hxxps://expert-eck-de[.]carrd[.]co/

Analysis

user interaction
yes
max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://expert-eck-de.carrd.co/
Sample260701-sdrylsaw2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273916691849866"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DFEAF4FE-D1F9-44E7-A20A-937C11136F34}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6124	msedge.exe
6124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3248	2456	msedge.exe	85
PID 2456 wrote to memory of 2052	2456	msedge.exe	86
PID 2456 wrote to memory of 1064	2456	msedge.exe	88
PID 2456 wrote to memory of 1064	2456	msedge.exe	88
PID 2456 wrote to memory of 3300	2456	msedge.exe	87
PID 2456 wrote to memory of 3300	2456	msedge.exe	87
PID 2456 wrote to memory of 3300	2456	msedge.exe	87
PID 2456 wrote to memory of 4828	2456	msedge.exe	89
PID 2456 wrote to memory of 4060	2456	msedge.exe	90
PID 2456 wrote to memory of 4828	2456	msedge.exe	89
PID 2456 wrote to memory of 4828	2456	msedge.exe	89
PID 2456 wrote to memory of 4060	2456	msedge.exe	90
PID 2456 wrote to memory of 4060	2456	msedge.exe	90
PID 2456 wrote to memory of 4404	2456	msedge.exe	92
PID 2456 wrote to memory of 4404	2456	msedge.exe	92
PID 2456 wrote to memory of 4404	2456	msedge.exe	92
PID 2456 wrote to memory of 4728	2456	msedge.exe	93
PID 2456 wrote to memory of 4728	2456	msedge.exe	93
PID 2456 wrote to memory of 4728	2456	msedge.exe	93
PID 2456 wrote to memory of 4416	2456	msedge.exe	98
PID 2456 wrote to memory of 4416	2456	msedge.exe	98
PID 2456 wrote to memory of 904	2456	msedge.exe	99
PID 2456 wrote to memory of 904	2456	msedge.exe	99
PID 2456 wrote to memory of 5052	2456	msedge.exe	101
PID 2456 wrote to memory of 3848	2456	msedge.exe	102
PID 2456 wrote to memory of 3848	2456	msedge.exe	102
PID 2456 wrote to memory of 3848	2456	msedge.exe	102
PID 2456 wrote to memory of 4172	2456	msedge.exe	103
PID 2456 wrote to memory of 4172	2456	msedge.exe	103
PID 2456 wrote to memory of 3680	2456	msedge.exe	104
PID 2456 wrote to memory of 3680	2456	msedge.exe	104
PID 2456 wrote to memory of 3680	2456	msedge.exe	104
PID 2456 wrote to memory of 2564	2456	msedge.exe	105
PID 2456 wrote to memory of 2564	2456	msedge.exe	105
PID 2456 wrote to memory of 2564	2456	msedge.exe	105
PID 2456 wrote to memory of 4180	2456	msedge.exe	106
PID 2456 wrote to memory of 4180	2456	msedge.exe	106
PID 2456 wrote to memory of 4180	2456	msedge.exe	106
PID 2456 wrote to memory of 1768	2456	msedge.exe	109
PID 2456 wrote to memory of 1768	2456	msedge.exe	109
PID 2456 wrote to memory of 1768	2456	msedge.exe	109
PID 2456 wrote to memory of 4688	2456	msedge.exe	112
PID 2456 wrote to memory of 4688	2456	msedge.exe	112
PID 2456 wrote to memory of 4688	2456	msedge.exe	112
PID 2456 wrote to memory of 5996	2456	msedge.exe	117
PID 2456 wrote to memory of 6016	2456	msedge.exe	118
PID 2456 wrote to memory of 6004	2456	msedge.exe	119
PID 2456 wrote to memory of 5416	2456	msedge.exe	121
PID 2456 wrote to memory of 5416	2456	msedge.exe	121
PID 2456 wrote to memory of 6124	2456	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://expert-eck-de.carrd.co/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc9cffc188,0x7ffc9cffc194,0x7ffc9cffc1a0
