hxxps://api[.]launchernew[.]ru/api/launcher/react/windows/x64/NewLauncher-2[.]0[.]9-windows-x64[.]exe

Analysis

max time kernel
898s
max time network
821s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://api.launchernew.ru/api/launcher/react/windows/x64/NewLauncher-2.0.9-windows-x64.exe
Sample260625-h79qeaav2p

Score

8^/10

discovery persistence ransomware

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
27	3052	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3052	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268458631046446"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-28459746-3881314244-166055492-1000\{3688072F-BA52-43BD-AEB8-8179B1E9D385}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-28459746-3881314244-166055492-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4312	msedge.exe
4312	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 6088	1792	msedge.exe	89
PID 1792 wrote to memory of 2608	1792	msedge.exe	90
PID 1792 wrote to memory of 3052	1792	msedge.exe	91
PID 1792 wrote to memory of 2608	1792	msedge.exe	90
PID 1792 wrote to memory of 2608	1792	msedge.exe	90
PID 1792 wrote to memory of 1060	1792	msedge.exe	94
PID 1792 wrote to memory of 1060	1792	msedge.exe	94
PID 1792 wrote to memory of 1060	1792	msedge.exe	94
PID 1792 wrote to memory of 1360	1792	msedge.exe	95
PID 1792 wrote to memory of 1360	1792	msedge.exe	95
PID 1792 wrote to memory of 1360	1792	msedge.exe	95
PID 1792 wrote to memory of 3276	1792	msedge.exe	92
PID 1792 wrote to memory of 3276	1792	msedge.exe	92
PID 1792 wrote to memory of 5968	1792	msedge.exe	96
PID 1792 wrote to memory of 3268	1792	msedge.exe	97
PID 1792 wrote to memory of 5968	1792	msedge.exe	96
PID 1792 wrote to memory of 5968	1792	msedge.exe	96
PID 1792 wrote to memory of 3268	1792	msedge.exe	97
PID 1792 wrote to memory of 3268	1792	msedge.exe	97
PID 1792 wrote to memory of 3156	1792	msedge.exe	98
PID 1792 wrote to memory of 620	1792	msedge.exe	99
PID 1792 wrote to memory of 3156	1792	msedge.exe	98
PID 1792 wrote to memory of 620	1792	msedge.exe	99
PID 1792 wrote to memory of 2868	1792	msedge.exe	100
PID 1792 wrote to memory of 1992	1792	msedge.exe	101
PID 1792 wrote to memory of 2868	1792	msedge.exe	100
PID 1792 wrote to memory of 1992	1792	msedge.exe	101
PID 1792 wrote to memory of 1992	1792	msedge.exe	101
PID 1792 wrote to memory of 3800	1792	msedge.exe	106
PID 1792 wrote to memory of 2504	1792	msedge.exe	108
PID 1792 wrote to memory of 3676	1792	msedge.exe	110
PID 1792 wrote to memory of 2652	1792	msedge.exe	111
PID 1792 wrote to memory of 1608	1792	msedge.exe	112
PID 1792 wrote to memory of 552	1792	msedge.exe	113
PID 1792 wrote to memory of 552	1792	msedge.exe	113
PID 1792 wrote to memory of 4312	1792	msedge.exe	115
PID 1792 wrote to memory of 3720	1792	msedge.exe	116
PID 1792 wrote to memory of 1868	1792	msedge.exe	117
PID 1792 wrote to memory of 3720	1792	msedge.exe	116
PID 1792 wrote to memory of 1868	1792	msedge.exe	117
PID 1792 wrote to memory of 560	1792	msedge.exe	118
PID 1792 wrote to memory of 560	1792	msedge.exe	118
