325844730e3fe884f68240817d4b841e5a8660f64156cbf91e019f80e979cded

Analysis

user interaction
yes
max time kernel
1049s
max time network
1022s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 13:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
open me.html
Size 6KB
Sample260930-qppxaayw2p
SHA256 325844730e3fe884f68240817d4b841e5a8660f64156cbf91e019f80e979cded
MD5 1acb555743ba7f9342ce1a2116a5bdc5
SHA1 e43a1778ad4f07df736d161d8ff72eb7117442c3
SHA512 fc78fce7ca5072f8a350547452b7a2f28f1339a9224137c7bb2f3d24de833fe8175fc0ad07b3ac202c6214387e5eb4ae0a4b76fd426d7a7388ea32b2d254a281
SSDEEP 192:kdPeXFLdolX19iOQlQScGy8G8LWopxLyJB3B0xvA0GSsCJnD:lFA+KqtsSs8D
TLSH
T17BD13157A7D30523B547A5B92BA287493274C103C50ACE6D3E9CA2648F859D29EF73CC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
82	discord.com
76	discord.com
77	discord.com
78	discord.com
79	discord.com
81	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5940	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\SOFTWARE	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC	svchost.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\NGC\SoftLockoutVolatileKey	svchost.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{0CE6DEFA-4744-44A1-9CA9-D3DBD1F3D56A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1704430598-3087477806-3297458608-1000\{7AF7C8D4-3A8A-4611-904F-930DF41BB4A1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1704430598-3087477806-3297458608-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6864	msedge.exe
6864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe
572	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 572 wrote to memory of 2072	572	msedge.exe	89
PID 572 wrote to memory of 5940	572	msedge.exe	91
PID 572 wrote to memory of 5248	572	msedge.exe	92
PID 572 wrote to memory of 5248	572	msedge.exe	92
PID 572 wrote to memory of 5248	572	msedge.exe	92
PID 572 wrote to memory of 2616	572	msedge.exe	93
PID 572 wrote to memory of 2616	572	msedge.exe	93
PID 572 wrote to memory of 2112	572	msedge.exe	94
PID 572 wrote to memory of 4988	572	msedge.exe	95
PID 572 wrote to memory of 2112	572	msedge.exe	94
PID 572 wrote to memory of 2112	572	msedge.exe	94
PID 572 wrote to memory of 4988	572	msedge.exe	95
PID 572 wrote to memory of 4988	572	msedge.exe	95
PID 572 wrote to memory of 6052	572	msedge.exe	96
PID 572 wrote to memory of 6052	572	msedge.exe	96
PID 572 wrote to memory of 6052	572	msedge.exe	96
PID 572 wrote to memory of 5164	572	msedge.exe	97
PID 572 wrote to memory of 5164	572	msedge.exe	97
PID 572 wrote to memory of 5164	572	msedge.exe	97
PID 572 wrote to memory of 836	572	msedge.exe	100
PID 572 wrote to memory of 4728	572	msedge.exe	99
PID 572 wrote to memory of 836	572	msedge.exe	100
PID 572 wrote to memory of 4728	572	msedge.exe	99
PID 572 wrote to memory of 4108	572	msedge.exe	102
PID 572 wrote to memory of 2096	572	msedge.exe	105
PID 572 wrote to memory of 2096	572	msedge.exe	105
PID 572 wrote to memory of 2096	572	msedge.exe	105
PID 572 wrote to memory of 2656	572	msedge.exe	106
PID 572 wrote to memory of 2656	572	msedge.exe	106
PID 572 wrote to memory of 2656	572	msedge.exe	106
PID 572 wrote to memory of 2352	572	msedge.exe	107
PID 572 wrote to memory of 2352	572	msedge.exe	107
PID 572 wrote to memory of 2352	572	msedge.exe	107
PID 572 wrote to memory of 5992	572	msedge.exe	108
PID 572 wrote to memory of 5992	572	msedge.exe	108
PID 572 wrote to memory of 2296	572	msedge.exe	109
