hxxps://plusrover[.]com/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://plusrover.com/
Sample260703-c8k6jsft4p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275203196241853"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{9418B084-6CFE-4600-87BC-E10434C0455E}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{6F08E453-15F0-4CC1-8C72-681B7A9FCAA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 1612	4556	msedge.exe	85
PID 4556 wrote to memory of 3704	4556	msedge.exe	86
PID 4556 wrote to memory of 2580	4556	msedge.exe	87
PID 4556 wrote to memory of 2580	4556	msedge.exe	87
PID 4556 wrote to memory of 2580	4556	msedge.exe	87
PID 4556 wrote to memory of 1904	4556	msedge.exe	88
PID 4556 wrote to memory of 1904	4556	msedge.exe	88
PID 4556 wrote to memory of 4840	4556	msedge.exe	90
PID 4556 wrote to memory of 4840	4556	msedge.exe	90
PID 4556 wrote to memory of 4840	4556	msedge.exe	90
PID 4556 wrote to memory of 2068	4556	msedge.exe	91
PID 4556 wrote to memory of 2068	4556	msedge.exe	91
PID 4556 wrote to memory of 2068	4556	msedge.exe	91
PID 4556 wrote to memory of 1992	4556	msedge.exe	92
PID 4556 wrote to memory of 1992	4556	msedge.exe	92
PID 4556 wrote to memory of 1992	4556	msedge.exe	92
PID 4556 wrote to memory of 1056	4556	msedge.exe	93
PID 4556 wrote to memory of 1056	4556	msedge.exe	93
PID 4556 wrote to memory of 1056	4556	msedge.exe	93
PID 4556 wrote to memory of 3856	4556	msedge.exe	97
PID 4556 wrote to memory of 3856	4556	msedge.exe	97
PID 4556 wrote to memory of 3856	4556	msedge.exe	97
PID 4556 wrote to memory of 972	4556	msedge.exe	98
PID 4556 wrote to memory of 972	4556	msedge.exe	98
PID 4556 wrote to memory of 972	4556	msedge.exe	98
PID 4556 wrote to memory of 1176	4556	msedge.exe	99
PID 4556 wrote to memory of 1176	4556	msedge.exe	99
PID 4556 wrote to memory of 3720	4556	msedge.exe	100
PID 4556 wrote to memory of 3720	4556	msedge.exe	100
PID 4556 wrote to memory of 1120	4556	msedge.exe	101
PID 4556 wrote to memory of 1120	4556	msedge.exe	101
PID 4556 wrote to memory of 676	4556	msedge.exe	102
PID 4556 wrote to memory of 3392	4556	msedge.exe	103
PID 4556 wrote to memory of 3392	4556	msedge.exe	103
PID 4556 wrote to memory of 4448	4556	msedge.exe	105
PID 4556 wrote to memory of 3944	4556	msedge.exe	114
PID 4556 wrote to memory of 3944	4556	msedge.exe	114
PID 4556 wrote to memory of 4660	4556	msedge.exe	115
PID 4556 wrote to memory of 4660	4556	msedge.exe	115
PID 4556 wrote to memory of 4660	4556	msedge.exe	115
PID 4556 wrote to memory of 4656	4556	msedge.exe	116
PID 4556 wrote to memory of 4656	4556	msedge.exe	116
PID 4556 wrote to memory of 4656	4556	msedge.exe	116
PID 4556 wrote to memory of 4420	4556	msedge.exe	118
PID 4556 wrote to memory of 4276	4556	msedge.exe	119
PID 4556 wrote to memory of 4448	4556	msedge.exe	120
PID 4556 wrote to memory of 4156	4556	msedge.exe	122
PID 4556 wrote to memory of 4156	4556	msedge.exe	122
PID 4556 wrote to memory of 1028	4556	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://plusrover.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb3667c188,0x7ffb3667c194,0x7ffb3667c1a0
