce1b9a47959708746111ad42fc983110dcc81fa266055e7d8198c3a512618b9d97c003ce41b8461871e331
TLSH
T153411858A6E91108B3B76E5AABF7A46D487E7D372F0BD49E00010E4F4A72B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download