69cad00d77aa3983e47a0e5a607c2d28bb8a614fdc0538340c472a0a29074f06

Analysis

user interaction
yes
max time kernel
251s
max time network
253s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bubbles-and-babes.html
Size 167KB
Sample260930-srzwdavybx
SHA256 69cad00d77aa3983e47a0e5a607c2d28bb8a614fdc0538340c472a0a29074f06
MD5 d8c1bd5e5665d722e016775e0d29ef93
SHA1 c595b8cbfc59ae74ae8253599ab67d91ae53485c
SHA512 fec76c30de9724dfad45ede39064c28cca0234a7b82559f1ec7384f11d9cc4703a363bb18126cfb1d9be0b19988368330d389d603506a03a412b31d1eed74adc
SSDEEP 3072:ZPhMPt7cv9oh0RQhmqiYCzUoNbNb+QU36MBMlt2+C:ZPyGpzUoNbNbbyiE+C
TLSH
T193F33AF32049113F4B3762D8A028F30DB2A6661ECE024955F6FC52DC9BD5EA575322AF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3560	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 36 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{7574C252-DE76-495A-95CC-97989848950F}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupView = "0"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByDirection = "1"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = ffffffff	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{C6CF02D2-CAEF-47A6-A4C6-D0FC23BD5971}	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\NodeSlot = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\Mode = "1"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\LogicalViewMode = "3"	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\FFlags = "1092616257"	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\ColInfo = 00000000000000000000000000000000fddfdffd100000000000000000000000040000001800000030f125b7ef471a10a5f102608c9eebac0a000000a000000030f125b7ef471a10a5f102608c9eebac0e0000009000000030f125b7ef471a10a5f102608c9eebac040000007800000030f125b7ef471a10a5f102608c9eebac0c00000050000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\GroupByKey:PID = "0"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 3a001f44471a0359723fa74489c55595fe6b30ee260001002600efbe1000000079289440ff41dd01f705837f0d42dd013798c9b5ef50dd0114000000	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\ComDlg\{CD0FC69B-71E2-46E5-9690-5BCD9F57AAB3}\IconSize = "48"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2544	msedge.exe
2544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe
2416	msedge.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
5864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 768	2416	msedge.exe	86
PID 2416 wrote to memory of 3560	2416	msedge.exe	87
PID 2416 wrote to memory of 2368	2416	msedge.exe	88
PID 2416 wrote to memory of 536	2416	msedge.exe	89
PID 2416 wrote to memory of 2368	2416	msedge.exe	88
PID 2416 wrote to memory of 2368	2416	msedge.exe	88
PID 2416 wrote to memory of 536	2416	msedge.exe	89
PID 2416 wrote to memory of 2452	2416	msedge.exe	90
PID 2416 wrote to memory of 2260	2416	msedge.exe	91
PID 2416 wrote to memory of 2452	2416	msedge.exe	90
PID 2416 wrote to memory of 2452	2416	msedge.exe	90
PID 2416 wrote to memory of 2260	2416	msedge.exe	91
PID 2416 wrote to memory of 2260	2416	msedge.exe	91
