hxxps://contabilregia[.]com[.]br/wp-content/wp-admin

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 18:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://contabilregia.com.br/wp-content/wp-admin
Sample260910-w7sc1sec28

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	208	758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com	3956	msedge.exe	1
Email address	208	758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com	3956	msedge.exe	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3956	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335388578244800"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{A6D04224-C7B2-47DC-91DB-39ADD4B5D988}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	msedge.exe
772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe
4564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3548	4564	msedge.exe	86
PID 4564 wrote to memory of 1568	4564	msedge.exe	87
PID 4564 wrote to memory of 3956	4564	msedge.exe	88
PID 4564 wrote to memory of 1568	4564	msedge.exe	87
PID 4564 wrote to memory of 1568	4564	msedge.exe	87
PID 4564 wrote to memory of 1248	4564	msedge.exe	89
PID 4564 wrote to memory of 1248	4564	msedge.exe	89
PID 4564 wrote to memory of 3928	4564	msedge.exe	91
PID 4564 wrote to memory of 2428	4564	msedge.exe	92
PID 4564 wrote to memory of 3928	4564	msedge.exe	91
PID 4564 wrote to memory of 3928	4564	msedge.exe	91
PID 4564 wrote to memory of 2428	4564	msedge.exe	92
PID 4564 wrote to memory of 2428	4564	msedge.exe	92
PID 4564 wrote to memory of 684	4564	msedge.exe	93
PID 4564 wrote to memory of 684	4564	msedge.exe	93
PID 4564 wrote to memory of 684	4564	msedge.exe	93
PID 4564 wrote to memory of 3576	4564	msedge.exe	94
PID 4564 wrote to memory of 3576	4564	msedge.exe	94
PID 4564 wrote to memory of 3576	4564	msedge.exe	94
PID 4564 wrote to memory of 3084	4564	msedge.exe	100
PID 4564 wrote to memory of 3084	4564	msedge.exe	100
PID 4564 wrote to memory of 3488	4564	msedge.exe	101
PID 4564 wrote to memory of 3488	4564	msedge.exe	101
PID 4564 wrote to memory of 5044	4564	msedge.exe	103
PID 4564 wrote to memory of 4668	4564	msedge.exe	110
PID 4564 wrote to memory of 4668	4564	msedge.exe	110
PID 4564 wrote to memory of 4668	4564	msedge.exe	110
PID 4564 wrote to memory of 4916	4564	msedge.exe	111
PID 4564 wrote to memory of 4916	4564	msedge.exe	111
PID 4564 wrote to memory of 4916	4564	msedge.exe	111
PID 4564 wrote to memory of 1360	4564	msedge.exe	112
PID 4564 wrote to memory of 1360	4564	msedge.exe	112
PID 4564 wrote to memory of 1360	4564	msedge.exe	112
PID 4564 wrote to memory of 1100	4564	msedge.exe	113
PID 4564 wrote to memory of 1100	4564	msedge.exe	113
PID 4564 wrote to memory of 4940	4564	msedge.exe	115
PID 4564 wrote to memory of 4028	4564	msedge.exe	116
PID 4564 wrote to memory of 1692	4564	msedge.exe	117
PID 4564 wrote to memory of 4028	4564	msedge.exe	118
PID 4564 wrote to memory of 4028	4564	msedge.exe	118
PID 4564 wrote to memory of 4028	4564	msedge.exe	118
PID 4564 wrote to memory of 4924	4564	msedge.exe	120
PID 4564 wrote to memory of 1692	4564	msedge.exe	119
PID 4564 wrote to memory of 4924	4564	msedge.exe	120
PID 4564 wrote to memory of 1692	4564	msedge.exe	119
PID 4564 wrote to memory of 3748	4564	msedge.exe	121
PID 4564 wrote to memory of 3748	4564	msedge.exe	121
PID 4564 wrote to memory of 3748	4564	msedge.exe	121
PID 4564 wrote to memory of 5176	4564	msedge.exe	123
PID 4564 wrote to memory of 5176	4564	msedge.exe	123
PID 4564 wrote to memory of 5176	4564	msedge.exe	123
