hxxp://45[.]41[.]105[.]170

Analysis

user interaction
yes
max time kernel
388s
max time network
388s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 10:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://45.41.105.170
Sample260701-mfl79ady5x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1768	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273750804437929"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{7B3D5B67-FCD6-4359-8D0A-2C0476D3F7E9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
728	msedge.exe
728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 4460	1816	msedge.exe	87
PID 1816 wrote to memory of 1768	1816	msedge.exe	89
PID 1816 wrote to memory of 952	1816	msedge.exe	90
PID 1816 wrote to memory of 952	1816	msedge.exe	90
PID 1816 wrote to memory of 952	1816	msedge.exe	90
PID 1816 wrote to memory of 1996	1816	msedge.exe	91
PID 1816 wrote to memory of 1996	1816	msedge.exe	91
PID 1816 wrote to memory of 1252	1816	msedge.exe	92
PID 1816 wrote to memory of 4664	1816	msedge.exe	93
PID 1816 wrote to memory of 1252	1816	msedge.exe	92
PID 1816 wrote to memory of 1252	1816	msedge.exe	92
PID 1816 wrote to memory of 4664	1816	msedge.exe	93
PID 1816 wrote to memory of 4664	1816	msedge.exe	93
PID 1816 wrote to memory of 796	1816	msedge.exe	94
PID 1816 wrote to memory of 796	1816	msedge.exe	94
PID 1816 wrote to memory of 796	1816	msedge.exe	94
PID 1816 wrote to memory of 4368	1816	msedge.exe	95
PID 1816 wrote to memory of 4368	1816	msedge.exe	95
PID 1816 wrote to memory of 4368	1816	msedge.exe	95
PID 1816 wrote to memory of 3428	1816	msedge.exe	99
PID 1816 wrote to memory of 3428	1816	msedge.exe	99
PID 1816 wrote to memory of 436	1816	msedge.exe	100
PID 1816 wrote to memory of 436	1816	msedge.exe	100
PID 1816 wrote to memory of 1068	1816	msedge.exe	102
PID 1816 wrote to memory of 548	1816	msedge.exe	103
PID 1816 wrote to memory of 548	1816	msedge.exe	103
PID 1816 wrote to memory of 548	1816	msedge.exe	103
PID 1816 wrote to memory of 2948	1816	msedge.exe	104
PID 1816 wrote to memory of 2948	1816	msedge.exe	104
PID 1816 wrote to memory of 2948	1816	msedge.exe	104
PID 1816 wrote to memory of 4072	1816	msedge.exe	105
PID 1816 wrote to memory of 4072	1816	msedge.exe	105
PID 1816 wrote to memory of 4072	1816	msedge.exe	105
PID 1816 wrote to memory of 4200	1816	msedge.exe	106
PID 1816 wrote to memory of 4200	1816	msedge.exe	106
PID 1816 wrote to memory of 4200	1816	msedge.exe	106
PID 1816 wrote to memory of 516	1816	msedge.exe	107
PID 1816 wrote to memory of 516	1816	msedge.exe	107
PID 1816 wrote to memory of 3336	1816	msedge.exe	108
PID 1816 wrote to memory of 3336	1816	msedge.exe	108
PID 1816 wrote to memory of 3336	1816	msedge.exe	108
PID 1816 wrote to memory of 4152	1816	msedge.exe	112
PID 1816 wrote to memory of 2024	1816	msedge.exe	113
PID 1816 wrote to memory of 5024	1816	msedge.exe	114
PID 1816 wrote to memory of 456	1816	msedge.exe	118
PID 1816 wrote to memory of 456	1816	msedge.exe	118
PID 1816 wrote to memory of 456	1816	msedge.exe	118
PID 1816 wrote to memory of 2108	1816	msedge.exe	123
PID 1816 wrote to memory of 2108	1816	msedge.exe	123
PID 1816 wrote to memory of 2108	1816	msedge.exe	123
PID 1816 wrote to memory of 4260	1816	msedge.exe	124
