hxxps://faceit-client[.]com/clubs

Analysis

user interaction
yes
max time kernel
599s
max time network
601s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/10/2026, 22:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://faceit-client.com/clubs
Sample261022-13lrwsvsft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2224	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{90D43C16-32F3-48B3-814F-E380474924E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5616	msedge.exe
5616	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe
5504	msedge.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 5504 wrote to memory of 3996	5504	msedge.exe	81
PID 5504 wrote to memory of 5588	5504	msedge.exe	83
PID 5504 wrote to memory of 2224	5504	msedge.exe	82
PID 5504 wrote to memory of 5588	5504	msedge.exe	83
PID 5504 wrote to memory of 5588	5504	msedge.exe	83
PID 5504 wrote to memory of 6020	5504	msedge.exe	84
PID 5504 wrote to memory of 6020	5504	msedge.exe	84
PID 5504 wrote to memory of 5792	5504	msedge.exe	85
PID 5504 wrote to memory of 5792	5504	msedge.exe	85
PID 5504 wrote to memory of 5792	5504	msedge.exe	85
PID 5504 wrote to memory of 668	5504	msedge.exe	86
PID 5504 wrote to memory of 668	5504	msedge.exe	86
PID 5504 wrote to memory of 668	5504	msedge.exe	86
PID 5504 wrote to memory of 4592	5504	msedge.exe	90
PID 5504 wrote to memory of 4592	5504	msedge.exe	90
PID 5504 wrote to memory of 3372	5504	msedge.exe	91
PID 5504 wrote to memory of 3372	5504	msedge.exe	91
PID 5504 wrote to memory of 5424	5504	msedge.exe	93
PID 5504 wrote to memory of 1324	5504	msedge.exe	94
PID 5424 wrote to memory of 1712	5424	msedge.exe	95
PID 5504 wrote to memory of 3308	5504	msedge.exe	98
PID 5504 wrote to memory of 960	5504	msedge.exe	99
PID 5504 wrote to memory of 4752	5504	msedge.exe	100
PID 5504 wrote to memory of 4636	5504	msedge.exe	101
PID 5504 wrote to memory of 4636	5504	msedge.exe	101
PID 5504 wrote to memory of 5616	5504	msedge.exe	103
PID 5504 wrote to memory of 844	5504	msedge.exe	104
PID 5504 wrote to memory of 844	5504	msedge.exe	104
PID 5504 wrote to memory of 5336	5504	msedge.exe	105
PID 5504 wrote to memory of 5336	5504	msedge.exe	105
PID 5504 wrote to memory of 920	5504	msedge.exe	106
PID 5504 wrote to memory of 920	5504	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://faceit-client.com/clubs
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff8251fc188,0x7ff8251fc194,0x7ff8251fc1a0
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1708,i,16523274633475465637,7552784994261946091,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,11662586953620057907,7632637827569330971,262144 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2092,i,5937445921158368329,11067131812208813156,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:13
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3552,i,1196894862077271005,17340343762225846067,2097152 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,1994071505683599774,7853256149830281329,2097152 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,16989879964714488983,18234258959751698953,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,1828510694301736789,8230549475417654047,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16980485843260340668,8191289453885125922,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,2538801323302065838,17269052610380822867,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5424
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,16980485843260340668,8191289453885125922,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,10158364793329347845,7774434067176795768,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,3162317282836602657,5088097732218650670,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:14
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,9398575174393481360,14518458199927471795,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:14
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,17524604266394195737,1300695611344911537,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6420,i,10587693385069013888,3148275875874583463,262144 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,13434444345186287035,9044680621666531916,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,16446670881561228444,290074283082992017,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=3140 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,6184224831101262541,17101647404333153072,524288 --field-trial-handle=2332,i,14578957902664340934,17139152629105791294,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30a947d6-b05c-4cd1-85ad-c633f760fd0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30a947d6-b05c-4cd1-85ad-c633f760fd0e.tmp
Size 32KB
SHA256 a99530b86de85321e8e1a20ade969bdbc54a3a173a4ebc13ad4d19abeed3a4d0
MD5 09f370b2f0727cb1278a65203f6febe4
SHA1 d86b6934a81457997a142c019000879aed023365
SHA512 701b54c9148b1559d90427b24db662098a74a4356bccc6179ed3bdf085d3f3ecee4d6ac03b38ad1ada8c300ea7e43e30feed5ce7d509e394aead4d6fb55cba3b
SSDEEP 384:ndiFzQkUSvj38NY8TUNTUlIRKCC7zBQxzyfoBjT+Cyl9kn6V/fMP/fvwQTeUErgv:UFdj3zwgDCBadBGzW6V/UHfvOZLS
TLSH
T119E2B3F2A8D78977D9AE4B97A37E2D4299FCC113B5885984B7C81C1CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4652a5fa-b09b-4d48-851f-f5ede511e37d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4652a5fa-b09b-4d48-851f-f5ede511e37d.tmp
Size 26KB
SHA256 2633c1f33e32985a5ceabdb7b039fb46e8e51b0e7b99e166168678c993ba6a58
MD5 a7a01bafece6551a7d825d463e032e6d
SHA1 dd7d43ef9ad183deae2a7c9c44f8e07fb62b0ca1
SHA512 1acbc50bdcbdfcced60e97684e534ccce62aaab71ff818aa6cc22646ce7dc35b36e218948d108bb7a4d2de7433bd8976d48d4c83c93b0ddbdd18673b62e4c84d
SSDEEP 384:ngiFiZcI638N88TUNTUlIxBCC7Ah9xzyfoBjT+Cyl9kn6V/fMyvfsa+VYTQgL/75:7FQ63DwgCCUPdBGzW6V/UwfhgB8
TLSH
T1E8C23B32EC94C9BBECEA8ED9A74A7643DEF0416395CCAAC4D5D85D1D009B1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97f95684-0522-45b8-8ca6-5518e659d005.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\97f95684-0522-45b8-8ca6-5518e659d005.tmp
Size 27KB
SHA256 5518716e4d960c263cce23e54841c1480448541016e2cd78d34ed8c0861686b5
MD5 be1a3b200423c7ede704a82f64637b61
SHA1 5b8b6b44d2d3aa9cca6915454c38f8929eb5f744
SHA512 b9daba75f3162913d674278b4327e4af7a1d2eab85e1e1fee3afc5045a82c7cb6b22a27f98c353267deedcadf558073d5edb029739c502bde3481ec54c47ac69
SSDEEP 384:n+iFzQkUSvJ38NY8TUNTUlIRKCC7jfQxzyfoBjT+Cyl9kn6V/fM1vfvwQTeUErgv:VFdJ3zwgDCPadBGzW6V/UNfvOZLS
TLSH
T1B6C24A32E895CEBBEDEA5E99A34E7643EEE04113D9CC6AC4D9D81D1D009B1CD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

