hxxp://twitter[.]com/1/statuses/2098070222187921821

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://twitter.com/1/statuses/2098070222187921821
Sample260910-x8s7davdpg

Score

3^/10

discovery persistence

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4500	msedge.exe

Checks processor information in registry 2 TTPs 16 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335423263701034"	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{0CA0A5D6-EE79-4BBB-A8C7-EEB022173AB5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7084C8DB-2D07-4234-89AF-EB1D43A0578E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5144	msedge.exe
5144	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4336	firefox.exe
Token: SeDebugPrivilege	4336	firefox.exe

Suspicious use of FindShellTrayWindow 41 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe
4336	firefox.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe
5080	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4336	firefox.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4588	5080	msedge.exe	84
PID 5080 wrote to memory of 4500	5080	msedge.exe	85
PID 5080 wrote to memory of 1704	5080	msedge.exe	86
PID 5080 wrote to memory of 1704	5080	msedge.exe	86
PID 5080 wrote to memory of 1704	5080	msedge.exe	86
PID 5080 wrote to memory of 4392	5080	msedge.exe	87
PID 5080 wrote to memory of 4392	5080	msedge.exe	87
PID 5080 wrote to memory of 2096	5080	msedge.exe	90
PID 5080 wrote to memory of 2096	5080	msedge.exe	90
PID 5080 wrote to memory of 2524	5080	msedge.exe	89
PID 5080 wrote to memory of 2096	5080	msedge.exe	90
PID 5080 wrote to memory of 2524	5080	msedge.exe	89
PID 5080 wrote to memory of 2524	5080	msedge.exe	89
PID 5080 wrote to memory of 4660	5080	msedge.exe	91
PID 5080 wrote to memory of 4660	5080	msedge.exe	91
PID 5080 wrote to memory of 4660	5080	msedge.exe	91
PID 5080 wrote to memory of 2400	5080	msedge.exe	92
PID 5080 wrote to memory of 2400	5080	msedge.exe	92
PID 5080 wrote to memory of 2400	5080	msedge.exe	92
PID 5080 wrote to memory of 2208	5080	msedge.exe	96
PID 5080 wrote to memory of 2208	5080	msedge.exe	96
PID 5080 wrote to memory of 2208	5080	msedge.exe	96
PID 5080 wrote to memory of 2320	5080	msedge.exe	97
PID 5080 wrote to memory of 3384	5080	msedge.exe	98
PID 5080 wrote to memory of 2320	5080	msedge.exe	97
PID 5080 wrote to memory of 3384	5080	msedge.exe	98
PID 5080 wrote to memory of 4712	5080	msedge.exe	100
PID 5080 wrote to memory of 2536	5080	msedge.exe	101
PID 5080 wrote to memory of 4032	5080	msedge.exe	102
PID 5080 wrote to memory of 2536	5080	msedge.exe	101
PID 5080 wrote to memory of 4440	5080	msedge.exe	103
PID 5080 wrote to memory of 4440	5080	msedge.exe	103
PID 5080 wrote to memory of 4440	5080	msedge.exe	103
PID 5080 wrote to memory of 5412	5080	msedge.exe	112
PID 5080 wrote to memory of 5412	5080	msedge.exe	112
PID 5080 wrote to memory of 5412	5080	msedge.exe	112
PID 5080 wrote to memory of 2400	5080	msedge.exe	114
PID 5080 wrote to memory of 1720	5080	msedge.exe	115
PID 5080 wrote to memory of 5332	5080	msedge.exe	116
PID 5080 wrote to memory of 5884	5080	msedge.exe	117
PID 5080 wrote to memory of 5884	5080	msedge.exe	117
PID 5080 wrote to memory of 316	5080	msedge.exe	119
PID 5080 wrote to memory of 316	5080	msedge.exe	119
PID 5080 wrote to memory of 5144	5080	msedge.exe	121
PID 5696 wrote to memory of 4336	5696	firefox.exe	124
PID 5696 wrote to memory of 4336	5696	firefox.exe	124
PID 4336 wrote to memory of 2892	4336	firefox.exe	125
PID 4336 wrote to memory of 2892	4336	firefox.exe	125
PID 4336 wrote to memory of 2892	4336	firefox.exe	125
PID 4336 wrote to memory of 5304	4336	firefox.exe	126
PID 4336 wrote to memory of 5304	4336	firefox.exe	126
PID 4336 wrote to memory of 5304	4336	firefox.exe	126
PID 4336 wrote to memory of 5304	4336	firefox.exe	126
PID 4336 wrote to memory of 4436	4336	firefox.exe	127
PID 4336 wrote to memory of 4436	4336	firefox.exe	127
PID 4336 wrote to memory of 4436	4336	firefox.exe	127
PID 4336 wrote to memory of 4436	4336	firefox.exe	127
PID 4336 wrote to memory of 4724	4336	firefox.exe	128
PID 4336 wrote to memory of 4724	4336	firefox.exe	128
PID 4336 wrote to memory of 4724	4336	firefox.exe	128
PID 4336 wrote to memory of 2080	4336	firefox.exe	129
PID 4336 wrote to memory of 2080	4336	firefox.exe	129
PID 4336 wrote to memory of 2080	4336	firefox.exe	129
PID 4336 wrote to memory of 2080	4336	firefox.exe	129

