cb322b4b26277fb8bd5208f4278fee95680e556b059e5c9f9968e9d988ec3672

Analysis

max time kernel
898s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/09/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
159.195.156.html
Size 5KB
Sample260924-vsctcaxcrd
SHA256 cb322b4b26277fb8bd5208f4278fee95680e556b059e5c9f9968e9d988ec3672
MD5 4a52c609b714a42e709a8ca9bc7a9b16
SHA1 73fa101e6f063163866113c218cd611361bd95f4
SHA512 161c57ccfcff4769ddd51eb13854a5e35844d1f1037f6a32b208208fe055d785bad7808a5026b15946fa3c147e5c719646fc23132b0a412c590ca8fd3d32ed98
SSDEEP 96:PNyQtoXZzIEb0EaW87wLMDg5pPxIdS+XBW+dkN0jcfcGUR3SaYzueh8uAmw:PNhtkCBcAg5pPxIHU+KNZDUR3SHy8Hw
TLSH
T1C0C14CE36A765036DBF0279760F37314025271CAA300D0F4A9A9D73E9DECE1E81442D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery spyware stealer trojan

Malware Config

Signatures

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Process not Found

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	Process not Found

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	Process not Found
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134347436992747316"	Process not Found

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	Process not Found
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2304238888-3968896904-642854331-1000\{82F8F81F-F6B0-4FDD-8FFF-1EC965CDD590}	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	Process not Found
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	Process not Found
Key created	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	Process not Found

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4532	msedge.exe
4532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found
848	Process not Found

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 3816	848	Process not Found
PID 848 wrote to memory of 5596	848	Process not Found
PID 848 wrote to memory of 4468	848	Process not Found
PID 848 wrote to memory of 5596	848	Process not Found
PID 848 wrote to memory of 5596	848	Process not Found
PID 848 wrote to memory of 2336	848	Process not Found
PID 848 wrote to memory of 2336	848	Process not Found
PID 848 wrote to memory of 4288	848	Process not Found
PID 848 wrote to memory of 2876	848	Process not Found
PID 848 wrote to memory of 4288	848	Process not Found
PID 848 wrote to memory of 4288	848	Process not Found
PID 848 wrote to memory of 2876	848	Process not Found
PID 848 wrote to memory of 2876	848	Process not Found
PID 848 wrote to memory of 2496	848	Process not Found
PID 848 wrote to memory of 2488	848	Process not Found
PID 848 wrote to memory of 2496	848	Process not Found
PID 848 wrote to memory of 2496	848	Process not Found
PID 848 wrote to memory of 2488	848	Process not Found
PID 848 wrote to memory of 2488	848	Process not Found
PID 848 wrote to memory of 5868	848	Process not Found
PID 848 wrote to memory of 1300	848	Process not Found
PID 848 wrote to memory of 5868	848	Process not Found
PID 848 wrote to memory of 1300	848	Process not Found
PID 848 wrote to memory of 5456	848	Process not Found
PID 848 wrote to memory of 2092	848	Process not Found	106
PID 848 wrote to memory of 4520	848	Process not Found	107
PID 848 wrote to memory of 5540	848	Process not Found	108
PID 848 wrote to memory of 3704	848	Process not Found	109
PID 848 wrote to memory of 3704	848	Process not Found	109
PID 848 wrote to memory of 4532	848	Process not Found	111
PID 848 wrote to memory of 3296	848	Process not Found	112
PID 848 wrote to memory of 3296	848	Process not Found	112
PID 848 wrote to memory of 4136	848	Process not Found	113
PID 848 wrote to memory of 4136	848	Process not Found	113
PID 848 wrote to memory of 4696	848	Process not Found	114
PID 848 wrote to memory of 4696	848	Process not Found	114
PID 848 wrote to memory of 4360	848	Process not Found	115
PID 848 wrote to memory of 4360	848	Process not Found	115
PID 848 wrote to memory of 472	848	Process not Found	123
PID 848 wrote to memory of 472	848	Process not Found	123

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\DataCollection	Process not Found

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,14871670716229326587,17086347126900070218,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:14
1⤵
PID:2092