PID 4564 wrote to memory of 5268	4564	msedge.exe	124
PID 4564 wrote to memory of 5268	4564	msedge.exe	124
PID 4564 wrote to memory of 5268	4564	msedge.exe	124
PID 4564 wrote to memory of 5632	4564	msedge.exe	125
PID 4564 wrote to memory of 5632	4564	msedge.exe	125
PID 4564 wrote to memory of 5632	4564	msedge.exe	125
PID 4564 wrote to memory of 3824	4564	msedge.exe	126
PID 4564 wrote to memory of 3824	4564	msedge.exe	126
PID 4564 wrote to memory of 3824	4564	msedge.exe	126
PID 4564 wrote to memory of 5376	4564	msedge.exe	127
PID 4564 wrote to memory of 5376	4564	msedge.exe	127
PID 4564 wrote to memory of 5376	4564	msedge.exe	127
PID 4564 wrote to memory of 5496	4564	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://contabilregia.com.br/wp-content/wp-admin
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc880c188,0x7ffdc880c194,0x7ffdc880c1a0
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7616059270474118622,3878243261223986148,262144 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=2008 /prefetch:2
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2164,i,17831911021196612964,393179648218330303,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,10306231436438704707,15617539716104519929,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4112392300280795452,6364171586629748844,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3284,i,1351211374478204508,5092235036716797194,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4112,i,2407801591916225309,17946881074831909640,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,12733230368619138626,1936060423348920089,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,1869940114472178826,5825850130283384303,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,1733650299166973348,6999682059903148602,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17907192604438976037,7865506042953215662,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17907192604438976037,7865506042953215662,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6232,i,17475411439357836361,16265407610495133064,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5892,i,7106099399347725044,14924006080000743045,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3720,i,11177524466906389040,749758229796434918,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,15485148011513013685,10010469397289001542,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,4572640792778779220,10963249877958786489,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6732,i,6439902939974975229,9525067386145450873,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,12209632553259729363,1187977139406252205,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6492,i,3453495756979802043,11493015029530146351,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,15623539893775161048,8546859505888652215,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,2685555353796022070,5771135277438098146,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6940 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5164,i,6112355572065040315,9422280441562163342,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6744,i,17490897948891801654,15353962648288270942,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6472,i,11553988169458636575,6813970242688128994,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7196,i,7868279337099855043,15289015606414777704,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7564,i,11048136805999252836,7183906826777254635,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7620 