hxxps://dva-bc[.]netikrz[.]de/LIVE/www[.]versicherungsakadmie[.]de

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 09:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dva-bc.netikrz.de/LIVE/www.versicherungsakadmie.de
Sample260930-lf94msts8p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5956	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{BFC1486A-1AE7-494C-B2E6-B4F2414E3C9B}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{ED0EED94-C46F-45D0-B860-5E27B98F69BC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4248	3976	msedge.exe	84
PID 3976 wrote to memory of 5440	3976	msedge.exe	85
PID 3976 wrote to memory of 5956	3976	msedge.exe	86
PID 3976 wrote to memory of 5440	3976	msedge.exe	85
PID 3976 wrote to memory of 5440	3976	msedge.exe	85
PID 3976 wrote to memory of 2496	3976	msedge.exe	88
PID 3976 wrote to memory of 2496	3976	msedge.exe	88
PID 3976 wrote to memory of 5840	3976	msedge.exe	89
PID 3976 wrote to memory of 5840	3976	msedge.exe	89
PID 3976 wrote to memory of 5840	3976	msedge.exe	89
PID 3976 wrote to memory of 1816	3976	msedge.exe	90
PID 3976 wrote to memory of 1816	3976	msedge.exe	90
PID 3976 wrote to memory of 1816	3976	msedge.exe	90
PID 3976 wrote to memory of 4020	3976	msedge.exe	98
PID 3976 wrote to memory of 1732	3976	msedge.exe	99
PID 3976 wrote to memory of 4020	3976	msedge.exe	98
PID 3976 wrote to memory of 1732	3976	msedge.exe	99
PID 3976 wrote to memory of 1640	3976	msedge.exe	101
PID 3976 wrote to memory of 5964	3976	msedge.exe	118
PID 3976 wrote to memory of 4064	3976	msedge.exe	119
PID 3976 wrote to memory of 3172	3976	msedge.exe	120
PID 3976 wrote to memory of 4712	3976	msedge.exe	123
PID 3976 wrote to memory of 4712	3976	msedge.exe	123
PID 3976 wrote to memory of 4712	3976	msedge.exe	123
PID 3976 wrote to memory of 2312	3976	msedge.exe	125
PID 3976 wrote to memory of 2312	3976	msedge.exe	125
PID 3976 wrote to memory of 4012	3976	msedge.exe	126
PID 3976 wrote to memory of 4012	3976	msedge.exe	126
PID 3976 wrote to memory of 4380	3976	msedge.exe	127
PID 3976 wrote to memory of 4380	3976	msedge.exe	127
PID 3976 wrote to memory of 4380	3976	msedge.exe	127
PID 3976 wrote to memory of 1780	3976	msedge.exe	128
PID 3976 wrote to memory of 1780	3976	msedge.exe	128
PID 3976 wrote to memory of 3424	3976	msedge.exe	130
PID 3976 wrote to memory of 3424	3976	msedge.exe	130
PID 3976 wrote to memory of 3424	3976	msedge.exe	130
PID 3976 wrote to memory of 4868	3976	msedge.exe	131
PID 3976 wrote to memory of 4868	3976	msedge.exe	131
PID 3976 wrote to memory of 4868	3976	msedge.exe	131
PID 3976 wrote to memory of 1612	3976	msedge.exe	132
PID 3976 wrote to memory of 1612	3976	msedge.exe	132
PID 3976 wrote to memory of 1612	3976	msedge.exe	132
PID 3976 wrote to memory of 1788	3976	msedge.exe	133
PID 3976 wrote to memory of 1788	3976	msedge.exe	133
PID 3976 wrote to memory of 4160	3976	msedge.exe	136
PID 3976 wrote to memory of 4160	3976	msedge.exe	136
PID 3976 wrote to memory of 4160	3976	msedge.exe	136
PID 3976 wrote to memory of 5144	3976	msedge.exe	137
PID 3976 wrote to memory of 5144	3976	msedge.exe	137
PID 3976 wrote to memory of 5144	3976	msedge.exe	137
PID 3976 wrote to memory of 3312	3976	msedge.exe	138
PID 3976 wrote to memory of 3312	3976	msedge.exe	138
PID 3976 wrote to memory of 3312	3976	msedge.exe	138
PID 3976 wrote to memory of 3176	3976	msedge.exe	139
PID 3976 wrote to memory of 3176	3976	msedge.exe	139
PID 3976 wrote to memory of 3176	3976	msedge.exe	139
PID 3976 wrote to memory of 2276	3976	msedge.exe	140
PID 3976 wrote to memory of 2276	3976	msedge.exe	140
PID 3976 wrote to memory of 2276	3976	msedge.exe	140
PID 3976 wrote to memory of 5312	3976	msedge.exe	141
PID 3976 wrote to memory of 4776	3976	msedge.exe	142
PID 3976 wrote to memory of 5312	3976	msedge.exe	141
PID 3976 wrote to memory of 4608	3976	msedge.exe	144