PID 2416 wrote to memory of 2280	2416	msedge.exe	93
PID 2416 wrote to memory of 2608	2416	msedge.exe	94
PID 2416 wrote to memory of 2280	2416	msedge.exe	93
PID 2416 wrote to memory of 2280	2416	msedge.exe	93
PID 2416 wrote to memory of 2608	2416	msedge.exe	94
PID 2416 wrote to memory of 2608	2416	msedge.exe	94
PID 2416 wrote to memory of 1808	2416	msedge.exe	98
PID 2416 wrote to memory of 4984	2416	msedge.exe	99
PID 2416 wrote to memory of 1808	2416	msedge.exe	98
PID 2416 wrote to memory of 4984	2416	msedge.exe	99
PID 2416 wrote to memory of 4988	2416	msedge.exe	103
PID 2416 wrote to memory of 2340	2416	msedge.exe	111
PID 2416 wrote to memory of 2340	2416	msedge.exe	111
PID 2416 wrote to memory of 2340	2416	msedge.exe	111
PID 2416 wrote to memory of 4908	2416	msedge.exe	112
PID 2416 wrote to memory of 4908	2416	msedge.exe	112
PID 2416 wrote to memory of 4908	2416	msedge.exe	112
PID 2416 wrote to memory of 1592	2416	msedge.exe	113
PID 2416 wrote to memory of 1592	2416	msedge.exe	113
PID 2416 wrote to memory of 1592	2416	msedge.exe	113
PID 2416 wrote to memory of 5216	2416	msedge.exe	116
PID 2416 wrote to memory of 5224	2416	msedge.exe	117
PID 2416 wrote to memory of 5216	2416	msedge.exe	116
PID 2416 wrote to memory of 5420	2416	msedge.exe	118
PID 2416 wrote to memory of 5420	2416	msedge.exe	118
PID 2416 wrote to memory of 5420	2416	msedge.exe	118
PID 2416 wrote to memory of 5796	2416	msedge.exe	119
PID 2416 wrote to memory of 5796	2416	msedge.exe	119
PID 2416 wrote to memory of 5796	2416	msedge.exe	119
PID 2416 wrote to memory of 5916	2416	msedge.exe	121
PID 2416 wrote to memory of 5924	2416	msedge.exe	122
PID 2416 wrote to memory of 5932	2416	msedge.exe	123
PID 2416 wrote to memory of 5748	2416	msedge.exe	127
PID 2416 wrote to memory of 5748	2416	msedge.exe	127
PID 2416 wrote to memory of 5748	2416	msedge.exe	127
PID 2416 wrote to memory of 5128	2416	msedge.exe	131
PID 2416 wrote to memory of 5128	2416	msedge.exe	131
PID 2416 wrote to memory of 5128	2416	msedge.exe	131
PID 2416 wrote to memory of 4836	2416	msedge.exe	132
PID 2416 wrote to memory of 4836	2416	msedge.exe	132
PID 2416 wrote to memory of 4836	2416	msedge.exe	132
PID 2416 wrote to memory of 5716	2416	msedge.exe	133
PID 2416 wrote to memory of 5716	2416	msedge.exe	133
PID 2416 wrote to memory of 5864	2416	msedge.exe	136
PID 2416 wrote to memory of 868	2416	msedge.exe	138
PID 2416 wrote to memory of 860	2416	msedge.exe	139
PID 2416 wrote to memory of 868	2416	msedge.exe	138
PID 2416 wrote to memory of 860	2416	msedge.exe	139
PID 2416 wrote to memory of 860	2416	msedge.exe	139
PID 2416 wrote to memory of 2544	2416	msedge.exe	140
PID 2416 wrote to memory of 3040	2416	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\bubbles-and-babes.html
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff805ffc188,0x7ff805ffc194,0x7ff805ffc1a0