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7624,i,10816774618155671220,16090135472923398197,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7576 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,7677136980614860457,16704982519786871974,524288 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7628,i,7007248557339480417,4351663735333222695,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7760,i,17348242568447742585,10344957474383480947,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=7836 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=4768,i,1936059988124344205,10466266916086757228,2097152 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5424,i,836276046344560035,14344806187009619934,262144 --field-trial-handle=2012,i,10765926005818313948,1618567294842540900,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 346KB
SHA256 06fb30c34e3d7cb64ec821dd7d1eee69613b4a84c3841c081dee7143c151555e
MD5 e4bc0d7ecc0b43b6b8bd71ed0d8e894a
SHA1 27776f4cfd2ff01e98221769cb4aa554a2670e6a
SHA512 4c0956fb89b264ceb8dcc20a8cf905a4ae784195e78c306d2c0577d2e4c0548b6058ecda0516a089dc97570864728ab60503bffd804af5d0934e5f9c8b1fa475
SSDEEP 6144:ZPNyy2q1x/xjj1YO1RKSXVSFAsamiA6r/dsaRDDQ9fSoA9pT1c/i:qy2qhGORKNARmiRRDkJIpv
TLSH
T1EB7423DE4C0A0C9960EAE1034BDF477B3A4A44E7E0C5EC52987C1DD26D9F2627CED688
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 8KB
SHA256 2510891b46587bb5bf199144c9606b4e047125e616a6cf3128b9b31dacde547b
MD5 a53d1c22b63d354eb1d3cc3558ad9e32
SHA1 7c57032e0421b140ee20897b6009d5a34ec52596
SHA512 b84cd286947c4b473f838db775de7b03558878d719535105023ad7516872ab8ae9996e8534a27aa60be200fb4297e75188ec43eb6acafbc69f6db0ae3221efcc
SSDEEP 96:uSZ5kVHQXv0SFXx4FYikBVZZY8KPoFfG8e+mz3SMzeKepgO28fwWbhYRMwoNQ5iF:PMw8SFuFYLTc9cs7fgWxRRoO5iqZ149
TLSH
T1D602B88A07D2A238EF6FE5B0F1D78A933F7C484721A38FA3114CCD7D294A781AE15614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f17594f64e48b9b15b1642990c1b58672eafd69a0003d55e28c5d3ec99f76b52
MD5 1877c4fe7f594d243990dd082f6b3251
SHA1 cc4df45a01eed6388c6131156e0362690bb496e7
SHA512 c8a4d399d8f248f40b32052b82bf0a8719c505c07185d593347b892b106dc7ea68f99617717f6edb8dc899b37d67782b9dbdcd93e77fda391ee96721ce2624e4
TLSH
T13F613B850B62F46AEBEB31B0F0DA03077D31809A06775FD6028C8D7D590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a7b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a7b5.TMP
Size 3KB
SHA256 5f211d6b15b524887940e71079e46816ba3715b3a00df5af28ff3fcd398dbe52
MD5 262c68eebad206a6d158740567fc8ef9
SHA1 eb58e3140096dd3ec71a743dcb0fcf0c6f2da96a
SHA512 b591bdcf8ff0ed74831807f9b043796cb35bc3bf1d7b62411ba98a79dab7f74e5088e0e5bdeacf8389c4c3fe01833fb63c4295eab37b25b542e565fb1e2291fa
TLSH
T1E9613B854B62F469EBEB31B0F0DA03077D31809A06775FD6028C8DBD590DB15FD657A8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\000003.log
Size 34KB
SHA256 8ff7b524c619e363957ec5cac08e5608518cde000976ac4df0bbc4c55e8de521
MD5 582fd0b5b24050b0bc2e917ff4ead49f
SHA1 aa42f22fdcb4f53b7e9161268b940c5e3ca30a68
SHA512 3ebefad2b751fa40e39088fad89b5613ed33241aef43049cd0b3ab4f495c6e4f154173b3c7c4d4b94827088f00b89ecff18823222fd503615a284f0cf6c00020
SSDEEP 768:euC6D3Pu/t88bNMmznPZcWO9pzM5afDGNK+dOiG4msrv/DIVdUMaToTBhw1JfK:FD3PKt88bNMmznPZcWO9pzM5afDGNK+y
TLSH
T142F20F4566FA4755F2F78D3C792626C598377AAABC00CB6C9170768E44B9E10CDB0F23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.virustotal.com_0.indexeddb.leveldb\LOG
Size 357B
SHA256 c25c5ac7180bb86d430f2b5f5732e00e7561eb562ace104a589db2b0a43e827d
MD5 d97f9bf2ef36e87510c03e094628d4a6