PID 1792 wrote to memory of 5280	1792	msedge.exe	119
PID 1792 wrote to memory of 5280	1792	msedge.exe	119
PID 1792 wrote to memory of 2604	1792	msedge.exe	127
PID 1792 wrote to memory of 2604	1792	msedge.exe	127

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://api.launchernew.ru/api/launcher/react/windows/x64/NewLauncher-2.0.9-windows-x64.exe
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fff683ec188,0x7fff683ec194,0x7fff683ec1a0
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1564,i,5827442185343695374,10653301623411963471,262144 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10510083519808829460,9295717223867248133,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:11
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,4138916912804167846,13858631574459229926,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:13
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,12858129540708683311,13327691245332376218,2097152 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3564,i,11088678759398965608,12456726946297839718,2097152 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4356,i,9535081956387700762,14404912396665662787,2097152 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,4018617385774694638,12174791666698043992,2097152 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:9
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,15744562362550071458,15706656485615613372,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:14
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,797108298859067047,1022255398124826181,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,16461969973717091558,17523997412237818025,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5784,i,15772281267739083280,12801448226513935708,2097152 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2323291095214715932,8085032320884537353,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,2323291095214715932,8085032320884537353,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:14
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,17389364407412552497,6103265751486192901,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5290344892727877827,3737391099193083607,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:14
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,16228340937900891180,7249978197911438771,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7160,i,56213510057863429,5825149670786887746,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,5694778272069419901,696557857990999619,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:14
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7148,i,16816896872108985581,7012154486347954749,262144 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=7372 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,14315674945916187023,9873984889102253159,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2163955447020033945,7135228561342244012,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=3092 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,10091491611592825929,7985597800585757666,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:14