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,17386809330921756404,6099965425052111868,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,15522664970995876620,909440940844336039,262144 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1368,i,12058382456414373609,13054332973441068233,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:8
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,12984216380331067280,1614514709240903480,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,6937177830946776712,1093264028812069529,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,4528006428007730293,10699665060522108589,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,9146601907369990877,14349417597928993574,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9527029289872535900,938592587086583121,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1180025388693284646,13220356270548344757,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,788705431029963781,8009144357778782417,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,788705431029963781,8009144357778782417,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,16021265205026700876,17922638393598944187,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,12466679592219873071,9332499441390554432,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6620,i,866140132843611937,18439980156657158354,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6884,i,7797221964502687500,2435365102789677929,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=7000,i,11345655375078574856,78974353146701226,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4772,i,3301529548482241309,10359568989817511818,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6980,i,10959496225315456400,17986903147290014885,2097152 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,3063845697810528208,7559064183880454015,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=7516 /prefetch:8
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7452,i,11279757795922799298,12678535059953754153,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7560,i,12398021165366592135,4985897664526033669,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,3719516522814235304,12008521783825625045,524288 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5436,i,16544878026815927596,3101505796005265247,262144 --field-trial-handle=2104,i,16193854121416651694,6442271097887738973,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 401KB
SHA256 88fb2840097072b0c20e48eb6b959fa40ec0f8097af5af0d6764715fb41bbb4f
MD5 dbcab7a3858911c61080bd261545ff26
SHA1 d40f496d18f7902c7c4a08da059dd14821649f90
SHA512 1f0bb67da02347a51e5804234d68a91e756f40c6280e8860aebe352519a1bcfd888fb016f056e478440c750581ff23e8dfa7992ef0ed5da89208969f4fe58ad1
SSDEEP 12288:AReuLkWmVX/3IjdPxJlRVKaYu663Y1V8kYucLR1GGX0jy:AoMkvPeRV6hV8FvG8
TLSH
T1B29423A0E42557A11CFCC96DC3DAD255361B6A13F662A21E2F8F38077B0D88784E5B6C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000083

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000083
Size 67KB
SHA256 f1e4dba0a10261e59e3996d5c912d93a9e11790e9a3d03ce211db5ef92afcb2b