PID 3976 wrote to memory of 3948	3976	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dva-bc.netikrz.de/LIVE/www.versicherungsakadmie.de
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff12a3c188,0x7fff12a3c194,0x7fff12a3c1a0
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4268092499996104261,12464757198941957278,262144 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17846200155433854436,14931368520080227022,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2544,i,13582938026260170764,8457716546497228,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11921149129117644785,9652592843365780972,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14234167579833727212,17004315026398332119,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,9336937157406073992,10288832985985592610,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,4905904959754234158,16937498459639259153,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,12497725650395583221,12738630210881994688,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,12497725650395583221,12738630210881994688,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,2089320446588737255,6443858411689309282,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,6386812290910666343,3974514994434958471,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,30368530618099231,7605296969711732327,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=2908,i,5919982561490822780,7412773170266404320,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,15001743522842023488,16779123140553899970,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,17347097762032534395,14433980463522915123,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6688,i,1291465789019475759,15206181787622547348,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5340933699734523854,1183282771926859386,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7056,i,3561601585791658786,16433796039707069660,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6680,i,13837808197068877374,9857984103031042915,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6984,i,3782942694051014867,2582426439201126373,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,1590578041245306587,8335489839709667055,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7164 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6552,i,17518158174135512857,8922943809637810794,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7260 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5732,i,5157721061110891861,10974019797942243915,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3608,i,10208343551290390982,1046676764846017223,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7188,i,15896008316100032135,13126398499931456056,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=3564,i,16183972008030048205,2441195525921368146,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,12551820654413310426,13531082004409344388,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,689881259142677409,17816303757295454719,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7336,i,8224609351791910229,4183928866271238812,262144 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,8750448198560095547,17031512107874350,524288 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=34 --always-read-main-dll --metrics-shmem-handle=3052,i,17123476021938361149,8245856722962986397,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=5208,i,5269230799314202628,167979385000343650,2097152 --field-trial-handle=2260,i,16898258415094970240,8578150927096348374,262144 --variations-seed-version --mojo-platform-channel-handle=7284 /prefetch:1
  2⤵
  PID:2900

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 02cd19c48185d57a30606658bcbe30afcb6ca619c09720d351e767bc53cb392f
MD5 bc592675d69ed1b54fab05ec2e557e46
SHA1 cf7c1c359e4296cf6959a9fbd91f65da51242057