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,2295875387312887136,6244892498828163812,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:14
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,14061845652489554367,1633405956419050875,524288 --field-trial-handle=2484,i,16455877023864794036,4962550968868243860,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1048

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5144

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b778cc535cfe9ef8131b9d727f221c5d63c7f15bcd4cd19db345f2c97bdf5594
MD5 a4b8f3b6133ca4686118d40b6c8d4ea7
SHA1 cbca41492cec17181764c1371da84a0e0481f93f
SHA512 65135f099a2e372c9a11538ad8ff73abdfa24612895545773034b613318a9166b5560e41026d2ec245dda6b088efde1566126dae35182ddcb3fe795a786554ad
TLSH
T1B7D0C0743F42F108C04904F08534EF101337B81230839900F070C80E84E40C0A3C9053
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b4edbbe62f29386512f6cd1726c675b23fdeee21a26a2896a394ff9b87143167
MD5 c0060c375421fc206e85d98fc2ea6677
SHA1 2189b0dd881564dfef39585cc2cffda4dcd3ec91
SHA512 338dc8a4791fbbe759582d4a8fd55c1a6245fcc722bff11ff926118daa91041d62e98b05cb2e63b22ea119d41a557c511dcfb12592ab416dab9980af0b5ca713
TLSH
T1F2D0C0703F42F008C04904F08534EF101337B81230839900F170C80E84E40C0A3C8043
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 e797009c9c5fd899e6fed0ea48a77a29f58e3197be1ffe2ed16930d279394269
MD5 aa69f1e267b6cc10fcbf7cdea4905e58
SHA1 4f7b7edaff6e75a42d6f451f495b8158646080e5
SHA512 42fb22fe7b0d686d33084957f05ca91cc33fb2739ceb73f72e1f2252c85c5f936ab473590203a9a8db8a012b3218076473ed512f098afb693be0743f13cbe83d
SSDEEP 192:JjKwpbEEEBBB333wwwaaa000iiiizzzZZZ5LO:JjKwpbEEEBBB333wwwaaa000iiiizzz2
TLSH
T162E15856C6D4D79ACB05148A4DA8D36C40717B0EFBDCEA4C138C8DDD348E99AF9B16A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b261ddbe94ea7548b30143256532bb9e0c4c4ac08b379d627ef23197a6337cb7
MD5 518dbcb883c0a21ee27eff6091c94145
SHA1 34d8e149c8a0df7b18977d9d058e005e42ed39f1
SHA512 2ebf90c68f15da0c13c6c65b803e71df425884a74d5a620061d9fb71b858ada8bc8d7fcb31cb77c11fb2882bad6068bc09cb05cebfed5beab0fb038e6265cde4
TLSH
T1C4E026A848D8C32EA614B5475768434EC2C0370FA7C86A8F3708D8CE7481780B2C2AA4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 e3972e65d3391b418eb5a794dee4269f5ac282c486904494f0cf839b3ff9385a
MD5 b691af31fb5a8ad4c17e3d30256233f3
SHA1 c37dc52b22f86fe5351c488bbf3aca67925b563d
SHA512 6f237e234c14c7b4cef6710aee62de40499e8f7cee214b212131faecb41ee267222e38e44d6db7de0db55944312575257ef49639fa0c5887bd28c3deea26296e
TLSH
T1D8C08CE9B988999ED7D1ABFD5A69B0000A4402F3D81E8B031118BE8131989F00E25470
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eb4f19ac84b04b6b799702a97af4004ee966ea81d14111f1702fe23e7a26bac3
MD5 5b8cc25fff77274d653a2c3d768ad0ed
SHA1 e04abdfc3fefbecb23a80d6f6607002eb5127683
SHA512 d1a24e4aea00132ec591943b38e4e72c2e9abd355b52b40ff7c425bbc63e5fe97260e70dab1c19e0879095f13bc8777d2f287acdca602f47a1dd31db675d6d23
TLSH
T12371DDF4B0E61617E7DA897451E5149DF3B0CF44AFFB6F1AC8987CB48A05F874264890
