hxxps://perfiles[.]exitus[.]cloud/get_host[.]php?user=LPCORFIN-213

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
900s
max time network
642s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/09/2026, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://perfiles.exitus.cloud/get_host.php?user=LPCORFIN-213
Sample260930-tkd6rswy2q

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5556	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{C295CC75-3ACF-4C49-B0A9-C79AFEBA42D9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5792	msedge.exe
5792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 34 IoCs

description	pid	Process	procid_target
PID 4572 wrote to memory of 4988	4572	msedge.exe	82
PID 4572 wrote to memory of 5556	4572	msedge.exe	84
PID 4572 wrote to memory of 3596	4572	msedge.exe	85
PID 4572 wrote to memory of 3596	4572	msedge.exe	85
PID 4572 wrote to memory of 3596	4572	msedge.exe	85
PID 4572 wrote to memory of 2280	4572	msedge.exe	86
PID 4572 wrote to memory of 2280	4572	msedge.exe	86
PID 4572 wrote to memory of 6044	4572	msedge.exe	87
PID 4572 wrote to memory of 6044	4572	msedge.exe	87
PID 4572 wrote to memory of 6044	4572	msedge.exe	87
PID 4572 wrote to memory of 6024	4572	msedge.exe	88
PID 4572 wrote to memory of 6024	4572	msedge.exe	88
PID 4572 wrote to memory of 6024	4572	msedge.exe	88
PID 4572 wrote to memory of 4424	4572	msedge.exe	91
PID 4572 wrote to memory of 4424	4572	msedge.exe	91
PID 4572 wrote to memory of 5208	4572	msedge.exe	92
PID 4572 wrote to memory of 5208	4572	msedge.exe	92
PID 4572 wrote to memory of 3956	4572	msedge.exe	94
PID 4572 wrote to memory of 5020	4572	msedge.exe	105
PID 4572 wrote to memory of 4940	4572	msedge.exe	106
PID 4572 wrote to memory of 5492	4572	msedge.exe	107
PID 4572 wrote to memory of 1880	4572	msedge.exe	108
PID 4572 wrote to memory of 1880	4572	msedge.exe	108
PID 4572 wrote to memory of 2008	4572	msedge.exe	109
PID 4572 wrote to memory of 2008	4572	msedge.exe	109
PID 4572 wrote to memory of 5792	4572	msedge.exe	110
PID 4572 wrote to memory of 1140	4572	msedge.exe	111
PID 4572 wrote to memory of 1140	4572	msedge.exe	111
PID 4572 wrote to memory of 5500	4572	msedge.exe	112
PID 4572 wrote to memory of 5500	4572	msedge.exe	112
PID 4572 wrote to memory of 1276	4572	msedge.exe	113
PID 4572 wrote to memory of 1276	4572	msedge.exe	113
PID 4572 wrote to memory of 4960	4572	msedge.exe	118
PID 4572 wrote to memory of 4960	4572	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://perfiles.exitus.cloud/get_host.php?user=LPCORFIN-213
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff84e4ec188,0x7ff84e4ec194,0x7ff84e4ec1a0