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,15609359015723272270,3025518916797757260,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,640557024598573549,10945196873987520532,262144 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,10028282651768564437,13527200058811760602,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13978694474824201576,14202268175886589118,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17584761536891218263,14478097794457832647,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,16395333869913447153,14875624998136080954,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,4649076837089434622,6739103782840728219,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4992,i,2660595878377317258,10172952804752203032,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3384,i,15273706191702577836,8011181515708491785,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,1206129668214730543,1348357612058331000,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,7656475305894700195,11512138723762150763,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,2631864813132402160,351747147320424659,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,8023370280946264472,4219877656841359515,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Modifies registry class
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,11013142918776941895,16125310708862342782,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,7527487129893924613,10624695651433631602,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,7527487129893924613,10624695651433631602,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,1016397311118016625,18165408853822311671,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6672,i,2369953357159815050,6524850317299964290,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5364,i,18091628505934792513,15013067388870751210,2097152 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,16768846114107230601,6889860798280238677,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,16718931843382505835,6457571228485356832,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,4271657199347880048,6933053363933009534,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,4190967800222838973,908832320677781124,524288 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6632,i,12789712387615824744,317557671365653697,262144 --field-trial-handle=2244,i,15344180027934521937,2906746073587955299,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7ebb34f009909df3bd63f661df4b755a5a5a6ee42112ad16b9fa9f413ab51ea1
MD5 7dddd563f3f2a547f88fa298c7d46a31
SHA1 76a9165d20a70fa5224998148f59ec173fa6d809
SHA512 c66d4cbd067afbd1f4a195624c0220190e5a58d4d06eaaed69d899e1d01f241a4aa22b5aa7602bc26112dd7c7b4ae1afa855dffe4b08f8f036d3a5b8d400bbec
TLSH
T1AF814E5B4286DBB3D359C870D3E02615BCB1C02A0A5B1F736190877DEF21BE7B20611C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591728.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591728.TMP
Size 3KB
SHA256 9e667dd9d33d643bf149664e2cf938e8b8549bf6055e04054db6503a355c3451
MD5 9221da2699a1f10b96a1267215279366
SHA1 2b61f8da24c37d10f54dcd04aa0e31c3643dbafe
SHA512 e0e7fe622f1d37bc954eb052e07ca59784dfa0745b953de731502cc95d08011c26cb360b17457ba082be10d9ea724a33bb81dceee299fad81a61034bc8c1b96d
TLSH
T11761715B0216EBB7D329C930D3F12505BCB281160A2B1F7352818A7DDF31BE7B16660C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 343KB
SHA256 3b8be43b54d700bfa4c27521db7f3a636628bb4c85aed253d5aad82191fe2ce6
MD5 5ac91b7e131772f6b01abb52a420392b
SHA1 cfcd146b7210f5de5ee167cfee5604c888d676ad
SHA512 81604ffb0b821b8c0af372000163acf19340ec57bb59fe6eb9aaba8d42d0032908204044bd33a8b1e3491b66203a998dbbc3deeecf2cff0eafd0391eb6a4fe5c
SSDEEP 3072:7KFDI7hFRNTEtGj2D5z8QzVS22c2uU+z8QzLtz8QzOw5+5mAzu8y7OPw70zu82Wb:LNsNAQQLaAQ/tAQmi8Ni8bi8ZfFqE29q
TLSH
T1C7741A0D22D676DBD02D037718628D56D3B9EECC116CB09AA8A27E1D22F7F413674B1E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9128201151097e8841725e48a6c56f9a2707009ba243b5b5209acd73ee2bfa60
MD5 b2a2a0fc9e9f324f3c65c82ba9973758
SHA1 60443bda0a9ae268df77f186c0ae29cb3eb7df5f
SHA512 f4309f2c0cc177b3ce5ff2d5132cdd7239c64c0799456ba2440548155378b1ed499c3c993a8ce404c8eb7353d3ab8106131b652c9f226867adb0c3af5a2b2ba3
SSDEEP 96:Drn0OOuAVumuGutuuu8uevzr1SupulczDu+wd9Mr6u1urusuNuzugZuIu5auPp:Dw9BVZa/vZvzrskj/vs9MXwZUQlr5o
TLSH
T15EC19EF3C3D4C22DE81516F496187D1BDE2D1D6883283C69D9DABF4B93E6071E211A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 430c6b27a0b27ab9d3dc5d5815f47052985d98fa8cf7eac2d52165fcbcf415bb
MD5 d0429d84537e08165fce67898a7c7387
SHA1 817052d7f1c57f6d6695bdf149d1a7199c6c1103
SHA512 20c1c3b00c449b0a4af4ec9d479a7c0d1412b8ec3448860d6a18c9693c7c89f44cecb3e7e0fcf1e798adb1bf29d1888a81b5d1f2a326bb452fe4c8af14ccaead
SSDEEP 192:sxZfRePyM/jK1Ml8UQskR/fAsa/JC7Idpi76PHW6+WNnIOfY4B56smIg54J:sxZfCq3R/fAsa/kknHbZfFUy
TLSH
T17D52D8126A345E7BCCD7D209FA51BB57D6F54572A2900E44AAFCCA0C05EBBED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e1947a6a35b0e04295f27d317daa594a28d2edbfc8263cb95df34516dccbb665
MD5 384639786495b65d7a755ca42af8b453
SHA1 5336faa10f681db2d835ec0134889bb97afe75dc
SHA512 ce2da5938472cbe741cdcae690f2c153dfc2a7fe5942633373ee903d321187e6dcbaf090d4c8ff94ffd96f10067e10e0092be76b6701fb37c8a66b45498cff1a
SSDEEP 192:sxZfRePyM/jK1Ml8MkR/fAsa/JMbIdp07JFHW6+WNnxm/Y4N51smIgrJ:sxZfCMR/fAsa/iEOHbg/x99
TLSH
T1BE52D8126A34997B8CDBD209FA51BB57D6F54572E3900E44AAFCCA0C05E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 150614d0b16a1979afc690a584e495a513e73fed9afff83112279a5d3b14eb05
MD5 44b99dcc7fed0f7b2fbee8fbc387e586
SHA1 7c4b72a06a3cc7eb39936bd2701d716bb210e892
SHA512 451399b90b3e75e7891d254eed0e4848896948ff6d6128e37437b9ab21a68ae6e43f34583b3a41e7d596cc2f0f7cbc3d0966505075bc26b2940c4a5c356b4724
SSDEEP 768:ES8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opd/roJkUUnsv:ES8iJPNWvx76ru1jahALocds5Ui
TLSH
T136D20B3B680CCB7E4F844E9CEC266F966DD801CB5B944D5447FA884C03CB6EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a37e490a-2755-497c-a652-d82380fb1685\index-dir\the-real-index
Size 2KB
SHA256 8d768b5bd69d9d317b673087ab38424f47f476299696ab5174601a49f6266aba
MD5 07a5e62e96afab96c883cc880d7ef862
SHA1 fb6ccef6922d1365dd6b7569b5d22a4bdcf89835
SHA512 2878eefb9d7b8c87e2b6f949674ed993f12de871ed114cebebdc9d43f3e4398af76088f33c3b437b7e2e2b99f90d694375821fb9293ef2c1329d8794eda504c5
TLSH
T1FB41224CCC90AB9EE8B561FE2D9415B297B52D28FC58C2535060B6B23843A645B4B5FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a4c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\a37e490a-2755-497c-a652-d82380fb1685\index-dir\the-real-index~RFe58a4c7.TMP
Size 48B
SHA256 4afc0b2e6b799dd5bbeaf3edd747c9f6b84cb925dc426b25dab1dbd3d76e85c9
MD5 e274397e0982df53c81fa8d177e5018a
SHA1 cdadbd9f6244400388220ba6c25d1ae86d25a826
SHA512 6830895e654d9787efadf37f1b33c7056bda2c8851fd98c39944407d7d7128c0a579bd4da65e2ba31e75c4b0de7634eb3eafa3173203bd722b59d0fd90ae8157
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 221B
SHA256 a5e8e7546567e5103e0e479c28a5b498b7b1c558aba217802e8a69eb1fb350c6
MD5 aa8632ec054f7ad8661898bd6109c5d0
SHA1 01560cfde5549dc94d5b4768b82cd6ba02c29bd4
SHA512 8f8129a05a25c4d6c899757bb1c4e694b6ddd318d2f98f5fce2615f13fb0dff151b87dafbada3af11774fe6803113a1e69789dbc02c06cf30087f4c1fa83a553
TLSH
T1B9D022C3C330AD471B30DBC1603852CC912F8C2AEE84CCA08602F2823078793C280D68
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 216B
SHA256 0fea51dfdb91c0ac7be50917b6766a6d0bef10096b5d225ba261c014d8b0dc18
MD5 a6f3174f8ab11adb3bc40a7542139645
SHA1 afc481bc5c919a21e7be4e0a3f2443b9c22cf845
SHA512 5c49cd65acccdc7743e7f2199525892a71e80684cc397ba0f06c8f8e7607f48e8644190d159491bbf782d38f283451cc4754ffb56b8af53e91b28fc8975f52e9
TLSH
T15CD022E19130A8A71B34DB8934382A8E812A8C0CECC0DCF5DE18B1E331B8623C040A69
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 2d1a6caaa86ab43505e69aeeb3d1573392d319693cd2c446c2206dc5d1ae0f09
MD5 0aa73f9eca2f87ebd66b5ae2ea7f6b32
SHA1 906ea53b2e6baffb084a57c820584c852f9c0424
SHA512 f8074ccb084947c882988d576bbea28628e069907bbe09bd9b9ccfacb1d890f7ab82890dae9d39faef5a1d108281c60b89bcf83e61214b208deb9ce3753141a5
TLSH
T1D0C09BD2D450D99B0E38DFC81038575DD50F854CD4C0CCF4D20491813474913C442A65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 044f049bdab41024d617f1986ba6a99f1815075c05b0e3d17d6f010adec6708f
MD5 b0793872e3c1f512665aefb192c57af1
SHA1 88003f69bea7e89963017220f4385d3ee5e04356
SHA512 b22a0be4145db0217c7dc34d406977ae866821248a301fd8b76a36787a3070a63884d13d4ecc4f6d28acdd9601e79e4d9588d178624262b42b15a7b957cabee8
TLSH
T137C09BD29450D9D70F74DBCC3038675DD50F854CD4C0CCF4D60490823574923C441A65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe584f73.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe584f73.TMP
Size 137B
SHA256 651a819d430398b320b61a0b4d5ac120a990ddc9c50e5dba2009c7f85b3e8106
MD5 5b4222bb66eb1a2da694b7bbb3b7559c
SHA1 d961ee3eedcd31b1bd56a32abb4fbb3a19d88343
SHA512 7752613236024312c874f4f2652a2eaf7aee4f318a7d0d149ee079b2f0279869ad0d71dc210bf95d4cfcc144df0309e5a014ab942f59693b9646f3679add6670
TLSH
T13BC09BD29570998B4F34DBC51038579DD51F8D5CD8C0CCF4D205B0813434A53C441965
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1978d0208772e8d8648a6269b76991675878291373063968d731fd322aba25ad
MD5 d8d812999102637b9df4fd452f7abdda
SHA1 531fddd94334696f5d3ac4ee0abc89bb6e65bf58
SHA512 5d7b16b47f829471bb25df68ae857871f3c3e5bcfa212705209f705206a19b9851e85eee472746b63a05fc54816787ae979b4cfaec7e641849e8060634752e4a
TLSH
T1F3A0022901644241D40003F0B941018D265448944601536140BCC0F4AA50150622B658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b2a3292f091e87504cde26f252942efa2e71f5417762e1df43239f287de71894
MD5 1464f72ab84c6b81b0b7111f5e5e66f4
SHA1 4c348662a3d3c13a3af6e32d2cba5d288146e66c
SHA512 f1c47ad0fc4efac7f59a29e212cc37a75cba2672613877c5f6acf1f3228e65f076513b8431d64cec39310f91a077d4d1ee4e7e725f8f162952424a02095dd80e
TLSH
T1BDA0029469401461C45802F838859DCC221CD8E47609163554AD8484FEE4650E11E047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589f96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589f96.TMP
Size 48B
SHA256 4c6d501b433c07a32545f7d36bcc0f322f41048a5d25bae4c0fdf5eaa065c8db
MD5 775a804d421f9df7e8bcaf5711a5becf
SHA1 97493db2230f1371457244c414a1908b57d57ee0
SHA512 e8dfed25f915319da88a9821d45b365ea0dc9d9259bbbc6c994ed024a2699a301dcb3f3b79f043a303ef43dc6c0af0763870d317b7a56adc724e0709b6a84249
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8007999ce9c64923f39bf404fc79ec7f60673cb6897d1b14fa3cb3b5d2f2557a
MD5 719b9ecbb0cc5a765cc84cccbd47bf40
SHA1 d8d5248a1c56c37685936b6a638be56d0e77899c
SHA512 ab4ca11c6f383e6659dfc074436b2a51f8e41250b75a1cda49def9c81ba2fd8dbe78313faf0fdfd155591dc48efb52018f7759e03ef8f53c492d0c0ac722e096
SSDEEP 96:KwfyKoK6gKTiaK4YKRGHKxoKxZKxsKx4KxqKx2Kx6KxgWKxeKxDKxzgKxgKxgK4S:8n/b+KaKfKGK6KMKsKMKlK0KxK6KqKiS
TLSH
T18F91240271FB42263C7D251CA36687278B827BA3341CE42B77B955B10E6AE254CFD4ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f91a6553-cc4f-4fb5-bd7d-ec0496b4db98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f91a6553-cc4f-4fb5-bd7d-ec0496b4db98.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c59959a29d6f84f14b7284f4edbda128fae7ceefae1cacef72cc0bdcf10ed692
MD5 53453c1e0e1b35f40baf1a800547a8e6
SHA1 4e30e291d98c86e7de2b3a9850c049a4f4f37a7b
SHA512 d2a2f3c225a80463d61543e246a23eb54965fe5d630bc59836a217c11ea9f9810edd6fc4520483d400ffc0ecf973c81c6f95dbcee2dd6089a9798a49c4d6b703
SSDEEP 384:FiF1tNn/s3n9SpzsNY8TUNTUlIl9V6csYukqbFUi78OObjI9G6w7Os:MF1j+9qhwg0zb7829MZ
TLSH
T142C23BF258D7893ADD9E8747B37E2D164EBCC167B6845A80B3D89A0CCD971BFC206811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 149bddf8426dd999b286b4096e29f5d590123f927c5204412c771ed475a952d5
MD5 e9bcaf17d526f8403487c0fe269aa009
SHA1 9d487ad5d06edc9501bedd2f5aa965f1a05be04b
SHA512 cff711cba4e8377882095f5d5d18164acb7cc321fc756418fc6d1060494b78cee3aacce5d056e7f6b4f308ad3e4e786f3d23db40f334f9b827e69ba60cd771b4
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5f5DjBhPwivh50xy0SFYK4AxYYCbK:gONZ6kDfQmiUyx9Z903bb9XQi4CCU6
TLSH
T1F102E835A8B86CBB8EA3AE49B48777275FA4117BEAD42F84D9E81B1C00D765C1703436
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 71ebfc5ab5944f7f543c774db706b9d87ab92e36af039c77232fdc7503583120
MD5 e7bcd0fcc6ce06e36dcf0bf2f34d1264
SHA1 838e53f72ef438143045207459df344a53b8c2b3
SHA512 39a03b2c78e83dec4769a0da5f031a87342da20d5ebf0b59f6a7a342ce263658e41a4a64f58a26d15171a46c40651970e460cbcb03126b43cd6353bc29e45fe6
SSDEEP 192:LONB6kTQmiUyL9z903bb9zUNEjDcRfq7U6:LONB6Uaz9qbFUiI8U6
TLSH
T119123A7268B86C7B9DD3A845B08736175FA49277EBC86F90D5EC2B1C06DF29C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 393f13dfa22c6fa7a7c89d99a6e19ea3f85ebce0dd668016773f018c6999a161
MD5 5614f73da147a62eb26007ba3b9a07af
SHA1 a3771822e9ad2df9532f427878b709ba2801488e
SHA512 faa7d87bf966f19c767a9023376928ad50e8126dd0f437215b34ed1efe778f40c50b8fd7579466195829df2d11b79ceb57784a865b5de9bd443ef58b6520e520
SSDEEP 384:otNn/s3n9SfsNo2V6c1YukqbFUiU8OObjI9G6w7Os:oj+9UEzbU829MZ
TLSH
T13F92AE3268796D7A4DD39555F1873A2B9FF881BBD3C82F84D4EC9B0C06DB2AC0312916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e82eac29699aad871ba5766a0a2473dcc4160a35053fabae3c496c6efa83acae
MD5 b7a4c2ac064749d7911e123c417df7cc
SHA1 666a77b2abf71022eb39edc02f3fc7a17d914b52
SHA512 ba9e0f93e9267e81d319f94847415ba12ba584f0a4e214202a41b1b267c14cc0d2f4fff5dc667f8027b8c397c20f4af2c97ce0753d9f72e07e02bea27c956f9b
SSDEEP 384:LtNn/s3n9SfsNo9V6crYukqbFUiU8OObjI9G6w7Os:Lj+9UhzbU829MZ
TLSH
T11D929D3268796D7A4DD39555F1873A2B9FF881BBD3C82F84D5EC9B0C06DB2AC4302916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91788228-e59a-4596-b794-ee4b49901fda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\91788228-e59a-4596-b794-ee4b49901fda.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 53ac294b3e9dc898569030cac35dfbd3310dee948513500ab460b9ea66d0e74b
MD5 4ee5748024be6331fdb72ad70e23f45c
SHA1 31fd58456f894157adbe1917b3dd6a28bbf1af32
SHA512 56586460ae52e32b91afe13ee44b7da22ad9c2f2241565cef67b38482c2ec8f85a449e720c8aaf5f3aeac0255391cab35062ff8a9428522a701055cb918c15ed
TLSH
T10141065CA6FA1148B3B36E5AABF7A46D547F78773A1BD49D00110E4E0662A40C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download