hxxps://rovno[.]xyz/d?zid=25272&uid=306&pubid=411325&psubid=044e3420-6c43-11f1-b84c-bdc3614dc318

Analysis

user interaction
yes
max time kernel
600s
max time network
493s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rovno.xyz/d?zid=25272&uid=306&pubid=411325&psubid=044e3420-6c43-11f1-b84c-bdc3614dc318
Sample260620-bfbwqsdy5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2984	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134263911062453272"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F75C4B6B-CAFE-42BE-A938-C5D7B89F6B53}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3408	msedge.exe
3408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 3364	4452	msedge.exe	88
PID 4452 wrote to memory of 2984	4452	msedge.exe	89
PID 4452 wrote to memory of 2212	4452	msedge.exe	90
PID 4452 wrote to memory of 2212	4452	msedge.exe	90
PID 4452 wrote to memory of 2212	4452	msedge.exe	90
PID 4452 wrote to memory of 4552	4452	msedge.exe	91
PID 4452 wrote to memory of 4552	4452	msedge.exe	91
PID 4452 wrote to memory of 3760	4452	msedge.exe	92
PID 4452 wrote to memory of 3760	4452	msedge.exe	92
PID 4452 wrote to memory of 3760	4452	msedge.exe	92
PID 4452 wrote to memory of 3984	4452	msedge.exe	93
PID 4452 wrote to memory of 3984	4452	msedge.exe	93
PID 4452 wrote to memory of 3984	4452	msedge.exe	93
PID 4452 wrote to memory of 2724	4452	msedge.exe	94
PID 4452 wrote to memory of 2724	4452	msedge.exe	94
PID 4452 wrote to memory of 2724	4452	msedge.exe	94
PID 4452 wrote to memory of 1588	4452	msedge.exe	95
PID 4452 wrote to memory of 1588	4452	msedge.exe	95
PID 4452 wrote to memory of 1588	4452	msedge.exe	95
PID 4452 wrote to memory of 3704	4452	msedge.exe	99
PID 4452 wrote to memory of 3704	4452	msedge.exe	99
PID 4452 wrote to memory of 3704	4452	msedge.exe	99
PID 4452 wrote to memory of 2576	4452	msedge.exe	100
PID 4452 wrote to memory of 2576	4452	msedge.exe	100
PID 4452 wrote to memory of 2576	4452	msedge.exe	100
PID 4452 wrote to memory of 2152	4452	msedge.exe	102
PID 4452 wrote to memory of 2152	4452	msedge.exe	102
PID 4452 wrote to memory of 2152	4452	msedge.exe	102
PID 4452 wrote to memory of 3532	4452	msedge.exe	103
PID 4452 wrote to memory of 3532	4452	msedge.exe	103
PID 4452 wrote to memory of 3240	4452	msedge.exe	104
PID 4452 wrote to memory of 3240	4452	msedge.exe	104
PID 4452 wrote to memory of 1020	4452	msedge.exe	106
PID 4452 wrote to memory of 3928	4452	msedge.exe	115
PID 4452 wrote to memory of 3928	4452	msedge.exe	115
PID 4452 wrote to memory of 1352	4452	msedge.exe	118
PID 4452 wrote to memory of 1352	4452	msedge.exe	118
PID 4452 wrote to memory of 1352	4452	msedge.exe	118
PID 4452 wrote to memory of 960	4452	msedge.exe	120
PID 4452 wrote to memory of 3244	4452	msedge.exe	121
PID 4452 wrote to memory of 1752	4452	msedge.exe	122
PID 4452 wrote to memory of 4512	4452	msedge.exe	124
PID 4452 wrote to memory of 4512	4452	msedge.exe	124
PID 4452 wrote to memory of 3408	4452	msedge.exe	125
PID 4452 wrote to memory of 4440	4452	msedge.exe	126
PID 4452 wrote to memory of 4440	4452	msedge.exe	126
PID 4452 wrote to memory of 1392	4452	msedge.exe	127
PID 4452 wrote to memory of 1392	4452	msedge.exe	127
PID 4452 wrote to memory of 2892	4452	msedge.exe	128