SHA1 6e23e206531890f127cf17103593eedb6be46abf
SHA512 914612d844d2b7f5716277723f3f6a697686ac71571fa08a3f8054fe316239c7b8780a47d6b39f12c6f74a69a7c3a87a23a7c730d0bca75cde0d0a5efb6bc9c5
TLSH
T1CCE0687884DAD12F526012D305B8FF0AD7A7261FE78DAE414F80CC6070C604CA43D251
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 ce30b8f106307baa6acd8b2956b4a59a7b55081ebe196ebc732be3ca26c8a8b7
MD5 5b7c116f9e9d9d3c52d85308d853e214
SHA1 ce01983c1848c1b19dbc1ec4ec264887761e3809
SHA512 eb1778678b5945da7211372811ff31e81a83f6df7ff35933e5a25b798a6b2a95c9ff64a8ad80f3fb388c88628e777269673213a27d10e0713dacee5c88f16e3b
SSDEEP 384:Dww7yCuWtF2vc3GxBE712yiMahVu38jGk75TNta+mG3zqM4BtJEHSTuVtk0Sd26X:0rWrX
TLSH
T1DE429EF3C3D4862DC81166F59F283E1BCD29096463683D17C9DCEE4BA3E64B2E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 8671fa2334e43e0a9b474127018e61c5bbc64b200e73dc9384559c7ff6673e44
MD5 9ced7053c1b9da629b9335efe47b39d1
SHA1 45d52971fb798cb8312b717518e8cdbcebe304d6
SHA512 5e7916ac9f2563516ab597b42260ac898e721c87f05849738eff4273c9f1c39080fb7a4f0dcb607d4284c2a06d1ea374b06fbf01fae9b5c674ea42ade4692f01
SSDEEP 384:Dww7yCuWtF2vc3GxBEPLPdpXJDY12yiMahVu9jG75TNta+mG3zqM4BtJEHSTuVtU:JpfhWrp
TLSH
T1185280F3C3D4872DC81176F55F283D1BCD29096462683D16C9ECEE8BA3E64B2E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 99a7824463fccefb83fcb967b1d1434de9a682d56a391b8de27adc970263ed7d
MD5 3d0941eef56707bb3dc8bded1b241d8a
SHA1 9202970b6e1abe6bd765c5adbf61325f47721106
SHA512 f3ef65ac06d29330d8853f7942351ab78e2cbc80ef8a274c3eb894fd586b1e4462d7f44c54201be22f57a882f74f4520bc63a9b943aa91b9f9868c2ee9a1b872
TLSH
T1B5D0235336017279555D7FC1545BAC8FC72710304C42DDD510D49859053246C453B140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe5919e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe5919e7.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6be298e921d758af1dbb3a74f5506f1f2dea16e72f735371d796fcfce8c1a8e9
MD5 b070ab404c2395a7facd6cbfa13ad837
SHA1 c25eb82d441b663f9bcd03b91e51aa94564c65fc
SHA512 c20f0475d6174790e2322a2644e22cc577323b9d70824ca8dd9ca1a30bc06d1df2ec51bb2676495a3480a0d3a8f2fc09f89f07897843d9683be714f7f487a9a1
SSDEEP 192:sxZcR+yM/jK1Ml8MW2/fisNRIdpJHW6+WNGYw8aDJIgrJ:sxZcku2/fisNaJHbG79
TLSH
T1634209016B34A97BCCDFD209FA517F53D6F94472A2940E44A9FCCA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 b20ff76db99afd3b347cbf3eb83e8230fcd10de97cced4ba6c57a302d9d998b5
MD5 8a9ab136602a516c1209b03260c9fd38
SHA1 b7645970dc21e33038350c9445f9bf4fee90dca8
SHA512 b21e5a96d7f16dedd2432211de7c26803bf30456ec8132bf6c2d5924e0c73fcc936b9fff9a7b3b66e0b8ead10fbce7c9421671ba9e8d755d4831aaaad25cacee
SSDEEP 192:sxZeR+yM/jK1Ml8UQTucBW2/fisNbGbX0ddpOEC7pmA3HW6+WNgR9aHDb10Yg/YJ:sxZeUqCmW2/fisNb+uEhHbtdk/FwY8
TLSH
T16592094265209D77CDDBC219FD61BF52D6F94463DA844E8CA9FCCA1C04E6AFD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4e77505680fbf15c5ff22cf47a930f15a3f2842d1ae7c4013a48ea2878719b1b
MD5 a08c76d4165648d3f02e6fad88cf6903
SHA1 9a4e445ed85f53c3bc3ee705e4c3df7d5e483afc
SHA512 dd0092ed671e4a9693e4d4d93a5b694e11389971b9f4510cf904a0dcf24e06f779ae71fe5e799d8eab9dbcc55f785816696d49b221d25b8f0e73a52ae2a18a7c
SSDEEP 192:sxZfcR+yM/jK1Ml8MucBW2/fisNZbXB5ddpmAlKmqHW6+WNgR9aHDb1/YwMADJIX:sxZ0UWmW2/fisNF5YFHbtd/vsY8
TLSH
T17D82F94166209A77CDDFC609FD317F52D6F944739A944D8CA9FCCA0C04EA6ED221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 d330be6485f76e9f38a74e121b82900f8a7b9ac0c7b98ff54d752491e4ea53f7
MD5 d8f3e6d95f224185b0a51a112bae50c9
SHA1 1762922224dca741ec1f87d9b88a9b34c95c3854
