hxxp://leamoreconstruction[.]com

Analysis

user interaction
yes
max time kernel
32s
max time network
34s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/09/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://leamoreconstruction.com
Sample260928-scd1csxt7q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{66044389-4219-42E8-B9DB-B397BA4DEFE8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe
3496	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 2860	3496	msedge.exe	86
PID 3496 wrote to memory of 3768	3496	msedge.exe	87
PID 3496 wrote to memory of 3900	3496	msedge.exe	88
PID 3496 wrote to memory of 3900	3496	msedge.exe	88
PID 3496 wrote to memory of 3900	3496	msedge.exe	88
PID 3496 wrote to memory of 3960	3496	msedge.exe	89
PID 3496 wrote to memory of 3960	3496	msedge.exe	89
PID 3496 wrote to memory of 2892	3496	msedge.exe	90
PID 3496 wrote to memory of 2012	3496	msedge.exe	91
PID 3496 wrote to memory of 2892	3496	msedge.exe	90
PID 3496 wrote to memory of 2892	3496	msedge.exe	90
PID 3496 wrote to memory of 2012	3496	msedge.exe	91
PID 3496 wrote to memory of 2012	3496	msedge.exe	91
PID 3496 wrote to memory of 3040	3496	msedge.exe	92
PID 3496 wrote to memory of 3040	3496	msedge.exe	92
PID 3496 wrote to memory of 516	3496	msedge.exe	93
PID 3496 wrote to memory of 3040	3496	msedge.exe	92
PID 3496 wrote to memory of 516	3496	msedge.exe	93
PID 3496 wrote to memory of 516	3496	msedge.exe	93
PID 3496 wrote to memory of 4044	3496	msedge.exe	97
PID 3496 wrote to memory of 4044	3496	msedge.exe	97
PID 3496 wrote to memory of 4044	3496	msedge.exe	97
PID 3496 wrote to memory of 4476	3496	msedge.exe	99
PID 3496 wrote to memory of 4476	3496	msedge.exe	99
PID 3496 wrote to memory of 4476	3496	msedge.exe	99
PID 3496 wrote to memory of 5008	3496	msedge.exe	100
PID 3496 wrote to memory of 2272	3496	msedge.exe	101
PID 3496 wrote to memory of 5008	3496	msedge.exe	100
PID 3496 wrote to memory of 2272	3496	msedge.exe	101
PID 3496 wrote to memory of 4584	3496	msedge.exe	103
PID 3496 wrote to memory of 1140	3496	msedge.exe	106
PID 3496 wrote to memory of 1140	3496	msedge.exe	106
PID 3496 wrote to memory of 1140	3496	msedge.exe	106
PID 3496 wrote to memory of 5448	3496	msedge.exe	114
PID 3496 wrote to memory of 5448	3496	msedge.exe	114
PID 3496 wrote to memory of 5448	3496	msedge.exe	114
PID 3496 wrote to memory of 5128	3496	msedge.exe	116
PID 3496 wrote to memory of 5128	3496	msedge.exe	116
PID 3496 wrote to memory of 5128	3496	msedge.exe	116
PID 3496 wrote to memory of 5156	3496	msedge.exe	117
PID 3496 wrote to memory of 5156	3496	msedge.exe	117
PID 3496 wrote to memory of 5156	3496	msedge.exe	117
PID 3496 wrote to memory of 5472	3496	msedge.exe	120
PID 3496 wrote to memory of 5472	3496	msedge.exe	120
PID 3496 wrote to memory of 5472	3496	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://leamoreconstruction.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff82aa7c188,0x7ff82aa7c194,0x7ff82aa7c1a0