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,7625880080480080625,4722988493214482703,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,1257152690895049784,13036150190799203377,262144 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2216,i,14644881566976589312,2421354269203980578,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10008567842776450976,11166838339499446901,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,14153427051693498658,2347051560079574604,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,15104972590706019435,14822167634192843236,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,14997464152011603993,13395703045882543985,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,5563518283442155230,3363277956518512763,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,5622078675286788598,5567181317840678790,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14249165244830690336,13359141525471949739,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,14249165244830690336,13359141525471949739,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,7914836741493829969,8739582918330493583,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6748,i,16456174496142499346,3232032484673032204,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6712,i,2063741467570523128,3379460150258925005,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,4786928681928911230,1112542001246828968,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9484436668282072702,12084307539496355815,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7144,i,876374159153940195,17877486269001911064,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4476,i,4452500119259545487,2352610183798584142,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7396,i,9681383157589812038,9438500081232506680,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7400,i,11730955338662053735,4389796937916663328,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7380 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,16200721061800058539,9333444253464581920,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=1892,i,18370364162982646296,17116668769910307336,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4496,i,1190483936916336996,495400980338582804,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7356,i,806159154737311627,6583145759226723066,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7712,i,3727647904409579807,544839202067040229,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,3396483466090999142,10022420181493203938,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious use of SetWindowsHookEx
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7696,i,6457273473119433331,9591685534673579421,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3620,i,12940407688710201774,8095726847434312380,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8220,i,14846329367375472921,11637762782684320033,262144 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=8400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=5180,i,17444071760271234562,8690230976624617512,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,1295896567313855000,2181880539678864346,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,529499579823874429,1732977769076176322,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,1747619120493621440,8141506748691804978,524288 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3396 /prefetch:8