PID 572 wrote to memory of 2296	572	msedge.exe	109
PID 572 wrote to memory of 2176	572	msedge.exe	111
PID 572 wrote to memory of 5868	572	msedge.exe	112
PID 572 wrote to memory of 5636	572	msedge.exe	113
PID 572 wrote to memory of 2584	572	msedge.exe	114
PID 572 wrote to memory of 2584	572	msedge.exe	114
PID 572 wrote to memory of 3708	572	msedge.exe	116
PID 572 wrote to memory of 6864	572	msedge.exe	119
PID 572 wrote to memory of 4624	572	msedge.exe	120
PID 572 wrote to memory of 4624	572	msedge.exe	120
PID 572 wrote to memory of 5112	572	msedge.exe	121
PID 572 wrote to memory of 5112	572	msedge.exe	121
PID 572 wrote to memory of 7156	572	msedge.exe	122
PID 572 wrote to memory of 7156	572	msedge.exe	122
PID 572 wrote to memory of 6332	572	msedge.exe	123
PID 572 wrote to memory of 6332	572	msedge.exe	123
PID 572 wrote to memory of 2696	572	msedge.exe	124
PID 572 wrote to memory of 2696	572	msedge.exe	124
PID 572 wrote to memory of 596	572	msedge.exe	131
PID 572 wrote to memory of 596	572	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\open me.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff87e90c188,0x7ff87e90c194,0x7ff87e90c1a0
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,2009106632094391750,18349744094704328804,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,14595969628196064707,15507179279305292261,262144 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,6069488118674532186,10465839297518440180,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:13
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,3279424090866506727,8445702840500485648,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,3200820256299289429,15033870341698801487,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4352,i,10215209117008675046,9471386831112038855,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,14043172147030700270,5285030597877538377,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:9
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,7205864340931639574,5189762702968086624,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,332254518349211977,2210173779225202818,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3155718605950667091,10321144243663947174,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,3155718605950667091,10321144243663947174,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6560,i,1974490734980746656,16460096513408460187,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6780,i,17064822890058131656,7633067058057222538,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4636,i,9146664408422709578,7137853937513758452,2097152 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,661911823117343829,14430236337026825762,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:12
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,13597331144319738831,7892215740052115711,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,4820962993750012735,17804238818052901444,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:14
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,8577625734021806389,16456588454313931817,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4488,i,2572211624505489474,4287293359935823696,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:14
  2⤵
  PID:5636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7624,i,10830958402920657026,8176457172642966125,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:14