PID 4452 wrote to memory of 2892	4452	msedge.exe	128
PID 4452 wrote to memory of 4136	4452	msedge.exe	131
PID 4452 wrote to memory of 4136	4452	msedge.exe	131
PID 4452 wrote to memory of 4028	4452	msedge.exe	132
PID 4452 wrote to memory of 4028	4452	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rovno.xyz/d?zid=25272&uid=306&pubid=411325&psubid=044e3420-6c43-11f1-b84c-bdc3614dc318
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffaeaeec188,0x7ffaeaeec194,0x7ffaeaeec1a0
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,16638789319986227889,16578536953446874812,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,8962738782290913062,6459423710973132564,262144 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,10681257182029481468,10134395449259826311,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10439846490508004958,10513199661811450325,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,13278595204512888933,17386249829602039372,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,9516489506778372807,5041041513443240607,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,1451170701361577911,5770001117568066666,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3572,i,15903177469067928400,2764242396462932230,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5216,i,4336812307935576880,4524397409147617192,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3928,i,3390755174579732213,12493497861532171267,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,7627091959996330228,8243086952767714532,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,165082512477691933,5644688224511160194,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17699458863290677819,13972842362369042106,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,17699458863290677819,13972842362369042106,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,4761175310745476304,4642916775041680703,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6472,i,9187900779892558306,17234822199967573585,2097152 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,3939810713314108127,647332143826358777,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,1719099741752361224,13249693664279669839,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,15834155139446396155,14909841078988195366,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,15103446340444484790,6068086855144984448,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3708,i,8523790815752469062,3561402230887157123,262144 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3956,i,4737571770468788253,17677931516783515851,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,2160209279487525014,8371388245987174842,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,13484415907984487255,1882490739288608205,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,14308815766747354571,17482795119260448625,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,16612793181940158448,7231003762159948380,524288 --field-trial-handle=2272,i,9046589642559309781,18364581171166215969,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 2.5MB