PID 1816 wrote to memory of 4260	1816	msedge.exe	124
PID 1816 wrote to memory of 4260	1816	msedge.exe	124
PID 1816 wrote to memory of 4324	1816	msedge.exe	125
PID 1816 wrote to memory of 4324	1816	msedge.exe	125
PID 1816 wrote to memory of 4872	1816	msedge.exe	126
PID 1816 wrote to memory of 4872	1816	msedge.exe	126
PID 1816 wrote to memory of 4872	1816	msedge.exe	126
PID 1816 wrote to memory of 728	1816	msedge.exe	127
PID 1816 wrote to memory of 2372	1816	msedge.exe	128
PID 1816 wrote to memory of 2372	1816	msedge.exe	128
PID 1816 wrote to memory of 2372	1816	msedge.exe	128
PID 1816 wrote to memory of 1596	1816	msedge.exe	129
PID 1816 wrote to memory of 1596	1816	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://45.41.105.170
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,6543260420047034817,5837385941875218452,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,15759732445182313860,5597185702169681509,262144 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,18099399448155806010,16595004288081108678,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,1470295154142517612,5264249266418319000,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,5306146893553231218,6564761033447238646,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,10526773903834765326,7624848553376396871,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4667535870900520060,6581806077813676130,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,8254925048066463584,6619122109832029680,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,12461584388826786224,9952281403831195209,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10628498653120219183,6770714534141623434,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,10628498653120219183,6770714534141623434,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6436,i,6269524967454192405,1366518773931717586,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3708,i,2571382009065764944,14158486915463796497,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4464,i,8577630915594395609,1254857567784462489,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3476,i,8763510670169898386,9130827313112004938,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,14455504395407020276,156747174897106604,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6212,i,8211304253104868249,11194581782819476551,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6924,i,12892974427548734266,17669867764877541027,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,9859424274182596870,15937521633205433242,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6944,i,328080576595544353,2950323184836144104,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6412,i,8863623883617679717,9485957970674198537,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4568,i,12521035459051386019,13295052796682130670,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3520,i,15802397585148117273,647944074259661218,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,6847854545475188245,413154535867576633,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5184,i,5691691341088632661,6786460922444293309,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4248,i,1750313595230021140,12113175743077633144,262144 