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3080,i,11724780544245979917,17312798844949388835,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  - Modifies registry class
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5472,i,15132087476177521779,4795774061424973924,262144 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,4723057960138086177,6558855610846924276,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,12331922426248815489,12401794530537832844,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7576,i,13770434602195519180,13062255166378271473,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:14
  2⤵
  PID:7156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,15516872620164836537,10346147135999099068,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:14
  2⤵
  PID:6332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7832,i,12163469450609764276,2075473904198478128,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,1271731449566833600,9853299246541714914,524288 --field-trial-handle=2440,i,11112531825421543734,4697582956482822882,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:596

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
1⤵
PID:6940

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNetworkRestricted -p -s NgcCtnrSvc
1⤵
- Modifies data under HKEY_USERS
PID:6972

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6608

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 648887a89dac8888df245d8758dcd78e85ae79931c9464f19b0967fcd69c3d2f
MD5 b053e18c94ac6f6c60a9e0a281e1687b
SHA1 17ed2d8ae6844c2878132336a2fea7d044381f8b
SHA512 abf3d05979a55f573445c0c7a95529a5899c0d9f55f350b3eb35132d8502e23e6c764ffc98e92f4374754aa22e9292fd03f8e6e8113c0e919f428e797e339bfa
TLSH
T151D02BB9DFECCD62D54820B402508E116095B4156D490040D903BC04DD110814D03569
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 68f353a62995fc87917d7d1eef768abe00ffab02e1d3e469100f99b6987f6488
MD5 5ba62d3fe2ddefdf87e8dd139f3e421b
SHA1 1986deda7bda2ac5b490eacb9fe2784fb6d01648
SHA512 4e6a767b24298d2e01c8dbefa41509e1bc67cf2c2f34fd0bf866fc1017e1d15a470a5a95feb8ee1cccf4b8ccf5fa9054bcbb93919c00de89eeffec199b68baf9
TLSH
T19CD02BB5DFFCCC62D54820B802518E116085B41519490040DA03FC04DD110814D03555
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 431a939304bc70572fb2d442ce76b7e1295569899a561fef7df087f514e3b1ed
MD5 02f3251dfb1c6daac71cc9607ef719be
SHA1 5249ae87d20630e8615eefe3cef89763e1e6b042
SHA512 d794b94d225c5fe041bb38818ed38c7daf84e9f3f50fa06a2f1f9df0218321526573de12ff4d2271b67c866d6f9503dffdd91494a62719e3d07943c2dfc793f9
TLSH
T1A0E026D456CBC32FE64A648B49A89B0C87A03B0AD3DCAECA2F00C88CB1410C0E3D26D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a03bbcdf5cf7eb097c6bc29b3c8ca65e5c0214df44b05f671287f7b666a5402a
MD5 b55e10e6c6a33badf9fe08772356d045
SHA1 48182159cbc1908f0096d47cb566489cf63add8b
SHA512 cd71c7418ace975e19f8a3bff66757aa9fbe4326f2505b13d9cc1bcc63c72a8d8f0618f81956cca4098c29354e26d1d06bb0efa82310b0e7ce0943a78d0df02a
TLSH
T192E04FD4A6CBC36EA20C644782A9AB5CC2A03B0BD6CD6FEA1704D889B141645A7E6694
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 edc2e21cb7ed97dfbefd6945645cebf921dbf71d9ec66cf6d0908f9225e6acf3
MD5 bf7115337d1750a687b68249db34aec5
SHA1 c4a7f0fbb29555b36e1b5147ee7bce4817b424c0
SHA512 626ceb236eda2dd8abb6c5bb196fff7c74a47dea82569bb7d6c8afb2531a8548d1044c4bbf863449cfd560ea1d1c580fe2ef5c967f1b149abdb0c0e8eee2cec1
TLSH