12c929cd-0b5b-4a51-bb5f-4bf944e72305.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12c929cd-0b5b-4a51-bb5f-4bf944e72305.tmp
Size 12KB
SHA256 5a0d768a9c50caa6895d1cce40ab7f74b301508474b52c0b49d0b613f21fc109
MD5 d281ba21f99197e10c7048c591627ef6
SHA1 2e6eaba5b4666c0dc7251721e4f466a78d4ecb8f
SHA512 8db91be98f487a539d3ef7b2b454f1f77f4956883159c9b7e1ca6ba301f8a8e7ca2b5b94362f4dc791e3378997da517c4e16eca44147dd41ccffb9094be76b3f
SSDEEP 192:sxZjRWFw/ftsIYI1ZqMqfzodpNIw/W6+WNXYeXY0gbw1CuRFmIg50WJ:sxZjSw/ftsI17qE3/bXX5Sd4gii
TLSH
T1E042C7167D28AD3F8CC7D619BA55BF53E2F9503390912E48A6FC8A2C11EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28a557b8-08e9-4dbf-9870-8f333ac24d9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\28a557b8-08e9-4dbf-9870-8f333ac24d9f.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f51127a-d431-42b6-8482-f4c16d9b6e04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f51127a-d431-42b6-8482-f4c16d9b6e04.tmp
Size 26KB
SHA256 7fb4f726a2d3a2a6b214cdeb7b0da263afdedcb08c2fcd7705ce110be3ad6428
MD5 8f1f2d288a8e1a9aca0701cb19903486
SHA1 1e7eb251e8cb349e5693c2f78ed7edcc8a477175
SHA512 53a6438e88d08704aa84bab5416fc0bb8a50febaa71bbf597dbc44d522987d84c4e21eda12d771c69e2873aaa09214c214e2015f936cb85f8c0a7380a62357fb
SSDEEP 384:sxZjSw/ftsIE66s8qMpRiYnazAW8pZS15posJWeT+T7qE3/bMT5rz4Fii:sbSw/fZE4Mnc7WeT+TeS/bu5341
TLSH
T12FC20705A924C83B9EC39D19653C7E33EAEC506222C5DEDA56ECCE1C019E1FDAB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 9182d337368204b5e3712a2c0f5c522d994fe0d03efa63a03d81e4db157b998f
MD5 a45fb9179a99afbbdd09211e52cef522
SHA1 ff499af99e733bd6924ea4013833b127bb6914aa
SHA512 deecc6f9adbe8295d7bf39be043c163caf7ccbbe79b089753dcb9dba44fc38586ba1b220572920e300cd227c927d3f03f5bf1e5b3318bead5356db0c25ab7f68
TLSH
T154E0209404E8C33DF50464CB01F4930C8780761FA6C06D6D2708C7C8704B8446797570
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dce68d3c5841f11c575e5c2a7babdb296e207a80664a67653cbb8d13ebada6ec
MD5 8ca50a2b25ace0c7e3e7ace9889a511a
SHA1 35b3a0fb5ff428cda5ad63a109731820eab4ec84
SHA512 38eff2612c4db665392affd39d2ccccde54393f2f0918979d525e3030afa1fdac299ea9cfc683614a82869ebeb23d5be325db85b00f2abcd07be1386c83f9f35
TLSH
T105E0208505D4C33F7244A44B426CC74C9782371BE2D06D6D1B04CEC8B049040E3A5560
MD5 SHA1 SHA512 TLSH