MD5 79cbc2b95f182db5920058b483f77252
SHA1 ca0b6a36201f21c109f4b257d6bb7a704a9c7ff8
SHA512 717b1244589031e0723b8aa2a8a7ec7ad637ebef0ae959106d4cc6a0ab29420fda8b0df4d672e31a6f37d2b1aee4f4058dd4e9500e5ee191eabb5a4df9f17339
SSDEEP 1536:SmC8PiOUYxzc1GblrqZHNYorlXDwQ/Pkwe6oNcFyxpPTsyxIBd8QM0Xg/F:SIPi6xEqrq1NRrlXpnkNK+7s2IL8QMQ+
TLSH
T13863026CA1A25A46279F77C7C03A26C6976C876114C082E6E5FD103D99B4E9D1F021BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e2
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 3bd2f876fdc164e0258b4a39d0f216aa4a0abaad59b2839846735d25de9d2a07
MD5 4000904f53371ff32d965a875bb919aa
SHA1 87e29d57d7feb57af273a1d2fe64c50ae37375ce
SHA512 49cc94b7a0d0a7b04e938825f86111f82aa2ac2e496bf0ccd909c47755764754a0446ca446ec9e0ad43007c8c32cb4e033cf66b770cc86e204d887502dc72085
SSDEEP 96:2iAYmdsbzepx2rJx33O53RBhbDT8X5mZPU9HDIA4Nl6/28lh:l1mKveKrrnO53bhfTssDhNlw
TLSH
T1CA02E6C983D567DBEB657B32D1E3B944323280A6CD837FC70050A4BE6486BF37266916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ca02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca02.TMP
Size 3KB
SHA256 21b5b616f124175b657111e6f5ca1a81a786fb65f884a8c687cf46d7a7756640
MD5 0ff758eaec4d403c1670718b79e7b794
SHA1 f6f9abbff0709aa9dcdb97c42e633776d6fd22cd
SHA512 5555ea56a855ce4e58bc607430fc3d29140738937fb00a6d87d25b1ef500eaefb52291067e769596f40366c8bb9ef199ddf34fa6f441f57ab673d343e88cfef2
TLSH
T1E17191D403C6759EF3A23973D2D232917770D1CA0E43BE490154A8FC9AD6BF5AB1AC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ad83263-c0ce-4240-8a6f-c9346c8caf4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ad83263-c0ce-4240-8a6f-c9346c8caf4c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 94512dec02e60396308a13675742aa2d30070314d191372fd46a6e0102bc59ea
MD5 a11de731a923d745db4bba93ca01813d
SHA1 8aa31bfad76b2d1738a6dedeb353540ba74e8d00
SHA512 c49ee7b7fd2777f8ac4f63f75ef1b2fc9ccdf5b25b8a4ed0b9d304e6805645909d901cc43b6f285ee9268180fd6e52e6037c68464067d65514c9bfe22b57d063
SSDEEP 192:D8ifySb2Yn+rP8XwEgd1cZRzlpc7waaR3xlXeJitHG3GF4V6Ex:D8ifySb2Yn+rP8XwEm1cZRzlpc7waaRu
TLSH
T1FC02B2F7C3D4862DC81166F15F287E1BCE2E096553683D26C9D4EF4B93E20B2E251A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ddb544383156cb9995cb49ab72721b9bb595b845d9c23b18a76bf5028cf93303
MD5 4fbd5ad4c7c966137d1368903cabbea3
SHA1 f290e08761503ccad18706697341589efb99df33
SHA512 39c2bf375ffb0faf19553b0db51a3b4c98cc77bdfa17c73ee1349986fa803e30ce4a28604bda8e58b0f595a194d09008ec9baccb59c2a197d7c0c3a5f0ba1f3f
TLSH
T14AD022A3220130BCB55C7ED390AAAC8FC32B00248906FDFAB0D05A9C25378EE061B140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe586637.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe586637.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab7cd55d66a6752676a35bcb9cc79004f209ff7539135714c403791eed93a6fa
MD5 b09ba614052167519a38643005f3d736
SHA1 0430694e062fc505981f16d3e481938948125018
SHA512 aa5640f49896b43ac8ab3fb92b97674db37951e782e719d97ace6b1ade45e64c3bfbcccc258aa2c816de1df2baf0c07fdd239e1f1af8b8d50072520fb695b9e4
SSDEEP 192:sxZVduRIKyM/jK1Ml8MWOYy/f49sQBOSVS5m4b+rFdpmVEAlVyHW6+WNKVI1qVKU:sxZu1uOB/fwsQBXfD1TNHbhZ/i9
TLSH
T11462E812AA345977CCDBD209F915BF53D6F81472D6940D48AAFCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 8e163637e1f6bfa9d2cb921663477366b7ef2836c14f54049e902da0154b86a6