SHA512 b2f1862af0741e4ec5bab051de74c120c2f7d47768ab1ee938d719833656ab922e7dd31c9ac1f3a2545c5538e9ee7ad2d34731d90a4a5d9e7e33d97368f8047c
TLSH
T1ADF0F9F5C825AC3B08FC1B1950A50646E751235B2680988F3B3DD11D8FB1A3B968695C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b1
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
Size 437KB
SHA256 a451b8791f9183f16a2b30959f9f69e20f35117f8ca6e34e463916869328f3c8
MD5 15d9ce7fe8b446c91cc0598983dde50a
SHA1 b2ad1e9b11a41f5176e3cc495dac68aa26e0955f
SHA512 39e14f23bbde8278b586057eeb648777afc1e6d11b71f3e5529688341f7868b61d0d7ef43cc925189a70def4a6b53e863a06fc8d36e7551c9a50745be6607529
SSDEEP 12288:9SyJNj5Vy52pw6eyroMIW3/dJhlzOH7pVUa0Uiku:9vJzV1pw/yroMfCIUfu
TLSH
T10B9423CFDB2108E7FE76C411CDAD9FE8049BA554056D8CB35BB6066D825A0808636FEF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 19KB
SHA256 c5568357926d9093300b5bebf2cbac9b7858c01e02a91bffb340fd82e84cebaa
MD5 4b3383678fb336d03c007bfd2866a88b
SHA1 b682b1b294fe4249892a2ad01b3f698818eb9e44
SHA512 31e895452bf27f190fd40402a4ead790732079e628ad10a0127d092cce07247623ee3e7adfa53318089f0b6e165f7021392745cda3a80da504c52a0bb9cb2639
SSDEEP 384:dZrK5HrsMuzCak8oBfXhjPLBKQiz43bSmIZph55ZA8RD:dZmtwMkCak8IflPzLVIxJA8RD
TLSH
T1FC92D062F65AB8D31CDBD782704DC540C8A6272BEF4A63E51EF67566B31B0633287214
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 21KB
SHA256 bed514a326972fc0947503666e200e60295a7aaa789818138ecd4b41c3f359f4
MD5 5b3463c6a60e81bb4d17c13c1505db8f
SHA1 317df981ef3a0c242e40fa964368c0d3b75d8623
SHA512 3979438111bcc157cdf40c9091dd24503f5262a1cb494b904ee07a1b8b0124733a402dc800e5687ed7605f131a59009ca1ab85f56f17eff152e98bb47257a274
SSDEEP 384:2S7YCn02R1hBPf/Ezj3hnGuiXIc8lkE8127B2qViOIiw2aBhr46BgD:17YC02R1H/i1GuiY4D1bqViOIZRBhrns
TLSH
T14CA2E18345D8077B4D214902E119B8AB9F27F1F7CF76E90BD04BA96C44E463EFC41562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 55KB
SHA256 e014b51f3166ff2805e4baef95b0e004e5ca6c4458d79d7120e2e0d8c7338f68
MD5 80a436220dc6d81684a4eabf404fbcdd
SHA1 44b73c2bb1a8ddcdf3f29f3cbdac0d9f9f8443ef
SHA512 e0d8e95ff9eeafcec567fa91c09707a9de234fea0aa0269bbc5d9f99726c64bbdbc671ad09ca57cbd151e21e0c5d24574b203e5960bc58e3729266c4d8945d3d
SSDEEP 1536:56rCv50G526N5hwRr1PvZISibAZsop6Pok0:5+eLXDwNZvZISnLoA
TLSH
T1714301E109CA53C388AF50C392110BA46C04512285EBF6EF91EAEA5C7ED247D711FAFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e3
Size 48KB
SHA256 5e33bf2f0d9e4f1972541bd8d9c93638749bd4cd58ea0f9c06d75f8b6dfd9fed
MD5 def500da7fd9a25e142404b51d5e612e
SHA1 a78db2d7eff7a911b4a7623ef9d375e6d30918c8
SHA512 e6b1fa619695d56f0e623dcfacfe5b6a1621a5e2775e3d52de3d0d1ddc309b8f22e7a6d3a082b9c9122111aab25afc4ebb5467003276e3fcc06786ffd06c12c8
SSDEEP 768:aoKgbJFkXEO8hvtxjaXZZ0S/hdmwL9BeTYs/2c20R9ha6rgsa2yTdY7:ao39zO0vP2ZxJrLXeTYsec2c3aagsya
TLSH
T11723F101B9BC0A481C6C6BF777514694A50CF54B5E98989D13BC70ACF2F3BA4723ACA4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
Size 66KB
SHA256 623aca813ce052d152be2f37a139f5d9d63af079cc9e840ba22c5727d776e372
MD5 2350554909fd1f2489604adf52c24a50
SHA1 65c277e55733727bdecf4b3c04bc0532c91193e9
SHA512 1ff266c37d189fbf9ea4dd66b6e397df72cc295aac2112f33cdd79739255b182e60c867d8b89311535cfce4dd1053bffa58e15995fd487bda82baba9b6eadd45
SSDEEP 1536:RNPa5tE1dB6O5NDZHs5ixnfpN2mDUn7tWEIKXdn833rHbDXupGOJ:RNS5rMHs5ixn9DShHp8z+GOJ
TLSH
T1FB6302C89724AA3676243B205CE7C1F4C33F3EE6D65A2AD79954E8A524108B702DDF3C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e5
Size 98KB
SHA256 db5c86ec53fa77aa6ce91529eb6e5ac4b424525d8ff6a8568607acac62c8880e
MD5 a6535ee55f99a5b320d804f925d5d1b8
SHA1 6b8a3a1a8638d3b952407f29e2a8589683c9deba
SHA512 1d31551146001666109538be97f1adda8af83ed2205ee987304b844fb8bed9715f4ff04d991f4fe2cc1b9a944e31c8c803497bbe37b668003c882748c4699003
SSDEEP 3072:MoYow0i5TdiYtDnUugVQR+JcF7K6DN0RUgg:lE/bikTUuRAJcgAiNg
TLSH
T154A3129ABB3A16168F7D29D9D2F17ED1C4CD23CDAA061CC2801DF6586E886E41A0FD49