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c1c0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59c1c0.TMP
Size 3KB
SHA256 67c91c1daafd3efb68c6f7fc94c10505975bd6ee5cb5cc9c11d5a60d94ffdb04
MD5 7a94e3fbbd19a7d2b8b44297d6a17a3e
SHA1 6efc980cc31c1347e541b077e0537353a8352d80
SHA512 7cbc10306a5ae25feb126e47b1962e5b45b10ab3f6c3b435a24a08b556e213de45213d9ec0ebcd68f8e4f3e27fcf57797fb39ea780b98c121901064274e11469
TLSH
T18571DAF4B0E60617E7DA897451E5109DF3B0CF84AFFB6F1AC8987CB48A05F8742648A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64e63f30ff4dd9707d74ea4cba7abd3a14ebf0ee7f8c8b8106a3ec459cb3f63e
MD5 48e0df0a2cf0f636b47671c73f5cb65d
SHA1 c7dee7458703fd27a999073fd0a9ff4c052c2683
SHA512 05cd846b80ba2172a233741bc68f8fd6f42027e841c888416a6e07bb1650bf05cc80d2e742e709482864dc4994d85208b1ed045cd7b0646796e0a8984845b5fd
TLSH
T1A441BDF3C3E8866DD90156F0BB187E1BCE2D0954832C3D5AC9E4AF5BA3E2471E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

eae886aa-3b9d-405e-9b74-017dc9f302f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eae886aa-3b9d-405e-9b74-017dc9f302f9.tmp
Size 2KB
SHA256 30ccf21f2d48fada5b41ad73c527c181b08556c994eebee6f99aef09a1534d8c
MD5 670620e87201a20c31b76da9006cbf9c
SHA1 4ca8ce1eaa9ac2a8970e5d05943b8843b62d86f3
SHA512 f562aced8acf2e9eec2fb8e7ea4ceb7ea6ac0299912910ba97dcc3401913d9aa2b0664c3eb7657338b05ccb85ed711a37180a94210074b8e8f0f4d85b4679781
TLSH
T17F41ADF3C3E8866D890156F4BB147E1BCE2D0954832C3D5AC9E4AF5BA3E2871E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8ba0bf085b51a2a1d566b0bc64121bf4e9f846913c66a48f7952cf52aac5ef2f
MD5 86ce953b2525f07005fa79dcbf0bcce3
SHA1 89b250e612f48ad2e2573a9d48ea69c0cd2a8887
SHA512 7c3ee6125caa2740510ad26c1a6d73bb80419eab4cd74bb0c4e1c72e016297e2e38420fa5ae376dc94d279d4107798a2062022da99db2c28ec767be0f0e8688a
SSDEEP 192:sxR6R5yMqZjK1Ml8UQ+oE/fyseNhcGqNzoA8pw/g6+WNIYYMRYuqQ+GtIgD+9J:sxR6mqVE/fyseNhfpw/5IOqQvyH
TLSH
T1E762D8166A389D77CCDBD20DF6557F93D6F81562A2905E44AAFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd16a06a42b5bf11fa85402aad7b3cf90c59b6aea76a495660f2e60d0f54fea4
MD5 68b0cbb682f5f481993a974527ace64d
SHA1 be7e8b35bbbaad9fa07630527f130c353743143f
SHA512 a6804c1ca74a66161a55ab0dd62c761b1a6b2866dbce8afc80dec514c53bab48ded667fafd4457bb868a8ccd4123ffa547d5e0c60c01009db24951dedc707fb2
SSDEEP 192:sxRtR5yM/jK1Ml8woE/fys1NVcGqNzoA8pi/g6+WNIYYMzYuqQ+GtIgQJ:sxRtJOE/fys1NVfpi/5ICqQv0
TLSH
T1C752C815AA349977CCDBD20DFA557F93D6F81573A2905E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6cb4bc32618552cf3a15e4eb95997d85fc312fdcc85fafbef4fe879821edd65c
MD5 f24f6c1974cc58e06d82fa21d8a60586
SHA1 136175c0f542553d0cf4c3c79deffd5dc5924220
SHA512 f0aadd9f74a62cdb43690b942423b9b9fbd89e7dce2a72d69ab9057e8e257a21f2ad0620c193e57588d9578f3cbe584ea384cd87f3cbbec158c3c0ae5c35997c
SSDEEP 192:sxR6R5yM/jK1Ml8woE/fyseNVcGqNzoA8pi/g6+WNIYYMzYuqQ+GtIgD+rJ:sxR6JOE/fyseNVfpi/5ICqQvy9
TLSH
T11052D815AA349977CCDBD20DFA557F93D6F81573A2905E44AAFCCA0C00E6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 176e1cbedc3488bda85ccb7f11a5e6c46abd9a5e33bec7885ece11691fbe562f