SHA256 a383de16c6136f1edab102c0c0414f4072197b46957415740fa3c7889ed81fdc
MD5 8730acb1e2865828f9ed5cf86fb386e4
SHA1 9afa2bdb412730bfba41959514d6daedb7b57e26
SHA512 c5675cc49207c37b09695e958c2399154c3f84f651c138835d0782e5d7684b11d7a0a3771c862a1e3fd22c525ef404d23e3b23dbb062a6c2c0fad0eee2601d99
SSDEEP 12288:jlfBWQx0LxbHMsM8BYAbIg7G8FGbBKnx0TGS3MOEhBYAbFg7G8FcPA73KZEB3tKQ:jlEzzMnQr0EZUKZEB3tKBck75T+FCo5
TLSH
T187C5334A85A3FEEF02357C77A836B4CDA66807D74290FD3BAEFC857D97599A80403250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3be073942d3bda59ce89db20b35fc0dae7104d4d4b609170babe3a37e3242daf
MD5 745a4b00758a5608a95fd355070a23e4
SHA1 5e22221e94d9c578a160c6c7dee32c9cea73f6e2
SHA512 a98c974321f5849edd64a6eb991a2835a467e2dd703b3d564063627c79c67f72e3f080de45aebfdc86754da0d1c2520b7316d68b64d8f9037b1bc36d9daf712b
TLSH
T1EBE026B949E8C7BEE200748781B8630D92A1360E97CC6B0E3B0888CA7446680F6C2E90
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5f0896aa6b3fbb301140e2ec2a097846147597aff43fe544400fc4d051009da5
MD5 b6ec5ac7317964f4d668a3bbe09194f4
SHA1 8fd9745df5aac231f6d9e683a55b6444bf49999c
SHA512 fa5fd8373d5ba01184cc705a18f22ce93dce174b1c67c2059b7a7d488257c5ee3f2299d16ecdef139ff8cca3ca38302ec1e221c2e2a101ca090fc400b78a465a
SSDEEP 96:BBgo6eavrBz2BNeijpTwyy9egWvyFK3XOu:P67BzOzjge5t3XN
TLSH
T12491088D73A29491CB210E30F7DE0A83B7F891C8059F6E56E068403F6B067BE42277E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e79c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e79c.TMP
Size 3KB
SHA256 fc980c784cf59f9474d60b6b0f4c4066a00cbea26448221a743fe45689781681
MD5 b78888271bc81118584b8286410c391b
SHA1 8901a61c0a0de83c11cc8494dd5de7c993d6d7a5
SHA512 61d7f47e766268b37e33d828ab88e24060623f80261cfa876a59ddc284810509e321c326799660c13965220edee6f343b2d9108b2aef4b8b02fbfb0310217d22
TLSH
T11A711BDD3322D452D3210E30F7EF0693B9F141980A8F6D56F118597D690976F467B538
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 a824fad14be6e965cf90f1780af8821fbe39282b5386a3e70567f3711932e2b6
MD5 be6e63c6222b703d38fb8bbb833ad184
SHA1 ee41efa86b570df78c626eff09de0dfa9955868e
SHA512 0c3854e38cd0c2f0b3cd380f2b92c365f657528818311306b4c4495bd74519ca5e6891c45c3714fec13b124739d6438708f442f3a753cdcd5a05f2796ab508a5
SSDEEP 96:DXOwepppuJp9pipT+hSzswpukpzpHpubJpbpgpK9pWntp+Oj6LBwpmA:D+weHUJX088AwpHtZQJBm09IntAOj6LO
TLSH
T1B2A170F7D3E9862DC82656F0AB14AE1BCD5E0914832C3D2E89D49F4B93D2471E641B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 b639998b1ae6df4b9ec71a0e49b016739a527c973606f7b39055892486a07742
MD5 c60581287bd262f934ce3731037ac246
SHA1 839df23c7294950c3d638d97e787e2db40a67bda
SHA512 d13c53c7c0df47b9dbc338b13fae75ea2d12ea72a50f3039d1532eaf915b9d0a0d7c41645876977f2e428e54d4dd6481974f8d122fe3e04443ae107873edb453
TLSH
T10471ABFB93B4922DD92256F0EA18AE1FCE6E0514C32C797A89D0AF1793D3061E141B4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0cbc70b5a01001c6b97c4caae6a0f63946f663a848d5e38ebaa7fbaa1aea622a
MD5 679c640735516211412bbef76636554e
SHA1 2682d9d8936e6e6a2cc4110768b18528791e2146
SHA512 56ca3fbc99c312c8b5d811c7efbc6d1cbaa91789eb1cebcb13a983fd70abe63b22d630b165f9cbc23e51da843f297f4397d19f5ebdbc3aed448fe26b4c0a56d9
SSDEEP 192:sxZZRRyM/jK1Ml8MkJ/fIs7CIzIdpdvTyJ9HW6+WNIa4B/Yw0uQfSIgrJ:sxZZjMJ/fIsuIsGHb8/Cq9
TLSH