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e6
Size 98KB
SHA256 c469b5fb7479b3b7cd4ef9a0bc61f12980ee239bc0970d75e120b8474db55649
MD5 cbbce8da225ae18597538f0c63f9ec82
SHA1 f724871d62f9741309cb2938494158457f3d1382
SHA512 767c9608b88f263c79685e1a339d84ddc7b0ddd19712ae26beb9d8d689171d0e882430c2d62272ee332ca0b60d944aeced0affc9f0aea71f7cba405d31c553b0
SSDEEP 3072:N4uhosG1ZzDi3o4ZTMnqoeCkcH4t+HZY3HsjeSz9Gz:KuaZvi3NiIGq6ZjeL
TLSH
T1CDA3121E50F6C45C0593848DAA086FD9A509B607406A2B743EB3C3F6183FA97B17AC5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f1
Size 444KB
SHA256 460282e3d2164f265ec1080e8e8cb7b6a5b9112a9f181b793a99ffda3f0b6fbb
MD5 c998647ac457ca1e3ea10513f795c220
SHA1 5562adaf8ff99fdf44b4649a04bb91d9398fe996
SHA512 eb08e604fb0251a9792884988dd7e3e3159d132aa5644b4c775228fa95b6661177b9831e60fa9957f96c7a66ec03f5a5d9be1d864a5c83e447bbdc70a91f56ed
SSDEEP 6144:+MPlRkqfZZE/pFLLNbANaxGTzLLl2Jf2FL70zy73WMRbROQ5LZPg:LtRngpFLLNJWnpxey7mo3g
TLSH
T1B9A4231134B4A086525540A0EF4E2E5E03AC61D193B7CCF2EF5FD6EDA8C5B259FB2389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

851139ceee987361_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\851139ceee987361_0
Size 305B
SHA256 718677048dea40d24ccb3919d8f7ba513035d485b5689625c7be242c51385f94
MD5 9d307c5ea5a00f261ad373a0c2d565ca
SHA1 ef86107c22f220743863efeba24e48e515b71c67
SHA512 b1dc6477f653436c97035ce15840d3d5773c33dde00c0e6d34c9212040caa7acfdc3e9f559f8eac63b55af4cc3c6bea955df43f22361ad8550de3fc82bb806fd
TLSH
T1B5E0E7E310442018D5FC51BA43A2352EE53780844FDCD5C15180C57613105B521DD473
MD5 SHA1 SHA512 TLSH

Submit Download

88c5e53988e625d4_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\88c5e53988e625d4_0
Size 58KB
SHA256 269f90238426f3d281b18bdadd2b89dccdddf5ab6dc8006dbd580725022d8957
MD5 c401755afcb511efd0021c2100237863
SHA1 601c5cd2886363594c544a5d309afb0442f20841
SHA512 bd56e6dfe133fa86da1ff8ca6df6281be09e198a86031315b5990af495c25829cca882a10c2d025648c24635cf427677f4c938808f0bc77748752d7bd4e77a6e
SSDEEP 1536:mZCZjbojnohIQMC/OXHWD3GC0L9WLBin8/9B/lBpqV:hIoGdC8a6LALBH/9hlL
TLSH
T18D433A8FF1D1B3258DE2A6E2009B660673BF64256CD9041EB845F7F42A70D8B907EF25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c60c18854767028004600d2a854913dd5b957efb9d4657de42f277d4fc30e240
MD5 62ecf6d494e9ef12dcb1a684364af4db
SHA1 d54ec3a1936c97b9a2185e00cb08384f28ede756
SHA512 c353486612ee70768f13f648a249624cf2a6e49a98fe4a85c9d48a229df4035ae4a215433fdb19a4f918b2b61ff8162f11480ddb33074173e03a3f3566e8f479
SSDEEP 48:YALlgyDPNbOC8NsCD9CCDeeXCDTyslVRsPfo7gmzsLWzBwEs5WCvsGWC7CHCnOC1:D1tOg3g4VwahzBw0bGcGO5HzRBiikGO
TLSH
T19F9188F7C3E9826DC90195F0AA14AE1BCF2D0556436C3D4A84E4AE4BA3F2871E151B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 6053bf4af54258f2abfb5ec44db5a5041f0afcca3fbee0b26edfdaeec8038df4
MD5 34abb7cc0ff12301c599db1146c7d014
SHA1 5afeaf96538398848ee55d16e667a92a93c64309
SHA512 17dbe568874390ed396b3ac9108fb06a2b7be97adc6e49b0a9a4bc73561defd6a82b03b27063f809519fd67bafae9ffc47c40cdd519a35e220cab2ddb3fad678
SSDEEP 192:D1Ag3gQXFCoNMyJ/J+Jhwahozc75THiikGjcpgaPkosivsfPANPuZ3kaE:D1Ag3gQXFCoNMq/J+Jhwahozc75THiig
TLSH
T15212ABF7C3E9822DC91195F4AB15AF1ECE2D0918432C3D5A88D8AF1B93E2871E15578F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 aefc54879f7a32a677ed9e6dc77493e8efed6a46b9ff3107cfcb13f632ba498a
MD5 19eb30b932e0e899f159e9c9941058e5
SHA1 4c8d051b4c216b3b1b922fd691326870ded49a1a
SHA512 0abd057f4618735605d4034caf24d5c27589e29007fd5a30f66e8706cfa257269548ac64c8b49805d851be1efe1bbe24fc9ee6068bcc219870476b2988b23307
TLSH
T1A7D02377130F30759A5C1DD5F156ECCFC76610102802D9D514D0A4D90D3145C06571C3
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 dda7048792527babf0b457c67ef04c34f577d3e7e0c8be336407e5bd176ed437
MD5 80cf52c3e527577b97afdee4ed4692e2
SHA1 06fbe6308657ab31765a8c4e5a37897f564d8273
SHA512 bdc135fd0c56ebfb42a6ad53e8406754994628fe07dbd3e608ce4c5af86f2a0a8d437398d6632d29af3eb1189e2a5c05690cbe53c418543f82ff24fd6db59f41