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://twitter.com/1/statuses/2098070222187921821
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffe8ea5c188,0x7ffe8ea5c194,0x7ffe8ea5c1a0
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,12033159581036742425,8443613262177835329,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,1900508870084986297,7050912215711260336,262144 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,10646910369382439674,4155939994681825775,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,2582389235937652797,14873431364048763463,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,12318689115544180350,458208310730420866,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5854061421830532819,4836764404315431876,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,3173985511521475672,14496383057277018170,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4940,i,8156448889798012633,11251368087681685515,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18270441800656784028,14796343559723032952,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,13895869501778735095,6038720000901852568,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3837621330243306899,9191476868717297001,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,3837621330243306899,9191476868717297001,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16967158797210675447,18000648748240039356,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,7558824451803432310,489705145739727993,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6672,i,9433049527350277979,7580428444947545996,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4292,i,16340019769546678690,11622334363457726014,2097152 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,8032727627232358093,7735718066771911999,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6964,i,6000335419315647701,5637662118608394457,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6968,i,6433831485416894802,593627634012394377,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7108,i,9084215940144856355,5468201311046049607,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7408,i,2908437708386692244,7130706823093811952,524288 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7012,i,1224630848116150354,12031872648294531659,262144 --field-trial-handle=2304,i,5157017968444625586,16553462313608463562,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2956