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=8132,i,7218270264560613614,6649264924444557583,2097152 --field-trial-handle=2560,i,13207568322426976577,8020187960007933094,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4428

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 801KB
SHA256 e722fe3635e60ea2367b1f822d4e9c33914c79748a0de9772bca5eb7e3f5be35
MD5 fe983232aea13f89f1fa5709bb8a6134
SHA1 d190ebc6aa6014349ece2d57260badb815f2907c
SHA512 0472184197a455639cb331a976cb810d7e8c693d21913f051935bf049ababc7a5fbce12b80602744a8487eca11e961b6f7fe520a854b35cc04e3b913b484263a
SSDEEP 12288:QulDYsLgFPiQiPpudO3SuAD1UG7voqGSiPOVsB7yEmTUF17cKuS61C:QulDYJ8HBuQSuAGGUqhwOymSn4nZ1C
TLSH
T19805331BC7559253C394E138FC9D21B32219B95284954EBFE22F4A074EE67583A30DBE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fce876901b0d79976f4a17cb2ff2945c33dabd5a7981460d29f7e3d7d887b3a5
MD5 bea7bf988cfa6b2be53101029e83f4b1
SHA1 aae686d61398132045ec522f9ba2a4bef204a5e5
SHA512 5d83df86b1451284ba65d3b479ee5e56804efb59271c38fb9d08598f406e9595b35884c44be4c57fbf772073d3b6c3ca27d8b155549600802aae71722148890f
TLSH
T14A71FB49E6D14170FF68C531A1DE2E8339B8877989C31FB37EA5C87DBF16B126828045
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d7eb5dc472305848b70812a3b16eb74de05f16da1c9b8a053d98b52217dfc3f
MD5 a73351324ba1bf55f7d22d99f2f896a4
SHA1 f2e974e7fb1cc986d773353365f828a1358fc6bc
SHA512 f1711a32d4e66b57b524a3c9020da08eba5301f5f5d4fe4ec9840c817f10f410622ce278e9019fc69e9bac57a6fdfc539770e35a41b67d7b1f32d222fb307310
TLSH
T16A619481EAD18470FF59C971B1DE2E833AB887B989C71FB32DA5C47DAF1A7525824044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595980.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595980.TMP
Size 2KB
SHA256 fa19a5bad38785dacdbdbe4c0c34255b6f7a8e9719aacd74cf8c3a5dc0ef794f
MD5 db1be46b9a51fa09f46f262c97232767
SHA1 b84142614f80faecbd8ffc6e062c377c494f17e7
SHA512 286882c15e2aa9968963b3ae85ec0fc4eb15f5c270dbdd4d4b9614e5474610085dd67ed977426ed17246c99cacda07568dfed43888db7dba1707189710a6d28e
TLSH
T10B517285EAD184B0FF59D970B5DD2F873AB887B998C71FB32CA4D4BDAB0A7065830044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
Size 240B
SHA256 4ec2d8380592e119f58b044b7a9047a3ff4f50cb38d82c4826a5a455c54c3104
MD5 37f0efa8835c915d1eae508648437369
SHA1 03f61cb75bd48f9fb57f382200549999399ae31d
SHA512 7546d7e069715b7453532cc71434c37058b051db927d2f8ed0930a443f92912c2b9454a56915d274c2de8877e31afb28463da5b2caa73788ee54aa5c285a4c1b
TLSH
T13ED0A970CA18C416D396833222FAA978385612A123A32B8338B410B4BE193C0060189B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 4e595e1e1339de9517e54329fd536948930930d8fdf5aab6036aa8f926e8553f
MD5 4a809a9d1097f19cbe3b7811d6748cf8
SHA1 69566bd2183e121f6bdb86a31403a3533bf8bf85
SHA512 c3a50ec6f232dec36394f7a98a945e0a7d58ce5f7ec5dbf6319e449a4d306af007d8a5e80da4f45961794e11af006deca8e6177c661bf83dd87b2275ef2f1c28