T14A52E902AA34597BCCDBD20AF955BB53D6F51572A2940D44AAFCDB0C04E6EED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3456ae162e6c84c94dbed1af41c9fac3d3186965c0fe28679783c65ab22ce8ae
MD5 f73634bf5bf9dc2d0de78654e56e7275
SHA1 d1d7997d4751b30b8afd09b4d44094fcc4292ae0
SHA512 b4210c3f70a62743ca152b85ebbc55730315f7b0217a6c2bfe40634ac6206526d97d298af398749d1ff711d484841f5b7950385d94104cc22888608620b380f9
SSDEEP 192:sxZZRRyM/jK1Ml8UQHkJ/fIsNCazIdp/vTygt9HW6+WNjP4uBGu4B/YwS7QFSIg8:sxZZjqEJ/fIsUas3HbaL/to8
TLSH
T1C062D816A63859778CDBD61AB941FB53E2F55572A2900E44AAFCDB0C04E6FED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 92302cf7487b024216ab2b7fbcff6a9e09ad820efd06a5b7659dd9192bfcc358
MD5 bf47b837106b441f89e5a57a467fd6fe
SHA1 ce1e5cc1413777aca21f9f9ca00be9ad7c49a4fd
SHA512 276eb37c71a9ca297acdbcb178f2f24c87e6927d758885491035070d441d734db84cf0d7a38d6c5f8b5fdb3f1783704175f1cafd0bed4d9dea87062120d1a454
SSDEEP 384:sxZZWqEJ/fIsUP66s8qMpRiYnazAW8pZS15posJWeT+Hs3HbaL/tq8:sR5EJ/fwP4Mnc7WeT+HcHbCtD
TLSH
T1D6D2FA069934C8778AC35D19743CBE33A6EC50626285CEDA5AECCE0C019D5FDAB4786B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 766745af60d2aa3eea669203c68ea7ab0bfa8e901860753c7de0cf15532d3259
MD5 7d834a156f4a349f1bf04ff24760fea1
SHA1 019bc2d789cd59a11d1adb4088fae5ac5dec7fae
SHA512 7e5c80c8512366287f0f319badafac9c37775b80bf6d76a6c275d0457970540b97eb92d132433491b43e845af9b0bb87e3a499ca1d45ca8a069fabfd86bf1da4
SSDEEP 768:NS4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dWrohycHa1:NS4jeXmWvmKLEu1jacPLZQdtXe
TLSH
T12CD20A3B284CCF7E4F844E5DEC26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 10de490443c5ae882b5bf34dc61b8c8755118bed1e5ae3e17aca6bdb75ab2746
MD5 695bf9c2526c9b9a3c6e4b65378c1ea5
SHA1 dec742678d765913dabc300d3a63328cd3748ef9
SHA512 272ae890e1213282d8b421392726b6f271b9c4a93aafbc8493676d7c5ea64d7d3c1d4c742c59330f92b3bae0f30a289a3eb0deec2038fe5b48fb0601bc3e319f
TLSH
T1E131844E8D84DA5FEC5445B219B3B8BC32B489CC4721E213982C2275BD1236E169F1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0fe1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5d0fe1.TMP
Size 1KB
SHA256 b9f2d5a4bf880ae19257bf3b6c7f08a2a931ef0e4b327bad6c13424eefbf4d65
MD5 20d1da23ed82082b7fa3f1a3f6227223
SHA1 a1c963c23fc486cee4933919533c53a2c8f6f90f
SHA512 64e01cc916819f9cdb8214796d0e8aaa80793e04e01d11b17280f386561763d784112219e4d6de10bcf6fe5819cb1e964a9ec71a089c8b1b1e918c20da07e5a0
TLSH
T17031674A4E818A1AF8C450771EE3B8B8733598405322B793957C5639BD257BE1E4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5de893fa8a6a5452901effbffbc9220bc4e027797e0db5ddc218fdc8bf5cd267
MD5 e7bb7b4b8878c1d5aa63c9c0b8d58f54
SHA1 b76a2fa7046b9fc4b775090ea377a81107cc3e5f
SHA512 bd4f771397b80e2e594c50a2b2225e9bb431777c4b64128ed768212f6c3289caba97472e7b4f932d5e8647cff48b3bdc9d5817f4459369495e211ab809b3494e
TLSH
T15AE068FA2CD72E20AC7F87E238B245B44006B428C590AC8E2016A2E750A02282016C60
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 752c0acbca476dee3c1c34251af43e9197440ad3a513e1aa77ce08299583b876
MD5 afdb9cc1c78665bc0c76cf461bfff705
SHA1 2cab7c28a798faec0b2e4e65f4209af860d93ce5
SHA512 f730a008dcc17207c9b02dd4554741c455119318a6d6ce40026f56d2a585ad303807d3024cbddecf34329fecbddb860f6817bc242c09c56a34e7feb0b1ebff48