SSDEEP 384:sxZWxC/fAseOZXf08RI6HbVa8/F/8YonShOSsN:suxC/fyAfhHbRF/8V4O3
TLSH
T13E72F8156928987B8CC7C519EA397F52D7F910339C954E4CAAFCC91C08EB6ED2203C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9f2ba4df971b455ae2172e0829ffbcd5d122fe3a3ccfb2d7fc68e9b7b204bb5f
MD5 6318b5f785be6b8b6684663260a0602c
SHA1 37abb89153a5c05b9f5ac19ddfe4d94b988d8223
SHA512 94c3e70c63d272efa5047a4d869718b70ff49c043f4c3e9e3b0a53e9eecf5d8d4f70e860a2a6412f0c8c75f6892b349ce76114a697ad89b8b5e5a088586227e9
SSDEEP 192:sxZWRskC/fAsGQZZ3Vzodp5fHW6+WNVN0V/YbIy0Y4bnIgjEJ:sxZWxC/fAsGOZ3+tHbV+/FLYonjI
TLSH
T1A942D915AE38A97B8CC7D219FA59BF53D3F9503390941E48A6FC8A1C14E7ACD220785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e524417aec3aaa41ca2bd074c08a14e600992465053983ff821326be408ef42c
MD5 a8075486c110fe81c3b888ab97f0ef58
SHA1 2a6a7639cf68e052c54eea45aaed3bf16e10e0aa
SHA512 8cbea8cc30c3529fff155ae5150c4af5f17c5406e6cd855a9a810d0848ae6c85bce6f86136aa38997980b3b49554f9b393e46a24ad2e5648a6ba563cdf3ce3ef
SSDEEP 384:sxZOEC/fAseOZxf08RKapyHbVgEHeQ/riLG/FM8YonShOSsN:s2EC/fy4feHbS2FM8V4O3
TLSH
T149720B566924997B8CC7C119EE39BF52D7F910239C855E4CAAFCCA1C04EB6ED2203C97
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6b1ca623e0d3348d6637d4efac8ee594c5393acc2983021826010b988a749eb9
MD5 ea274fcdb5b041b726fa0b05a701d1c8
SHA1 880bd8c826622f4d57aa15f61c120f12fc75e1c8
SHA512 aa55779a5d2466dcc0fb999a5aca5ad1bce540e1b1ee65635da921e8bd0c45cbbef5d9ea8d34a6f4f8c95857d9fcc4e1369cda77acb5aff1e33426142977839b
SSDEEP 192:sxZWRskC/fAsZQZZ3Vzodp5AHW6+WNVNP8fYbIUO0Y4bnIg5YEJ:sxZWxC/fAsZOZ3+SHbV6fFU/YonSI
TLSH
T1A342D915AE68A97B8CC7D219FA19BF53D3F9503390941E4CAAFC8A1C14E76CD220785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 13860fceffe2bb6f4477c01fe0f85cc371cf2fa0a6240c62c60ff4dcb672f01b
MD5 77bb48e4becb54e9bb80a9a7009c532b
SHA1 be38576b19775212a8920f71d9140c5cb319f8c9
SHA512 ff259e20283d4acfb5546847802d978c2e5b744464f104edb6f92abdfe4f8e1faec8f9b5b160afb9af60f8cdc8ec290dee1ed97d01470900e0095ac6f94a43af
SSDEEP 192:sxZWRskC/fAseQZZ3Vzodp5AHW6+WNVNP8fYbIUzwy0Y4bnIg5YEJ:sxZWxC/fAseOZ3+SHbV6fFUz8YonSI
TLSH
T1EB42D815AE68A97B8CC7D219FA19BF53D3F9503390941E4CAAFC8A1C14E76CD220785F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ce57b687730964f84d4a5a28f2abb6bbc74a73805aeda3a4cb81b2b67fee2d05
MD5 e567dade181e9cfc4c164435bcfd77bb
SHA1 5017746ed6ce62090fec9393f7f391e640c15a60
SHA512 b81091c99b09f57f43eb8d3a8673d2e82239b608aef82fa38b91d011ce7ac2165d8787b3a6944992a6536a83e7fc130b2841b8a4dcb4c5501262b7d5f1654780
SSDEEP 384:sxZOxC/fAseOZXf08RKgpyHb6HeQ/ri/Fzw8YonShOSsN:s2xC/fyAfyHbPFU8V4O3
TLSH
T17672F9166924987B8CC7C519EE39BF52D7F910239C954E4CAAFCCA1C04EB6ED2203C5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d35da11-dfd1-4f40-91fc-f923bdb6ebb4\index-dir\the-real-index
Size 72B
SHA256 eeb1ce8173e2de627a2be8e4a072bfde3d5cc6d746e30bf1933a53bc75dce3fe
MD5 07d3370ab0952b68beb8577ea09abfdf
SHA1 4b8e6c5cf27f118a0aa74e71b93ba166d510e65f
SHA512 4386c0b4f336878bbe6ab75c8ace330240f9f04a1b47011db230ef42d98d45a917fdacab848470ee001c3cd06de7b4db4eb8c40e3b120fc94183fcf3e6903f90
TLSH
T164A0022307C0004DD01692F5256243E25312E8121540170B40B94444CC614804F6100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4d35da11-dfd1-4f40-91fc-f923bdb6ebb4\index-dir\the-real-index
Size 72B
SHA256 45e73fbc0b409931f528b8f084d33d0a5c23c3a7eb483b80e106022bc40d0283
MD5 c0d32aa505e92d8ddc2c657166263abc
SHA1 cc0164cb9ba2f2b34a104d5c421f00d276eb6079
SHA512 831c152c8fba8083ddea0d323da0af93f81626392bb6dc3015312894630ffc7e0501df54a0dff4e356c4c38cfad31b6f44e2eacae8c41afc25a190bc41d26a50
TLSH
T184A0022602984405C4022EB12B9357576314CC2F170563BF41A74854FD9458459A920D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a65bb451-146b-4a80-ad6a-24d18951150e\index-dir\the-real-index
Size 72B
SHA256 63a8f9140b9ce59a03fef7e2c35eb0c99049653885f993e80a402393463f7424