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2008 -prefsLen 27099 -prefMapHandle 2012 -prefMapSize 270279 -ipcHandle 2100 -initialChannelId {c7fcd20e-12fd-4abd-983c-2dacd7b1de6e} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 1 gpu
    3⤵
    PID:2892
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 2464 -prefsLen 27135 -prefMapHandle 2468 -prefMapSize 270279 -ipcHandle 2476 -initialChannelId {0d7ee7f1-718e-412e-a359-bbf26ca15297} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 2 socket
    3⤵
    PID:5304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 3740 -prefsLen 27276 -prefMapHandle 3744 -prefMapSize 270279 -jsInitHandle 3748 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 3756 -initialChannelId {b5fe6b9a-d8ce-4dab-96be-04c5815689e9} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 3 tab
    3⤵
    - Checks processor information in registry
    PID:4436
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -prefsHandle 3904 -prefsLen 27276 -prefMapHandle 3908 -prefMapSize 270279 -ipcHandle 4000 -initialChannelId {b339877f-aae0-42c9-9d68-4a30488f0b4f} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -appDir "C:\Program Files\Mozilla Firefox\browser" - 4 rdd
    3⤵
    PID:4724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 4328 -prefsLen 34775 -prefMapHandle 4332 -prefMapSize 270279 -jsInitHandle 4336 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 4344 -initialChannelId {9916db9c-30e8-4985-9cf6-60c1b920d77e} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 5 tab
    3⤵
    - Checks processor information in registry
    PID:2080
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -parentBuildID 20250130195129 -sandboxingKind 0 -prefsHandle 4832 -prefsLen 35012 -prefMapHandle 4836 -prefMapSize 270279 -ipcHandle 4844 -initialChannelId {e8aa315d-836d-4ebf-8fc7-8e6161386b88} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 6 utility
    3⤵
    - Checks processor information in registry
    PID:3872
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5008 -prefsLen 32952 -prefMapHandle 5012 -prefMapSize 270279 -jsInitHandle 5016 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5024 -initialChannelId {b4fcda37-33cb-4378-b8ce-eadeba16ee60} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 7 tab
    3⤵
    - Checks processor information in registry
    PID:4664
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5268 -prefsLen 32952 -prefMapHandle 5272 -prefMapSize 270279 -jsInitHandle 5276 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5284 -initialChannelId {504be834-d5b7-439f-8a21-71e7e49fe4d8} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 8 tab
    3⤵
    PID:1008
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc -isForBrowser -prefsHandle 5264 -prefsLen 32952 -prefMapHandle 4828 -prefMapSize 270279 -jsInitHandle 5236 -jsInitLen 253512 -parentBuildID 20250130195129 -ipcHandle 5228 -initialChannelId {15dc67f9-e99b-4971-a2c6-704a89668821} -parentPid 4336 -crashReporter "\\.\pipe\gecko-crash-server-pipe.4336" -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - 9 tab
    3⤵
    PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bcd71eed4df9f11eaf95b9a8cdad5673c57b3a30f10947ff5de4d7502fa900c1
MD5 ce85614d1a1c32916229fa1470fc91c1
SHA1 4ae5ede50c5368a890b6cc3ba6125c7810dec945
SHA512 3c56cec898811cce5da3cdb20912a623789df023152745a5dda7e5c46b1eb7e09d367bfe3fe82aab80bba85a6334823e06a970d740884886b711390a5e3841a6
TLSH
T133D02320B85CB8E0E23B003C0130D210B1CC0063F223920AF1100C0E9D3C44103F0AF7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 65KB
SHA256 cbd1df3cafaaf9eb5b54b6bc70de0ddc1a88d7c2b92e80c165537a95b2b3c664
MD5 6cd758be0eaedf55250412c8909b2074
SHA1 1734bf33d9a72df83ae22a6ce6a0a2dde50730fd
SHA512 1e22b86efe9d634a114542f03412e7d5b44be238671a35276b844635005dffca78b94d610e0410eaccf68aa0683faf9258581ea40d7ecb05e4e0aecd34672155
SSDEEP 1536:Z2z8hAwSvbSxj4+UJDpymkv4kCGAwYC2p2I/m4w:5ES6Jwv4EWpOR
TLSH
T1DE5301E1EA71D528D6281EB6CD875AD910141648B2872BA3096E3D2C7FCF3B59FCBC41
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 f4c02bb08fb89954af0105ba369dd6401725b78e9b6127e361c537e3a3376490
MD5 665135e0e27a58e2457b2dc960456d68
SHA1 88f33d0e76bcdbd5908cefcdd7642a46cbf51894
SHA512 19dd3ffc240be10140eee6fd30758f54dd2e66083ffb7b5f968207d8eb77d98225fcccc0ca3cee6389bf042a1567be0d0ee34d29c8a1ae4e84543810f5b9dd19
SSDEEP 96:B3vYwmLhWNfpZb6UbzRdKn2uNkLWrFhWGpLC0f4OqKTpAGvFdZmFp4CnBYIB/m:BfMLsp/4cLQWGpmGqKlXdZEp4dIBu
TLSH
T1FC02B8B6698BE560FF5CC130ABD60C8E3539C0420B9E7E668263F4FA1777AD861D3614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 c1eef763788dae4624c0671368d4022c78dcf8e649074d5a9439df3953304270
MD5 41ebf981841b744544f495a04d3526e0
SHA1 00e83d00bb8b8cd640304bacf9728414bc6d9238
SHA512 4c6111ffb25b7861f6e28e824b6f24470f5d36c88a371b6bcdf7d4c101388f5a21635624ef2473927eb2bbcdb003f3b4114a9f884f83fc57190893e95d34793c
SSDEEP 96:f3vYwmLhWNfpZb6UbzRdKn2uNkLWrFhWGYLC0f4OqKTpAGvFdZmFC4CnBYIB/o:ffMLsp/4cLQWGYmGqKlXdZEC4dIBg
TLSH
T1DE02B7B6698BE560FF5CC130AB960C8E3139C0420B9E7E668263F4FA1777AD861D3214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 ca713238d5e1f086012cb54b98e07a8d02c86a0ffc3e31eb5cc147d7a641516f