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,12597543608417005792,740289107902692019,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,8611100788928822909,14777529718315940499,262144 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,11914483048146916923,16467711336466896042,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8099207868048185719,4681948211800331886,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5902286066429278327,9964683512674130916,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,1538050025888033834,1862444207917705776,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,14512447428382982299,13575513220992494820,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5052,i,7965417498031192006,10098703300019125423,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4316,i,11196037505307636129,4943642116477784314,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,2075534395230112366,5470826299642275869,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,7360928025563001982,5545897382008510341,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10791392702717163681,650715454088157299,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,10791392702717163681,650715454088157299,524288 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3520,i,11143164529451893170,16224279846234096710,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6592,i,773083201910654356,4000639142847528348,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6972,i,8673061589825862303,11002565419994315837,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6768,i,12882843142339529510,7194062696148526267,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6756,i,5040728822765197868,14980388087686141969,2097152 --field-trial-handle=2300,i,6257156388755835279,12622385213345245441,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:5472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bffc89667c47ef8948ef2985b30d1266ae370bdef78868d1a5906024e8cdac5f
MD5 f1311acac6ad7f3daa168fce32e08c30
SHA1 ad6365f1dcf1fd39a799aa9401125b2566f6cc32
SHA512 d1c94732964306ef38f0c155ee90f8c452a897b37eaba38449c240a590af897438bf93ac3d55f8efe0874b3ec9f0c99bf814db990a41e3af729fba59eeba4f7d
TLSH
T186D080D891E5355CF52531396127450173CCDD45F5035306C0554657C6452E605F14D5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 feac19ed71d9ed431fc2ddbddb08a5e12759945d3203c2395fede9040c871f2d
MD5 c63d325eb7745ba9f54578a91bc95cee
SHA1 49c0896566842d7b2e4aa1102017c17ddb5e7f2b
SHA512 9eb5d9b62e614b3ccb08e5294bad4750d173bca1f7ba4abeb07a5427a7d883bab423ad097b0563bb1f1477ba91e79c4ad5692fd5ef34432ca95d95f3514e8264
SSDEEP 192:kR2cp4FNYeWqg2eM0qaAAA76dYS4Lz0MvBZ6cCJkqB4v37etPtrUfNvo+7a+5aES:kR2cp4FNYeWqg2ewJAA76dYS4LgMvBZo
TLSH
T115D1C8C3DED1A6E1FBFE053210DD5B1AB63258CB69A31F223415C4B8BD77B8152803A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 020ae6c07bd3ba8c9cc679d0bb536bb5f7b1e38cfc0d1dd8b969c39a4ded0a9b
MD5 b9263ab00bb12cfde1bf0582c3b75e36
SHA1 0a19491f9143102501a5dc8394691a18d3fc31be
SHA512 b3125fa587dfc46b969c10954f556ddc9198dab6212b9c75bba937afd34fca81ad6e2f3471227907c3b690cab968477f40efedbe6ce80dbd303497402fee24c6
SSDEEP 192:DMaSojUhs3eYd1k7gaj74DOxTcAzKViVSd5ZcU6Qm/iE:DMaSojUhs3eM1k7gaj7WOxTcAzyiVSdu
TLSH
T1F0E1ABF3C3E5822DC91156F49A18AF1BCF1D0556436C3C1A84D8AF5BA3F2871E25278E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 87ad2156d7e94c8e1c0ad591cd3fee717c393716c1598eb4d6d18f0e09f35b97
MD5 dfc77d17b87f64def4489fb448574418
SHA1 37343d2f1b3aca70b15e9755c5234c178dba039c
SHA512 339c5189fbb1d2fee81a4aac17cfd69b0f2160d927309661b875dcbbc947ec43d7a574d68b5c6a8791947c032d9ac66071a73315203eee9ca85be2f7ddffb90c