T16EE026C486CAC32EE6086447D26C5F0C83A03B5FD2DCAE0A5B00C8887405240B7CA6D0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 417KB
SHA256 2a13f157806bd2083eaed91e534af6a89490233e69dabcad37664cc1121764e4
MD5 c1c170a1ce64b59884e60f2344a22a4e
SHA1 61c14d8f5fddf53dcab660c90e3e754ad074b48a
SHA512 2fa7dd1512c1e3265cfb8890d130e2b8bf53296e467bb54bd018e4491f8ef3b39c83c1d9a16584188fb6c868b97c38352b48af8d4402bcdf7acace6e05879a82
SSDEEP 12288:FX2/fOpN9bjHHD9Y4B0NrAfC8miUUwee9WOlCvRrbTXumvXi:Fm/fwbbHJmxAfxPUU9CWCCJX7zvS
TLSH
T15E9423A3F302EECA998A7CCEBBC75C854E14347C68CCE697416B584147B87990696C3F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 70KB
SHA256 9e1826cb1fbbbc5112fdf133ebfbd13884530c05d90af402d9360eb4968e2cf7
MD5 a8bfc2117dc2bb93a10bdcfaaa7e96ac
SHA1 b429907ed6b1a51b2b8fdb54d7fabc8b97ec1d16
SHA512 74767b4f2133ab3d7641669f667e8c035e5e4617c2cf2a0e61c1fc4d21aa3acd6f47bee8e23a1bbb6a3a27cc024046ad42c0e86830e4ff73a1f68dae2383c74d
SSDEEP 1536:4c/a+uOhY49frHz3ylizadM0GS+HJcdoTOxO37+feBeysLnkSDsJhhjQHZLQZY://tBhD7yli+60GS+Hm+CxO37+woLnHsu
TLSH
T1516302E3508E7BDA022B78851C1937FEF0811306C6D3CB476EDA5B1E689B27BE751109
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 422KB
SHA256 ae124a58f83295776fe950f7ab6ae57c5888301e8243a0acca571aeac645a576
MD5 46afc1ec88b379b6eadd85747fe90bed
SHA1 86477faaeb469f2105c2c975bf0875457715af6d
SHA512 9219b1675daa93c8acc88b3ebb44fb25ba6bc0f59d0f297fea500e3f957a970da23482265e9580faa1aa65076cb48d565e65f481bf7d8f9b507c3746e8b5ebe3
SSDEEP 12288:uFuCFrFFTVBl9+MBQk7OadFveBvdCNtQ2GCjGMwy:uJ7FTVBBQkOUpepSKdy
TLSH
T19B94230E89991CB05CDEBA9349D18E50C30FFCE924F50C5759CBB2A1B00E76B684F9B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 58KB
SHA256 0e7cb822ed1a946f40a3ad0a4a9c900e1c5af85fce61afc5fc6727a8fde699fc
MD5 949a6779e33694acdfd5e9c75d6d60a1
SHA1 353f9375d43de437d0b08de512a0fa5c75856c8c
SHA512 913f5257882e10e7f5dc68fba48c0cd5de0198e2e955761396f807011cce0aa12ae54e6a3e716492cd9eb0537a67a4f60798a4fcd1a515e814aa40e4c5dab9a3
SSDEEP 768:0X+HsYhAZBw1m+e6TvWgd/9UgsXLS/8lXVdqw7XgXEmYfnAS9hkdrZDBzemLNiC:0OMMA4e6KgdVo+/sVVXg+kdlTZl
TLSH
T16243026E461BE035BC8E4A89B1E236025F179C29BBDD94D0E1E29EE741F274849D3226
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c9
Size 19KB
SHA256 3cd28e2e898ec6e2824646e44457e6f9e2d2538af8cbe392b4cdfc89ae08856d
MD5 1957a38263fde8d3d9e0e3e6c0a56da9
SHA1 1a87073eb6f1f2a7d8f23c94557b234b2477aabb
SHA512 9f385c42cec4e101b91a9751200f34d7759a048d17410896677acd6c7b9c543a7db6225c4a1acbd75e2f1ce315ed5b2641ebd0150274fd09063608e78d226d2e
SSDEEP 384:arFr+j6zobLqnC9DLaqWnml0FXO+GhPP6lioPQJ+fjGXRRHfqMsPP7:aJStnqCnWne1+jIuGqtP7
TLSH
T17392E1589DA022D3C08AA0EFD10AF543225B108A4FAB3EDB447ED80AB757F19DC47A53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 23KB
SHA256 07536f270f720de20b7400fc8d702f0a9f7dd65ca346c5852f1f41d1d7c00208
MD5 a6727362fc81fa8bf61410c37411fb00
SHA1 7212ac442d0d04dcbb5530f464c0e44a67a3c2f8
SHA512 121b79a12813a13afa72784255ae4f6efa912058c1298ce190704c171763f5cd25c5630e4e71a50ad279795320382c2adf507250d1f1368df6057b75f64d131b
SSDEEP 384:nbBQcKA60sPdNwlGGWcFnxwhCr2fYGAjChu18lg9ZJNtfD0yVPATGPiHVUDNg7+L:bBjCVXhCSfYGAjChu18l0ZJNtfD7fPiY
TLSH
T111B2D0640B49B653F0E30B1D201605F62B61FE6DDA3A48890E5F6B3B569B34C874E93F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 12KB
SHA256 a457f1232c71a21158e1147ad4341760c5bfc60c677ed04060c43c9b19a0b1f4
MD5 c8d581e25c4cb4c8440877b0da526c12
SHA1 d8b5d3b69cfe0a81cf40a48324b9185e8c68b515