MD5 221aacf392be0f9878fe9038aadd556a
SHA1 af38426be9b49666d4ffcaaa9bc15dd4a86ec03c
SHA512 b3d4f2c5edcc0b553406dc415b3e5d7a8e0ccdd21e53898629eeeb0a027faed96a1c7f6ab2a52cda9756a831ca2938231480577a4e303e37ada3fe5a910aaa1b
SSDEEP 192:sxR6R5yM/jK1Ml8UQ+oE/fyseNhcGqNzoA8pw/g6+WNIYYMRYuqQ+GtIgD+9J:sxR6JqVE/fyseNhfpw/5IOqQvyH
TLSH
T10062D816AA349977CCDBD20DFA517F93D6F81572A2901E44AAFCCB0C00E6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 246a2a8f9de58d7fb7f4dced1a66cb9a091e2421ae688a422320cd1b9aa6959f
MD5 4fb14850110ad5f9b4d44c507a282ca5
SHA1 79c595647efcfd8ec4d2bd22dd7c6f68445c80d8
SHA512 28ad4fa4b063456ca95a4eedbb979ee117f1932cf26c892982c74c737e58b539ea20fdaf73679a2cb26c77c980cf648c361dd5321bdbd3660ed8b116c18e23ce
SSDEEP 768:j+8uI7WgNVfq38F1+UoAYDCx9Tuqh0VfUC9xbog/OVbBJ6Zrolvs:j+8uI7WgNVfq3u1jaaH6Slvs
TLSH
T109C20C2F640CC7BE4F844D9DEC25BE966DD801CB9B988D5447EE890C03CA7EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef1b156f-db04-4cfd-bb9d-932ec8d97dd6\index-dir\the-real-index
Size 360B
SHA256 06a9f7ce64a52cb37b9307ab06cd9a4e3dcb1cea0506eeccaff767cecfb7d534
MD5 8d8405e3c8f684f04c04cc02dabc100d
SHA1 0a2ae51d1513f95485520ba1aa2b77d6b67c8d27
SHA512 e18d30cf774c8cdc16117a83063ea1c91bb24787602f10257545514d5c6d3a26fe146d7bef50477f1054fa2a21be2af1f548c774df9190cb879ba3c46544f476
TLSH
T1A6E02BA9AC906755CB1638391871341D233788EC11384E83219C64BD4C3162B6348218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0434.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef1b156f-db04-4cfd-bb9d-932ec8d97dd6\index-dir\the-real-index~RFe5e0434.TMP
Size 360B
SHA256 a9e5c09997f1d44b782d894d4f17893e2a67548758ffd329620d87892baefed6
MD5 76f1868d256d55134a077c75c2f542df
SHA1 d3588262093605d32f60be7d9d2a4a12c53c051e
SHA512 eee56bc35a5b4db4563e51022070578ea52133aca5550267e0a8a356ae48f597ceaca5373d0d10f11021653b3b86ba70c3a20c4c6b819ea4dbae388a773aa6de
TLSH
T1A8E02EF56A80ABA6CA4230B94861612E2272CC2865188E2224A0B0BD4872715238822D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0fb0e855eb7e6416a9bd7806d532eb848163d6e52c7b8638ecc48964d66a4223
MD5 dad5c8ba4462f9a6ce3143b3cd057fbd
SHA1 03088a17a9c23443c97cdc07bdd8c9f28a65933e
SHA512 a92a2a27e2f17e4815264581aac1336ed1f8060c96f22645b645d055ce6a66cfef8865c88c3f32618d325b64ed4fefd2fd8847c46800a73b8b861c4af04e17e5
TLSH
T192E0D8BA3DAB2854ED7F9FE768B2A090004978588946FD9E107DE28750B13156446C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 99d24ceaf9466db0e8a290d44e3bca4357253a04927a86b0e7e41948d5ab4658
MD5 a0eebfe1475824f73e0f56daeceb4005
SHA1 eebf3b79f23ef129233a4feb22884fd0a78b5e99
SHA512 1a9207f2396e6d0b1d5d25cebe977c2d286b6b99282226df341baa8331230e3df3322cb084c13682981d8cfbc4b7475134fc4e6b39dc528569f5dd948da18352
SSDEEP 96:KsMgKtOGSggK9CS1IhlLfbQvHeD9tQK1F9jQhdtuD17+1mK+ML:6P3GthC
TLSH
T107B13015717BE31438BD268980A4956F024331B3325EA57B7BA871E61E6FE004EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5c4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5c4a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 46d327cee5c6a343fdf6ee8cc0be7e69225760457e0eb0095ddd341f3c95c95a
MD5 42509c8e24c1286a0911773bc46e7cbe