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,10360699980709526989,7271261947764664335,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:14
1⤵
PID:4520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,10261931833875184499,3434133166331256726,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
1⤵
PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,4123897847730616631,18214018588315420792,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
1⤵
PID:3704

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5464,i,12104482231336702511,8400771665528955157,262144 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:10
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,13289517749456400060,12681859091823510930,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
1⤵
PID:3296

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9194768817420538663,4398936863372279283,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3280,i,7561054051472271806,15176123300222133461,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
1⤵
PID:4696

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,14349778844701230559,8184720483644574315,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:14
1⤵
PID:4360

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1052028312216799934,7846785165678026475,524288 --field-trial-handle=2432,i,5092331291435908933,17226308426474163237,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
1⤵
PID:472

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3cf7f2fa0c628357b7b352f94726cf4d9e34dfcd93bbcf51f519a9f740f15c8f
MD5 a19657e0da91b188d78c452f8f8a7b36
SHA1 af0d07c1f2fe2913b27591645b4f8023094c9631
SHA512 d674fdbcbe097799c2f52cf7f3209fb03ebf6fcc79c542b48611d17fd57e18b0d28f609ff10b0a58187d5a403dcf36a6ab8176d1d68f2ce52d86f9cba4b50c93
TLSH
T151E020885CC5C23DF54878C7427D574CC280374E92CCAB4D2704CD89794168067869E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 49ffb330b1b63a3a0e092bbc5173025e368ac2d8a447d76b2a799d327096058c
MD5 44b244f952e266493afe930fa22ae72d
SHA1 ab9e4f3d85bbd3b5239c2a0924a73f309d3e7821
SHA512 6746aa5c6b741a90afe8da1d1f4a5c99d8a35181dd76f763b88f94aa302b531d8c6f3771281357305053985571cdd4ccbdf516d7335351f415e8b769eb0355ec
TLSH
T105E0268848CAC23EE65874C742BCB70D82B1376E92CC6A1F5F04C8CC7487444AB866D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9dd89596d2952ec420e7542f6f068a69f4f8e489ecfd5c90be8025b4207bf55d
MD5 c059aa61476d30a470b11ace8a48fd64
SHA1 035a2f155704e36b7da21013cc4dcbe5a40c60b6
SHA512 923cce6e183799a2749f3f2f442b71a2e57a7656d4aef1c49b028f77821b74a9fbf8e0d158b30faad4d9daa26ee65a0b5214acce5d2d141923bf501366d7bafb
TLSH
T1EDE026995CC9C23EF744648B417E570CC2803B4E96CC7A4E1704C9CA7481040A7A2FD1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5fde73c256564795499c664c273d5298adb4ea8dc1cc682d286b9fa1c4dc0270
MD5 6198c456f111ac75bfa46d106c2d197d
SHA1 6b7ac755700d41be4ea004f589cd173fd0734e2f
SHA512 5f47db3f41daaf7326b5edc3af9bb92de7553c49c350af7831e1c34130d1d8efda321f10a9fdf4deecc57086784ec0dd4756b7b6504a3d859bdb790b2b32d66c
TLSH
T12D61F6625F3CB15DD76CD176E486809EB6E84AB296832EF103F0DFA47B863A12845302