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,9867076422496396750,10485515889877817259,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,17016713180072107343,5490829433323520142,262144 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,7340133324910845448,2514604255654902022,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,16542357256542269387,5993640569420578340,2097152 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,14826591662762031431,13718068402483757163,2097152 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,8265657188286388907,9117547145718388634,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7176578757078587106,862779704069753650,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,16654036385574094739,9226097071543060042,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,16654036385574094739,9226097071543060042,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,16046797020560998799,13764497966115507313,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,11468390209458313963,7333462567525732542,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,17559076711288171622,6696751035164399031,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,7766260451408494656,18408191894968530595,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,5130493158205656679,6396922517179211194,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=768,i,1098447364558655405,9925366627495411605,262144 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,14111948970121439818,2137146711592544484,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,13933860619200877085,8331747062952430028,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3384,i,12884184041644652573,12158675889843097806,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,16048062652483239690,14723703842076929328,524288 --field-trial-handle=2296,i,10782198896343144850,13606273968185401852,262144 --variations-seed-version --mojo-platform-channel-handle=1528 /prefetch:8
  2⤵
  PID:4960

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27341f426aa0efd6c484bc21b43d92cf90ca72c2333c8e492f256c83fd880a23
MD5 5e7e3b8030681bdf6022439fe49f75f8
SHA1 0ff916bc55fa603e71947fca76af181bf6a176af
SHA512 f028e8f02a0deeb001818c82b1b058d78b877b08dfffccd53e7636c6b399cea4a3f75d2e7d48b81a7bd267b29da417e86f7b980e8764b264d26bc3942cb86bac
TLSH
T192D02BA49AC8C8C0C84120361358420831C8D23448A3404244E00254CED126216A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6204bea9f8b1ad36010b54acce7e8be8b24f4872037dffac553ff0027e0e506e
MD5 ac020bbd6c39f434e4be10631c1ef9ce
SHA1 deec115dae6133f96ac7a60f1ce277cc004d6826
SHA512 6b4a0246601af27744249758570c7661a324f1115ceb8d7aa7acd5c8e9c7792e55c605c74f62f55d904291cb73951ecde58a884d87909f3b6f6466468350674e
TLSH
T19AE020CC56CEC73DF314644F41784B4C81D13B4AD2DCAE4D170484567505058E3F69F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 79b7b7ba1511dd5272979d39187342ec1f4ebd280b6c9ad8e7801f93c90fe0b4
MD5 55efbd2ebd32d97390e7d377d7701eb6
SHA1 eda43341e5b5d84e6f5a3a29b1216b5e1918bf0e
SHA512 802eef68f591ae4f03687518f7f9b7aaee2e9fa33d38552386cfcdcccf7c4cb53401ccf1c8418f32dc35af067b9f0f825961014bb7c81773fdcb3aa65cbebb65
TLSH
T11BE020C445C5C35DD110748B42F4CB0CA3C13B2BB6CCAF551700C445B04295CEAB55F2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 782bb235f5f6ac3b0097596ce53842f38a0c46a138b2001f4a8a28d8ca3fea6e
MD5 7643cf88b7feb455b366c93090d9751a
SHA1 0adcd28ae7fb2afcec09d86d301b0903711416aa