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=1324,i,9126717934636816562,16723152573991499797,2097152 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6264,i,7789528125276179713,16273032506680986416,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,17190103467388807423,6256662262893835540,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,154228494334671245,6632669263691436441,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,12076127747841594527,4617951754131798208,524288 --field-trial-handle=2316,i,4821416780913067155,5970845789419561893,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:8
  2⤵
  PID:4152

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 02556487c351d6c0e5ed0496b2e5211a65147246c5990b9b411809821690e9dd
MD5 a8035dc3de4cb9df6e8c5d59f9f949a4
SHA1 ddd70312957aee713443fbdb2d3adb313bb8729c
SHA512 f2feb0b4ad8a71f14cd3b97fc675b83090830d57670225429dec5def081151272eeb7f2f8a98985a207520219078569d2f7d1750f672a44a8e14c6640a20f9aa
SSDEEP 192:QjBF68qSqSTTTKKrR6DDooBBB8neF333QQQQpppMjLO:QjBF68RRTTTKK16DDooBBB8neF333QQb
TLSH
T132E17F4342E5DB9A8F2510DE4DB0639C41B13B0FEBECD648076D8DDD304E89ABAE56B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1f7e4fe3a76a3a6135f54cfdd1ce7a5baad131c21ca7f9fd04556c55dd124b3d
MD5 94fad37c29772d6819476f5640ac2e1e
SHA1 dad92f7b85dbb4aaa0035458b709a26a7b32f07b
SHA512 124d8e4d1748ae1be3997bb616cb2eff7a7afc589b10248b801065c52335a8d772051ef95013f2dcbf791c877417459b68aa137481ebe8bb59dedd9a6d761d65
SSDEEP 192:Zjsv62//333333333333333333333333333Mch:Zjsv62//33333333333333333333333H
TLSH
T19DE1408B8398DA5E8F0550FA4D70639C45B03B0FEBECD508175C89D9314F49BAAA5AF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 1e66d862ac6f6fb3b8fa59d61728ab8928fabe6cd71f373e9ebe0d463764d774
MD5 a2a0193e6b675c7741d38b439cd8763d
SHA1 4ccb4461c90799bdc4f2ae80d36646aa7aecc623
SHA512 461162e32b4304cbb78d42dfa574782a19b5aa710427bae69a7a372fab8b0c440bc385a77bde37c2b619f73dfd6d2f455f6c07cd29d8c78a9e1a3839ffce5a34
SSDEEP 96:8BC2KvYIaNTI+oUis5kUnkaXHD0a0gNh9qeyq/:O9yY9I+F2uHD0YNpD/
TLSH
T1A9D1BB7411ED26DDDB0D0F31D19F094463B4AAFEFE26DBABDC9168EEE4263940426520
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1c3faec10c1297b270bd3cae018de874351c6b1609da880968a422a220abc955
MD5 892398fbd49696d211d1d114a887f48f
SHA1 d76f9405a331dcaa9e4864ce02103758876fc4b5
SHA512 84baaa53000472822602cc9b715876755716642856b47e7aa63e238f677836dc43a3b4885308a71c1c088943d93d1694bd0d3227bca2c2455bd38fbe3c509f46
TLSH
T122712AB4022E26ACE3965F31C0DE42913771AAFAFD3B5F97DD9260FED9017604829038
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9a78905c1a2ea0fd95026105a1e19b4646b9ed1121f4c3b8fe44dfbfd62e47d4
MD5 3334cc31b08127f59a509bff60307acb
SHA1 124eeaadc8668c11a0a5fa26202a01120707a233
SHA512 23c9b3ce038caac213ace96d653bea84f374d2083e1c99f0ab2883e2ae18126c4700552b4d4d05e4804482e11dfb2b900c352e83477b87ea528c90d7418807a3
TLSH
T10A71ACF7C3E5866DC91195F0AE146F1BCE1D0552436C3D0A85E8AF4BA3F2871E112B8E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 1ffd9a553f03abc8a6da6ad220df1b14e153de1649a252c0be7a852a020bf076
MD5 661720e549e8577231550a3efe20f645
SHA1 a482c826e9f1c2406b8e151b612c250fddd8d229