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 06b699a319bee12fbcaebca55996a7cbb84f37c77471f8393ca662412786ddc5
MD5 b5333deb4e0ada2e6a21151e89bced70
SHA1 19be1b8cb535114ee60ba05697462538c8fe5e53
SHA512 539f2387878213a8581a60ba44f5a12dc096b91d0fadee759b26c31a251e6b32bd466e7580d04992c322660081ba4c7a553c42a82ea4a27fc43464c3c3591752
TLSH
T10461E7625F3CB15DD76CD176E586809EB5EC46B296872EF103F0DFA47B863A12845302
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 760b048998946963f7cb7cfccdc6d7e1ccc1adf3d60fa7670d97eb7941532413
MD5 a2183e39b24648ce75e381dcfc3ec75b
SHA1 2af1edcbd47de74ec0992df3a7273f0b776e550c
SHA512 4445af10c4fbf4aa88a1825ab0ea9d5e8b90fa169455f229ae0a9fba65be494ca601b2f72b2169da6a1c7f69f464450e3001d662e61fb68961b4644e63a12d31
TLSH
T124319CF7C3E8863D8A0155F4AB182E1BCE2D0925932C3D56C5E49E2B93F24B1D14099F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 071ae3a878e6af28d4c3c4164bad98860a8f70c82aaa47b0de6aa22684a9dc70
MD5 28ca517c95dde865dae1dc724e7cfe4a
SHA1 f7c10b8d4bd21dc027f9c2ae2e999d4f3e84b086
SHA512 b00c0144deed7220ebe7ea0c57f91deebe1a38cf4273ce061af653f46766954380f79c7616e4e2769f978e4e725873355e3507dd0e72039a97920092c1ea8019
TLSH
T1BA41A0F3C3E8867E890155F4AB182E1BCE1D0915832C3D56C5E49E1B93F24B1D28199F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7b1ba376d00e488d8f53dc73dff7a84f4d6351fc75bbbe212772ea472340d4a7
MD5 5019ee6c331d9d836f49a4b916026c1a
SHA1 72ce594b5bb7b916f95a0bb503d180ff77476f69
SHA512 2ff6cc7d899c40e435929b8c0bbd66c7dc57296a865b5b9bb55b2eb307fd1a9af21cc3c4f6fcbe0db113ad86e3c9d6b16e8001052b69f1f7b1eb9495a5d08558
SSDEEP 192:sxRQrb9/f5s4RdzoA8p4//g6+WNIYupiaG3IgDKJ:sxRQP9/f5s0Qu/5Iu6
TLSH
T1E532A615AE28A93B8CCBE20DFB65BF53D2F95032A1951E48F6FC961C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 05b140fab3d54f4353f96fd115da174d240dc0f9a41498b7210ec8f9f9d7b97c
MD5 ae7e4d7ddc4cf74be5ce9518a867bef5
SHA1 9684f88f0e3dfb2d9100a082f4cb53eb071c9a4e
SHA512 f7233ce1798cd1debaf4b1ca7c1095ddb9b8a9415a090d5f0507975071a4bdc67a81b4f9b6c92193019047b93658e1e407a93a566b2f8277d681cb56f70545cd
SSDEEP 192:sxRQrb9/f5s4KdzoA8p4//g6+WNIYueiaG3IgD4J:sxRQP9/f5sbQu/5I/w
TLSH
T1AD329515AE28A93B8CCBD21DFB65BF53D2F95032A1951E48F6FC961C04EB6DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 727b739f36b0208fa5ab8cec5eecb56b284214c313430df10a5ac3fda6d2e159
MD5 d0f72656a8fff34d63f0bfa0f08caa94
SHA1 1eeaf1899d5ca63ce7f44de7cb59882ac3131476
SHA512 0530e7d1bfc3ddfe98b8df832ef4fee1d41812e3d56dc5cb1b085ad5346115a42538f2631c9dc45158c5d61a294c9c96b64662b58bdd0cd50a4cf04b9fda89c3
SSDEEP 192:sxRQrb9/f5s4RGzoA8pe5/g6+WNIYupiaG3IgDKJ:sxRQP9/f5s07m/5Iu6
TLSH
T10E32A615AE28A93B8CCBD20DFB65BF53D2F95032A1951E48B7FC961C14E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 9586ce9e345b00e701d41844c99d95b9e395687c13fdcf7f4ae4f2e82f5ef5bc
MD5 c2611767a64cb3775da65505c1e79ba1
SHA1 99fa882c26a409f32a0753dd216a3b4fb452d1da
SHA512 a4f599a3c283e06ea29187d6f051c399ce02dd9549ea5843c5257aadc1d85954d7b5a48ca026602a4f7c9e49ec885d1020d564318eca379eae7f77655986bd7c
SSDEEP 192:sxRQrb9/f5s4RgzoA8peQZ/g6+WNIYupiaGYIgDKJ:sxRQP9/f5s0ZB/5IN6
TLSH