SHA1 d3c07787fab049c7da241b6756c1284827ea004b
SHA512 2bcdfbb9e3b1990076d9a5901d9ea0ded00c1d3d2622a141e08f15d2281deaf74b44c288ad2dfabba613845d580fe770fbc71406535e34e620e2a8093295cd5e
SSDEEP 768:rjaeqD4MlshiLdMmQ3sSgaff8fceofcLitiyJ5p3EFlnNMLmO99T+:rqcjhIdMH3Lf8fWfOOp3EFlSC28
TLSH
T1F303BF36ACB09CA39C72D685B64777976EB00267C7957A8998CC7E0E01DB6CD130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 1cf8db929bc5300a3b5b0ca772fa42e4bf3cb030ba725c592bb9b6a5349584d0
MD5 f26fa8c7ec8b374831ca35018d9be64e
SHA1 e7e793341724ff42d96c07c086574530113395e3
SHA512 8dbaa37e79785fdd09abb4661704e8348541c260f7dd15b4b648c34286972392cd3d79c58e10b791ba62f03e7ea161c36300e2b340c16c7c2058ca734cbd9245
SSDEEP 768:fjaeqD4MlshiLdMmJ3bSgaff8fceofcLitiyJ5p3EFlnNMLmO98T+:fqcjhIdMq30f8fWfOOp3EFlSC2J
TLSH
T18203CF36ACB08CA38C72D685B64777D76EB00267C7947A8998CD7E0E01DB6DD130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 be29d4d0b2291481fe75d719003ab5d023082adfe07caa3c93b4bd9dc76ae21c
MD5 83007f467ded015dced4b0a38c484e02
SHA1 b37cfae8db5e470918f68965834c11c68507cd8f
SHA512 24c8d90279e20a700fcc4babba03a15a5fa5d4f855cd8d3b6903bdfda854b3a872d9063332bf46b706de1c4201ed63c4c80aad9c308792c990b92542fa5fbea8
SSDEEP 768:pj+9z3GSgaff8fceofcLitiyJ5p3EFlnNMLmO9zn12bfm:09z31f8fWfOOp3EFlSC2Bym
TLSH
T146F2BE326C608E635DA2D6C9B54B778B6EF44673D6842A9888DC6F0E41DB7CD130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e81c718299336ed1a1d56a8d3226dfa89d3b865f003dc436970ecc2c08c98fee
MD5 abfa5c60f2c9f68cb664bffb1c5bb5d2
SHA1 d69b2a5f1b0eeab722c9c8863f8bc3c8d92ee88b
SHA512 b6fe600134de773d3fd801f84e304df90239cd28d4e8965e10b1fbf3d047b2a9fd2c4ce2f10c9999d9c0d9247bf1736c4467053c7f541bbf0db442f6c8738e64
SSDEEP 768:aj+9z3tSgaff8fceofcLitiyJ5p3EFlnNMLmO9zn12bfm:Z9z3Gf8fWfOOp3EFlSC2Bym
TLSH
T13BF2BF326C608E635DA2C6C9B54B778B6EF44673D6D42A9888CC6E0E41DB7CD130BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 2fa6a9b6899d4c1b64ab5194038392633dc4f0b57d91dda50122e770d91e1e1f
MD5 8c1e4c342f8edbbae479830c995dabf8
SHA1 a68c3165eb53706ce566fb4934b20ae241e1e79e
SHA512 a1e1b2254e0466225fe7a55b8a97a3744c6cb6a8c7d61f09f0beaa650f64b117ed388f1cb7efe254b64cf76cce2075b5a5659d3b24f2b265f2ae573850eb97bb
SSDEEP 768:WF1j+9J3kwg3Sgaff8fceofcLit3yJ5p3EFlnNMLmO9zn12bfm:j9J3Df8fWfOzp3EFlSC2Bym
TLSH
T10C03BF335CA08E676DA6CBC9B64B3387AEF44273D690669599CC6E0E41DB7CC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d0e1282c3bceb38502bd9619f2d3350d118ae430cbb7e79c5e8d29fa4d94b029
MD5 e181edcfe415290c7df71659bffbabc5
SHA1 ea879d3801a35d22e9c85446692cd81096df485c
SHA512 60cf5f8f62139c59c2d3b72332c75b273d977fb410120c36949bc833b5576cada828284c1714b52940ab6e8abc0a68f355114609c64e0d94f2b001cfcc4eca7c
SSDEEP 768:UjaeqD4MlshiLdMmQ3Hagaff8fceXyJ5p3EFlnNMLmKEyjWtTzTb:UqcjhIdMH3gf8fGp3EFlSCjyj2v
TLSH
T12603D03A98A09CB38C7296C5764777976DB442A3CB913B59D8CC7A0E40A77CE130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a8e4fdd4-3dcc-48c5-97c2-b6b7a730ba97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a8e4fdd4-3dcc-48c5-97c2-b6b7a730ba97.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download