SSDEEP 192:DvEgB87URfaE0nZP60jQk5WSjk4V0qSk/yOPsUIOSeC2dzdb4OkWb:DvEgB87IfaE0nZP60jQk5pjk4V0qSk/z
TLSH
T13A02BDF7C3E4866DCC1156F49B116D2ACE5D1919832C3C2AC9E9AF1BB3E2471E11264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 317ee560521a885647be2d7b1bd9d7d7b242e711977b2645140620599c069b73
MD5 70ab1a728a534445a1062d9f216b56f7
SHA1 1ca15efa385791570429b48dc2f7dfc5a9e3eaa3
SHA512 8be95eec8362ea4d1b4b7bbe95ddccf27675d63fc962128e7a6d460b261a3b919b84df169bdf5d0d24de744350688eeb0ca22370a3bb108aeead544b73def801
SSDEEP 192:DvEgB87URfaE0nZaXk5WSjk41qgP8IOSeC2dzdb46JJeNy/SRzGkWb:DvEgB87IfaE0nZaXk5pjk41qgP8XVC2l
TLSH
T11402DEF7C3E4866DCC1256F49B116D2ACE5D1919432C3C2AC9E9BF1BA3E2471E11264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 bf624e02120c67dbdffd0c94828749f3dbeb8a8861f6bef88143cf0e0c5bbc2f
MD5 2f379da8b7428c69d29f4acb336eb1cc
SHA1 891f2e87bfa7ae1d96864ad767cd38c5d113c457
SHA512 fbefd2f30b64ebf5184b429179024d810d89b603ac5e08daa16ef17049b0dcdb5743ee303de76eb15e4c67e43554ba75dbc78431fb202b7c928e8e4cdc29446d
SSDEEP 192:DvEgB87URfaEIDnZaXk5WSjk41qgP8IeC2dzdbAJJeNy/SROkWcmJx:DvEgB87IfaEIDnZaXk5pjk41qgP8HC2y
TLSH
T15A02EFF7C3E4866DCC1256F49B116D2ACE6D1919432C3C2AC9E9BF1BA3E2471E11264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 49217701ab94c2bb660e9d8ffbd84d5e69b5d69f06cb54ecf8715903238270e8
MD5 9f8381e5d6804fc8ad97a8ce1dfe5e75
SHA1 5d3b0e160f8f8da99dbed3d8d9835c13b88ea5bb
SHA512 f1a8a75104fec51edad72c9365e0d7cf7d2caade3fd9dd4b001122778d1d37e2d4e588a72f43ce5affb1a9efbd9f18873ee59c594422f2300a592cfdc3761246
SSDEEP 192:sxZ9RvWeb/f8sHRZIdpdEHW6+WNGYYBaCxIgrJ:sxZ90eb/f8sxyWHbGft9
TLSH
T1961296116E28A57B8CCBE21DBB15BF53D6F9503251941E98EAFCD61C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c76b4d58b748420874cc192abb301e1bb9ac3099356e8e60118a9e3af46b0a2e
MD5 372d1f19611d674d96af140240442828
SHA1 bb19b5f21f8da75e82f58a75e18ba2dabadc3f48
SHA512 65fcbeaf6a61bb90b69875f2d7c1344effe3b7fbe8a50ff8c0c5b75c358c90372a8a4a688320c72028a31db704dbc4b7f6fc7a70cb10212b182c141dd48de200
SSDEEP 192:sxZ9Rvneb/f8sMhNIdpHn9HSta8HW6+WNPjSVz/MDHYYB/CxIg5tJ:sxZ9teb/f8s2uItPHbMYHfMd
TLSH
T19032B752693469BB8CCBE21DFA15BF57E6F5503291D01E88AAFCCA1C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 291cae4892bccb55608407a6e299602249766dc4a7e0e77a0bcaf3c7b50d5807
MD5 58204a9f0652aad362131495e735d2da
SHA1 70355e2e7b6821668cce719a9c705ff89df7a87c
SHA512 aa03a6c39c32220094848a45b90d9f76d5469a5a3dcd45f53384725761a0c9f51d7d1c0fc9cfb6e4e50dbac21bb476dbe9c9cb33c5770459669a444c1bead27b
SSDEEP 192:sxZ9RvWeb/f8sMRHIdpdn9HStqHW6+WNP3YYBaCxIg5PJ:sxZ90eb/f8s6I6tqHbfftb
TLSH
T15422A6516E34A9BB8CCAE219BA15BF53E6F9503291D01E88AAFCC51C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 75c57c72614292c5cd999788928d7dcb1a02a6cf11d72f852a7bb2293ac4ceee
MD5 ede0a60355b1dfd6345444bab4c5218d
SHA1 a90bd6781642599d8468c4b327e382298657c9a3
SHA512 008839be7f09c3c68cd21e79ad4f1a5bc31d10ada9094c46ccd1f7fd918c0d2e3088fb49c993da00f831e6dd77fc40071fae1de5b6ec84be560c6d19dc2e346d
SSDEEP 192:sxZ9RvWeb/f8sMhRIdpdn9HSta8HW6+WNP3YYBfCxIg5tJ:sxZ90eb/f8s2a6tPHbffsd
TLSH