T1B8329615AE28A93B8CCBD20DFB65BF53D2F95032A1951E48F6FC961C04E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aaee23b7-4628-465b-9da6-1afd6c2230d6\index-dir\temp-index
Size 768B
SHA256 b9ac823e5dbf7b02440b95fb0dc0913773f3ac0ddca521ba9b04c6ea709c679d
MD5 ec5bc32ff164538aacd22cbff2d378f7
SHA1 2da8727e2f7e40eea6fd3acd7609a18c4380a33e
SHA512 2aa460b3e228c305c517650b88a9c86192f95da3646d214f1bdaa55b8809440d72beda6b273688c7aa302257157728730ffa044a2f8beaf20f3b641944e05dd8
TLSH
T1DA01418A1D125A87FE500071683EA884523910DC43016B1FB0FDE02B9CE2B80B941664
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da635.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\aaee23b7-4628-465b-9da6-1afd6c2230d6\index-dir\the-real-index~RFe5da635.TMP
Size 768B
SHA256 dcc5ca775dee509280a12fdd27fae58274dc0d4f583992b981af8d19cf6d43a3
MD5 d413f0bf5b60403fde20395d19af4a23
SHA1 0a1ad83cdd60b010d26addfbf6c5b70c21480703
SHA512 994799722e717ceefb613f89910680b4508320460251ea3c1166de9166085879222d73e9e0701ae29622379f517fabaa9c8b7faf740421dac41b7b5535595109
TLSH
T1B10120DA01228A83EC0001F1993CB595213A51045348AB1FF3E7A46FDC907D4BD82DA8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a1eb7c1bd61754ef8023fee6d37034e130623bf82a2549995b9b23633352b0d2
MD5 ddeb2a26b59dec563212b5bc0baaaa1f
SHA1 61215e7ca0cc0abb8f31e6300d6e5625b23de31e
SHA512 3c8240ef25ab462d5eff6dd0389f784a167c344d72098b006e4206f09e3eab27777ee5e1724f822f52148db5ff00c6dc0790dda9a354c9c5a7fdc47359295196
TLSH
T19AE068F32CB72850B85F92E6243244B901027D658A80AC8F202E92D710E22503446C67
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59fd42.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59fd42.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 aa7b56a1e74a8842f8a4cc1c43a6ab4cfae405671b5f938e11fd043ba2c18d65
MD5 2e7a455f68fd6e1ab5208b95440b34d1
SHA1 a00f42170fae5a484288ac592924c69a1ce6d3bf
SHA512 b91aeec2c0efe984c453636f4a6091133bb5afb417aabf6391a28565df61c609a5536ec4565aca64b724cf9be453be5ccf5e08e8f3403cfd5028a59beab98e60
SSDEEP 768:wX3IXw0SO5K8trWWhMIYNa8S5oYklnA+WNfeF+u:wX3IXT5TWRdAdNe+u
TLSH
T1BCF2B036A9A49DB3ACE693C5B24677027EF58123D1885AD8C9EC5B0F05C75BF1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 3d93ab12b10bd5c402d788267b64d8605e09ce55baa50fa50fd9dffe35c98810
MD5 afcb7f75c2e58884e0c9f4df3ebd481f
SHA1 056a69ab677350b7fa28c2d78642daa28fa187bd
SHA512 a9b642b945c5a8b6981008b7c835026910e832a694d2760adbb06591ecbc44261c59635ab4c3bb62ed6e73b97fa19a1c1d00d178d6e79213ee6ece9c24ce42ca
SSDEEP 768:5aX3NXw0SO5K8trWWhMIYNa8S5oYklnA+WNfeF+u:AX3NXT5TWRdAdNe+u
TLSH
T1CAF2C036A9A49DB3ACF693C5B24677026EF58123D1885AD8CAEC5B0F05C75BF0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 4fa0ba5324da6f5af5f0adda053f01ba2a733d2070a702d7180e9a7c10a19174
MD5 ca5915bc705744a2c862434370d1fb70
SHA1 817baa616798c578d4181ecaabda568aa3d3ad89
SHA512 f7d61770b9ffec8b004f74dabb939bc8d440f894e6282cdc1e98b794025fbe7cff6ef91bfca053adc0f9e69b4e0b4067e534ca2eecee76f10bd78029098d1086
SSDEEP 768:GFQA35wg2Xw0SO5K8trWWUMIYNa8S5oYklnA+WNfeF+u:NA3+XTcTWRdAdNe+u
TLSH
T10303AF379994C9B7ACF69BC5F64A3702AEF58173C188A9D4DADC5A0E01971EE0307C61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download