SHA512 1d29d9895bddc267f9e4a54a71f07ad7c8f5a0235433806e3a32816657119bcf93c704dcfabca492310d1162640dc7fab57deadb65909aec7b461e846e95577a
TLSH
T107D02263160474F5A56D3FD280AEBC8FCB3730308A92DDD510D0EAAC393186E070B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58c59d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58c59d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fd62b0b7d20b746732b566b6312b89972901463da28031305e79e6b81ebfcb2c
MD5 d3402e4ad87775c96d1af0591db906b3
SHA1 2e54c396611998a0972df8dab85874befb1d1a65
SHA512 d2bf2c18aa06396a397f675306aa6a973777d4332688dabab1f5eb200763f6976d71abf7952eced22a963314c4e48a72babf4da56819486c53e96c904d7e65ff
SSDEEP 192:sxZVR5RIayM/jK1Ml8MkYY/f4Asy4sVqVI+IdpUVxHsV56+WNGYvrVME6ItpIgrJ:sxZtXMT/fpsyPd6HjG5u9
TLSH
T18642D8166A345977CCCBD309FA55BF53D6F91472A2900D48A9FCDA0C05E7AED220B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 33c83eb93067433929ca564eb60ba8abf3c2caa737d14411fa680d007845fb5f
MD5 d2c7d8fbe2fa8fe24ac39cc9f2aebe15
SHA1 4b1df15035172824b6b92afa03d9d9617ddf3eb2
SHA512 e92cd0fc24493a3c9488223b9f49bd654ecbbf0888a1f03391f93548ebd48c2f1a6829f2350d1ab1027e374753307634e6dd415e3ec08a1641aa9b1b1361d7e6
SSDEEP 384:sxZtnURBq4T/fpsB2F29AHgS/KuiUfsaH:sliI4T/fc2FNHgoKaL
TLSH
T15882D75766248977CCDBD619F921BF53D6F81462DA500E4CAAFCCA0C00EB6ED221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 7679473e47400debffd95e56b569633e447a3c3676f13b16a11051e92621f4da
MD5 e3efbd91cf3dc26ece8691f8945f1f8b
SHA1 0476a48493f9b1d3d81ec19e981d3594dff2d6c2
SHA512 12457713bfb0b09ca029c758a895621ad2637a9e3e60aa7abf7921b659d04892775e16059ab3db57d5743fc936821cf4a34e4ab52b8a6e2d1d9ad78811c2232a
SSDEEP 384:sxZtnURAq4T/fpsB2F29AHYS/KQiUfsaH:slin4T/fc2FNHYoKML
TLSH
T1AE82E85766248977CCDBC619F921BF53D6F81463DA500E4CAAFCCA0C04EB6ED221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 454ecba8190d980afaa2a695422686bbb1ecb3b89d491c80945ebe05f4a81844
MD5 16b0540cbc975b4e0b53a6577ced621c
SHA1 5a001d95631dfd13af0454d2948cc9933115a412
SHA512 bdf2da94f4a5aea0ec806e0bd3dfc3f25a252cb866c583446ed96d32bf626edc56e5b01e75a33595f6443f6ad5877f7d5db7a6755c20313497d8627d6262fcd4
SSDEEP 192:sxZVfQUnuh5h5RIayM/jK1Ml8MkYY/f4AsYu40IVqVIlodSebOOQddpmV9VxHtV7:sxZtnURBMT/fpsB2e29qHES/IuiUfsaH
TLSH
T15B82E81766249977CCDBD619F921BF53D6F814639A500E4CAAFCCA0C04EB6ED221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3af403d050885d7f5f4d9779666703e332d20da7ba58ec9dae612ae2959afb19
MD5 4902c4a596707e89f3dd3d51fa339809
SHA1 3b5fe2a2b0558f1a5cc8651c0ed6ba964a69dcd3
SHA512 88610186127fce75a8e37f5e89d3ba2c994b4a9112b62ca947139491e53865ffd8ed2ca320adb82344d87a352e182fa3529925163eec4b8d539b07ee11b18aae
SSDEEP 768:pxseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pperoUC:pxseJ3xWvhfynu1jaVcL88p1Z
TLSH
T156D20B2B280CCB7E4F844E6CEC266F966EE801CB57984D5487EA880C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 d25c408642432740d71b790ad92d86f1a4b957d134a4ae143ba31aedf783461b
MD5 ca74b912d2948186834391da9a853740
SHA1 1cb3eba962b9413a1442d483c7da61d18f1459f8
SHA512 df06aacccf3fc7c91c3895284d6a2d60dc7ba51f7d10fc6849eec9223af9c398670ada5cee8402cac5bf52883e493c5cbebb03a9f93be44a430a96d4d9656f5b
TLSH
T140A00216238040CDD00712F635A611412212CD2C664D630655909495C8A06499D6100E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\070fc69b-28b6-45cc-8a56-75c8dc728b82\index-dir\the-real-index