T12A22A7516E3469BB8CCBE219FA15BF53E6F9503291911E88AAFCC61C05E77DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 47defd744c84507b58a95de6ecb182f14919517bc926495a5cfa36387bc4514e
MD5 7b02d40e0aa8813373932da877ca15ea
SHA1 80d9743dfdd5bbb499e5c06cc1850b4c2cdded4b
SHA512 67746432d8232f76796d8d48d249f4adb618ce79bc4e16fb09c63939c36688430b240fa29000ed6b1cd6579b56c15b6746695e78ad17c0abfa7a05032447a84d
SSDEEP 192:sxZ9Rvneb/f8sMhRIdpHn9HSta8HW6+WNPSVz/Ny1YYBsCxIg5tJ:sxZ9teb/f8s2aItPHbQU1fTd
TLSH
T16B32B7526D3469BBCCCBE219FA15BB57E6F5503291D01E88AAFCCA1C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2e9b808961b1b3cf8456ab9086749b9583b4ee3004fb9cd5063b3c6032e83133
MD5 3296a2571319c46b36bc31efb4b1fd18
SHA1 7c5a97dc40ce932fd2a5cbc64e9804c0288552db
SHA512 a1da11741545021daa422558430464a73a2c95332491eba07b315d34e2128dc238b84d88e69d7ee6b4f18dbe259e21c1d90802e4baa9a77d866e544c757d3237
SSDEEP 192:sxZ9Rvneb/f8sMhhIdpHn9HSta8HW6+WNPjSVz/MDHYYB/CxIg5tJ:sxZ9teb/f8s2KItPHbMYHfMd
TLSH
T19E32C852693469BB8CCBE21DFA15BF57E6F5503261D01E88AAFCC61C05E67DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5d6fa397b4ddd1462d257866f611ab62a9e593d6e37833f30cc6710482596196
MD5 68feb32a8a9c6e080c11ccc2709208cf
SHA1 2357631ba58e3b95a5d68a84b74a8df212eaa657
SHA512 dac12cb4f4d64cb645a6de4e4ba12d6a386bcb4f75a5a3c063976e8da8a9058cb9b56e1d0e3bdc5f50fd8e5fa5f191f60bd4d0527e909c9c2d793248d45af241
SSDEEP 192:sxZ9RvWeb/f8sMhRIdpHn9HSta8HW6+WNPT1xlYYBUCxIg5tJ:sxZ90eb/f8s2aItPHbLlfbd
TLSH
T10932A7526D3469BB8CCBE219FA15BF57E6F9503251901E88AAFCC61C05E77DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d92bd3722fceab38905ba88b0028c1d836a41bc7ba26f64d2f476f72b1a2064e
MD5 3ae7dc96db7516988a97475fa79b3e99
SHA1 d5f74d3f8893a771c5a7574a3d3e1698e08c581c
SHA512 e0e2e1ead13300da3edd50720ac499c6a71063003036dd29ffc15743f45b1dc02c5083ae8017f184ab6ed5c36e35ac5b03e9acd099bee611afbdf5b44cb43423
SSDEEP 192:sxZ9RvWeb/f8sMhHIdpdn9HStqHW6+WNP3YYBfCxIg5tJ:sxZ90eb/f8s2I6tqHbffsd
TLSH
T12122A7516E3869BB8CCBE219BB15BF53E6F9503251901E88AAFCC61C05E77DD2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 98987b1ce2eb5e830bed433874a19177becd315f133a0256bd1f78a79b9108ca
MD5 78711ca737ea2c49a299ab0bf9d511c1
SHA1 7ff47ac31eb9ba7ae06579ac59295e7f1e6ff758
SHA512 45cf23431d4bd144204ce78a56ce7b8b8d73ccd309a76c0dbdc608e5e80b5840606779cc5a092ee4d20194e3ec8b1115928e4a7c7b3f360a62c4baabbe367a32
SSDEEP 768:PQyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXcropZiI:PQyYR7jWv3NpBu1ja/CL8OXHr
TLSH
T15BC2F93B640DCB7E4FC01A9DDC5A6FDB7E9802C796548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\01725165d044e06ffdb4830051b6b457da4bfae0\index.txt
Size 147B
SHA256 8dc0d54d7af01049e58bc49e70055c8b2724a32780bac5018cf628e9b2aa57e3
MD5 11d3f5141077942912e3212fcd5d47d6
SHA1 d3d36a1f91f53ff2684c20a8260ec516b1e35602
SHA512 97bc32ff8ed3015eebda16a63949cf484ab6a042dd353a2c1045deafb22575cdceade208b081b628e8609fbf5ab2300b654f02addc7857874e2880a4d63a7c8e
TLSH
T140C02B7F0002982B0E3E5FCAC860F3F9A3BA34CA7D8544C8C924311808941037D1AF82
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e99b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\01725165d044e06ffdb4830051b6b457da4bfae0\index.txt~RFe59e99b.TMP