SHA512 32f81a37d8817393cd1e2f9faf2edf35acbc099deaaf51ebcbf8b553a761163f865339fc22c95044826d916e1a02a086ac15ccd7034284904e2ce45a915db968
TLSH
T1AFE0208455C9C35DE600665B416C670CC1C43B0F92CCBE17270484A57201194E39B5F1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 d27dc23c325daeb7ae409b923c94bf4fa01b1f187cf7a8f88defb3719958166a
MD5 adfd928420b3901beef2c9991a2160ec
SHA1 f9fbac6492ed08c9c030c341ff46f530909f09ed
SHA512 392e243fc07d740a61e8691bd0828404837d7a5f5667227b51d8616430ab151c2a49ad378007c4736825898aefb5975e92b422b6d208f7514fd319758f4697ae
TLSH
T137F0F9B5CD21BC3B18FC071820A54746E75113573B40488F3B3D420C8FB8537869686C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b66d764fa93dc1c37ab59d4efbe2f1a778085e75fb40ec8c7597a5ac7f4fb590
MD5 18eb2d8a0dba92f745a8d7ba6df5bea3
SHA1 50ea3d5aaee2646a2e843999389eb6d77d580886
SHA512 b8ef2e5ee49e90c234c031738536c9acb68de6f5b7becd6029b43ce14db37706fc1d8556a1045af3d58b6c7b31c6f85add92e4b664205a72dd64d26957e5c640
TLSH
T1BF418BF3C3E4866D890056F0A618AE2BDE2D0954822C3D5AC9D4AF6BD3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3c755cb598a8405faf4725b041dae3157824ba9de50c8bdfee724a5d7159cb90
MD5 d16fa24671748fb26b99758155248536
SHA1 e2f0b57a90996e284130f5cb74385a738d866881
SHA512 d33d407c011749de9f40643f8236129c5d194ce600c43cb46c0b95d4eeb0bcb3b53b568acbea6fb3bcf4febd38f93bb0541207496a51b01133d15cc4582684f5
TLSH
T15141BFF3C2E8865DC90156F0A718BE2BDE1D0914922C3D5AC8D4AF5B93E2471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7d03a74130744717b206c2830008feacf7d85c82ed26063b438536e6389e9f80
MD5 3be3582d4d0c6b9a28e15ee51c89396c
SHA1 09261590a19f2c1a0866fbf3a3364d9130c29523
SHA512 d70b7c3e96d714eb4d18359bafa857703e60460d1a2f27e5c6268d74bcad7cf7c18360d1fabec48635cd60ba077cbcdb7242b18841d237782aff14736b59d20e
TLSH
T15A418BF3C2E4866D890056F0A718AE2BDE2D0954922C3D5AC9D4AF6BD3E3471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c3b4d431ac285a5053ced8bc8d16347c0911e497984d43ee28940d0cbe4b603b
MD5 0e9b62e93f5c3cf26dd978597bf73466
SHA1 cb1083e4e7f5f3be02bdc4612307a9c20a38da1a
SHA512 86f51794020ca4e9c043093b5109c275d663e1fbe73569b5b342a230c111cdf07469581dac7ac93825b9b47d3f3cec212cc79e471f9167957392f84a05cd9b62
TLSH
T1BE41BDF3C3E8866DC90056F0A718AE2BDE2D0914822C3D5AC8D4EF6BD3E2471E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fd43ef150dd9a4500d71c0ca35f7ae45513d5fead0f32ca779a36879a892494e
MD5 93419171db7364e41a4b154c47d78d72
SHA1 66523fe19aa14349249de586025bb520fa0c325a
SHA512 ab46e0c9e1bef60826c83b5184a12f187ac905e3081c2f5922b2aa5c2cd1eb388d3b76baa351a688c2313f32980e1ecd5a90a955d4920594490d32c578b1faa6
SSDEEP 192:sxZzRIkj/fwsQZfXszodpeDHW6+WNz2F/YC3rUl8+JwdqWIgj3J:sxZzZj/fwsMfXvgHbU/8l8dqujZ
TLSH
T10C32D7156D28A97F8CC7D209BA55BF53E7F95032A1D11E48A6FC8A1C14E7ACD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0246b89c12bc183402f6df0da674e5055db679b48b9787d840ec06aa7026a2b2
MD5 93b7a46039e563ac4ba618d03a463341
SHA1 0ae3c6a7ae882bc18e344eb97cc9abcdc38b16f8
SHA512 7e59a2d380f3d4e2fe99e82e3d5be71fe19134d029965903fb1ce82603d4cdc955fd204ed293c172287485721ae643edc15191639c2781789ee67535d904400c