Size 72B
SHA256 7727e45e7dd6b1027adfbc8f7f2169aaa7f454c20f3614eaf0041917b322b53d
MD5 6434fe56b981afecd5f17c37524ffffc
SHA1 77ccdb6f3c50ee536c9f597867b6f46b52d4d8cf
SHA512 82e5992ee2588b2966d99beea92621c3982fb8fb9f476108019e50c06675fd1392004417d9e28be78f4a1ddd0dda232adbcc635a5f82866d978be08849f290e1
TLSH
T14EA00230CB8040C5C42256B1295707493319D8A42D15230B44910145DE604805D4101C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 3KB
SHA256 cb2cdb66e116fda35342b8c1fbabd334ca4416e724d50fdf88d470c513124caf
MD5 a68fa9f4ea55e85ddc1b62b3b632e874
SHA1 f75ca71e370c5fa40551eb2802cae1b4b2961335
SHA512 edb9fac38391d46f98e72cc7b548926f0a7451c3f4782ec6c35cfd7d39896500ad77ddfee146e329a406994cc3323dac22f9ba18af5b76cb368a74fcd7f4b59b
TLSH
T10951FA4E8D4A288ECDBC19B2A8F614C937392CED5E498F0F16BD6635BCC333D1909189
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 624B
SHA256 03744ac7b779e631289976b41dd95f2c8e02b1e24b60ee24c37ac891b73ff4d5
MD5 27043897994c29d498ab64d0274b9a87
SHA1 3a67c8e589b15b9b3daaa6be2a434fe116b8ab82
SHA512 a57790e37041eb662c82f12fc2d736e691a0c2543f5b4a54227407e4e9e6aa496ae8cdae15fad38e7c435d159afd9331750999242a964ca0a85a7c2b4c27768b
TLSH
T18DF0DC144F800C26EA6845772AF6A4E0A3704DECB361A97B286C5C7E2D213CCB4573EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f1c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe588f1c.TMP
Size 624B
SHA256 ee40fd3235485065845bff451ce4de3ea045c90f997d6833e51db326ffcfe078
MD5 9890218af25724d032b2280708fba054
SHA1 b05c41ad845a7c4bb8a4eda25566d8c75c4b00e3
SHA512 81316371222ce1136208314d7b72bb067a1d9646095b356b275d7cb11ee242ddbfc1509ce0dffacc4a3390edb4f71d18298cfec5c00be871dd7399c9e38dc586
TLSH
T130F0A3554B920D11E4200A7B2EE694A8F3308C507636FEE7385C6C6E6C757C999022DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9f5213913bed40729b43071d233a6ead9a9ccd5696f7c3e3c0a97295d4a9c875
MD5 fb73993c959451004595124602d6e2eb
SHA1 06d40af6a6b989289bdf07056aa8ec63bf873927
SHA512 99d6ee19ad04ed7995a3961930e71c4425d6f0ebc1ffc72f8bb28681df170331a01a3a9f60638b4e13046c40c5e3eb3031ff6f5c349dc39d56222f8650b03f8b
TLSH
T154E068B62DE32414BDABC3D22030C090060A74A8E902FC0E945BF6831072315309AC35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f32bcefd6e8c7f65c88b29f65b64001bd4ceda2a71ce9652a92885f216c68f70
MD5 4a89fe8182a94c6941ba18e0719747c4
SHA1 f4965661b25398b79ee033f74f6c36c22b636887
SHA512 7629b56958dbb342cbe12fd03629593ef83b08cd885616d04668ef68ee2cdcd705b07f8b2c59ba635dd5117181cfb91b191b2451f59d04210110264ed2b8589d
TLSH
T19AA002A0874B2841E40B0670344555407390CC35514963538AD0A4ACACB76856245B01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e5e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e5e6.TMP
Size 48B
SHA256 85065469caa56dacc2a72015e38eefc3201a2d3fa1627c9f9b8cacf66e45f785
MD5 a29d5cc326de943c8e85b7041137acf6
SHA1 d57aa8e57dd8d91236e8af5821e0b23120eb7c83
SHA512 4dee9b41b66824c2b873ab2dc885fa786249c066e66dae8bcab85b3217c0ce3ecd5d361b09529bca32ba38056063b4b4b5a461b83d83fd313aaa1f1dd76ed7ab
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 65c4c0e762cd96f4dd77455c67251ae179b4d5b32d515cef648294ba4a6c3c3e
MD5 8fd16c7dcb51d1fdb9b419411053f84f
SHA1 7bf4ee0cf101759e2f621f2a7d9617ec4331688e