SHA512 37b621c6458e5d0dcc80782ef61ee1568f344ff2f0466e6cf5efd0df2ad2e3b4566c2982a60ab60614aa747b6659827a0a565b1de8ce0300205757e24b12efed
SSDEEP 192:kNPKWV04TWzz9bVULc8fwXOJtlwtjWTtxgE3Idgku:oL2z9h0c+TGyZtYY
TLSH
T12552D78260E44292EF5C44B7E5C79F463AFB6AD440879E2A001DA23C7E337D98E1F253
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 383B
SHA256 b8ffaba2cd024bb521e77d8a34d7fa0d8d2f46c4d4234a879baa2091fad50fc1
MD5 33767637745d8f27ce6b95822b259587
SHA1 403867b11c005b06421e616a7c7bd6966f5dc9e7
SHA512 70d28e8558491ec63236548c7d48454ac260f5ce9ecf9eabf5f3e1eb66bf5f0db66535a9a51bbdf2af74d7c597fbf02065b5e8f3011cd1b9525f200763954bb6
TLSH
T1E9E092F899CEC21FE11820974975FF0992F33B0AE7CCAE825F0DD854B042148B9E9190
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 95b76a75997f387101d91f4dd973a5d3e806fc53e69ef50038dfd0fb6a5a5bff
MD5 a8a93d177a1567149f731095307d8268
SHA1 4f5fb5bbe4f2c9c890ccc9328826fa38aae0673f
SHA512 79f9be6582954e460e20a7dae8684347a9dad3309305ac4dfbe789ee0b785a5d6461059e9c0f7ac916385a498eac7f6c943b789d9646132aad6f73ac2a505e93
SSDEEP 192:DHubH5G+O79aRaZTjheeGjc76tThGf/k/fCfryUkr3KrIx:DHubH5G+O79aRaZTweGjc76tThGf/k/p
TLSH
T1E3E1CDF3C3E9862DD91152F0AA187E1BCE2C0965436C3C2AC4D49E5B93F25B1F181A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 a4e8ebb9a54a87955bb15ea16f363a8f0c9cc919671af401b5e58594e5cc1bd1
MD5 d2486c1e922f91962cbbdeec7e8fe622
SHA1 9af578fda0ca3cb39df4498d24c23b74faa17c29
SHA512 d2c0b431e58e2e7e1c40ad25552bf8d57f6cd67a22e5d43a06c22b0370f2453e1a485e6e11567a624439d213939cc3743667d11f9e21edbb6c69c188c6ad63c8
SSDEEP 192:DWaX6ixvuuKqaRaZTjhn1jc75tTHG/tfCUryU5r3OrukrqGTGj4v:DWaX6ixvuuKqaRaZT51jc75tTHG/tfCl
TLSH
T1D4D18DF783B5822DDA1192F0AE046E1FCE680465436C3D7985D0AE1BA7F25B1F181B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

aeee5974-5ed3-4fb9-a451-07206b2f3f6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aeee5974-5ed3-4fb9-a451-07206b2f3f6e.tmp
Size 7KB
SHA256 e0ab4f25fd7bf45f051db6594bd6e47bb220e6f763cfbad8f417b2417dc4e6fd
MD5 505ebe656d9efb486a073d22deb5eb85
SHA1 1a6727e3a320264149aead2eeddd6506ffc0be2f
SHA512 cbe365560b379b696c682d7eec5e943c09cad97e769f80cedd5214a55640358986d059ab5ff044bfa55eab4e57d9183fb3a6db17a2ffd12be63683737483b07e
SSDEEP 192:DHubH5G+O7lBaRaZTjhe1jc76tTh2//fCfryUkr3KrukrcmRQx:DHubH5G+O7lBaRaZTw1jc76tTh2//fCA
TLSH
T1E9F1BCF3C3E9862DD91156F0AA187E1FCE2D0965436C3C2EC4D49E5B93E25B1F181A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6b142462f2ff349b43d704a02efca53b1d6f51f647403d1ead5533a2cb9b39b0
MD5 b36440991255a0c8b061fac48e1cbf3b
SHA1 b022d66d98f053aec93900a8db5483133479c5a3
SHA512 f8efecfc64fa1e64b9e097d94226ee92e43b917fc76cdff9c21a5334aaa9f81b2b02341f01f1e767946b6ca396fe03944bc0f12a5f69c37ed9f3a40bcab67620
SSDEEP 192:sxRORFOW/feGsCRQRXqbtxVoA8pXBUV/g6+WNgFWlAHw4/YcTXmiTlGUIgD8J:sxROmW/feGsAQRXumS/5vAX/zWiTR0
TLSH
T13052D815AA246D7B9CC7D259BA15BF53E2F85033A4951E4CA6FC8A1C08E77DE2213C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 95ce0b3eacf4f4b24837b167653e5abebe1a83b240ba2063d16307bbb16e3840
MD5 46a322385ffd3b723e0d6a3990a8ab22
SHA1 98e266cf17956fec5069c9a69814a98eedbbea79
SHA512 97a5225e3919ef85614257b34d3d2470f796b9914e8387c9a2a152f493baf3a5aa7a102b57e3bf9acea1b51865187a23221cbe8c08f8d3c2c2e954ff2c4e502c
SSDEEP 192:sxRORFOW/feGsCRQRLqbtxVoA8pJBU0/g6+WNgF0GDSw4/Ycl6XmiTlGUIgD8J:sxROmW/feGsAQRLumV/5J6u/F6WiTR0
TLSH
T1DE52D815AA246D7B9CC7D259BA15BF63E2F85033A4951E4CB6FC8A1C04E77DD2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7bcf60aa52804c627a4118f82539473f943f97f0bec6bf92b44951f16cb88fa5