SHA512 63a3cb83850bb051f9bf98b234f9d618893d131d0e185152f8bda5335d031bca6ba6aeb8693763ddb080d6c0edf3cb998be5f6a3b32bac2eafb5bc0dc48835dd
SSDEEP 192:sxZeR+yM/jK1Ml8MucBW2/fisN+GbX0ddpUEC7pmS+HW6+WNgR9aHDb1/YwMADJC:sxZeUWmW2/fisN++uCiHbtd/vsY8
TLSH
T1A082094265209D77CDDBC619FD21BF52D6F94463DA944E8CA9FCCA0C04E6AFD221381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9a0b91ae958e970cdd86aff9ca06a862caa0f51892e4747d8c2bea841fc36f37
MD5 c4403dbc0632c77544bbf8612269940a
SHA1 129e943d5dc01ce039d3f578b6b7fa32cd0249e6
SHA512 4ae48b0fafd8c3e372e00e8b3369d9d5d020bf6e5ccba097b5da8298a3068c2da3b984ac0d249685970e175afb9c1cca3941cf73346b5cfe9ba17148ce44a17c
SSDEEP 768:1u4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+darohTcRa0:1u4jeXmWvmKLEu1jacPLZQdRKR
TLSH
T117D2093B280CCF7E4F844E5CED26AE976ED801CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\5c43a047-8cf3-40c7-975e-9da73172ae98\index-dir\the-real-index
Size 408B
SHA256 fd464c9042448effc5ba502445b2c8f5ef719563930b3556a9721ea73aafadd7
MD5 6371266fb2b12293d14cb2d34d15f4a8
SHA1 a1f68e6506b687e9187222e715dd616689533541
SHA512 0ca4a1a432b510625f2691a6f3a4e2821d8178a676b708113ea714d217cc445200c59b556bc9e8e6461cac8e452a36ae9e059531719abaa0dde325d97576aca9
TLSH
T1B7E02B3AEBA203A2DA81427894D92191373F10EABD61528558C4B0ABFD10A381D8776C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\5c43a047-8cf3-40c7-975e-9da73172ae98\index-dir\the-real-index~RFe598757.TMP
Size 48B
SHA256 0cb38125b62fd27c0b56b7f6302f03a756314b629859a8a884a323ead8d13410
MD5 809b9a5cdaa81583c6737f38bab95764
SHA1 619417b3ff3bcd446de77d73c5c78897fcd79a1e
SHA512 1a2f333a9510718f41319f53606e9d15a69c1deba49e27ee2ec1b221aa53bbda5c1cd53643dd3046d923bb7377bbff5d21b8b39f95b5586eb85b50a33fff6533
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt
Size 147B
SHA256 124e7717374b49c781dc4a9ee9b97b58d9510e3bb6746aed79d45508236ed2db
MD5 e5646fd9c1a52fae29fd56d60a031a43
SHA1 3f2ca6c8d50b521bb6992de23e596c797e8e4b62
SHA512 2cc32c203fcf6de18407af2f8674d475a315dee19194c9dbc9e80b08d2ff76f75cd0c00fcf3d8e04cc8d6303eead7135ce133f1756175cb6100d53ca46b999ef
TLSH
T173C08CE34054A8140F60A9C112A4D224C6130069F8CAA9CCC051E0D0408052F1831A03
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe598776.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\198b1dbef7ece2ad03770a72810f2b485859f245\index.txt~RFe598776.TMP
Size 152B
SHA256 907ca08261646b94ef67b50dfc99aefed2f227ce11aa907c58005092cc3bb769
MD5 84c6e56358c82af54afa6672bf7e7218
SHA1 d8cd149771b4c4011e13df3648e9a9580f7147ae
SHA512 345eef6365e6f64fc65c7d02fb6b67d76f75d08a9ed1ef9d320454ebce0b10b8361cdc3aacb23507c69af5db24b6a0d46b483b868e5030e7c30814fb3fb773e5
TLSH
T10FC08CE3506464100F50A8C202B4C224C6230EA9F8CAA9CCC052F0D100B052B1931A03
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 78388dff6ae06ad0ceb8fa731ce6b3a9656359eeb8106074bee4115187f461e7
MD5 8141c47737575808723d7ead5916e0a9
SHA1 281ca655d53237f3c54c15b7b91543b21d6eebe0
SHA512 251c89848c054ee497d71c14f7a2f3f168ed16405837415ee630d075a771044d7de2a43e000a98c7c9f6bf5a995422b38f84fdd798c2cade9539cd680ef87a74
TLSH
T16051C54F4E236FABDD9C11B114B51485B338A5CC5388AA2BE0FCC135F8C77242869AA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59355e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe59355e.TMP
Size 1KB
SHA256 640448f87b0c327bdb5a05946a47461130a1c672730e754a0adb39523c5040f9
MD5 eb25169e89551c21fac99ea5cced9414
SHA1 3fbcd7bc9055110f149b960c26252ae0219903db
SHA512 fb2611c503ce00c4db257e9a1a5b470700e44713a9e1adf4dfd468eaee2c7aa5c9483388040422cdb9be220968981a51a8bbc784899ad2641ab2f383374d0529
TLSH
T10341874A4D94891AE88440770AA7A4B8333598404322B783A4BC5179ADA2BAE1E4E0D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3c00c727-a42d-4dda-8781-27462a00dc28\index-dir\the-real-index
Size 72B
SHA256 9aa46e4d33c92b0d07b1e2501ef29ad3faa74c54ce7061d6ae53f5a9079d335f
MD5 dd997a8fb8bdc87feb1a2c90c0aec150
SHA1 ee8a05506bd5243925719f5e563ec18bd9196055
SHA512 53bdf7f2ace1afd3fb97183c40bfce58fa3b48ee37506d2a3d88da3b37fd0985c3bceedea64ebf0a56800d76e38b313c80fd61a542bade83057610aca31e8233
TLSH
T1C6A00238415CB463D00006B055424158A314DD7151058317A0A18A59DEB117F59C21A3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ae0abac-9a6f-4918-bef8-404e3e716d8c\index-dir\the-real-index
Size 72B
SHA256 c46105612aced9ca46cb5a0ac4c3a418c419a1c42e8ca432e931f97e933e23ab
MD5 bcd9598fd89e4042aa0114be625f1638
SHA1 998449e12973c47db0906d73ff6971ce04fb46f9
SHA512 371bc4e63a05cbb2c50b453c83b9833031c48e4f3b44a1815328a3e98987f61fd9f9c6e612df7b29d6fa53f31e2903941bfae0f8a0b350cfe457098dffe3ebaa
TLSH
T188A0023901800176C9C10B7091835177F3395A7443060B2B8790E8698CAA6A1E30E840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5967f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ae0abac-9a6f-4918-bef8-404e3e716d8c\index-dir\the-real-index~RFe5967f7.TMP
Size 48B
SHA256 7c2698c2b2a2db93282b1f0a0c0fd85c5a672513187af8686564359a4967de6d
MD5 175360ef117320147c7c7c73f32a180c
SHA1 966bdf4d433b83672e5d9c67b498624d2e16efc3
SHA512 b37bf4947bb3e038c7e4a1d1610896b171e3848ad4a3c2d7ec43dc4242a6fb198db340edbf426b9978e438c9875d97fab4421f85bc5fccdcfac9698d2b5646a8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 7df19a9c2997c7c5383e718c4117227b1e78c7aca6152bb1f64b78cc446073d3
MD5 482857b4641bccaafdef1f7d9a9e993a
SHA1 44b71019c3cc534b0a462298000f05b2778e9135
SHA512 1324edfdb5510f450af6de4f64e3973ec828a4835456eb475768fa47b52ef76ca3b435f6ec3d3fe6b9b6ae17eeea3730e8044f6429d4e6fdef93366659ff6872
TLSH
T148A0022402E12035C063DAB6399611512358D9100202131781D95644CE50995AE4961E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591a25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index~RFe591a25.TMP
Size 72B
SHA256 0869c00df960f8d49776a8a2809ba80c39f3bdea4599d7affcce4eb2ace76e63
MD5 ff1eb890d6bf555b3a000cf723616693
SHA1 d4b35e6526bf4552cfd28f30192c4e390fe02daf
SHA512 d13f90640862a0a4356dffe078a359433c704ee4d73c9951047dc9c36738a7587c4e6dc27486501f4e22ce3a21ce9439d15686b34e8c31922495c10dff8f4a79
TLSH
T1CBA0021043801405D9A311B9255242C11B01DA111240930740D5004ADC578C09D5348C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d9cf0c5-10fc-4835-8d54-2c97235af179\index-dir\the-real-index
Size 96B
SHA256 e9108d33213fa1fcbd46f158d67c885010775a6cfb94162a9acee9aad70c7ffb
MD5 bd5190911da4f67f52eed26705a4c2ec
SHA1 49582cbbdc74b4b66d0089699b81872fa7fecef1
SHA512 fab9096233900feb1253eb3f56f3039f01fc17b4c9333deb8a7d35ed904fbd7fd10d69fedbaad22797ea7e6f8a1cbca5954d2c1806576c64935567c95570604f
TLSH
T119B002597141557BD953D7BC54CB555672625C515705375391D0947D95113A14902004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5967f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8d9cf0c5-10fc-4835-8d54-2c97235af179\index-dir\the-real-index~RFe5967f7.TMP
Size 48B
SHA256 34d54f46aace85e16661b6c5aa85d95787ca427f81406fadd75a9029ae74ca91
MD5 9248be7f2910d99193c36100b062ffa8
SHA1 c50846d83c640b41ef5053eafbc9325cf146c648
SHA512 3157d4843a61ca3fe977fafd4237104bb32bc27c55b9db413555da277b4d7662ba546bd393aea5896898254c6917b641e1358a3b482b07e4eb1d4d8b1e29d511
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 519B
SHA256 5bf383426bc442b527342076f5de80dfe90cc5d3c54ce45b8f7f2da1b7830680