SSDEEP 24:Kd9f4LiandPrD4bf+4fP8tayd6qm4a2+NIjQmKilhaum1EY2SmsM18w3yXYlfQDK:K0CFI9K+IgXyp6IfKP6AfnItKA0IS
TLSH
T18B91660275BB62413C7F2808A650972A1B4271533618796B7FA800B31E7BF684DFE9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596344.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596344.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a9a82b5a10268cc93c332e7ea1d38631fa3e20df410587b01645e5ac0fd263db
MD5 35a1e55f7c6fe8fece786034f2561a56
SHA1 c0f49e95ab40ee68ecc78dcd04d25996a14237e2
SHA512 007d6eea28b5b7597b847fa2321e64e8c51c412ec65c17d46d4f73f8102da89d6e9808528558f8b31d7762756d34d21aebdcd23e75d961d6c5487173aee72326
SSDEEP 384:OtNn/s3n9SfsNBf9wpluJof+G8WYWXsFgITGT0Iax9i:Oj+9UgZwxqgi+0/vi
TLSH
T1F4927B329838AD6B49D2A586F44F36171FF41667AAC57F84DAEC6F0C00CA6EC134AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c5fdd0441bae726204c359c7320a7bdfc81098b507ca61123030aaef8d437160
MD5 2ce47f9dd5252dbf3bfb43b2f59c9b1d
SHA1 b4675a3f02f1b4a1305992616347835f5bc03046
SHA512 6b7bfac99b649e4a69bee19bb1d3300c07c1ab0e6eb922962eb035a2a915868f407c4d91662315c4a33830f8bc4435bc4b333f4c2f4328ba2f5a0596383a129a
SSDEEP 384:F8iF1tNn/s3n9S7zsNT8TUNTUlIlm9wplCJof+G8WYWXyFgITGT0Iax9i:FnF1j+98qwg2hwxEgi+0/vi
TLSH
T1AFC219F248D7993AD99E5B47B73E2D124EBCC167B5816A40B7985B0CCC8A1BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6b066a6d55e63bac732358c09ff2e983168f2d714034f40fec89bb06811ee322
MD5 c6978d9608c93692a5b6550db92db91c
SHA1 f22fb1ba77adbcdcc72402b04b5db7aad19115e6
SHA512 091ac38196ce4bc510e9f84b2b555b91f750e42e9f1fd5f00b92f6fe42a5821239bd6e5e8b77b8478d2e1435d9dc44f6d7e35ef1ebaf462c1cba7751385a232f
SSDEEP 192:EONC6hZ0QmiUyBh9pc/+jV0jzorWYt5wOZJiU6:EONC6o6pu+G8WYc2MU6
TLSH
T12902EA35A8686C778EE2AE45F48B77135FE5112BAD956F84DBEC1B1C00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 98a5ccaaadbd4e1b9bd557569249aea15403d04bcd04f055cff78d906f6842b7
MD5 b716fb7db964e82fb5aebb24754b0d1c
SHA1 0aa054b8afd0b736f0c2dc8d7b405352dc3bf495
SHA512 3afcaae7fa7c807612e6181b1d48c9b78aab58ae15f56f6b75d3411cc069b31ed432761f2d3168cd7c5f393413615440aa4e1a6d82ec345c5b36b30f97180960
SSDEEP 384:jtNn/s3n9SfsNBm9wpljJof+G8WYWXsFgITGT0Iax9i:jj+9Uf4wxqgi+0/vi
TLSH
T146927B329838AD6B49D2A586F04F36171FF45577AAC57F84EAEC6F0C00CA6EC134AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3a0678c8dd3def617b7de027644e691fc492b5c24ff3c36448f6d030c4c06421
MD5 c3908dbd1fadb7ca166ca4bc6b11c21e
SHA1 485dc7e489982839d9a27f3ccb719de4c06bebd7
SHA512 74965b73b81762d999556883cf2d6ece2d0f18d120951c02b9d02b2b7e28d7e038b354bedf1477737e369fbeef9b9d2f593eaddb8dc0209ea3f6cbfcdba7653c
SSDEEP 192:gJONs6hZDQmiUyNh9Yc/+jV0jzorWYWXr5cOqSqwU6:mONs6pAYu+G8WYWX29gU6
TLSH
T1D7120B36A878AC7B5DD2A945F48B36135EE55127EEC57F80D6EC2B1C00DF6AC134AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c561d21eaf22cc64e1aeb9fa476e8aa17ca8c60afa85e6c091330f17cf3735db
MD5 be3f525988ac234bde0297e661244e70
SHA1 954ede8b5c3320333ea7bc6e0fb958af12237c20
SHA512 85c87dafd95541e0541314d437d2f6c307884eddd7a69e195da58577a9e0f2d7b20131853a4eba853820e965989126ff38956004bcca875e8f5595e3c5da0aea
TLSH
T1B441E758A6F91148B3B76E5AAFF6A86D447B78772F06C05E50110E4F0A63B00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download