MD5 8ef97da1fbc1972d8c2acdd1b26fdf1a
SHA1 633018d779fca6596e9a971c4916ec40f069ec13
SHA512 50f435ccab776013874a603004f192950983d5925d3d3f21d6febe31eddf04afb5fa6825af3022773beeb7f5b0b669a458332ce586538ff789b7cf39441d701f
TLSH
T1CCA00211416ED002E50462B07093337176199919E10113CD5FF2E0B49D985C4D651882
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b6f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a65bb451-146b-4a80-ad6a-24d18951150e\index-dir\the-real-index~RFe59b6f2.TMP
Size 48B
SHA256 898dde8a41df82aa73c85161e2ee6ba897899d42cf2f55789a00753032683ce5
MD5 2adb82f4417978f20a50887e6d700a9b
SHA1 e68ada7f23c87d67bded836ad02c5d68702ac1b3
SHA512 6347faa5e74990336127ef22b304e35fa19a41cb34066da2ef3e9e029a14af1ac5767eaa5ea2b67d554f5917c31dc943cf9c0af5441ac808507e6aa62c14f1c2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eb4796d7-0c8e-468b-8bef-0ed78941b4f5\index-dir\the-real-index
Size 3KB
SHA256 b28e421969a1e155e98623ef27b7125f6949db9be5dacf1ea218eebd6dc65382
MD5 6221f919e4f3873dfc02a738123a5db5
SHA1 4fcfc9b52f7d1f6f1d6cc05c47dca15a13ce4c56
SHA512 9fce6965cb8b68f327f3541f0ed0a52f4f89d11e4ff401d6eebf7dddeafb564b7f87726bf73d6f9758ee489a4c6a7e945105af6c7878d297f4b0dad8f32b730b
TLSH
T16C51C50E0E622B6BED98A3B205B6045A3BB065CC6B545D1B58FE9034F8C3B1D3C69215
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eb4796d7-0c8e-468b-8bef-0ed78941b4f5\index-dir\the-real-index
Size 864B
SHA256 00ffcdd400513d67e6a2cc3d0aa876b901dbdb27426c4b2fc4178d909fabd314
MD5 7b66bb003534bf7ca8d1e4baa13b84de
SHA1 df408eaab8cb30f3cd2f8e6d63ae9c9edb4b23ea
SHA512 2f5eca6516a4cd7448beaf583af1c6aeebca0cce881a95cc3da7d87eb9b030709eafa3d787b2bb76954be579039ae986489d078546b1b619082fc4fb47a09dd5
TLSH
T1A81162D91E835E4FFD140334143CAC4A713401DC2350730F62EED2298C9B700BC81AA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594b57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\eb4796d7-0c8e-468b-8bef-0ed78941b4f5\index-dir\the-real-index~RFe594b57.TMP
Size 864B
SHA256 ab9aa0673240cde2b7b82730470dcfab55f478db2410054b2d74309e82705ee3
MD5 0583f21be9564eb38fba9e6ee47c3c96
SHA1 d6f62b9bd5f0fec8761bfa14e62ae0bb5c301482
SHA512 c131c5a2cec44335f6c900215ea274d2d1c6fc81db3bf94dd4cac62ae8e0cd0375ab5397b5c9bd26ee6775209a4ed680f6a9d6e54e80b3cc435070779fdd2f5e
TLSH
T134110CA501538B06EC4803709A2CA94A717542446354678FA3EBA12ACC92B80AD82FE0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 479B
SHA256 645d93e2e4dd698467040336858eb93c5a94921018ba6f1d9061682d22dae06e
MD5 9168dfe6c00b519aed0dbdc25172a447
SHA1 fdc274e19b6d661e58fcfffb91d981faea04bbe0
SHA512 25ae84beebdab4aae234478af9d5ebbed4f25d8bbc636bf6e3655fefcb9d875b70370363f080e0f7345d68048402f5111ff2dff2006e00a32cea46f5fe70d05a
TLSH
T1FDF027B72EF70C54FCAB93EA207140A10515BC14D815AC0F602BF19792B23242459CA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 474B
SHA256 2b577e30cd795064cf4ebbac2431623036acc2e321023d07cbdc234d2d126fe3
MD5 3d19d735454adc26be7d413c1d1d467b
SHA1 c223a3d5acdfe554eba1c1fb0f50a889d264fae7
SHA512 784018e7411345b8371da103dbc0212308eaad58168923e6b578c694bf10fa2c0737a101e1e4bbfb2528d95010d6ee4716981192d2e0d45d7dc1b19254ee5253
TLSH
T124F05CB72EF70C54FCBBD3EA207140B10146BC14D825AC0F602BF1D792F23242455CA2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 68a22813e1b0583b32c7c1e8457835b09596872e38570ea1d509673965022fe0
MD5 df8b275f6316be81e1865350007f1afc
SHA1 126d639c5d09431240bd43e13ead2ccfc7e74891
SHA512 38cc6c484df1e420d3f050e4cc839b9c3f417a3bea93dd8cbcd87b1caa30903ff0829515ba0f197666229379c3a3d403b920334cbd188c024cf9822a6f240ce4
TLSH
T1D9A002118E8E9042CC20467555B6569C37704899110A139A84DCF0B8FED356555C3D41
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59a0e9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59a0e9.TMP
Size 48B
SHA256 492cef256967e17900ef608fef98b4a2a8a31f8e8cb220b4a74d229045961565
MD5 41413b47af0fb0bce7cb8d1068bb4d35