MD5 7bc27b24465c30ac23fe7a52cdbef48d
SHA1 a22538f6d3de220ac5df8657679dec34b1c41a38
SHA512 d40fb8f4e7629e3bd587007f8487b15f0bee31c491f3c99cc3f764e0dbc00684b150a9c0ec3392abf3472d552955aea539ce31a38fd3a016aeeb1c74e86dad6a
SSDEEP 96:Qj3vYwmLhWNfpZb6UbzRdKn2uNkLWrFhWGpLC0f4OqKTpAGvFdZmFC4CnBYIB/1:gfMLsp/4cLQWGpmGqKlXdZEC4dIBt
TLSH
T1A502B7B6698BE560FF5CC130AB960C8E3539C0420B9E7E668263F4FE1777AD861D3614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c697.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c697.TMP
Size 3KB
SHA256 946f6df768e9283694e64ecdcca7f81cb9ef8256640bf7d64848f43546bcb9d1
MD5 3e3c98e4e72de4acd304612c3897a062
SHA1 cba933fe18646b2a39ad781f214fe24c43e43394
SHA512 b04f879f18ae5906b36303e32223b82e0eb8cb2f52343e6a9a7035875bac97b7d5f7df002894ec2dc0aa828948cd9319b936a7a767106ed34dc2f465b40b36ab
TLSH
T1D5612D3A028FC160F3A0C572E5D11D0E3A7F40970B4F9EA5D3B339FC952A79595A3848
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 dddfff5682307f5514a53c17294f1b129d7ce776812461a7788053933dc917da
MD5 34e446319ce60adbe541c9ee27d569ec
SHA1 ba41ad8bf579b05c89f25e55821d48c43a6e37bd
SHA512 ee0875397429dd7223e2d68568ec961756ccf5b5124384f4a4ec832d9b856b347f57d2808295a99b8131c249dacdffc2e364aa4933ca69ad957fd49645413c55
SSDEEP 96:D3uOylgqg4gW77IHYa2kufszc3AwflFv5GORBHzwBtHzevGj4Blx3Bx:DNkJvZncdvPw3AwflFv57HHzktTevGjy
TLSH
T12EC1BAF2C3E5422DDD1252F09A146E1BCE2D055203A83C9A85D4BF5BA3F2471F2A1B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a35b9106-2d81-4a8d-9644-bec3df3daf1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a35b9106-2d81-4a8d-9644-bec3df3daf1b.tmp
Size 5KB
SHA256 391686d26b7370c1a47fb23a12d9a9e154479bb2a613203cfd97ffbbae2d5c99
MD5 aa61a76f078869bcccedbc2de906bee4
SHA1 da91ad6f48bea570d101cd18d62f9f5d4abbb138
SHA512 ab9ad18ac1fecf73b9e6e4b489094cefed393fd001101a8bf4f2f0d548855ca320de09d703b05ed1a38968b4fe2eb63e4db8d91f58636f1971e2816fa3e1c8f1
SSDEEP 96:D3uOylgqg4gW77IHYa2kufszBA3Awfb4DFv5GORB8tzwBHattj3mpx:DNkJvZncdvP1A3AwfbuFv57H8tzk6tt0
TLSH
T17CC1CDF2C3E5422DDD1252F09A146E1BCE2D055203A83C9A85D4BF5BA3F2471F1A1B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b543f0ba40905d9b601e25e49aea0d8e36165849b5a297b0fbd18853bb096e54
MD5 ca34122839c220883d2d04725aec3d08
SHA1 0c2f86ddd83e42c13b0d8f6147a3142f0bd6033d
SHA512 c1f94ddae249378b7fafc02fc34341a944ec20e69955d2995d8f57233e45865bbf75226ef2bc8504413a8c6e2c98171b1ba7a8d622b2fd8a1ce60b82bd7aef58
SSDEEP 192:sxZ9RAyM/jK1Ml8MWh/fKsxeIdp4FzJXHW6+WNjgk/YHV2CXlIgrJ:sxZ9uuh/fKsxPIHbr/rU9
TLSH
T13552D6126A34797BCCCFD209B945BB53D6F54432A2910E44ADFC8A1C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f36567c956f130be510ac89a542f03a58e0295694b22ee07b3c192674a8d03e3
MD5 1063529b8166948ebf753c56b7d0445d
SHA1 bc49aeb04610716be88bcfc596b9ca5351ff2dd7
SHA512 25f85a5c39fd04e916678a2279bbe595b9e060dd0babcf0e4d5efcf2981257e180434560f94476d828ccd1776525b3e65713db3fb6170a8c731ccb212106a1a9
SSDEEP 192:sxZIRAyM/jK1Ml8MWh/fKsklutfCbVoM5dpuFHcJXHW6+WNBaBAR5ZZYHg2FqlIy:sxZIuuh/fKsk8+hHbqAVZwsmNO
TLSH
T1FE82D6526A20A977CCCBD609B9217F53D7F8446399914E4CA9FCC91C00FA6FD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 6054e48e53ea3322d306099fb8542bb234cb139e643c75906a124d63dbd0c22a
MD5 765ef4c6af1c9611cc3f9749abadb938
SHA1 7d924253a01013200e2eb3d4b1671289276ae641
SHA512 837457a5f8bdf11ac8f217d9088292dea560dae4919c2bd300a56381af9f38b68d81c17c464b9a8266056ff053df29ab1155d9a528a356af51bb0471900cfd5c
SSDEEP 192:sxZIRAyM/jK1Ml8UQZWh/fKs+WpVY4utfCbVoMbddpuFHcJXHW6+WN9h1aBAR5ZJ:sxZIuqQh/fKs+WvYF8hHbiAVZK+4NO
TLSH
T1E192E7526A20A977CCDBC609F9217F53D7F8546399914E48A9FCC92C00FA6FD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 f8863aed19c2119dccaebe11d618c2c27ec38d8c3186b2a61600b673eed626e2
MD5 a2deebee4124af4696a0c162ade08150
SHA1 ff26f740fc8207bde981bede62687bc063b76214
SHA512 fb850646c65cc596637f023fd06884979c748c7854547daa7eebc6ce2848fa8a84db2e9c988f7a8796d1ed8387370a1a71126884862e20b1ba6c19996fa91386
SSDEEP 192:sxZIRAyM/jK1Ml8UQLWh/fKsklutfCbVoM5dpuFHcJXHW6+WNBaBAR5ZZYHg2Fqn:sxZIuqqh/fKsk8+hHbqAVZwsmNO
TLSH
T11282D6526A20A977CCDBC609B9217F53DBF8446399954E4CA9FCC91C00FA6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b38abf1878a651fd601b7cb70923c9bd5628d8927d2f4b4d41273d20c4e8c667
MD5 cf617a5ee7b9465c47107a3483870cd3
SHA1 846e4cb00bdf4b535a26d6a8e811063538476f05
SHA512 ae809ac15cf9ad71ef994a14941b01dd48b4737d99554ed70b4c3b71e44c3da3b2a1143969fc78c2fa42ac530dec8a9859da8168690c5ddcfce5f908e5a3cf5f
SSDEEP 192:sxZIRAyM/jK1Ml8MMOh/fKsklutfCbVoM5dp4FHcJXHW6+WNBCKYkNXYH12CXlIy:sxZIu0Oh/fKsk8+bHb5FXfUmNO
TLSH
T1DC82D6126A20A977CCCBD609B9217F53DBF84463D9954E4CA9FCC91C04FA6FD221782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 51c5ca2c097b9db239f1ea8100e6bad65365ff8f46509b74206fed39061a2018
MD5 f6be0eb01d20a2f0788e75ceaf9256b1
SHA1 68ee01e363f0db17105fef17b2c05b0d06e5b8c5
SHA512 34f01200fd38e11b6484ae75f706bc2bae45773dd93d49f8f809327d28b7c3c9aee4e9a9ae72175a821106b9515946c0671f92a9d169cc4f133864dcf05f197d
SSDEEP 768:50UZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RGroVa0t:50UZYTMWvg09ou1ja7eLZmR93t
TLSH