MD5 82e69a5b85ca43133546a6dede2502fb
SHA1 98102a58f0bbdfb67bf578d4aebc998b2e5c46ec
SHA512 6c2689d4bab4a9667b0fcd88a0bfc8d83d3afbe2659cf04589ebb0f984d1edbdd785d7bf4d0c114a8cbc3fa7b7c22a457295a99549f7cfcbffe562b19dce0d7e
SSDEEP 384:sxZpnW1sm1B/fwsRBXuSdFnHbLZl/UhtZ0W:shWim1B/fDXu2Hbvcr
TLSH
T18E82F953A62049BBCCD7D119B925BF13D6F81463DA944E4CAAFCCB0C00EA6ED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 6107c7b0eeb484d79c18eedf4bc0578f3668d92dd3b5ce32461e35caec3a2151
MD5 6354e98041638892d24e9702fd1da679
SHA1 e0741c431b75bfedd44ea70baffc88891a8c7fa2
SHA512 fe4cb7f798eef2a8ef047ca5bb47a27cb3c77d4fd828d0013361bf29b65fd3c2ecc7a2f50984080b110e0e75fde811ac60d3e7dd0c34cd45d5c53f0b20703747
SSDEEP 384:sxZpnW1qqm1B/fwsRBGuSdbnHbLZl/778tZ0W:shWkqm1B/fDGu8Hbv76r
TLSH
T1F1920953A52049BBCDD7D119F925BF13D6F81463DA944E4CAAFCCB0C01EA6ED221B81B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b5afcc7f65d0535d76e8ba98435afecdb9b42b889eaa5ab79f8c43e1522aceef
MD5 5bbc8dac246a35de9f8b20dfe2f33d96
SHA1 8b76c5876b14304a5bf199ad9644e8bdefea5609
SHA512 647671db32724d7320151c6f67a9d28364f5c64e563ca82ad122021993b6d8570f60653bbd5f89801edad0377d27f0965f3c4e445edccc6011de2baff9f598bc
SSDEEP 768:Ees6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNPro6p:Ees6pD1WvxzWju1jahILIsNc6p
TLSH
T12AD2FA3B680CCB7E4F840E5CEC2AAF966DD801CBAB98895447FA454C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 02ad6487cba2ad93415142d693c2e421003c8b039623f2ad74185fc8ecb144aa
MD5 f32f69f6c305008152dba90c0548ab2f
SHA1 bcc517d36b786d0c6ca3d56898c388eb8c04c33f
SHA512 a29305e89c6ce36fa8969b0faa7357867c7cc97d0fe29de89f7f9ba6e5018ba01293db053e809304930fd1f02f9eafb74c6001d8acf7e9d9d165314cda60b5c0
TLSH
T12151D74C4C42875FE8A842B204B2949437707CCD4E6456136CAC2235AD4776D2E5F7EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 3KB
SHA256 105c8fbcca15cb6136d846511e432a612c321ed867b055489593e54fc97eac7d
MD5 d79b15320bd4b054d9af2a8e47dd203e
SHA1 adf74ca42d3117055a5ac5f1f0f8b00f518037a6
SHA512 e208c6eb3bd00ba5fc7fb1fc1b7ac451d296d2a0a32a1915110db0201ba545a3d47ad490a937c878840dc9b3cdfade174f90c0b5819449aa96c961dce75004ab
TLSH
T14751DA1D4C83170BDDBC257258F604982B397CDD6A9C4B0B20BC6639FCC773D1959298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5838ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5838ce.TMP
Size 2KB
SHA256 b052918d9022f8ef8fbf1ea2b533ca12d80127f84123d9cc8cd14b50b49b7b76
MD5 6c23714e6fc2bfb5c7e7f9eb869a6ae5
SHA1 fbcefe96f5de8ecef5a615fb80b3fdde31dc9907
SHA512 c483652c692eafd5995b4ad37e02f3eb9311b758e071fdcddd87c7ff396236ae7bb0f53505c96d57abedf4e23084cd1b2223f264accb88538f5d9a98ed3a8fb5
TLSH
T1FF51B84A4D418A39D9C440770DE368B833366800C7157F5374FC5635AC9279D3E4E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 ca47893e1174b6d3aa07114de010fa0937a402466fea4ab11fede2cfd4759b5b
MD5 e9860a3c3a5d5e27a95d485d14beb701
SHA1 4732e421f92d185751070fecf3ccab68c27b4091
SHA512 d9b8ee9678b24199eb167ab236067792ac85bdb30e32f6b4e13da4b453fec5eb68544634dd42893df02ed23da71864fc9bb419be0b4a821f76ccb5839169decf
TLSH
T16EA00290CB924445C01291B2269303951780C9D01100530741A10048CC90C544D4165D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 7a4c7a66b2c8fa18bdb07b1d21459bbbad3f9fd88f273287806fc3877fef11da