SHA1 bca28360287a51fc48c7c8288f37e26c3d647b47
SHA512 a3f31be8a9e56a9477220adc1bda9a636ff85c1ccda2191f30ec5365f92376d0a102867cc2f066783dbc5b7ffbeac58dc228cf44ea2c7bc31c4018b371b3f545
MD5 SHA1 SHA512

Submit Download

195d2e876257c77e_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\195d2e876257c77e_0
Size 255KB
SHA256 ed3bcbce3b0280f673f7161a343be0714770839a8252c74e5199c3b81c281596
MD5 60812aa3ce3cddf1f998307bee6aa377
SHA1 b7c5414ad9c606ce3f585b45492ab268d55f49f0
SHA512 fb9cd93ad1a8358777b1b33b2ff89f9b6670cfddb569f8be7dccb49439e64daad6d056656b369a46839cdd8e526883a01078922b3592a13ed6b4fb1163b29f67
SSDEEP 6144:nNLGgJZqvkH2TGzW7+/6T3021ZprEghn7U0eK08QiQyIKZ:nNigJZwyzW7VrESn7U0I8QiQyIK
TLSH
T1F0447D723300F13FA8278EA1A6BA7F4D3825E217DD2706B8D5E4E5358FD6DBA141264C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98bed3b1ab31fc9f_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\98bed3b1ab31fc9f_0
Size 193KB
SHA256 de9a28b670ae12ef2e9b33bd907c0b9d15fb1449abb71ee6eeb36a45315ccc5d
MD5 74c72903ff1d31d00e618c9179727f19
SHA1 429c408150d000e71e1ddc397b0c787e8856ca07
SHA512 43487935124b041e79390b1bcf547cecc618bf85d277d809a8ef74170db61677e1d885929e9df196313ab7a4fcf95187ff9b911355e4f364f27d6d0deb90f6fb
SSDEEP 1536:UoWVFWcK8jE3VIyj/OznBCj1O8/vrbIvUB/wIULnqSZEn7zCo5VeJUuBHvIKcb89:NrFWzBlGbIvlpYPIbPIf8XFjvyuVb
TLSH
T1F6145B755300E43FB923DE61A27E7F4E3C25A167DD0686FCA5A4E430AAD3DF20526B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 120B
SHA256 00a65467e921a07387a85e421a54b06a8f72b8edd64f1842e86389a75ac981e6
MD5 7f8588806b8f10346199e348e8cd6a36
SHA1 d1688387a4758769bc5b940f96746eae1fa332ba
SHA512 f436b373094882e916d42a08bc1111d63910a4cfb7892a9cedd59fbb8aa30856ffb5ce8a96a9027e49a93c595b1568b821b2deab49123ee93176b8aa47430f2d
TLSH
T15AB0129558C25E21CC0D02F061C7C84012332A2006018963008281F9E2231975100C2D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 48727ed073decf272987a6c84b8ab7bfc40f573a477b4f9abe7c9d5a3b10c726
MD5 527a0a3cbdefd6a3be7c525ae042619e
SHA1 915ea3fcbe0b86396d9f2486a37df48d24595849
SHA512 959170a83bb748ad346806538878a34b7e22bf890cc61f5fa6a01a8233277cf1386081501c5ab3d91894021e3bb3f63377331a812e704618d9693ad2ab068a51
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIzZXUBQEGK+c:OtfFvpopPxrB4RhfIlXUBQEGK+c
TLSH
T1FAB2131471BA021138FE690C81B58B2F464232B33159E76B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c7e484c580ac11a2b756cec14b64ed06c2c220c2a7900c7cbe12354a77040730
MD5 6062f33c38bb33cddc216b727dba70bd
SHA1 0ff7fc6a7e430597801dfccebc5a71492a458196
SHA512 e882e40e8b03e55053aabe30f56f77572034d8c91f7f98d915ac6e6acff8cda0068d2626c7506fee41a79a1afc733e88bd51e9ddb31bc218b7bb866a22085b95
SSDEEP 384:nkMiFiZcI73sN28TUNTUlI4P5mg59ZK2fMBOHLtuVnp9dVZh6DKhHegL/7IzKof:k3FQ73/wgLkyBOHLtIdfYGHZ8
TLSH
T16BC26B32E8A8D9BBECEB8FD5A64A7A43DEE04153C5CC9AC4D9D86D1D009719D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b135f1b2a38c0a64ec47b538ec9ab00a596d2732511c7a836a1568032d2869f9
MD5 f566d9ef39010f666a8ed09f5dbcd1d0
SHA1 62a5b6c2d07dfda43549301dc29214b87af2aa67
SHA512 1c8355e9d5a20dcd57f60110eb6b7fee700bb8aff486312089913e96be094a0733f743d8318f6e6c4ae9ffccb5c83768864190a8834af41eedd1bd4bfb880b38
SSDEEP 384:nDnMiFiZcI73sN28TUNTUlI4P5mgDzZK2fMBOHLtuVnp9dVZh6DKhHegL/7IzKof:Dn3FQ73/wgLAyBOHLtIdfYGHZ8
TLSH
T155C26B32E8A8D9BBECEB8FD5A64A7A43DEE04153C5CC9AC4D9D86D1D009719D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cc3dc0ac7f8f9eb95a9a80bfd5ae11e26f13331dab9495c8f2e1e445119a0c22
MD5 74d143fe77f3c0a9959c117a1c0ca996
SHA1 6e5a08ec4a3fe79d32e72582c4a2d3e959161eea
SHA512 b67244b65df0b5ebfe3877325b9ad0aa80740e3e8463975add5d02d458cb88cbf3a6947978c04ae6fac57bc8e96e528cfd3c69626a3b6b1b1ee415411d3dde1a
SSDEEP 384:n0MiFiZcI63sNw8TUNTUlIm25mg5jnK2fMBOHLtuVno07O6R2FeoxgL/7IzKoG:03FQ63RwgSIQBOHLtR07TRVl
TLSH