T149E20A2F280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C03CB6EB511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 870dd8ad9f9d9e210d60929d236a4c4dd7e8939f1dede116e4891e95da850dad
MD5 600cb428aff9572bc286f7c1636a051d
SHA1 c227f66c42414f58ed469a1b4752f6d62fbefde0
SHA512 1128b017287ae55c25a86c390c3d340de45a7974e17ed662968628b0517bdcb5e3df91dcbfeaa398e2419ec5b7a409b9d8c59f59f45569ffe2d82325e410bcf8
TLSH
T1A0A002308BC80415E01361B2556303821380D8A012001B0F44920944CD504804D4110D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 615b58eff3cf21410a7bce6367ba0e18d51db55ab57654c1e36ed6950b94edef
MD5 81dc6d1b121ef1510f14eadcc573117c
SHA1 8e22e8f7e26253d14c3bf039b3697aa5cdcbe8f8
SHA512 db777fbf426b9e45f3d5eeab12266ed6b7c47ec71bfd525d397c12605179e56d38276efdef90fce431123ed1462cf4b2887b912d663061f344b7cbcb1c0cd5c5
TLSH
T1BAA002940E979011C90212F0ADD761A57310CB100B11B74791D66044CD775974D8116D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 a6d6a6d3ff0cf17be4f91e503b7bfc9f12434046b666e8ac9c65b527d5ac53eb
MD5 9c56571463d14be42d5745165e2122dc
SHA1 922b734bc839d8a5cb5817ba8d8aa056e144ca58
SHA512 6050a32440c23174caff38049b1357b900847b929919cf92d2c1cf9fb53e31cd5136d64c18b297bff183f9a67d63184c698a62572f3326064fc390a46a6af44b
TLSH
T16651A64E4D618A5ADCB845B304B2A4903B38ECCC4A519A1368FC2232BD47729295F6A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 51fdf6f7abd0cc6d0ed7ccd2f8c4c5b5680aa6cf5b56cb4bbe6027fc0414ef25
MD5 9a4312115cc6036eed443866f1b9ced9
SHA1 dc3739ca4e39a29f7f18696af30dbca8b543f1de
SHA512 44e4f38aa0c8b5fc62c2146391b35717b0fce97dce0ec4251f1ad9fcd39630b9c5ba999ec431b4d03e71a8bd9692dcb5386a9988cf1828e379e05e58e594d35c
TLSH
T12451C74F4D534B6EDDA81A7608B5449137389ACC1384690B62FED134FCC77186C596A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586741.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe586741.TMP
Size 2KB
SHA256 7edf8586d12c849ae6e292514fbe8f44a31485903af3affda0dec65c100befbd
MD5 ba02de80d6077184cf6d5cb44c1c9fcf
SHA1 7704ec8e38c21f5801a348383a003535dcaa718a
SHA512 c25f077d7fcea67e36c6f0260305839ca77b49e71810bd16a9d9f487b4518e7f8d471c442955518e1fbd64694a7f961ca165b896a0b521f269833b6273f631d5
TLSH
T16D51964E8D828639E9C441B70DE3A8A4373A690087157F5374FC5636EC927AE3E1F2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2f51890cbfba43c52134beeb2420a200682769dcee0f339e87b37319d4c24066
MD5 82f83fbe6e86ed4cf1a855f34e309b70
SHA1 9fb141987caae92acad7017e42cd19ba1917c2d2
SHA512 d86134165b6937760d81b56114df567aa6b22bdd952887b7fad0aebef69c83ec0d75810af6e2a6a1d4e158579cee3c7ab4e325c422ba64bf7bab374a0f53b86f
TLSH
T1C2E068F36DBB1810ADABC3D64471A5A4010238A8C64CAD8E01AAA2A310A23102806C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 09bc23f17470bf0fd7795834763407b37a787a69077867f379cd2a26d2812ab5
MD5 d33601e3ea2475bde5afe50929adf2ff
SHA1 5342e1f6ea2fe7cb1b06109cb25f5d70ed7d737c
SHA512 5fc11076b34d44895875a9ab427617e25c9239aca4085d75e4c6fd557900a244d1db0ac58ae0734d26e320a35f7aea17d0ba73cce88478f500d5cbec6c236938
TLSH
T1BCA00211CA579249D544427594660AC4A710F99C86157612C2ECF15CCA5214145A6518
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bff0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58bff0.TMP
Size 48B
SHA256 f99958c04a7fb9da56048b3146d190941f26bfecbdf3bbaa180f879291b8d6d0
MD5 76dc9a6de8133983baf6d02d854d6d4c
SHA1 e12d6d49b2c02af5b46f07d1a8cd2712b92405fd
SHA512 2f6a75b3a7bf8130023e861e25591d076a40473e30af5fe3a12df03e348d644c32c7b29b4a062fb1f12594cb8c0b491bb073f23b8ad71d79acdc26ce21cec999
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 1963cbe3a23559732557af005a26b4d3ba46d722bbb4230b78eb6ba270dba52d
MD5 7f1d3e298de448cc832fd4b5dcda568b
SHA1 d8724a78f4f0374d0dc9d49d31c47806722317a5
SHA512 d69d6bd42413fd7971e0eb8948cd2e36af02eb812626bfeee7e410710fb9402fa360e3e5757d58b1fe775b8374a665df4cff2d2ab7bb3891b91e307a1189d7dc
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+08:Ect51j55
TLSH
T199D1E55270FA22013D7E3B0982A497575E45F163311CA96B7BAC14B64E2AE21DCFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58eaf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58eaf7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 394862e4106d5598523f87fdc72f25513dd06cc1c47fbc25408e1298fa926ff2
MD5 20cd9f44a0fc2c50a01e555c96e8f8bc
SHA1 c8616fc4691b9b836af5c3e430131f6d78dd5452
SHA512 c610dfdede75b10318ffe42f4b8fc90ad647de50013679f9173aaf2d351badcf7610fc91297785666f16637475e6f7c66e4d8961ac206d518707951ee36293ab
SSDEEP 384:IiFiZcIBsNt8TUNTUlIlqITZNVX9l/n2zX5od+W8yLXxRmnwsa+VY8BZ1o6:TFQB8wgY4LXvnqOtxRVhgXn15
TLSH
T194A24C335954F87B9DFBEB85F94A32038FF480A7D6C5AA9092DC5B1C00DA59C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 5b3c348e04ee865796ab596454a1be92a35a4f61fccf232e95ce49368064c89e
MD5 959721a9e22c2598c58635d5d95697d8
SHA1 fea0b6f4f78839e9aae284c1a0846e697821a1d3
SHA512 16b057544fd76abb183b3b8cebeb6c74e956382a01722e25562227b2bf5857a2cbe11015d76ff19022492c65a8ba77f450e4870cba4132174e4db9b029a0e60f
SSDEEP 384:IiFOZcIBsNN8TUNTUlIlqITZNVX9l9n2zX5od+W8yLXHdje7SwbJSUOsPZ9Yl9sz:TFsB4wgY4LXNnqOtHdaSNg9a9hgXn15
TLSH
T1A4E24AE184C79CB6C4ADD7C7A72DAD021ABCC073B4499948B3F4662DEC9A1BFD316811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ab7cd26de87f710266d4b54f0c550f7a2f95166b1010cc6b0fe31c2b2a73020