MD5 ab5eaa548d682610394c13f685ec617f
SHA1 806ace32abbf2fbe82bcdca84b0b8729b0c7add2
SHA512 ea715bb531dc2277738c6f6eae42701c6355b2091b4dad12647dd1ea65be06cfd10ac2f6845c8e5c4fac61067f55527c8e40a968c53c1a27d1d1575ff579e1b9
SSDEEP 192:sxRxRFbW/feGswyREzoA8p4L/g6+WNIYckXmiTlGUIgIJ:sxRxjW/feGswyRlq/5IEWiTRs
TLSH
T1C632A615AE68A97B8CCBD20DBB55BF53D2F95032A0D51E48FAFC861C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 c50bdb17364e26cf344593086faab7b58113fbead0786d7cea08a8282bd9f77f
MD5 98c28e51f802a0a619ae6e5667ec6e8d
SHA1 fefd28afdfd3fca0e6f7837b7be1554d0c0cf5f4
SHA512 7205609230b3bc44f4cdeef25daace2ed77b832d67d150c23c63adb5c505362c183edeffdc7cf8c49acb839534a00b6db42c2d462f86fd7593bbbbc7213d6ebe
SSDEEP 384:sxROmW/feGsAu66s8qMpRiYnazAW8pZS15posJWeT+K0ERXumS/5vAX/zWiTR0:simW/fef4Mnc7WeT+JERXy/54PzWiTq
TLSH
T1AAD22905A924C87B9FC39D18643D7E33EAAC506261C5DEDE56ECCA1C01EE1F9AB07853
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d7495c9f686308b960e373d055db21adf8853124d7b59ba6a0a9dcb2717393c8
MD5 17f22a511bb94064d3cfd83e110402b7
SHA1 c8ed94f987445a0d58a6bdf830343ab39a68acd1
SHA512 4d2696dfcd2d8a13aeec2367b8ea02ebeac5de1abae2f26051824d64dfaa02d894788c71b567304f33017e8773e5b8da44dc51ee79a82d1eb40a9adb182ccab0
SSDEEP 192:sxRORFOW/feGsCRQRXqbtxVoA8pJBUM/g6+WNgF0GDSw4/Ycl6XmiTlGUIgD8J:sxROmW/feGsAQRXumF/5J6u/F6WiTR0
TLSH
T1CA52D8156A246D7B9CC7D259BA15BF63E2F85033A4951E4CB6FC8A1C04E77DE2203C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 96d1bdc586efb54918baf8554cd799a9fbe55e358a0825e6ef26357bb5fa42b0
MD5 32dbe9ccb46db5692d43414b82e24ea5
SHA1 6f2d3a2b95476bbcf22c77f82b9b7d431008153e
SHA512 6b06c73d4357e5e50aa7035d3f7d17e0ad3794f62e67d32d86fee418798a060b24244b08ae940accaed176f77fad80f5132d253de365d9d90a8951f11b4899fe
SSDEEP 192:sxRORFbW/feGsCRyR8btaVoA8pJBUM/g6+WNgFHMqw4/YcNXmiTlGUIgDmJ:sxROjW/feGsAyRcfF/5PG/tWiTRm
TLSH
T16152D615AA24697B8CC7D25DBA15BB53E2F95033A4951E4CF6FC8A1C08E77CE2213C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 700b81a19a84341d48cb6636919953918df1baf251870f2b2f66c57d75ceb82a
MD5 dee70a39544d396f13e726d66df0eeb4
SHA1 1f78257e64cb8a1a11bf9b2e9c6dbd0b684c362a
SHA512 cbc8bd16e36b476d202eacf0750b74d99f6d45731db1f45435b877586ea6c903e21a93780bcef0e237676feae0ada0088edec3489a5b91396a46abc2d8e3b6ff
SSDEEP 384:D7JakElfCtg17Ff9tKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVXn975RwproMXY:DFakE5Wg1Bf9t8F1+UoAYDCx9Tuqh0V0
TLSH
T17DB2CA3F744CCB7E8F804A9DAC196F976D9802C79A588D4047FE994C03C77EA92294DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0f602995-7ac1-4062-a237-c07e3daec1b9\index-dir\the-real-index
Size 72B
SHA256 b653df8cc9ddc6cdc92faf6ae75344670a55514b2d107879f7907e5d70021206
MD5 783b2d47db21f7f5f912b370ed4b6f18
SHA1 045276c4f65f073ba38680aab3765e6118b8b746
SHA512 9da01ed405e7d15daac316a31414482a7dec9581c0c7dcf286a05036433b745e8956079a846a0746f05e7d5b0a39b4404137f7f197508a3028495d96d5d4e109
TLSH
T184A0021862910001CD8223B067DAC1492322C9502A41135B72940845DC50DC94E7220C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6720c0c-db59-4692-b592-0e3314566078\index-dir\the-real-index
Size 3KB
SHA256 c087c8b107ce79223c50c4c44a5847a6abf01dfb30c37d740096422e5e14b1ee
MD5 009e7c71e7ba94a327e4aed11d879a3d
SHA1 a0cb537c82bfdcf9ff22d906d1c80256dd6f11cc
SHA512 ca009b46fd58ef81f4fdcf5b4466e137c2a1341f878f668dd40fb23ad6ad1785d000d41376856b8d05517e1a6a06478f4ac41f58ad5141e14a90066c87bb6574