Submit Download

9c7d3ede-ffc1-4952-8ee8-6e694bdb6c50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9c7d3ede-ffc1-4952-8ee8-6e694bdb6c50.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

121f0199-782d-4564-8e6f-734c6f40ee39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\121f0199-782d-4564-8e6f-734c6f40ee39.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7e7c210e-b21f-4492-b111-c43045c9229a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7e7c210e-b21f-4492-b111-c43045c9229a.tmp
Size 2KB
SHA256 502a3bfbbd771e3a16895d39be40c335c5df88698e5bf438965946d226302b8d
MD5 f6e195618a5f1c6e16eb5b5bce7b49a9
SHA1 c248464188916083362b1757085a898579fea9ef
SHA512 d99082eb1ca9864e2758574e6cee707e07f48d5e32cba3a90678f78feba677bf41f973393306cca89ae9bb7faf29a553205f47e29655cd52ffae542d223f47b1
TLSH
T1B7418CF787E8866ECA0156F0AA14AE2BCF2D0514436C3D99C4E8AF5B93E3471E141A5E
MD5 SHA1 SHA512 TLSH

Submit Download

81edca35-a33c-4ba2-b48f-3592fea12da8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\81edca35-a33c-4ba2-b48f-3592fea12da8.tmp
Size 2KB
SHA256 c7cabcabb6d327108d909ef0a9552af324b6b2028474b9b570bca12efe7a71ca
MD5 96cb0f81566ccf49601fcd65a54aadeb
SHA1 c17e3fc5d7f486b0e253f783ceb7c82eb56b3bf1
SHA512 04c6907f07a3158c3ccefe65c3b80b8bcf869e5727038cd1f2853d7af1c0789cf10f14f7b7641ee2a8fa1736fbeaafde05e3ae92ed76bbe4301396a59783827f
TLSH
T19551CEF783E4866ED90152F0AA14AE2BCF2D0514432C3C9AC5E8AF5B93E3431E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