MD5 c080a7f54405a336d1c2362340eb1333
SHA1 b05200330414a0672adfff8fc25fe38fcad844b9
SHA512 44515980c7dfa8bcb68d2e37a2568788761ada9ea4304f236cca8e125d38eb67241bfc2b6e3c336d800cbe974c36dc50d1483b13ea925ed58b2880de51824f14
SSDEEP 192:yON861VWQmiUy8ngGX5Obd+j2jzoryXm0/aRn3mDU6:yON86WFgGX5od+W8yUR2DU6
TLSH
T1EB02C835A8687CAB8EF2BE49B48737135FA92067EA552F84D6EC1B1C00D765C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 eeb5abae484d256e09d75dda999e4d30ffb695fabe928488b36f772fbcff1bc0
MD5 a38c1d514ca05b3c3189c508cd09f2fa
SHA1 ca2c4f13ce8a9d78569a2a2c022c2460350c440d
SHA512 18bd9c81504243dda3966db2e4f9269c28de2934aa1ff8675579a89251ddb6ca17fca56ef7ec220d8a3db563d74af9e6a9ed25b36c765a8846a93a238804e432
SSDEEP 384:QZcIhsNTqITZNVX9l9n2zX5od+W8yLX7Rmnwsa+VY8BZ1o6:uh94LXtnqOt7RVhgXn15
TLSH
T183826D326964BC679CEBE285F94732035FF89067D7C96F8482EC6B1D00DE698130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 12be8bdce8fbb6b359fc7253adb18d774621f5c108e5207ff7750f2d801379f5
MD5 1f5143b820140ad7d33e2385cb2fc3b7
SHA1 032670a5379cb561032093f082a9c32b7ef175f3
SHA512 2c8146578be1f681f4be26eeeff46bdfe6bf464e0e9eaaa553a32e9cdb15ec13d6d90098588fa51e21ca0827168180e1f4037402972603207a7b2b74abe0ce12
SSDEEP 384:UZcIhsNT9IYNVX9L8mzX5od+W8yLX7Rmnwsa+VY8BZ1o6:ShUzLXy6Ot7RVhgXn15
TLSH
T115826D326964BC679CEBE285F94736035FF89067D7C96F8482EC6B1C00DE6981306D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a233be64073469194889af2a916ff2118b11e9c7e19a1cadd8b538f83d125686
MD5 0373fb8d58e9e1b052c85eac4e86d67f
SHA1 f8833e13c8bd28b17e0b56f2360edb3d1401528d
SHA512 1c87e7f734ba1bbe821d2f67459be07a7484e0f271f0766b1b745ad897f0bb02b67ca7f477cdc803473b020195f08d3ac67bc27c3022f34d5e45926b6cceda5e
SSDEEP 192:YONG61fWQmiUyKnyGX5Obd+j2jzoryXmOXY7JjJRJqPnwU6:YONG6gHyGX5od+W8yLXKRmnwU6
TLSH
T1DA12F832A468BC675DE2B585B44732135FA95167EB497FC0D2EC2B2C01DF69C131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9cfab8ef9a7bb103d8b11cf01d2154dc29ab55654c2d92d1b099ad488759cca2
MD5 a5707372071db7d0b4002ba9b32da6eb
SHA1 b99de086f64fecffee944125acc4706587dfacdd
SHA512 0527e9643e2d8da05c49fefbc45ac45410db4e86fffdf2c282a57900e174eefa6010fe048eb5672ec202f4831d0804888d5b4879b991b5540dad9d309dc2177e
TLSH
T121E00202D30810B7C41C133245C3211032F6C07413F303955800117079437101E31F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d07390cf7ae991d1b6fdcafc0ecbda914ed6f354a449e026f86653dd9a3d139c
MD5 02f96d35a0ee939a0281761824b00f16
SHA1 a1c351c3813e3b304a2d7805b4cb9bd250e922c8
SHA512 d089bc80fce919c8117b1b256f78da26909da5a759031cd681a77efa0b5d135d87d3303a78c7e3968a7498d3ab6878eb1ad6f62ceff93e4bb1b5d0497e7aa489
TLSH
T1A0E00203931815B7C41C133645CF221033F6C17813E303955900A1746E437101E32F50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 18751b6e18f6defab117197be505adc8750106c0733162ed5ecc178e3a2583ba
MD5 a18567662ddc6ea7ad1d7a3d93a1cae3
SHA1 8dcc387aa071d6681e9cb7606b57a6adf0af9216
SHA512 30ef00716601f46267b55347380d879964920e7b66340b37839f6430315162d626f3b0059389874c27f5fb16417ccc25b149f622bd9be2c210b85f4f50d8e250
TLSH
T1BBE00401D3001073C40C133305C3310033F5C05413F303D5540011707D437101D31F10
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58779c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58779c.TMP
Size 392B
SHA256 8a6338e40bc88e1283f190011f152d986c40f364e036a539326b94f916a9a526
MD5 59ed98ba5049db5e5456b296ff24e5d1
SHA1 33216e6a8e2fe11f462c7f9b50767e99ea4f66d6
SHA512 80adc9d99d7075fc94c42bccf39f6689259021f109a3c768ffe76969897d2d6c636ff648f3ad574632f39232f6c2040e5dc9c9e4b7e1b77cc135368951c5641d
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 c4dbeb9fa086e08031bf3fd6f7099edf949c51ab47ab8747608313959bb7bc58
MD5 ffd8d77e7d39bfea159e22895395c793
SHA1 d2184a2906464bc4ac93aadea539875f74ce3d85
SHA512 5662ae3404e3d57a8bb2f8f188bb80183d968ae0e079b702ad077c267f2a0b6c5676ba44e3501d992218bae734929372e639c32971d0d416584a623cb65e34ec
SSDEEP 3:MsEllllkEthXllkl2zExllhZ7/:/M/xT02z8
TLSH
T19444040CFFC00405C50151304513C3700370DD101515F757F571DD137DD55404C00001
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26fc70c4-a71d-4a08-8a48-ce68cfe13aeb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26fc70c4-a71d-4a08-8a48-ce68cfe13aeb.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f6f49fabda07da8a96f260bed4dae3635540c11251d0f65f5417e30f9b089f9c
MD5 d4ee34222d7cd1b5e5e002aff117d029
SHA1 8855aac8b6a0cb000edf51eb5a11df597f05f978
SHA512 e9a6628caeb58347d7e9bd1c2384aac9b50cba23afea230e1d7efb1fc756eb52426efb39211ed2645281d897eae17c3459a4335a3b51a01198c6478568d8cfc9
TLSH
T1FB412958B6E91148B3B76F566BF7B86E487F79772E06C4AD10010E4F4662B00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 5KB
SHA256 4f3a5b17cb0bd3d62ccc432cb8fcbd9e0d73d3c778847a1ce7927ccf74e7469c
MD5 e86abff99167ab10d2ad860efe29a2f4
SHA1 a38d2a77138acc1f83f19e3057233201cde4bf47
SHA512 fbb7ccc13d962b4b4e49e034a6e0d83396bc41297ab23b2d6bbde2d527537cd9a429ec4a24d7f5cc4acfa0a2ffb0a902c6a25e354e03ba9de62c7ab054a617a7
SSDEEP 96:cZSdF95/7bkW60rcE+fyUR65WZYFT2FnF3F5Fb/dd66JozGzgClKtmc0d/UK:SOv5zbowb+fyjI71d66JozGzgCl6mc0d
TLSH
T139C1DA28F729963FC408423BCCA61F400F36394B988E7F1932AC641D2D562DE7A9D17E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.safe.tmp