TLSH
T19851B50A1D561B7AD8A8A2B205B504453B7876CC77549E1B60FF8138B8C3B282D99179
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 1e0130ab0c5b3332a4b3848554e7411493494e1ab5ee6f06c7c3ec423181a8c6
MD5 bb26394a9c4c181cfef1b1443dbc7ffc
SHA1 c8a5cf549d813aeab2316a69bf48e84b5a51e00d
SHA512 679d7cb2f11c81803e55aad2f81dadfcc3038ac0bfadede255cb7a74d94362b41aaf7e7cad423c3adde597d371164f67c81f138e1b7d2ca69d62989df415d510
TLSH
T1EBE0D8FA2CF62924AD7B53E9247144A54041B459C544BE4FE056E28770A1756205AC72
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 b6dc3c8acb344f96390225d4e70f7a7e07f3069e6bb62ca76756ccbe90765cfa
MD5 97547ab3bc07bb8b4495359aa36715af
SHA1 af6b8ef092c5b2c543e1d7f360e6572d04298fa0
SHA512 a5f352faf628f7ee1b878e90ab0df7ae1fe050f01065b7a9cd5a38ec2a6bf17f18be247b84ddca8e950cfd4aaa734169b6bed1aa54474c137eec54b002030ead
TLSH
T147D0A76FF0091154DBAB5B8126A3202E42383CC854D9908CF002162C4851B57A222FA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 9865897bd91c050900f8e7aa31a8d090accc6299f6844848e97f4e0e89b5bc88
MD5 12fd1b8c85400f923a52133befd5f910
SHA1 fc8482a91ff18ac75f91cc0a2bb2bd3873559c88
SHA512 65f2c68355457614e96758edec843e3bbbf129f97f6b6712aec416a03df5c62310617ad168726233d51e65f0aaf21d92127631e12ee3feb8f57a91f651515d8b
TLSH
T125D0A76FF4191150DB6B5B8226B3206E463C3CC955C9A08CF012362C4471F43A222EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a3114.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a3114.TMP
Size 138B
SHA256 5849963e57ce7a9256e1dc339a364707a3114fe125da851152fe98188c24be38
MD5 f85feae92cdf4481180469b85f846a72
SHA1 36e1e05fcb96d755dff60e575b6f88759f1e0c85
SHA512 a06afa709c4a391d9de7387cf4b8f83f5fd6771a558adddbdccaec084fb240214ab47197d9b9833f4f99cf8ca9079434e4e548a4b9e8ea90e00b5a71a74fc786
TLSH
T138C02BBFF4000101CB1503810373600D47292CDC88C1908CB003302C5030F173102FE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7f639f1a6ce03cd9576244af1d4131f97c5ee0cb386f084c08204afe4e36ca9c
MD5 b3d570731f15aab0d4b94d59a1e11b27
SHA1 acd53b8c4540b15cc4fd46dd58295b63a56290f7
SHA512 1f064f870daaf7f35116fe26a737eaec0527a05f7919e382878cd6143bcd8f1bf87525bd1fe3a9b9850269fe1a12080915069e24eefabe79821097c9d5cc80cb
TLSH
T15CA002238A5A9002CC240670A0F5D19833704CDA0147738E449CB0E99E9726096C6949
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59bf10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59bf10.TMP
Size 48B
SHA256 67f3430be8b536934ce7ecbb77b00fa0829cda5fb24eaead96f63cf67fa9e5f2
MD5 0634d805e2af8bb02fe71727095a29c9
SHA1 39fe70e8ea51b121532102ea5aef2e411e8631fb
SHA512 f2bf05bceba90c08750caef92fdd9fc12b96ee4f2c23100fd510c4cb752ab00aeb91523d36b595b97544f24130edddb257ef339deba42f4ab6f25ed5d2636445
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 39f0c6818335eb1b0358171e81ea31ce048a4bed124eff6dc08eea9963a2f359
MD5 d4524f071b57d8626cca447c98c5fd01
SHA1 9b8d2b3a06790c236bf3fe2a12b2686db42b7c14
SHA512 60d0cb7ea576d83f3d231b9807260d5f203a532219a1d7e14557f2a1eb2efe4c49bdea3bf355fd99a643cd6872c0479de67fc46c7bd7403b032e58373eb1eb5a
SSDEEP 24:KUCF6gAIFK+hE12SPE9yXVO5ek8IFKChc1WSL0ngfXgliK5KKOca++VIbsOKadh4:KYfIFKoEozytHIFKUcw8hINKaYYHy9
TLSH
T1AC91F461723A1200387D294C95D5EB5F994232573129EAAF37FD04628B7AE090EFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a1cff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a1cff.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 21f33a5bd40586853ec6739a8bfe8c272d94b6a99dca02573bd9fb4b117ae4c0