SSDEEP 192:sxZWXR9ucBz5/f+swAV4EcbNDddpm181vHV+6+WNgus+F1HeT/Yam+VIgrJ:sxZWX2mz5/f+swA34ljHFgyA/j9
TLSH
T14F42E842AE24A97B8CC7D219FE15FF13E3F9502295945D88E6FD891C08F67DE120784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 863032b1e47f7996c38fbe5b36668032eed15cbe791aab46c26cb8e7bd3c1b2d
MD5 7f7fbab69ef8b4a43b4cbfce6931125e
SHA1 54251fd6d33827306c771b525f3d36210cd28484
SHA512 375887f992a0785d6f5348846444df7f02d99ef37283ecf84390f6a0ca11e454e0717d6103937c74547e1dba9f59243500deffca2963ded5e8934db88eee9acf
SSDEEP 384:sxZWX0mz5/f+s7Wvs334lrHFgzA/0x155lW:sOX0mz5/fNYs33yHFgGGdE
TLSH
T13C72C952A920D9BB8CC7C259FD35FF12E7F9502289915E4CAAFCC51C04EB6EE2207857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8758457808c88027266ae3a8e15a2896491cbfd26a89d92dcca87a3c596a4672
MD5 7769290465d2dc98f0f1d71350da83fc
SHA1 1da9913380b95780050b07306829ee4a73f3d640
SHA512 6cc8cef254fb886768f88ebc65caee5a4e1373df10fd49acf10b6061a4faf85465f76c76373deeca2a09ef9177d3ab539c428f5cd0c612cfa899d7b1e9b838e8
SSDEEP 192:sxZWXR9ucBz5/f+sx7V4EcbNDddpm1181++HV+6+WNgueL+F1HeT/Yam+VIg5NXi:sxZWX2mz5/f+sx734lrHFgMA/j/155lW
TLSH
T17562EA52A920D9778CC7D219BD35FF16E7F9502289914E4CAAFCC51C04EB6EE2207857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 63697ae3a104a7675babb15c5c9209798dac4a82414d34605822bc4d73a35135
MD5 703ddbaa1c9a8fd0d1f0a59e8579d965
SHA1 abbdac178638d511e7b71b4fca2fd21b8cd3acd6
SHA512 52b2dfe125ffaf8717e46458a13bb502315f80998635c5b0b94678a3537fdbd797aeb18d71d48b67a867b15e2835e574d99b99bbebdbbafaf15f25a3d25daa31
SSDEEP 768:FeyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3iroCmZc5:FeyQRbrWvvlpZu1jaXKLf335CmZc5
TLSH
T17FC2EA2F640CCB7E4FC01E9DDC6A6F976E9802C756688D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 528B
SHA256 e01e1bbd3658ca19217ceb8d0bb9a79d01a4986b65d559b5761cf96fdcc11813
MD5 c7b3cca57929a9fbe035e606d0db9f76
SHA1 12245a1aafac5674a882d988bbd95ab1e6829fc9
SHA512 8d1e6ae2b1ac82b5326ae4dff5165d94d49777efd96e36735508328aea3020932ce7e60aee5a152d1ba1da9bf0915e4f6a50ea838761c62fd468f04daf56d21f
TLSH
T167F0F1C83E1341DAFC200136303D65565BB401CC53502A4B30FCA0164C477847B816B4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 2KB
SHA256 e1fcb4b79fb1f9cdd87afe5bb58b332d48d76c866a356327ae7dcaa9b72fa7ff
MD5 8ef8ae9f8e4867a1c87db9824cdf394a
SHA1 61142e94f99f8daafc5532d790ee3a6bb536c4a3
SHA512 793114a892dbfd419739d096f295cf61ba42574fcdc6f7f80cebf1dddbb42e872e061243079d20e6ef8f3e5ecb515d3fab579faa7e7f43af607652e10dffa1b2
TLSH
T10051D7994E466BFFECA860B218751946377065EC47941F0B28FD643A7CC73781D8E26C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5917b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index~RFe5917b4.TMP
Size 528B
SHA256 7bb8c60a457b7570c65cc38a64376c759c2f025f5cc1f3f8133d4825ae20ddf4
MD5 cb84cd728087d9368d5572c694d4eecd
SHA1 f011d273e43791fbb896e947e9ea67e0ef8a93ea
SHA512 c737c79b23e4175f7ef03caee35233a89bca0e27e59a852dd3e24ea86d502e289ac46f8c122b6e1ce675f7603678eb1c852630e4fd23eb0ea441ccfebe122a8f
TLSH
T1D9F0C0C8561387D5FC044232E52D655A62A55448E3602F4FF1FA6055CC43BC05DC3BB5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 06721f87281f60f06d33999fc10fb359a5ef404a88c0341a3b2d46c32a05d55b
MD5 de4533cd5d348e9193c9657d1d26a5f4
SHA1 9b5dadb8c8f1edb620122ffaad7c21ca81bce479
SHA512 e7a61a888702fd1bb525d59c834619764735003b2fdcaf4a1e3887726c3e1c66388df6f1b63ac39df6fa013d214d08bdd75e7abbb723b9a2899e0d19eb04017d