Size 154B
SHA256 d5d5dc847132603815b6b2a79062ba88e6397d49bbb3c440b8f4e1ab760d0520
MD5 ca10d189732a86a80a65f99e65bc0bbb
SHA1 70d6638274d18440c44682d47069f26ac20ef5cc
SHA512 e1df0eb798e24a952e03060174b49aae6e99a748dfa5df6eaba38e91f57a9206cb4e35dfa584c24d26ddc8f5c45fffa6828567d6865542353ce8363442398a4a
TLSH
T167C08C6E002248260E3E19CAC860EAE963B63C8A7D854488C924312644B0103AA18F82
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1fdc8f45a81c1ab8724c628e1229b5ba121b090ab292c1f65f38ee7c64a337c8
MD5 6ffb729dc3e574771aa2b0402803ef5f
SHA1 46471b7858c50546cbcc131279c9ccaf271fee64
SHA512 89cfe79c0573ddd3e7ddfb60a89f22ee0e1a4d94e4d9517e52e6d5e315aa521063d941801b6d523dc541b35cb844312efab36513f4be6b4bb89b929cc58c32bf
TLSH
T12BA00250C24D5182D45C0770208E2551A35088A24202022588A0E4B9ADD52F0B153102
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dc5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59dc5c.TMP
Size 48B
SHA256 9954ecba654fb917ded89765225e86a61cc2a0f4e9b083bdc7bfd409bbb0e698
MD5 1b6132bba88fb2a4945d0ef804bf6b4a
SHA1 eec7a126b8278e8ad54fadfc7ddf2d9997f9c142
SHA512 4773eaf00474349d9acff35718102a13907021f926aa89ca8c718ddfb0d669768d06e40c08f74948befaffdf5c2801f1ef6bc4c208664e4794351377ccf439b7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f6c80991dc23f40ad2e474f5e7c581295427885a8f3e255505b71ccc70b5bbdd
MD5 69494349c057366acc24ac31c4b066a8
SHA1 912ae07db0310d15a70d583b750af343a3f7ab71
SHA512 f64c9b1e07bd452f9f82d62910973fc09ef3fbc2263c78e7c279e2153d556cccb8241aa8e74881a24d64a3e9178c40c49d9de50fa7e6940d5814e566e7af89a7
SSDEEP 48:Kgfir/BhBab5UpISPaK9v1lax/KYstvTyLnKzHJp5Sbx8hISXSK9X19SxXCY0lHK:KQsAKVC+ikAKR+uRmKKoS+ROK6EFu
TLSH
T1FDC1DF55717B020038BD759881B69B1E6281B2B33019E67BBFBC50B68F6EE544CFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c770227a-900c-468d-acf2-6e59d118903c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c770227a-900c-468d-acf2-6e59d118903c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 743d52dc1fd600a767a8d3600be0a4dd07c136311602f32d3ba35ab8a856b4e7
MD5 a80b1710b7eb168430292a80ef0c569e
SHA1 3b2b72f5f8129b1b976bd11334e65b9f0a9384ad
SHA512 7ee6cd1c526a820bd87a9f4693bc018540d974d874b86f9628253cb3c8b98fc8033f7e1da0c42a01cc0e08b4e0ead94e4226e889c61754a4e0548b2bb0d03e26
SSDEEP 384:nZcIhsNGpW3/piti62QX5+DtJOnIqNJrz6vRtgOIwZOyWLwoa:PhKRZ69kDzOIqNhz6pXshk9
TLSH
T18C827D32ADB49CBB5DEB9181F48A32039FF45467D2C8ABC4D5ECAF1C01D97A8131AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 ce89ce711cfcab92ec49dad4511493bba47e7dabc6c58d66d965ac0c73ea8f22
MD5 8d4abecb359ca118422f687d8dcf4168
SHA1 1d2fa204d0885800bedcccadddfda0326cd46e08
SHA512 3e22649dfa06098a2a1c0d4db19a3e9ff956527a99340f2a03735d11a728ecd414786eec913928e53b4957c9f5ec735d196d4ecf3f7d4dacefb3c4e9e9ca1419
SSDEEP 384:miFiZcIKzsNG8TUNTUlIlAW3/pitB1QX5+DtJOnIqNJrn6vRtgOIwZOyWLwoa:NFQC/wgrRiSkDzOIqNhn6pXshk9
TLSH
T1BDC22AF258D7987AD9AE4743B77D2E038EBCC067B585A590B3985A1CCC851BFD30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4759856d14a359143e45561bea64d266b2e8a209771bb7297327d544f04a076f