MD5 6abc92b117eb3eb594a45e7636a89dc8
SHA1 f21223d6cbdad5b2bada4f5c4541a08918362ace
SHA512 65c311eb9cd01987c048c48b006b063eaceba914ac0788de0a00d2a3378150261df7a369a7a164c65dae808b80c930f2c84da679229303b739c82409fae2cf76
TLSH
T1A1A0021603C0050BD013B3F427D6017222154950F305130941905244D995976495708C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3a41203117dc5ead04c9d269d1a7f51548932ecba08be1d05ff711fb2e38d2e0
MD5 1f2b66cbf087732ea0044c36c2ecc67f
SHA1 4eb62c5a7df28dcb807a20dcd42ac771ed167c26
SHA512 6632045a145f2b269c6a9cd0695c1ac07ed926fa22f5149b3ae5ee78a08babd05fce2838daa43c273f7aa5174c29dbaaa1d4b45cbdc6c5dbccda847a72d2800e
TLSH
T136E0D8BB6EF76820ED6BE3E7247494750141381C8805BC4F586A96C350B13557856C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 23e73672460293c72cd0d353460f398f55cf8d73f8c587c863b3ac69cc3dd7fc
MD5 92fa73fd722177b0867620d6118f87b2
SHA1 d32aa300a0ba2e9fcf4fad193eba2d8ce8e7e038
SHA512 b173386b3f58d31a49bfbbeee379f87b374e842889e9d9d7820bde43f09e579171f231c2b75b576a10a11572baa7fee7d1d5e661457e500b0fb291705b3613ca
TLSH
T18CB011B2C80888CAE0820BB0B08000A8B828ECA08B0E222280FC00B0802E2000A2208A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ac97.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ac97.TMP
Size 48B
SHA256 26021e7137d433ff1ab7ac59765a2d5a33324e04299ea0e2d6987c75ffebb445
MD5 7942f098ee86c221b51eee138358965c
SHA1 9dfb064d788867e7ea51ca63dc257d569cc0b20f
SHA512 c7df2cd17073470ed1ea47061c1c404dd9d95bc52a0b314ec56c35f4a6787144f84c0378f0c028a9e7a4ac5b62b1580845bdd75c2e13620f126ab70da9d346f5
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 99f94b8d7de87241f90f3e4e4dd32f37c209d5c26a163a854ab253a0fa5c73a2
MD5 61e14f398639709ec1cba77072776e3e
SHA1 5385d5f9a1dd911f5789787a4989323efefb39f7
SHA512 b83244e77c62471b4027d28535a7d184eca50ea6e4181f1ee18aaa9f7c14ccaa530cc338358e9d1bc6dc34fbaa55426a01007453accd3edf42b9958fa6c0cf51
SSDEEP 96:KUAAKtePW9OK2QSOn2KUUiisoKxWH9KD3tg:iilZBlba9KD3tg
TLSH
T1AAC1280736B702122C3E390C93A497279B82B6637014E96B7FA860B15E66E344DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58fecd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58fecd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 b5c24f3d5ade8d291c159ef16e98689462d47c525798d139ee45f3183dce7195
MD5 9df02e68e6df296c8ba31c8596b55f30
SHA1 4206c8c46c1160b1f717cc13137e6b869aec9818
SHA512 74d285c5946661982a18532bb849e553287fd4709f4e3cecaf14157965620026533b391faf178cfe4e0db7bbd1ce345cbd3b7d9a67f0fb6c70e44ce61d6dc98a
SSDEEP 384:7iF1tNn/s3n9SGzsNk8TUNTUlIlcYTc1CfNca9gO2MHW37X0IidKzvZtLro:WF1j+9xxwgCyVFuOBs778KzZVo
TLSH
T126C239F649D74976D9AE5747B73E2E038EBCC163B2456950B3C81A0CCD8A2BFD30A905
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a9ca05d1d2e481653ab044fbacf82ae6b2e2215e255b4a60901934329b33bd25
MD5 13253033b8abb4405ae3273ae81430ce
SHA1 20c9f4ef8e8776a38c8e7c2d21aaa387dc89f30e
SHA512 601bf147cc543e81824faf8ffedf4b3d7ae38625574f7fd9eafa2de294333826db4c63aa6599f742a8aa63e58105584872aeea41c850556e34d65c279617e6c5
SSDEEP 192:qON3EV6O7+3hQmiUyVyVWGttb05O29h2qgGiIeU6:qONC61QGt9gO2MsUU6
TLSH