SSDEEP 192:sxZzRIkj/fwsCZrXszodpeDHW6+WNz2F/YC3ETUl8+JwdqWIg5v3J:sxZzZj/fwsWrXvgHbU/wYl8dquhZ
TLSH
T1B232D8156D38A97B8CC7D209BA55BF53D7F95032A1D11E88A6FC8A1C14E7ACD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a6ec5bb29f13776bfcaeb83d1ba00683cd2e4efc3abf5a64d523a946facce1de
MD5 e9ce2d53a08ee0f17b3051b995d254c9
SHA1 9eb7e4443cd38dfec3a525e1dc160d10c30372a2
SHA512 d216b9ad3692d7f378115682120f78e8ef5a08f6df64363fcf7e886aefc929b86edcd3eb8a3198df7a7c3f628ebe91b0af6f16df547ca540c861e8ad24d50125
SSDEEP 192:sxZzRI9j/fwsCDrXszodpeDHW6+WNzzJFYC3NTUl8+JwdqWIg5+73J:sxZz8j/fwsSrXvgHbhFZYl8dqug7Z
TLSH
T15342D7156D38A97B8CC7D20DBA55BF53E6F95032A1D11E48A6FC8A1C14E7ACD2207C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7126a688534bd1a2dd5bd1482386d74ce2430af899aa3b65e182ab68da5e82c0
MD5 56aefa0067734b0a328bee26722092d8
SHA1 65d2e6d5b90450baa22fef3e8ba9f5895ab73db7
SHA512 b3998d83fbfe82449a5d71d1247e48d2c1b25c1ff40026db8c7e0fec10adbdf9db62fc50252098c8de789876192e27adfde957a41b705e3208a14a4325bf791c
SSDEEP 192:sxZzRIkj/fwsCZfXszodpeDHW6+WNz2F/YC3rUl8+JwdqWIg5v3J:sxZzZj/fwsWfXvgHbU/8l8dquhZ
TLSH
T18D32D7156D28A97B8CC7D209BA55BF53E7F95032A1D11E88A6FC8A1C14E7ACD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 d13fe99a73ba75fa1d443f1e6be9e39c6546b620562039b35d66d9769fa83419
MD5 dc5907c3ed19db2269ae1de9e987d2c8
SHA1 b6c8ddf5ffac8bdcd8b60d6d25aff2e39f43402f
SHA512 5b570bd05ef0580abeb132ec1bbb0e96bdbfaf868405ef32b252d5422736c6ce2294593765ee00a63b05e95d91df1a28e5e513a20b9e5bab9e19d422b6561b86
SSDEEP 768:d8+S3v9WvhLvb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcwLle4ZvWrohMYd2:d8+S3v9WvhLvbu1japwLQ8vtKf
TLSH
T1B7C2E82F380CCB7E5FC01E9D9C5A6F9A6D9802C7A6588D4047FE994C03C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d51847b5-3dd4-42a7-91fb-bbca733649b8\index-dir\the-real-index
Size 864B
SHA256 196ac42107913cb299e85f5d8ec29ee3ed7bcea1156ca7afb23e5735002d0478
MD5 677e50620f20874d1758de82b378a4dd
SHA1 cde130691a4a934c416e645ba12efd5df2e9c347
SHA512 6fddf7b1d7bf4b4a0b6efeb2b9cee197c14d6f3148e7676079e8aed79970c27f47ab3aedc65beaaec3571d375b035fd55fc3f8d53d237741ac13e6758e8f5c8c
TLSH
T1A011029A5E92AF4FED6401B1383DB9C9B13910CC5344A71F91FEE32ECCD2B54AC41A55
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1c45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d51847b5-3dd4-42a7-91fb-bbca733649b8\index-dir\the-real-index~RFe5d1c45.TMP
Size 864B
SHA256 ece2727006b0ed19f5b274675a9ed80742d974c053530bc6eec84170e7ab0e73
MD5 9bee3cb3ba003fb29d7fa7b19e2f4950
SHA1 68ed298d132bd70bb6be19594808a59159bd220d
SHA512 4e5d259d6d61f02c3ef2e863558f0e484176bd5e8a734ad613bac4f514cb97e028f0f18af3b869209a75ee1a93640140fe0848b7206487dde88766254ec3bc6d
TLSH
T1171102A601639B46EC4402F1593CAA85713950045349971FE2D7A06ADCD0B94AD82E95
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4f093124bd24abb99037aa61fb61dbabb50ab4251a159d61abc5ca35d9eb81cb
MD5 aac5285ce5d05b0f077d39a84623b570
SHA1 edd92a963b5d613c90cc52e672a405892207e14c
SHA512 6a9e965e626740b28445319cb02aaead84287619c2ad6e5fe597f8f19870b36668bf9d5fc96466028aa887ea92b5a8f10afd864b8eb6142c98b42f3063334205