TLSH
T1D5A0025087C1006ED03211BB19920A852300C8A051005B47409E4744DC604C44E866CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 31afa59678e8a3d09695ca3fbace3f8df896a01ccbf4c1d2602715ac88295ef3
MD5 57aff094b6e3a77d9ec4019f641326f1
SHA1 58a0291e309d90ed8afc20afada8a5731475b438
SHA512 09cc3782b7c86acb7387ec59b253bfbc68b4552dc8a80e6669c9751a9ff07f0c715e5adf517936767f36a3866a3725f30d938843f65e818925e202903da3f597
TLSH
T165A0029402902000C01751F65B9A16511715D915410037C7B0A4016CEDB55964F4741C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 98b3c776630ebf0b3ce7864cc3ed41c083df07d1cc3749bc0c7fa8e2ac295b5b
MD5 0aaa28a9f2aa0489cf6c604da10c3c32
SHA1 da8104cbc18903a7dcb1132860b11d31abe1f197
SHA512 216a909b59fb48fd3080933ec68062807befa199ae795b5c58938a3a195bc869f434681f99f13e57dc4f329132c244794821f84c9154944f819eed05e9161cd2
TLSH
T102E0DFBB3EE72824ECBF93E2193244A50505B8549999EC5E502AD2C754A13962876CB2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 a0ef3d76f850abe2f33168e98ed0e24ad6a787b7e2fab44b6ca77165b5523e7f
MD5 173545fe7087205918ff06e32034da2a
SHA1 0e628ee612a3215e4096324f1ed2b022745f7519
SHA512 f71ed0a15b3e8935819eac1b0707553c64f25a92d454e49ade102aa3ceea9bf863ab5b4f89af93a56bcee577ff6d4098efea55e5ee87405f30f55ba75336f89d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe595c30.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe595c30.TMP
Size 48B
SHA256 523f931abf59fbc3b19d43d834d063c4b6b2309043e318faab518408ad12c923
MD5 5a52c077795e90043821af99e461aee5
SHA1 05cfb04dde81d5a971535857c2a0e29b4c233ce6
SHA512 2ff53f7d5fa0f2ab3cfc982ca881f68b4baad6c219b0dff975c033a06c3a9f55b77bb3de0552083db4d5934c53b4f878935287d36841078551879d535a3ecf60
MD5 SHA1 SHA512

Submit Download

bebc653ad99250a2_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\bebc653ad99250a2_0
Size 193KB
SHA256 8ff7166442cfcfb3157689f2ba25bd1915c44e4105d3cae8959b423dc481acea
MD5 2f844a03a6622c52cc2c57d31bd50ac6
SHA1 1dfee50d4e2dc95bfbb51c399685697cfdecbe3a
SHA512 7833348e8b2753a09437b68849cf92baa9e8c0c4b89234bb8dddff6483924274b04aa6120f37ed431975f3c3acd9192bb6f8f009626e1300899fd1d716a940be
SSDEEP 1536:4oWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:ZrFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T1D9145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a0a6367daaed114689642661fea55ddf9c5e9f45fa1a4751a37dff20ecc90250
MD5 771e6e16e7b47972475cb9bb23ff4c01
SHA1 f507496d77844cac9fee10667539fc88fd1dce2a
SHA512 17d4802f703e6e80515d4e6d3d53c66b75e3873e48581e26f8b4b257c9614f663aca62cd970c49c8f5f035199b8678b36b7c3984d7a2e080088e6ec34ccb48bb
TLSH
T134A0021D95C40905DC10267110550644222188212D05C64759DCF044ACDB04553A126D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7693476183328f9ce62de7525ec2ba484e652c7598ba3ecf35b20d0a609f05cb
MD5 ec5e59862951cf6ab613d780f327ac76
SHA1 beb84beccdaf4359247014f6318424bf8d1abd7a
SHA512 7c0ea02034ae40607225bef2c2efa6c8e84f73770507284be765a91e987c007dae0a437d2d730da7349018e1ba5c16b1c67088bb3a40e055654e6cc8355b8ae6
SSDEEP 48:K08x8g8N8B8L8P8T8sb8f8q83IS8Z8sK98518T8sx8R88Y8q878x8bnyLdTNdTsz:K4ZGKSIAasAKtuSLKKscmmz
TLSH
T1F39104553BB7120438BE2D4881B1966B515235727058EE3FBFAC0096AD6AE0C1EFE4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f0d7485afa1cd101dcc46fd07d366c7a0cfd9928f21aaab85230632a56a54a3
MD5 cf67c6665384fd967804484ef3e3d757