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\db\data.safe.tmp
Size 7KB
SHA256 4fbc3620d15a2a6e730d501a6b6f3ea9f0f3553b57227c1d1ca2dbb1a05cf532
MD5 d17b0f89d2350e658576bc89b4f6bac7
SHA1 293233d6d45cef6a47e8116fc7c0ad16116e219e
SHA512 4119086a166474b738634ce7b4f428935219ffff9dced63328af6611029c5008ef41ccadc3fbf014bffa71c4b4b139157c20e50a262fc721a50bd0b4fd5d2f37
SSDEEP 192:F1d66JozGzgCl6mc0daOv5zboPBZ+fyjqO+:Dd66JozGzgC1j3bopZ+fyjQ
TLSH
T160E11D68EA28923FC408037BCCA61F454F35398A984E7F18369C741C2D572DE3A9E1BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

events

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\events\events
Size 1KB
SHA256 2ba9f813570f1af21b9db872dab0e90297ff5c26329b99e594805d8a88af2f55
MD5 e068030688b2612c3223d0aff914d258
SHA1 91c86e3805467eac6ae7e15eacd110cfc31d7654
SHA512 95181e1bf53fc12aa28c5ce03de8f20e773f715dd8386729d00eb939b11f7aef6009cff8969cc56f448932add0345cb1c995e658302a956aaaac5afd561d7904
TLSH
T1FF214C5C3ABA4E6E9DC7E29C7841018E53514E4705471D530D92EE8DCEE2AD9327B43D
MD5 SHA1 SHA512 TLSH

Submit Download

24e700f2-e323-4ed9-ab3f-4c451afe7f7c

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\24e700f2-e323-4ed9-ab3f-4c451afe7f7c
Size 2KB
SHA256 ef60bb6a66b807af90b0bb98b496fd050ad43b96f54e1d4a3eb877ac9ef6a78c
MD5 bb19dd61f100c70b9e28aade44381588
SHA1 871b621c0d8031aecf4dd6403ba06e997dba6840
SHA512 d16e42aece7039614f5b318ff1b5553c06508163ddb958e37247cd29275092a1508eef7a50960b2bae6516574757c5dd8770fcf31b568ed34e477c269dca8f8e
TLSH
T12D41475C35745CB79DDAF68DC492274E53A58B0340CA1C432E61EF0CCD9A65E736A43B
MD5 SHA1 SHA512 TLSH

Submit Download

4b2e5342-3a2b-40a5-bbb3-741fdf7134c8

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\4b2e5342-3a2b-40a5-bbb3-741fdf7134c8
Size 886B
SHA256 8062ced25027a51931e13bd05c5dee1d9f5eaadb6a5eb11b1d01b6581fec1d6d
MD5 8db890ec3a2d8786164b4b6f378f9f61
SHA1 310ae05fa8f3870ca05e2e7b02320b77617b8392
SHA512 66f621e5261f6b29e074c7144a4f71dd92bd04fd74876311d20c0557f54f654c5660ab30f244f67ae7c94dcc18e4d52ac1a3e12aaab0e91436bb5e2cc5e60ce4
TLSH
T10A1123409A64B5F38C68D34BC5D1774687E4732384CA49143FA05E290DBA51F7776717
MD5 SHA1 SHA512 TLSH