MD5 3d9b78f0920764623584e1e5ab410a38
SHA1 0179a4ec7ae774faf4ef917feb27eec7773636d6
SHA512 f813112763530e4d06b36a92bb93b2f06b851b67a71bbd141e6787bfb28cf254ade0ad709dbb0e431577e7308b084a0a8b5571b5039be9393a0a837d5a750451
TLSH
T15BF059F22EE72A10BD7E47E6247108A8801ABD198944EC4E2406F1E710B23642069C31
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 c30d5c9a4f428c68d8835ab823e7f0eaf0efab13bc3abeec7db6344875faa24b
MD5 2bc1bb2b664867cce51f918975cb20a9
SHA1 47b33a4464013ef9420cd8daa635db077b4febfe
SHA512 ed3dd9c20e4c345cd5b52a939e8b770fa6e6abd6694567ad02c0708ef8c48786c53368c157aba446e7992fc5ff9dd7bed7c882a391c46553ee17e27398adca1d
TLSH
T112F028F22EF72D10BCBF83EA247104A8401ABC598555ED4E2416F1E790B2324146AC71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 619B
SHA256 d955ffb9333904b51637a4c1c18ca6de02aecf1c0d7094d1aea7d9e16d83fd0e
MD5 c433214c019f1abc6f2f5d244685585e
SHA1 d17992b073e49c9f6a0c5b5df6a9970773d4437b
SHA512 0f5fc88447403fa4febf8c5f9c59acb14d946a3769ff59c07b1323d228af473cac5d48f88d12f56b486605fd1dee949185809c1050e08ce48facc23f8e88099e
TLSH
T148F04CF22FF73D10BCBF83E5247108B8401AB85E8554FD4F241AE1E750B2368606AC72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 2ae79cd2a659ed3e9c0b35b0da55e11e656191459f82a7f149e004bbd1a0f372
MD5 28b23ffd2ba5f87717f663391f8b5c90
SHA1 40ff674ac1fff6c2eaccc7a6e4b40af700a03d9c
SHA512 edfaf2ff89c8e986eda63796089605d80f4fc8376f08e5e627e1fb492ec30580b0b1106f3d93c8523e951514d0b6ce63b029a4663e66e9c4f7281788843d267c
TLSH
T10FB02208080AA0CBC0FC033880A228AA333CBC200F0A300283FCC030C328B02A28B0C3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594e84.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594e84.TMP
Size 48B
SHA256 e890d6f46336507d264dfa34a7b5f5d1e6ca708391de925e31eccc08324bef79
MD5 2c72ed578f29b47db4deb82ea91cd1e6
SHA1 3f136cfbabe0dc747140653c8af007f3bcc18d84
SHA512 fefd85535775f39e217a868efa4de4ca0954044557a5d6b572f2264dbd4fd31ea4641f32a85a3f2601621b63cf07c0dd421e810dca89d1faeeab32e9c4fd3ba4
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 97b2c943df502d3ce1198a76cba4ea80d6532107fd47cfe1c4f2845d98693d7e
MD5 f29949e49f03be898fdfb740e687e627
SHA1 17b884a6e141ee7d6c1be899a38e8dde2da31e02
SHA512 9192bbfaa532991c925233398d4fb41cde2cd79ed3244091f58fd3810981931d1ba806d390e90596a6566f8a6ca9ac4adb0c76f44e04a9c16c6f67b2df251a15
SSDEEP 48:KMiNMA60EFT4P4IGYFKB0ZKFFCVgn4k+ydbIlKEcAodwZNTnrk7nmPImFkKBB5LX:KQpqKikaubaKEcrKEKP62uZs
TLSH
T1A0A13115337F52127C7E290C97A4DB1B668272633018E62B37A810764EA7F298DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5943c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5943c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 90d1fc504ea0f2670bd0c1ec63a409acda497fc8e2fba40e62377bd253e4287f
MD5 7ed503e01515dfd2d76e329308be0347
SHA1 9cb832bd86800153dbfa223a8aa3d92c4fd3cf73
SHA512 8cc63f803ad08b5fd145810f6e6f6ea6d78e05f018e6bfab500f22f195cf4d3d66e14bc5f4aca738981f4bc01e957ed2e80e112aca95739a9871c096b27412bd
SSDEEP 384:BZcIhsNzZHT0oLPq/f++OWYXN+2QFRsa+VYBWoz:Jh3xXHOVNl+RhgOWw
TLSH
T13E827D326C789C765DE7A381F84732174EF89067A6C9AFC8D1DC6F1D04DA6AC130AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bfc8f9319bcd6c81aea3a1b0a819ebcb75ca2ce64d2ce0f158cbbe17e2671cc0
MD5 8657ba09c62afd1e191ccb3b8f1fbc88
SHA1 45973d735b3439d0cba8de80b4cafbcd8f9ca280
SHA512 6f83aef163fdd44eee4f894236d2b3bfc446bb19c8b2f7ad900fba73033f97b1122c0be72a487822a0d7fbb86172d2a18c911aef2230e01bda1fe221ef56b69f
SSDEEP 384:CiFiZcI9sNN8TUNTUlIl0TxT0oLsvz7f++OWYXN+2VFRsa+VYBWoz:JFQ9IwgTRrHOVNlPRhgOWw