TLSH
T1B8E0C0B7BDE724A4E86FC7DE103148B0051178D4CD84BC4F01ABD5D390B5310B006CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 65be85d89c065d6828ef92bbbc1b77c0e4c130fc9e888b68153f77a8e8621aeb
MD5 2d904b62163a794e4437bcc8d686e3d0
SHA1 5a109692931263f22347c0ccc02719d04b69e44c
SHA512 ce8a9e4404d85d638eb759fa77d86101d36cdb738541df05fc1579efba74e4bec8db9b7df66d82bd1535e6cc8a8c1a76b013dacc17b29142779869e46333ad54
SSDEEP 96:K0UwKZ+6mZ6KawN8AKNeGq28KfKkFiKOoyS8YKBWmLCKI4C2VSKGIRggK9myqcQE:yjNB/XORbkJNlzjk517HNRZhTjRT5g
TLSH
T119B2F11571BF0240397E2D1881B4976E964272A33068EA7B7FBC04A6CE67E095DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 690e0ee93817cee49dde6d379557f1cdd8fae824d030ba888310147f7250cf2d
MD5 eeab1680582aa44f25150e7a0758803c
SHA1 7513eb930e45fec6e80934c9fed7c6f5109925d7
SHA512 3fb743289045e4ca99cce46434bfbe45d5fb4b0c06811879bfb5d4c5f6410cc0ba0a37fd15d837778271dc5e38fa02e1cf0dd9aee76f836079ba4596bf1ef417
SSDEEP 768:vFQ0X3dwgKJifoIGd6Yl1Az9MF3mjJD7OTW:a0X3mplL2AmlHqW
TLSH
T150C25B36D868C9B7BCEA8FD5AB4A7643CEF441138A8C5AC4D5D85D1D00D74EE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 598574ab3a7666b2031374dbdf44296fbb1f84f3b9580ab0f93f1d87c149d565
MD5 b856334d71e78b586cff322cc2d96dae
SHA1 626f717573d7c02d73f9bef1e3a43e291bbf1798
SHA512 8da11743db4d267165569b0ea8fe74163a28f35788d28b259bcb9fdf557a5c550ccbc18264dbc7c24569f9516e1c55941a1fe14908c3d9c4fa2c07b3729226fe
SSDEEP 768:nFQ0X3dwgUFifoIGd6Yl1Az9MF3mjJD7OYW:i0X3YllL2AmlHNW
TLSH
T158C25B36D868C9BBBCEA8FD5AB4A7A43CEF441138A8C5AC4D5D85D1D00D75EE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 3cc0197c95cfe000f565dc703586396e0fc8e683b7befeac62f59ed81b3c2063
MD5 d0e08c9dd91e4ad0d3085b82e95ebfc9
SHA1 219066be58758d13bc356c26d19e5a0b7c0bbeb9
SHA512 40dc45dbeaec780d3463df089dec60a32d7858a26916168243e220e5f503eff8b35eda68b38930ba25da1bfecca3402e8a925f4ad4d33f91f956909245a91269
SSDEEP 384:n/iFiZcI63sN38TUNTUlImkrjh+m/Athf6fD0IGd6YX1jZAmKssa+VYFd7UwgL/r:KFQ63Ywg5vJfoIGd6Yl1AvshgQ98
TLSH
T152C24A36EC98C9BBECEA4FD6AB4A7643DEF0116385AC5AD4DAD84D1D00971DE0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 31KB
SHA256 92d7566d827ca828a89143569172dafd600072198e196578c996ce4b49dd8aa6
MD5 0cb232e2d0ecf7ecc4a34a92140a9f6a
SHA1 560c2b43491b97a58809aa6921327b644d692f61
SHA512 ecd38ed97c3b3966af45510d66042665a2c10b55c394486c557718ebb0b7055b754525711fd8c6073aa9e50c8ebb1c9b6eaef6bc512ec3a961d6fc6361c60909
SSDEEP 768:ZFQlX3dwgK5ifoIGd6Yl1Az9MP53mjJD7OTW:4lX3m5lL24JmlHqW
TLSH
T14BE2A1F298D789B7E8AE4B87A77D2D0289FCC113B5885984B7D84D1DCC964BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ea1c51fc1337bb75b8efe1ef9b95f4324fd3b065b590402de8ba1af9008300db
MD5 a969c0c262cb361a1bebc55cf7b90659
SHA1 75cb4ac751f2a28618da3cb35b22a4bbc518ee2c
SHA512 1dafa72347cac863a817f56da8544de2daa4f7f2936a9e68441bd304a784e0a45df0f2850e6d6b4dfe772b43699701e32bd4c4de65f1b71b3d0c0f75fe067771
TLSH
T1F841D89CB6ED1008B3B76E5A9BF6A86E447FBD372E16D45D00110E4E4A63E40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3956-200-0x0000013561A10000-0x0000013562A10000-memory.dmp

Download