T10602D8356C386CB74AF3AD46FA873B235FA5112BE9952F44D6E81F0C00DB65C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d6b2f9317d5934381e08b5e8519355960cf5794d8193649c76d36ccb60df994f
MD5 cb1089ec97a2ed9b99447adaa024df78
SHA1 a92c34b1f30a095b37c67d86ca5b0a94153add01
SHA512 f302b3b7b6a675ab99b8c327fb4158b24b7992c5be5922e986160ede3dc2d8c613351f15fbe3921049176c2bc452ed02c672209bad24f4f3ce9f1f403aa093c9
SSDEEP 384:3tNn/s3n9SfsNsLOTc1Cfqh2a9gO2MHWm7X0IidKzvZtLro:3j+9UjUSh3uOB7778KzZVo
TLSH
T15F927C3669285EA65DE3A049FA473B17DFB88177D3862E50D1DC6F0C02DE7AC230B506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffafaf0dc6adeb88f1606bbb7f569455d6b19e58f3a76f0a4198ba40068d49c0
MD5 401a8426dd843c72edc274e4ed20fbb0
SHA1 e08cd4ef7878134cb3a8b806e20dec3439a6afca
SHA512 d7179b93c4938787fb17186d449acd903dd83bd74d83af16a629b59369b65ff33d278861fb6755fa6ec47ed256543292dfc3a6c7f8922a0bd9c1ab3d05fb1f19
SSDEEP 192:fcONrh6O7+3gfQmiUyVFVWfYttb05O29h2HoNTcNirqVRU6:0ONd66twt9gO2MHWo7U6
TLSH
T139122A36A828AC675DE3B145F58736138FA9413BDA8A7F40D5DC2F1C01EF66C234A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f380fecb9e4c458ef33308b7fb399271a9dfdcd53530084127d90bcd2e32fd64
MD5 7d4502d8b10c4194f590d535cd9429b4
SHA1 9da19048f68d1223c35bd4badd99f3766f571c2e
SHA512 6b4aca46e255fd105caf7d4b7027ea83f5e766441892c7f7b4ab859d24e5210d8959aa8ff586c4ab3d2860d3d8130f9714401bb47a64f002b87eba242fdc5ff3
SSDEEP 384:utNn/s3n9SfsNscYTc1CfFca9gO2MHWm7X0IidKzvZtLro:uj+9UEyNFuOB7778KzZVo
TLSH
T1AD927C3669685D664DE3A049FA473B17DFB88177D3862E50D1DC6F0C02DE7AC230B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2bec7921a7d4f21f022209c3bc8c02f409551d553ecb0aa6787db44fd1fc07b3
MD5 e6eb0dc601ffb4b8ba6233a76368ef3b
SHA1 357da337ccd6a36c4f674033b562cb86f89bb7a5
SHA512 7e48ca7f0e8562e86b5ac77686c6582ddf0351fa17002fc87878fc1859c8fc724d09bff53974b1f4923899be4b9aa48dab9f2f02907a44ed9f918d208dd6b170
TLSH
T15BE00243524000FEDD1C0370044B25781DE750140AF24A058D7101481D73304BF71FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 94fa8d0ec9ac319e067ad3b1bb7d445bad6ee5d944aae631e08572e6697bcc9d
MD5 b8e763002c66f86d24daa69d8ecb7b5c
SHA1 6cd5791835b23b66b154cd53df7c677d6b72a7c8
SHA512 da5e20600e12d93db112eee3eb81ea9cda7463bd02231a3b57d682fdb12c9855b48ded8a4acfa3ffc7db9c252668000a69d38caf571722932bc2e9b6b3797eac
TLSH
T174E00242534010FEDD28037000032A7009D6402405B106054B7101581D733042E30FD1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5858c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5858c9.TMP
Size 392B
SHA256 a3d9aff96631f3c9d8f50e2a77c14fde7c2d6fbf32a43b165666451172c36f45
MD5 894b8b8fc919ae20928eda4dc5066a0b
SHA1 0e139722e48d74c0b25dc86b0b898133727efd4d
SHA512 938d62b8dd11040972b920cc64ca5ebe212dbf6db42ec86321f5938c154a8a21e3fe6a62e47387d90c89a4ad1f99e6d1b24cdbd77c022328e61ac1b4dd4aaf6e
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b5089940246d4cc662e55aa85fb60c802c63f8c4575d34b3626a7fe0995a7215
MD5 4858e142e257a4823d9e063c12647181
SHA1 1b351533a8af2633fde4de2ecfd22eb6105da136
SHA512 fdb1198699229994477771f87d54fd6f10aece3edda37602eefbd7832aa47976177aaf8f0afccf685c99e1e891578cd9a6b931491be4b3cc5f2722f8170817b3
TLSH
T19041FA6DA6E91148B3B7BE1A9BF2A86D847B7D372E06D46E10110E4F0A27A40D861737
MD5 SHA1 SHA512 TLSH

Submit Download