Submit Download

7a2731ea-60aa-4051-861b-1bb7698cb838

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\7a2731ea-60aa-4051-861b-1bb7698cb838
Size 235B
SHA256 6281ef5e04eea851477ae2b4af1390993d66d649c09f3e2fcbc3654d0f3eeb51
MD5 448dd330d23fb242996aa3bad94c71c1
SHA1 c0f1719f59cdb658842f7c4848141cf67ed05891
SHA512 2e5eee24e74b1949bc6fb6dbfd7d6649b8cc2f13492a39fe79ff5dfe2eea04747722bdc710a76d4bfd72a21cadcae7909eceb38e5c5ec420cacf29603a819dab
TLSH
T11ED09780289833AC08001F03F0B4A8C331888C3310709850EA7105B88EBEEC4013580B
MD5 SHA1 SHA512 TLSH

Submit Download

ba6b552a-3bee-4d07-9ad6-be60a9121d0a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\ba6b552a-3bee-4d07-9ad6-be60a9121d0a
Size 235B
SHA256 877027dddede265926720756238d11a9f9fc03a3fa9ac29736ec8bd6f5cdc54c
MD5 fe8756f17a14e8d5502e9d264b598306
SHA1 beae8145a40f70f36b76bad939e80058321a9c4b
SHA512 5dae775a5aa931bcee0714ac1ada60fd3872dbd88c614d289f8895086f91b4647ebf561b0d0e87816814a17dfbd3d4f01756a72e8ab230eaede7df8f31fcf774
TLSH
T16AD09790188863AD0818AF1BB0E068D630C48C3710B89810C66101B4E9FABC84151806
MD5 SHA1 SHA512 TLSH

Submit Download

cba646ee-9592-4c72-97a2-437cb75004e3

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\cba646ee-9592-4c72-97a2-437cb75004e3
Size 883B
SHA256 35ba5924a4972baf45b078a6fd17c4318643b1fbdfe1310995cb104d853ea928
MD5 2e7452503fe747e8ea8e6ebe29897028
SHA1 3e1196314e8bcd2449389c0ffae5baf2f3b2d640
SHA512 a08ef828404cc56811f2b1d894b840bf9e087b71504118127652a6320498c149cf0233d64afbfed001886a6463ef33192ca82526989272a1eef65d916ee18329
TLSH
T16B112380D674F5F3CC28834B898137029FE4B22384CA54043EB49D240D7E91EA3B670B
MD5 SHA1 SHA512 TLSH

Submit Download

fa16e083-4abc-4d1f-8bf8-843f33cee76a

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\datareporting\glean\pending_pings\fa16e083-4abc-4d1f-8bf8-843f33cee76a
Size 15KB
SHA256 3e9cc6f67a23a8745e2b0aa226851fe63f9efff88c316e9c688bc319c7f7c397
MD5 f780ff6a1e750053f827ffc006748a3a
SHA1 df4fbf2945b55f2d49ce8e1c631338b7d2a2cdd8
SHA512 cb4dca33f3d80fea389e7dab0946acd0e67d9cde9226dbe9e0a28978c73834ff1c2c0761f958993d06b334f55addf78799ececbc2919f15102493880f7243433
SSDEEP 192:+pqbdLMaMjcP6N5ac69q76NVrkrroDTM/0pr1fMcbR5zdDi/vkbBr1U/RuKApRdt:TtVorGw0pr1kcbR5JDin2agKZpfS
TLSH
T13E72D956643049BA8251E3A894ECBFC3E5F538CB4C415FCADBE4BD046DEE06E112798B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 302486d6353c5e74addfffacd63e3c2a6062a91a2e47ec693a3d724924fd7966
MD5 48a62f227e93d2f9ce44d96bfeec23d3
SHA1 6f8cc5ff707476595870781af252fc691bc252f2
SHA512 0fe1ab3ea7bd84fa5023bc71d65746dc9e47d77617d92c3c5c9eeadee23acb723be5e51148adfd49911c403f116d9d3bb5114d6753dc139d6fb200e1115e467d
SSDEEP 96:xHrUTUmqGq6fzUL1zSWSSlfdv9jRunpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzULrSSbC9NWBrODBw88Jr
TLSH
T1D5E110789508CB6F74B676ACAC6488716AB2013BB7BF68D350B594C4051CF3442FA6EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

prefs.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\2d5mkwou.default-release\prefs.js
Size 6KB
SHA256 e0a74a74fa4ea42263a1b2e4622a8289e254b8d99eddc4c9cc04b214f46913a9
MD5 1a4683426da12dccf1fb3a2440871e4b
SHA1 29a9587e55b20718dd55759c3f00935a9479b481
SHA512 edd597b05d57ff2c267d3232dce0acdc52bdda1b1274dbe401d26a1487e4beda1532d3c99b374a93e4d42a02537c35628a7452ca1dcd82399037feffd1a280e1
SSDEEP 96:xHrUTUmqGq6fzUL1zSrSSlfdv9jRunpRHNWyS9JODBw88n8L4cnuFNj:1BR6fzUL6SSbC9NWBrODBw88Jr
TLSH
T170E12F789508CB7F74B676ACAC6888716AB2013BB7BF68D350B594C4050CF3442F96EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download