SHA512 75dc860234e12dec956a2e71c800c51227facd6cf6b83038e1c887f872b6160732c97be5765ed848cfa562bfcf30f3ae3ba5aebf77c779ac9ef594436989cccb
SSDEEP 96:KYH+KggmC8gKZWiKK0KrCq2JyKScmGbqGA5:49TT33ppGbqGA5
TLSH
T12FC12346303F42022C7E2858B2A39E368E4275633458A4FFBBB904A15E67E115EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592820.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592820.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ad267d7f85fd6a2b09c3991bfe310e675fca581de8eacd34ca2f0bae49257d2a
MD5 b71d94f4ee88bfd2816840e2c0f01219
SHA1 9f3886ba9dcf9a746c5a723a3a3a4460a74fd6f1
SHA512 34ab173524b6e5c734bce010b15c21e57e276eeee03a1879d1dceacc4e800d5c9dc37773d23872301109a4dda93fc8cfc26ccd81fe8ba67e5617b7516a1a8429
SSDEEP 192:uwwTSNWMsnMcPPQLz3XX9VofsNPsaYQ6bv7M7LK6MydQmiU1VmVUYfy4MTZS+FdF:WtNn/s3n9SfsNkbtI7qybcVGdwdUpUYn
TLSH
T1FD624B726C78AC2B5DE6A584F04636075FF4916B97C42F94E5DCAF0C01DB6AC030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9a450f92122874170132d18e1981320348e1d719d054db9460c61b4b83f00cf
MD5 e8b408d90aefb426af3e43ecd1d8c5ec
SHA1 509ceead23996194248676bbc324c2abd3bd9694
SHA512 2aeec6fcab58a0e67d2818388e1e391cf9881fabb216990a9786bd20aa2c6b66bfa178bd5c6bcb5dc3349d7070958bddd31da3166ea82c80aa9a547ebf317220
SSDEEP 192:lONnZ6vMtPQmiUyVIVpThTZS+FdLF847ihSU/u:lONnZ6UtRFTFdJfU/u
TLSH
T182021835AC786C6BDAB7AD45F48A37175FA4207FAAD01B50EAE82F1C00D765C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 9ab1f503a406867fb0cc6fcc9060f924d03ae86db0f94725df8b042dec195fb7
MD5 4d96c6d26cbf9710e3dc1d34075a7df1
SHA1 92d50b107139f88600730a79dccf8ce81b0f2207
SHA512 0be8925d407eb7f39a753f0071e83c831b31917a406b843ddd28cca8a66e1131acc5282826e0c58658371dc1fdec1b64b1c251af89c1c684483a448d97016cee
SSDEEP 192:8CONrJ6vMkMPQmiUyVHVpffhTZS+FdLK7Fd3E380IiBqKU/u:RON16UXRUnFdwdUoUU/u
TLSH
T168120A36AC64AC2BAE93B545F48636035FB4912BDAC56B50E6DC6F1C01DB6AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2a5fa1662ca712621a726cead7944f9464ba26c8b5803da277aa3cf3804ad157
MD5 bf4fd8785294c72a390648b9b34373c3
SHA1 0588459855fc6e642163c6096518a7d860ddbcea
SHA512 d9d9b14aaf22a79bce59fc59cb42c6de437c8ad011f2edd5c19309f62491ba3e0ab3aa25b2e9a63efbe3dff93f2e9b96d938ac5c28f667db2c2b972ac78a2dbe
SSDEEP 384:ftNn/s3n9SfsNk1TsNI7qyk5+2GdwdUpUYn:fj+9U9g+rUUpUYn
TLSH
T132624B726C78AC2B5DE6E684F04636079FF4916B97C42F98E5DCAF0D01DB6AC030B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 311f4f7706de13e9c255a1fa40b9d1d6d4885ed7899afe85f9cf151027a4cccd
MD5 edf6e2160bcd7c508b3564b9a92ffc0b
SHA1 fd45bf41f90dbde7716dec6b6b852ee116132a84
SHA512 a62205f2eacecce416fdbe61f4267ea4919e5cb028215dd705aa95588902ea9ab949325c674e7491fdcf5eb0e743792dab765edac5f422433a0b1cb90e45711b
SSDEEP 384:liF1tNn/s3n9STzsNs8TUNTUlIl1TsNI7qyk5+2GdwdU5UYn:sF1j+9opwg/g+rUU5UYn
TLSH
T1A7823B735C649D2FADAA9B84F55A36039FF05167C6C1AA94E6DCAF0C01DB2AC030FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9c79564557285dd11db2778df161f91a5ff1c5bd09cda380aec364a31406e47
MD5 d7cafd72bf3a78c9edbd73d3fc5a72b8
SHA1 65ce165691a1e61e6e8e8e2c7437d51a789efe41
SHA512 5a8c825d921a8048fd23748668e3450de78b90b019b8adf4815a832c2d0debab42f31732060fe923bbbce3b62dd8decd4fb44b11fb4828e47d4de942bfdcad55
TLSH
T1CD412858A6FA1148B3B76F5A9BB6A86D48BBBD772F06D44D00010D4E0A37B41CDB1B37
MD5 SHA1 SHA512 TLSH

Submit Download