T1D5C24B32EC94C9BBEDEB8F96A74A7A07DEF00163959C89C0DAD85D1D009769D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 b82e2a5017875e6248c27fd0dcc28a26ef51aa179ec6c372a44dfa0b8578eede
MD5 7de3cc1efa9032c9ad699c70ef3b0aff
SHA1 7600183d2b61224549b182ccf664a7cc46e94da7
SHA512 be7bc1448580e153f574dfe4dcb2db13f886b65998d1ea6040a7fa2e2576713bf9c63da5172e01779d2b0e9940fc25bfa99e9ed4e9ce4c6ff684d9e1580d6e8f
SSDEEP 384:nDdiFiZcIoh3sN28TUNTUlI4PTOmg9QEi2K2fMBOHLtuVnpDdVZh6DKhHegL/7Iz:DUFQs3/wg80ivBOHLtYdfYGHZ8
TLSH
T1BBE2C3F298D798B7E8AE4B97A73E2D4299FCC113B1884584B7C81D0CCC961BFC706816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 782e933f16f68bb0aae365467e398da7695cf86f7b5662ca8604ee8c3ef78e4d
MD5 0cb1cf585dff6c7235362ef7121b8eaf
SHA1 dbf2471a28411f46a33b51b744fede48c238205e
SHA512 1b0781a91ce663f208fa329a17d39f588d28ef8932cd90fd8e0dfe24c182e03b93fda48a6da9913a92a5deba8903573bc0222a03c8725b5e3f44b78e7b1b662a
TLSH
T11BE002075200007AC02D133405D32A2169E5402002F301455A2046681C633003631F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2052a97ff8802b90b53d64cfca0f8a39d229623fe827c950e761ec2f1f4324b8
MD5 1c9f4bb0ff2c1de712135f86d54f10a7
SHA1 4f9a2b2732cee9c434a1d74ae9c60eae965b957d
SHA512 9ca50bc98a80e9e00c7b74370eb1be41315e285b5f59ffac7aa20c015dba4d01e3567c2650ee00866edeffefc6c8664af62caaed5e2ffe2270dd397d0fbe7623
TLSH
T11EE0014B930011BFC039133805D36F316EE6802113B742465B30567C2C733003A31FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7bcd8e516505c1ba19b8aba56aa37fe28bfbbd5cfa0cacbef6669bb6f68eec4b
MD5 5eff98ccd390e289e6ce8fc3c8c41adf
SHA1 40a46c2c374f1612aa4f84dbbaf68878dce2bd5e
SHA512 3233431d219235a18d46bc53ee9a0534bcd2c5525ccb3b32f43964406ebd7137e2e8e349f539d29898ebe30c76eefd83a44e41e21cd9045306b42fa4528a05b9
TLSH
T125E0094BA30041BFD139133805D36B357EE6C02122B742475E30666C6C733013E31BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0b70266568019b374f5f076ae812396756e3d79063aadde6cb9a85542c2cb080
MD5 38d9c3e9fec5422c61b1c9ae9fe9e558
SHA1 05f8d76349d2f8731457ed4afe5a117ebe6f9461
SHA512 c5635fd24d468f72b17ada722edc0c09eeda2c48f7f8ec68b158bdb530ec04f200aab9f1b986a2d62ed8508f53b9b9ed98c46e3334e009a4df295e6f42a76a20
TLSH
T15AE001469200107FC039133805D36F216EE5802103B742465B30567C2C733003531FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 68928c88d521a9990abb75309bf7f3570be2df20a5f8abf55a86906810bb6a03
MD5 f0e9fc2edf027d77657cfad30eec3489
SHA1 c8322a77405ad6f17e124665b6c2bcf8e982205e
SHA512 fa76c07b01bc754a0969cd09bc3ba9582a2c59ec60c5a304634fa69e18ff9d3d4758cea0ed01d3a6f524e2f2f11c0e53fd12d67c3bdae5452e039ea4511692ce
TLSH
T19EE0045AA70081ABE039133805D36B366BE6C02122B6438B9A3066686C633012E21BE8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1c1f6d9f291a4f2f2cdd337a5d3cc755a959d0d69548e36bc4c8df7f15226051
MD5 178c33b558e711f74bfed31e1b758207
SHA1 5b1332de6a58bbedef2225305c76a12dd9fb2f04
SHA512 68210567b29a4d05debb9b8e484f91aff600b8618b869d1420f0650e047efcd22af2368ba8c485fe7ff87059bfef3009d7e6f9343bdd76adb81315d810749fcc
TLSH
T18BE001069200107BC029133405D36B216AE5802103B342465A2046782C633003931F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe595c01.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe595c01.TMP
Size 392B
SHA256 39217be7893a09514f5ecba85ef02ea7b93433980052f2ba76179d7b55693ef2
MD5 ed3889b95a4c3f8f27d0de8ecc875a0c
SHA1 e2e6b4fcb8c2d9d5e6739f47e5c395069afad603
SHA512 200b047fb69b03217534238ff6b997a83c5f9bb3e701aa65251cac36070abf31cf9fb3b4cc5f29e0578476293488d8e1b69b7501f8f3e3369a95e86793e25c7b
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 470d93f4c9c48d0723e128e3cf5dffdc5d3eab3f8e5c4d1e8745d8fc526f8dff
MD5 8a2e39b6b10ab2c9e51c088951662927
SHA1 b0ea2adc2d0a3902bd5f547d58108706c3724730
SHA512 2606056d329cfe1135aab79fdba465b8e091077aa422eef794341522e97f7544c059c8a057b1e88b67fdbaf2b2433493c8db428f29cca18fb739a1969c24ea08
TLSH
T13E41C698A6E91148B3776F66AFF694AD547BB8372E07D56D10010E8F0762A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download