b151a049-f738-4949-a492-8ef06e0a4507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b151a049-f738-4949-a492-8ef06e0a4507.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\temp-index
Size 2KB
SHA256 d3ce48019621e09beca6ccafdc43eb58914efba878117584fa8f5221e0b3990d
MD5 e96dfdf96c798dde446bdb14d33e3f50
SHA1 02c4deff0d34360f5e532bf9e47a3656914ffacd
SHA512 6e6eec31c0bc96ffd63cbd81733e4b6d90258aa1ad40d4a3988a8ab832b261057f3c5e2320c95c80ca24dcccb4315f1ce77f81a58ff2df76321501374b3c0a00
TLSH
T1E641C84A4D035B3BED585632247829593374A0CC13982F1FBAFD812DFCD3B146C89A6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\the-real-index
Size 2KB
SHA256 1630d8159e7af32eaffb5ef8b69fda02f69b8557ba617af3cd960ce0470c8c35
MD5 5ffab13d69f20cf4f9bcb58b97977ba6
SHA1 aa18c5a5726bd4c3e3a9e4eb584fb33c7ccb345b
SHA512 242bd14746e88d03768fcbb7f7637c8f6331755a7c3b590b98a4da832763671f8c23f641834d8f69a16f8a73c5809481c82884b4ec473e8ba16a6df916ca8b9e
TLSH
T18C41B5564D42473AEC5402730DE964973339E18847843F0F72E9D136F8C27986D99AE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 31db71b3f332065a426d8b7e9768097d79d807fcd721ae3cef27b5d4ce1a1965
MD5 378c7a27eac95f793caa4b7435109b37
SHA1 2c13e0edc1e4fbf9d1fc3c40566711e7dcf9561e
SHA512 38e57856aed9fb984a84f92e88d7dc5f9046c7dee8c9b62443715c5710ab38baf8feed0072eb1978d15272ca130303424add17f47d371ee1d77c769ae02cf72f
TLSH
T132E0C0F72CF709249CBFD7D638724465401EB86C9508BD0E401992C350B03993445C21
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 960dcc0f9f213b8c01481a04ac4ad39eb31ead418a980bbfdcca6b963f92900a
MD5 19b7326a7cbaeda0d856d8ebc49d4979
SHA1 1739f171b30e5738be0e1e2b86208668392342d5
SHA512 c88c3d7bb612b28af80f1fa2b886708022452495b378ff5eb009e31c662075d137835341d149d6ebc503170b30e5e14a5bac8b9cb19a5a8f64eeae60641912b8
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgO:ohdNdBzXXFPXgRbKvtp0Jlzn+BR0
TLSH
T19AB2495130BA12593CBE390890B59B2F52823573711CE62B7FFD00A68E6BE485DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c592eab5-b164-44cd-bf27-1dbdefefe45a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c592eab5-b164-44cd-bf27-1dbdefefe45a.tmp
Size 12KB
SHA256 56dffc3812334e01d5697c81af26ec83795e58a71a75a197a32b1aab6fac3795
MD5 e8b74b60afc65a12c4422322b770ae4d
SHA1 ca604a799aca65690b2bd5c04f87e8427fa24f7d
SHA512 6683d06c1d548b72be9ad21ff87323b18b01ce6c4eb54f02a8c2a0def9b8ae4a7e70253d5b88dd210bcd329b3795616c8b25d592079da11e02a04898385bd434
SSDEEP 192:sxZjRWFw/fts2I1ZqMqfzodpNIw/W6+WNXIOUR/Y0gsxw1CuRFmIgjWJ:sxZjSw/fts/7qE3/bw/53d4gji
TLSH
T14C42C8166D28AD3F8CC7D619BB55BF53E2F9503390916E48A6FC8A1C11EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ccf5646f-9e6b-4930-95b7-65f886ed2503.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ccf5646f-9e6b-4930-95b7-65f886ed2503.tmp
Size 12KB
SHA256 81d3376566c37abc8de09b380553786e1ef0afc90079ca1b0c0c9ac5f359e688
MD5 42eb4960fb843904045c5cd56d2269df
SHA1 0869fd84b82f4369b9f3f806b17be7dd7f2fe3e9
SHA512 d426a2c2c3c2221e7f636894f0ff20735566fede02909260a1bb21ba173d5b0ed69472be301b7331214fcf8878da30b75fd563a6fb6a3d81dc680c8b90ad90cd
SSDEEP 192:sxZjRWFw/ftsIkI1ZqMqfzodpNIw/W6+WNXlFdY0gSg1CuRFmIg50WJ:sxZjSw/ftsIh7qE3/bPd5Pt4gii
TLSH
T18A42C7167D28AD3B8CC7E619FA55BF53E2F9503350912E48A6FC8A2C11EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d52a5734-cd3b-420a-8cbc-3f4d623d270b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d52a5734-cd3b-420a-8cbc-3f4d623d270b.tmp
Size 414B
SHA256 d7bc7695a57b12cd71ba5b7bb72242789899b98b8f5eccf531bb65360c2a83c3
MD5 4bd6e83608b8ab7392b19a48ad2f6d91
SHA1 613c5752d2b1b5a1edb67963fe47b39d7cc94459
SHA512 fa65a5ebdcb59d6096523617bc389a868dc74aa376dbd28e24d2ef356ce8ccc8bdb6c3ae6d443fe7673f6b4673f8dd0bfd0c3447fcef8c97ae24ad30366c147b
TLSH
T190E02BADCC26BC3B09F9071C60504B4AEE6103572A51940B3A3C821C8FB163A41C5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