TLSH
T17AC22AF258D78876D9AE9743E77E2E024EBCC067B5849A94B3885A0CCC961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2097967ad1a8c7bf48b55ca79a2bba154d3fa302a3178be2d4c0b2ceed083cf
MD5 37d2f7cb15dccd921511c9f7268b78b7
SHA1 ec8c006cc76a851fe34220bc57608ad238189ac5
SHA512 0682799530e262e6c42bc66bd4db7d4b0d2cc5b3e8f02fa382d22931720fdf2454903f14adf7bf0f4aeb95212fd6f1a9af3ce34a1b4cdc21cf924af41b750a8b
SSDEEP 192:EON06hZ0QmiUylepc/+jV4O1cYa5wOZ5pU6:EON06ojpu++OWYh2zU6
TLSH
T17402E83568686C778EE2AE45F48777235FE8112BA9956FC4EAE81B1D00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6a9ff983c4f03e7d389b42836732d3a5f4562db0642afa60f8bed87c0bafd3db
MD5 48396d4b0a6372bcdfd5ca75fc4dc9f1
SHA1 3eba9a43b30d9c8bc5c44d3099d7d9a461e97ba1
SHA512 48e11dae9b660a26c138706821a97960d186e9e44604713ce5113ee3e06b4e40da4e7e9a897207e0d07b3e0594b3afed524153aa715ce08f98943a9b6090a4d7
SSDEEP 384:YZcIhsNz0TxT0oLsvoA2f++OWYXN+2QFRsa+VYBWoz:mhEGAmHOVNl+RhgOWw
TLSH
T127827C326C749D765CE7A381F84736174EF89067A6C8AFC891DC6F1D04DA7AC230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 023baaa4d11a1258e7db05b82b6f7914ad0d877a54613bc5e55a5ab63b8416aa
MD5 ffc54b568bafb585875771816039ca16
SHA1 a5cfbf1e5c5133a025a741a22c316a38a51d1ecf
SHA512 5dd4a3588417442fe177b9f0f7784dac9a2117a803cb593b3c45e6d4f3f53c9808b1159a3f6eec8dcf6458ab6b95091046f3a68eb1e6e52176751fd2b86e0075
SSDEEP 192:EONu6hZGQmiUyCedc/+jV4O1cYXN+2W5cOqUqHU6:EONu6eidu++OWYXN+2Z9RU6
TLSH
T11A121A326868AC374DE2A651F48732538EE5512BEAC97FC5E6DC2F1C04DB6AC234A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 df6da1f756f8977a78c4522ece14586e4eb69c2d7f53a017121b24449451ff28
MD5 f2e604aff86ad2f29fa2a24dc441bc89
SHA1 4731a2a9a2d4be22e9e09f7dfbced8eebc01ab52
SHA512 7f5dfd363057a0b83142f7986e55b0c352bed7abde2d95da50b64fd33cf64478806d9d63d6bc93041ca2d2120bdc5f474834733e592dcf6de11c73b03e54999f
TLSH
T127E00126130010BEC53D233106A367301BE2C12112F20387592001780C633412F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 78c00c75b5723b60e7741b2914faade522ae653dde53a0e12667c766be0b7d6b
MD5 d620694df0da67c6a18425914ca3fb36
SHA1 bdfe44a7e5a9ddb9b47e02bfafeba4e962feeac2
SHA512 7e7a193f732004fcaf4cc950d630605d120e2203164c6a0a7633847ceaf7a73f5742e6099d913974a147d81f7843fbeaab3fa113f7b876d959e151f640c45f45
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2261ee3d08202ad7c73930e3968e031de4f23f0bd68ee3474b4371c38bbd6afc
MD5 5f74f57ffd2cabe1a46b0557b35b2af8
SHA1 f1e948028a93cedd0fcb3203684cca7e7be2f9b1
SHA512 719a51506b3c48f3d3959a973c8b553b8af709dc0fbb828bd0fca8c3671625155c5291a9b18ca175692f5f4d51992a81bde5025063fe28027cf18334b259c268
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f793f8919aa9d707ddbcb1683314b7d62ee25a46ece88eb81d5da87422a181b8
MD5 4cb762a649a84f917e31028df0b9989f
SHA1 70cc371f78f9ead8ea6495e4443e2c93eb4424ba
SHA512 7b02111dd9768f83d300f06c21bab66255a9bf0033700913b66f207ec86fa17d1632d49f539d7ed1f842ae5f978090a16f199b00227e3e3965725e822d4932e0
MD5 SHA1 SHA512

Submit Download

9868e154-f9c2-42c4-9ba7-3112fcbc94f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9868e154-f9c2-42c4-9ba7-3112fcbc94f9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6d867fdad2650ac4f5bcb5d1ecfa5b92e3e9521479f19f562d134d5be0245cc8
MD5 f1f48be00e8c82d0019b55e14cba34e3
SHA1 c2b95df3c24b893d4ed3f93873b62f6783c9cdcb
SHA512 bf980d7f5378605eef944e3cd7252f75f831849ca4377ec14a0e4c34b9ec6f0c0241e0fcba4f9fa3368de0bd8c4814a26e942b6d3a4291ed46877702da0f4248
TLSH
T18141F658B6FD1108B3B76F0AAFF6A86E487FBD672E4AD45D00110E4E0626A40DC71B37
MD5 SHA1 SHA512 TLSH

Submit Download