MD5 b4fe87db706264a2dd3ee2046a32a709
SHA1 bc4e5cc4cf4c859622caaa54538900ee021cf22b
SHA512 8cbe901370178f09a2e38b70d735a3a2f9162e21d0d94420436dad2cb57d80c620bfe807b980e1c9a904fdb475e295c157cbf0c6c5e3e275bb45d8155de5a0af
SSDEEP 192:EONq6nnHGQmiUyzlQYcX5hQDP1JOnHodMcm2U6:EONq6nCSQNX5+DtJOnIN5U6
TLSH
T12702D834BCB86CBB9EF36E45B48622239FA4216BE5956BC4D6F81E1C01D775C2306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 50e6feb14a733979576b1a75997fa0f89f8b624356f331e206f4503a624b0c94
MD5 7e809ea9590a403074289619defa5586
SHA1 44aa3ab7066b1ec8f230cd82421fcc2cff63600e
SHA512 a02bb9e73b3e0452b9d0e7df6af0e67cabfcf7d6944afb0ba1bd05c55d575ce0bbb33d46fdb4845628507c3092a405406ff5960fe4e46fdb5517ba6a8316a270
SSDEEP 384:KZcIhsNGAW3/piti62QX5+DtJOnIqNJrz6vRtgOIwZOyWLwoa:ohLRZ69kDzOIqNhz6pXshk9
TLSH
T15E827C32A8B49CBB5DEB9181F08A32039FB45467D2C8AAC4D5ECAF1C01D97A8131AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d64fcd6fb86562c8aa0ef290b15ff110acc2dc9a9a81462c0d06b8c9f2208dc
MD5 720dcda8f89775ef3ba27b57ba404ac0
SHA1 f18d28ca18489cfce6f1300a8ac8926cbbbdc6ff
SHA512 cbefedcc4c51010d1c9132e2b5bb9c5989ac222ee0a81da98a480876d4953856ce526f5c4675937a95f799648278eff62bddd9ac66840191ff034367d5fe03d6
SSDEEP 192:EONf6nnHHQmiUyKlDYcX5hQDP1JOnHoqSSJrNg3Jq5vRU6:EONf6nJ9DNX5+DtJOnIqNJrS6vRU6
TLSH
T174120931B9A4EC7B5EE365D5F48731539EA45127DA857BC0D6EC2E1C01DE7AC230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98c42d7c69c4610c69cae36660951748ef73a0483615b5a6defdf89faca546af
MD5 3ce6e7c9a5c2fabeefe40a5d23dd7e5d
SHA1 327e0a3360b0e023ba615aa268b6f63329cdfe66
SHA512 7004db0f191b9abdbb5638304408149b032f2a1572f0d998546aed7cd1c186ee0f9c1fb0467756c32c1e99eca4d495a6cbdbcd1281cdfecfcd37f7ff430f125f
TLSH
T1FAE0020253590567C01943300093971167F1D41102720387561001660C333049D20B05
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c95ee953af93c49fbe46b5990302288c6a7b21be8d308ff8bc674ebebad98a2
MD5 1f43e2fe2e11fb6635fa5a34cf30e6e0
SHA1 f1422d873966b268e60390f98d71a88bd5ac3d2f
SHA512 a1ff54cc028356c393767393c158036266208e52e6c046549f92ecb9ccee507d50888c79f859c264fe96782b755f99ff381417ef723db37278ea3c94c9996daf
TLSH
T19BE00203535905BFC02D433000A3973177F6D02103B20387561101750C233049F30FC5
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe597c3b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597c3b.TMP
Size 392B
SHA256 e6f32cbb713bd406999dd86059b788919eee7b5927470dbe16d3ba2f7bdc78a5
MD5 abde6084a3ded2a4eccbc1b9eb4c2640
SHA1 313948a67380207ee6494d2e28433d82fed833ac
SHA512 a651bc8eae5b4d0ca6028b08b530a4ee9371cbfa9ccebcdf4d55e26b1c3c5abf2e7474caa12220452b18640455b7c28f25206af79e53a4add8317c965b0c004c
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 86190af6ee92def8a2c72340cd71028db3dbe2ed009c9609d9fcc7c032522f8a
MD5 81ee373b44f2cce0ae24bbe9294655e7
SHA1 13aa6a9d907a42a45ef28d489df0f14409aef7d1
SHA512 76b9b6b039c61ca1ccbacffa5b668d8e2b4c0e361f5afaca9f83e9f501d787e44b43b3058c169743673a31043743d26b757670dc21b9fc42325625e382cac6df
TLSH
T10941095CBAF91048B3776E5AABF2696E487EBD731E06D49D10110E4F0A26F00CD62737
MD5 SHA1 SHA512 TLSH

Submit Download