d9fa88fd-b622-4e0e-9fb5-ee0ea07d3a4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d9fa88fd-b622-4e0e-9fb5-ee0ea07d3a4d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bb9c9777-ae43-45bd-841e-b0d43b5aeb6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb9c9777-ae43-45bd-841e-b0d43b5aeb6a.tmp
Size 25KB
SHA256 3cf3dc067f6d4562926a013fee53b9853f8e5b546cb8f1e51d37e1f716c16f80
MD5 f6a5293e089528a93b84e7c862ec3065
SHA1 33db5a795f2a5e4eb516b21480cee753bb8d3814
SHA512 fa659d474209ecb0b20fb6a7196bfaa8eba3e21e91a4b23df094447f91a8e38b028219a7866619c9b08579f5b68568ddb9b14f3c1cffec596556af1ba03d326e
SSDEEP 384:n5iFiZcI638Nd8TUNTUlIxBCC7JAAcxzyfoBjT+Cyl9kn6V/7Qdsa+VYTQgL/7Ig:QFQ63+wgCCOAWdBGzW6V/MdhgB8
TLSH
T180C24A35EC94C9BBECEA8FD9AB4A6A43DEF00163959CAAC4D9D45D1D109718D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed7cb6f0-d0de-4039-b701-b092e8689412.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed7cb6f0-d0de-4039-b701-b092e8689412.tmp
Size 27KB
SHA256 fb9f2299d64bc2b40636ec7b3a1a268f65de5cdbf6bf92a28a22a83272c6e3f1
MD5 8d5fc0244c50125d6998de4db8aa3adf
SHA1 55e76e27faaceed6016d9199cef45b094ecf3b34
SHA512 f477a1a7b7609cb339448f70db750571c4634da08006913b2e342839a4143d0c331472d3334436fdb2b7ba73bd29fa53076d438e020efbe5c5d139bbfdb1457d
SSDEEP 384:nPiFzQkUSvJ38NY8TUNTUlIRKCC7zfQxzyfoBjT+Cyl9kn6V/fM1vfvwQTeUErgv:aFdJ3zwgDCfadBGzW6V/UNfvOZLS
TLSH
T1C2C23A32E895CEBBEDEA5E99A34E7643EEE04113D9CC6AC4D9D81D1D009B1CD134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1324-196-0x000001D723720000-0x000001D724720000-memory.dmp

Download