MD5 8ee5467b2dd6d98796f1e7d93f40d31e
SHA1 b7a7989295ca8346622eba2bd3a5866f7d3c9a11
SHA512 3dd527ede0a29d36cd0d987f31d1e76d2f41c060cc544fe8c622e6faf7c9a29864d61dadb89341b970e92aa39e09420333aa398899c420d3027d2ca6f70f598b
SSDEEP 768:wJ35Urw15ieO4hbbjnnUPO4Qp7cPAiSm2eo4w4cciGrTFl52skIN:wJ3aYnbjnwQpYoimeoR4ccFF32sjN
TLSH
T171F2BFB1D9F49E736CF7928176496702BFF08163E5C65A84C9DE2B4D41476EA031BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 18c51721d898fc4df44e7dba8d23b21f271292d41080699d61135ea3f4fcd941
MD5 9e25c65f0b536fdc3a2fbafc4edcb5bd
SHA1 e4a8c1affbb3d5fb478d4ee44f48ebe3e624f7c1
SHA512 0440fe770ae776b65a0274f077fec16462db0753e70c48db16c7370d4c3553ee4527ccf1a75633f7a18a6fe465269e49de3910b572a27b9365f76ebf183bbbd8
SSDEEP 768:DBJ3AUppLieO4hbbjnnUPO4Qp7cPAiSm2eo4w4cciGrTFl52skIN:DBJ3BFnbjnwQpYoimeoR4ccFF32sjN
TLSH
T163F2CFB1D9F89E736CF7928176496702BFF08163E5C65A84C9DE2B4E41476EA031BC07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8de1626525c30a807fc5d052f5d315f75452bea2eadfab847b5e30e6cdfd3756
MD5 3532dbd2e76fa4d9d8a46312038a2fd1
SHA1 df4bdbc0d8887576525366ac632fa2376a5a7548
SHA512 26349fd9ad3b7ccc76bb2098628470f99e3a7815eeaeba73a1cfa5d7732a22179fc1478e8d2b907ebac8954f12925ddb36f3258e1c3aca39322a2fba7b51040a
SSDEEP 768:vw/UxvxjgC+5j3pV9r85ieO4ojFnUPO4Qp7cPAiSm2eo4w4cciGrTF5yAgZbCM3s:vdZj3+5j3pvr2yjFwQpYoimeoR4ccFFX
TLSH
T14C03CFB5D8A4AE37DCF397843A5D6347EFF141A395C12A94CAE92E0D42873AD430BC46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 a688d96018002cdcbc2756402d10cedabc700016284e2b7ad6e27376c794a0f3
MD5 c8e9432dc4923f136f70177f57cd5303
SHA1 be22ac07433cc4a9782da85b7eb97cb0b6e6ab22
SHA512 4eb04610e620b1738a240e3016a6c4c59ad363c8a710660ebe6e509ccea272d7489aa85153257a16e725c1a49fa713179dc01cdaed4bca63b82a9f095f591590
SSDEEP 768:uFQ536wgwUSw15ieO4hb6+DnUPO4Qp7cPAiSm2eo4w4cciGrTFl52skIN:F539Yn6+DwQpYoimeoR4ccFF32sjN
TLSH
T1001349F289E79976E8AE4783673C6E01AEBCC163B4859554B7C91A0DCD461BFC30BC42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 961ccf7993a684f9480d8d317f06a0d4f3ce7317fab1a3b9f634ff0962a08b21
MD5 718feec72c6607c09108b6d81ac40178
SHA1 65dd8ffd8b5fcc34a90bed72eb4cf2fed85b0cd8
SHA512 0445c69ae3f47e2a87021a0677c0caa5149a04d0ac6671047c86617ed0e697de8bf88542ff8a75a306561a7470c709a52d198eeb1990fcd0c21708bfa111526c
TLSH
T13EE00202A10001B6C13C133000C71E2169E2401002F215846A6041B42D237002F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f8ea995aebd6c2a5685b7baf285ff2558bac2c38a1a1d0eb0e3a951ea42492ff
MD5 58cc4674b814a568b24c185e06b20853
SHA1 7528345cfe566368ddd4c015c0d43a33ff2cfd42
SHA512 3c02246b58362ea52967e86ed630f78873107cadaa09ac09549a67b63a46eefd41330e49c76aee22f2804e6caa4fcb1bf37afedb5748c9117df521199c65a863
TLSH
T14CE00403710001F5C13C133000C71D3115D3401001F115447D5041F01D137001F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59904f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59904f.TMP
Size 392B
SHA256 14ef71f39ada0b8a15722b098739cfbdc0e396410f811d98ce59e8f461d245ab
MD5 ccf5a3ef89fb8b162aca8fb45657d72d
SHA1 ad5c084c97d48c713a1764d585bb282b8c39f0cf
SHA512 62307499fe2fd58ea8a88b97cf710dfa1217a0218682126f9c518417302347770f03ede1ae99d47908f5089f5aa9e89153b050badfaa43447a31bcd25f24f091
MD5 SHA1 SHA512

Submit Download

890fb84e-6094-4409-91a8-deb59f98b2d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\890fb84e-6094-4409-91a8-deb59f98b2d4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4108-233-0x000001585D6C0000-0x000001585D901000-memory.dmp

Download