SHA1 b4994d1fa8f8c075029f9dd7ad52e1229b43b982
SHA512 94322e1020f7988995c484288804b0541e16022c3a36fc7b3a41d46813b6f95c9fc81fab817b81ac9eff380dd71f3f95752e9ac27e0811f6637c80fbb4a41285
SSDEEP 384:TZcIhsNcSTW29T2p5u8iGa1fBwKvzwyrqYn45B2je2:Lh8TkkGeBLvzwJ04LQ
TLSH
T173829E315C78AC7B6CE3A541F88777139FBC81A797845F84D5ECAB2D01DA6E41307A22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb8b4e3ed6ea81c7fc26ab2a601e82afa6b740b066035c5beacbcf504c15d4a5
MD5 3fc90ad41cbfe8f05e763587e132ac94
SHA1 fcf7cf4c77704cec66ecf28a0fbfe340b0e945ab
SHA512 a6d3362e196c54cca78d3187f218375f10e012c8b8e9a390a86bd9d8014dfc0927303d7c5f4dc079fe58938be7f974bd03973160d34be0cf4d69abb8d1c9704d
SSDEEP 192:SON96iDmQmiUyUAuq5u88PGPC1/KXuZQqk2U6:SON96Tguq5u8iGa17BU6
TLSH
T1D7122A356838BC7F6DD2A961F48736139EA4416BDB886F84D9DC262C01EF6A85307623
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe3b37e49df60c1423ffefddd77e7f3653e11dadbd52e07cbe4ff887b6eb28c1
MD5 34a959a5ea375789c371f2211aa041d8
SHA1 42a3ea333bf50d2a62b443314b2b33b4c84da4d4
SHA512 ed361d7b52f1886a88ed79abe1a7cc50d2164b9ef13dd97821963a8b443dbb33b605d7e25f31d76c5d791769fcd5f843c87498aa0cfbfb2df6c84f468d1b3dd3
SSDEEP 192:SONt6iDCQmiUyqAHq5u88PGPCuSqczIU6:SONt6/4Hq5u8iGa2pU6
TLSH
T14502F939AC687C7B9DE3AD15B54B7B179FE4016FE6941B84C9E8161C01D769C1303933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 53a22dc9b37a98a887804e731490637e2eb1b2bd1bdf46bac6f33bb412b4debc
MD5 14ba84487f5d2f633a3509a8260dfe2f
SHA1 18975048ace6b0d8d90e28db95f7192668168194
SHA512 69b1d58421ee71412e66ed6841e84b1e5b9c5fae5d8b89521acdf894fa765f2698c5d9ea70c2867054df8877238299bb71c6e665cd943506ab108eef11a886a0
TLSH
T1B3E00217570114FBC438033000931B3037F3D57403B323865D1401791E973405E72B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594f4f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594f4f.TMP
Size 392B
SHA256 641c8bac81c314e90b7af1aef8c7834890805fb0d312008ce9c7e5520d57562c
MD5 8de6d99420c2406eca8e898d17b475e2
SHA1 a4ea3f7e532496bb5f0101ab94d5c73c7b952e9d
SHA512 bf66f92b7b06757769300563a215ed1f0f62a3630fdbf40051deda079c9c2873bfeb3f22b61eb71665bdd1c72d27dbbe20773fc3ac9f631a557e2b5d636874c5
TLSH
T10FE00202160100ABC434033000C3153036F24564037321845910017509133405A21B80
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

e41080b7-93c8-4314-a7e6-8df2e8c9773a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e41080b7-93c8-4314-a7e6-8df2e8c9773a.tmp
Size 23KB
SHA256 a87d3273f04ecd053ac01f335f019997af9f256154c206dea1f26281400c103f
MD5 4172e57022b8f2f4650879b375930aa2
SHA1 2201fc62613c85a4e0db149931e7dda7b6650685
SHA512 11ef58768348703a56f45b2908826346edf02af608e7fbdd84e9afda2b4b1fbb28797e7f297251b3e2b4702c86b5a62efb2b04d06d4ee30621764e9b4c6f1592
SSDEEP 384:CZcIhsNiSTW2Z2p5u8iGa1fdxVSwIuSXOkR9a4wKvzwyrqYn45B2je2:whYkkGeBSJR9a4LvzwJ04LQ
TLSH
T15AB25AB098A4ACEB54E6E4C5B886F6136EAC40B7C6889E0CD5F4F739309F5F41B23512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1a4a3d2d6cf2ffdc527a31472bf46d35d76a8247976b3a74b6e6b15627446052
MD5 3c2a207a0d6e4125c625ac823f64827d
SHA1 d4bc35fbd5d95762bafcf56121300d5ed04bdb1d
SHA512 3c855eadcecd1b2953c4a286c9a189122a638eb48cabf82abe507fe840eab9912f9dd872f604f96d597ece069837fd08019bca616eda6f43763af785985a2b79
TLSH
T1A5413759A6F91248B3B37E569BF6B8AE597BB9333F06C45D10010D0E0A72A00D971737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads