hxxps://sharemods[.]com/w8bvrqx5vdl2/roundbale125[.]zip[.]html

Resubmissions

03/07/2026, 10:50

260703-mxpppscv8r4

03/07/2026, 10:49

03/07/2026, 10:47

03/07/2026, 10:42

03/07/2026, 10:29

Analysis

max time kernel
600s
max time network
600s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sharemods.com/w8bvrqx5vdl2/roundbale125.zip.html
Sample260703-mxpppscv8r

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2256	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134275498269369608"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1749168396-1890032557-311772428-1000\{85262BE2-D9BF-4CE1-A4BE-DC4396AAC875}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 1504	2904	msedge.exe	89
PID 2904 wrote to memory of 2256	2904	msedge.exe	91
PID 2904 wrote to memory of 5700	2904	msedge.exe	92
PID 2904 wrote to memory of 5700	2904	msedge.exe	92
PID 2904 wrote to memory of 5700	2904	msedge.exe	92
PID 2904 wrote to memory of 4972	2904	msedge.exe	95
PID 2904 wrote to memory of 1156	2904	msedge.exe	94
PID 2904 wrote to memory of 4972	2904	msedge.exe	95
PID 2904 wrote to memory of 4972	2904	msedge.exe	95
PID 2904 wrote to memory of 1156	2904	msedge.exe	94
PID 2904 wrote to memory of 1156	2904	msedge.exe	94
PID 2904 wrote to memory of 2508	2904	msedge.exe	93
PID 2904 wrote to memory of 2508	2904	msedge.exe	93
PID 2904 wrote to memory of 5772	2904	msedge.exe	96
PID 2904 wrote to memory of 1260	2904	msedge.exe	97
PID 2904 wrote to memory of 5772	2904	msedge.exe	96
PID 2904 wrote to memory of 1260	2904	msedge.exe	97
PID 2904 wrote to memory of 4452	2904	msedge.exe	99
PID 2904 wrote to memory of 6048	2904	msedge.exe	103
PID 2904 wrote to memory of 1964	2904	msedge.exe	104
PID 2904 wrote to memory of 4204	2904	msedge.exe	105
PID 2904 wrote to memory of 2560	2904	msedge.exe	106
PID 2904 wrote to memory of 4088	2904	msedge.exe	107
PID 2904 wrote to memory of 2680	2904	msedge.exe	108
PID 2904 wrote to memory of 2560	2904	msedge.exe	106
PID 2904 wrote to memory of 2560	2904	msedge.exe	106
PID 2904 wrote to memory of 6056	2904	msedge.exe	109
PID 2904 wrote to memory of 4088	2904	msedge.exe	107
PID 2904 wrote to memory of 4088	2904	msedge.exe	107
PID 2904 wrote to memory of 5232	2904	msedge.exe	110
PID 2904 wrote to memory of 2680	2904	msedge.exe	108
PID 2904 wrote to memory of 5184	2904	msedge.exe	111
PID 2904 wrote to memory of 2680	2904	msedge.exe	108
PID 2904 wrote to memory of 6056	2904	msedge.exe	109
PID 2904 wrote to memory of 6056	2904	msedge.exe	109
PID 2904 wrote to memory of 5232	2904	msedge.exe	110
PID 2904 wrote to memory of 5232	2904	msedge.exe	110
PID 2904 wrote to memory of 5184	2904	msedge.exe	111
PID 2904 wrote to memory of 5184	2904	msedge.exe	111
PID 2904 wrote to memory of 5540	2904	msedge.exe	112
PID 2904 wrote to memory of 5540	2904	msedge.exe	112
PID 2904 wrote to memory of 5540	2904	msedge.exe	112
PID 2904 wrote to memory of 3052	2904	msedge.exe	113
PID 2904 wrote to memory of 3052	2904	msedge.exe	113
PID 2904 wrote to memory of 3052	2904	msedge.exe	113
PID 2904 wrote to memory of 464	2904	msedge.exe	114
PID 2904 wrote to memory of 464	2904	msedge.exe	114
PID 2904 wrote to memory of 464	2904	msedge.exe	114
PID 2904 wrote to memory of 2488	2904	msedge.exe	115
PID 2904 wrote to memory of 2488	2904	msedge.exe	115
PID 2904 wrote to memory of 2488	2904	msedge.exe	115
PID 2904 wrote to memory of 5488	2904	msedge.exe	116
PID 2904 wrote to memory of 5488	2904	msedge.exe	116
PID 2904 wrote to memory of 5488	2904	msedge.exe	116
PID 2904 wrote to memory of 2356	2904	msedge.exe	117
PID 2904 wrote to memory of 2356	2904	msedge.exe	117
PID 2904 wrote to memory of 2356	2904	msedge.exe	117
PID 2904 wrote to memory of 4432	2904	msedge.exe	118
PID 2904 wrote to memory of 4432	2904	msedge.exe	118
PID 2904 wrote to memory of 5088	2904	msedge.exe	120
PID 2904 wrote to memory of 2600	2904	msedge.exe	121
PID 2904 wrote to memory of 2600	2904	msedge.exe	121
PID 2904 wrote to memory of 5936	2904	msedge.exe	122
PID 2904 wrote to memory of 5936	2904	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sharemods.com/w8bvrqx5vdl2/roundbale125.zip.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2ac,0x7ffba2ffc188,0x7ffba2ffc194,0x7ffba2ffc1a0
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,13823690119645748484,17137859992397771767,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3402149412928101409,13234338151076290636,262144 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,16754487042575376735,12703652479194377341,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=3176 /prefetch:13
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,15723281005366622210,12799212970769091289,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5560918793455833570,6543650773589620499,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,17122685819961654272,11281449521737602508,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,16215540359183100615,8419099283386731745,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:14
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,97675640732680963,2095988662890189892,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,97675640732680963,2095988662890189892,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,4005555350060388847,12534044187750597096,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:6048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,3881428469592940618,2984681777304244771,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,787833289058915473,16214642233598439832,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5344,i,16528266001268101069,4814122111245543090,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5328,i,16840202334640429484,641412139910590045,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5376,i,6684530152730381478,4378440805641943063,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5500,i,12338781998388499869,18173723536750139701,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5668,i,2350916840873098467,8536774495016411276,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=2728,i,6835910143953263419,18259528069840264438,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5660,i,12811980219795299120,17135022349404974778,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:5540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5524,i,823143225412126198,9976804430208197444,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5956,i,497966413921150966,17110101276837632745,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6960,i,14851532140674800614,7024188753152171603,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7252,i,2686920906606008775,10279548522770770417,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=7280 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7456,i,4774600449916354375,17906872198547792182,2097152 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,11019384373967402150,7606991285590813853,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6604,i,11811134779279976238,2824309934685315084,262144 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,10427554556246481642,17999671716427281372,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,14836136015312816991,15916355413477348178,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:14
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7804,i,4376857253770257167,2970971536292104861,524288 --field-trial-handle=2600,i,15524450705825051123,9253089046766625922,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
  2⤵
  PID:5908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 aebb6c70ab7a24d554d6f6ac0f891eea8d0143d763ae26afd14158a62471d32c
MD5 4df2b013f915bbf768a35e9c1e788fe1
SHA1 5f99dfa4310596930be8e393c0de83bb374a10f7
SHA512 5285653806cab96614917acfa4a3f6992cd581c9ad8eb14808de784b888ecfebb44f82a0a32c756a63c062605216d2535eed0d53eb14c4498ab3ae12d2d005b5
TLSH
T148D080E077697941C32534F274158740F7555471646BCA41B0D4D10C8D7555AA7C6257
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 55b968461c3cac4c7effa8a6c28244f55447bc6d9425abffdc980dbcf8f66a56
MD5 0f2dd8d756f52925ee56edb716c271af
SHA1 5baaa4f814deacaf47060c8d09015a8db39ce0b5
SHA512 9f360c7252debebc7f5372dc3ef1b650a635a7874dcf1f582432193203c260b088889ed1445047bad1f96fda147db83e0ec8ddfccd1d60be7a75e2fa03873bb0
TLSH
T1A1D0C0E073697941C32134F278218700F35004B1682BCA41B0C4400C8D7504A53C620B
MD5 SHA1 SHA512 TLSH

Submit Download

381353c6-ae53-461c-9dba-275f5a53e77b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\381353c6-ae53-461c-9dba-275f5a53e77b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 c180268b260c972ccd69764d7cbec72ceaba9ca95488fa8d5e745b617b882326
MD5 3a0059a85f5e521988ea731a7e3968fd
SHA1 2a4087fa4c863c35b1947fc5de200f061a006eb6
SHA512 65787715df53e2397c5ebd665e166fb9c4e15c0384c597f38d409e791eada7a84f1b15899870d7a86c6a21790d7c58609a4e65f59bfbf4da5ecc9d7da03f83f5
TLSH
T1A0E026E596C8C21ED38074478178730C83E0372B9BC86D8BF714C484B042880A78AAE5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 217b2809c051da9fe94567aca463ae6af3fd6e2775bfaedcebf3a53d127ae231
MD5 4d2e1f57fc683e1349111bf0226b40e6
SHA1 5ddb5f2ebec1e8f450fbb742ff4455fd00cf12ad
SHA512 a239ab5e69888f1115ed7a3a9fd01ef9bad8e0c83a5d6bffbbfff6b6acdcc6c8a3c2fac816c1bd12c6d1d55548f096968d34bbf10d08b00500140e82225a33eb
TLSH
T138E0268826CDCB5EA380A8874274638CD2C0365BE7CCE95E5B2088C5350A185AFC69F8
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 1f8243265e796d2f2651ad963ab087b79c12afab83da4e18b391ff88c8eda21c
MD5 e038104cb30f853d4fb4c17d93d811bd
SHA1 fd60f18b9de22295125c43e8f69d0bb409d9e4e0
SHA512 80a02ea233087329d60395883bcea2f3da0ceeeb470966e0ea39af14d3eb10d17a1e1de9cb90f04c3b5a5aab52eae358823b9066867a21e71295bab997049157
TLSH
T1D6E02BAAC921AC2708FC6B6C70954641E650132627508D4F3A3D810CCFB2B7B426682C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4881059787a375e62a07ba45744bf1c28a33a4eb18738aa546db383fde3a50a9
MD5 7ada785ea0631f35d421de65e6be63e1
SHA1 05f2e8d162658ac9848ce473c87f87e71a0e832e
SHA512 0030c8c0c63056cb34a9fae0f5b5888b590317d32b18837316f0f74f28bf655e9546771df3337e8d9c98137c498c9105a0c25d6fd0b0414bb40628a0a75c8309
TLSH
T10D717FA93B922BE1C7E74832EBFF50B935B8C5C6C1471E0F4174D53858E6384A36519D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f6ed3c1f1af4f2afe26bd5a4ebd220be08b9c65d733a1aa864f2a2824f450a4f
MD5 9b5dbc77b593c1f2940a1d414f27ad8e
SHA1 8a32b48661d78bcdb1f515874cdc3a824f4effe9
SHA512 df0b9068e17f2f6b80eac567215de676fefad5d979090a57cc56e983232d478449ce81b53556eb00cdb2fa7909f2ea5e88f2f751c360454349a9768f755431b7
TLSH
T1A7717FA93B922BE1CBE34832EBFF50B935B8C5C2C1471E1F0174D53854E6784A36519D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 eecfc65bc07283b90eb710935b2106aecf94852326e7936a0b39426b91b373b1
MD5 fa1a201944abb236282a59dc04a488c5
SHA1 1edc274b73e74bc2ed6d32463b0d2021a8ac2c20
SHA512 b27d64df28e706869326f9df238baa6e4b9d6e3d21e214c89d3b739f44018020c7394f8652e31cfdf05235f537e0f61a0e37eccd1d05af55b739557e03644d68
SSDEEP 384:D1bE00ejBNWesafaiGo1CwXI/CfXTYkNXkORIGAn2P2E5Ws8dBVVE+bIV5PvPk5z:0oFDeD
TLSH
T1664288B343F0E97EEA1299F55A15AD1ACF5C0928439C3C76CAD0BE0B93E3072E15560B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 fc58b646840c6ca831d5c6986364cac29200b3dca312a1d4e28a787ba0e818a1
MD5 054e8627795c652e7b69bb4faaccb9eb
SHA1 e27b38e17152852eba0f78773b45fec743517f42
SHA512 2526962650d9083129efc57d3642744e24045d8cb88b80e92b7b97ccb58bce8fcea0c17920181dd2bbb722d8d1805290ecfdb76a9d8fcb4c4538d401da93c724
SSDEEP 192:D1b5+me8JALjgvsafaij6o1CwXI/bfXTJkNXIORAnU2E4Ws8dBVVE+bIV5svPk5y:D1b5+me8JALjgvsafaiGo1CwXI/bfXTM
TLSH
T1F93288B743B0E97EEA2299F59A05AD1BCF4C0925439C3C76CAD0BE0797E3032E15561B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d53f4ae54af676c8f91cb9b7911e793d1cc02ef5515b9054c1ddb97e9c34e21a
MD5 34a3b58b7ef5deacf8e84f2f0e4e8f72
SHA1 d35e5732b1a3d0164b7211c5a4fcb480a3a6b280
SHA512 2ac3322443fcd225c0d6b6a78c3b00734ee1638162d2716df3fef6bcb223fe6fad019415fb8754648f8973005727f9e1d4451d30253d8e2fd3b09788cfc48fff
SSDEEP 192:sxRDMRV1yMqZjK1Ml8UQtFd/f+s0mHtZKOFvzoA8phTY/g6+WNfFq/YAuDTfv+GS:sxRDMAqLd/f+s0cDs+/5A/8fvlqd
TLSH
T17772FA1659349D7B9CDBD20DFA96BF53D2F91573A1901E44AAFC8A0C01E76EC211382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 ae9701546a04252990dfc910c25a505bbafabf7cd8a636ec278b9f2bae3e0970
MD5 25b4184efc43f7907071e6c75a9fc925
SHA1 f01f99f812e426b1b8d587b96e50b39bc4dfcb9b
SHA512 9ac2d137b992cced7964061f324802ac901866f59489207be538bf2ebdeec524b1c588edf66a8378adb5e523a4b06b2f5dee5e1fa6be5d9161a94c13bd15bb79
SSDEEP 192:sxRDMRV1yMqZjK1Ml8wFd/f+sOm2tZKOFvzoA8phTY/g6+WNfFq/YAIDTfv+GfIc:sxRDMAbd/f+sOJDs+/5A/Kfvljd
TLSH
T1B962FA1669349D7B8CDFD209FA56BF53D2F91573A2905E44AAFC8A0C05E76EC210382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b63412f07e4bb135a1c4fa236e128c59324ad7672022ccbbd2663e094a568164
MD5 9b131d21ca905a9b07a2c2c045ff2808
SHA1 22686632ee60c3574be1a11fd08f0acf424d1ac0
SHA512 3be6833b2630095f6cd170b30f39a5b8dc2f35e017ab37209bd96e605782de69e42c5b8af44a1e4a68c0c2b9c45ff7617515c7020d855919fa81013b01e1249e
SSDEEP 768:DckY2lWg1NfSB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbhHgurovmH:DckY2lWg1NfSBu1ja6dglvw
TLSH
T181C2FB2B650CCB7F4F844A9DEC25AE977DD801CB9B988D544BEA880C03C77EB511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80e16601-c135-46f1-89f7-ca31a7573b62\index-dir\the-real-index
Size 1KB
SHA256 14ec8c5223f34978dcd1d702a254181dd0c995db43d15ca6485ff22a85db7c07
MD5 f512909b0ecb34800df705aec76f2e41
SHA1 fe76b09dcb2cbb05822c95d8ebef2e2d1104355f
SHA512 830c7aa450c72e876f4e585f31994f032483c558a9966636ed70fc704fc24d4c1c97107d3c14156970a986302625138177fc2f620bf35eaa4056bc6b8c870784
TLSH
T1264163658C426B4BDC650A7225B5044C2735B5ED1F49AB0B217C703CACD733538DA55C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cddf4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\80e16601-c135-46f1-89f7-ca31a7573b62\index-dir\the-real-index~RFe5cddf4.TMP
Size 1KB
SHA256 a4d2f89b6a436f318eaa75b47ed8a1bdb0c6d216daf08c061c1860ff4abc783e
MD5 a1190ef6ae8aaad23fbc8bab80766cd8
SHA1 9bad7889f1d791b212839b86784692fda9c22a0c
SHA512 e2b6f0e4813bfa6dad9698cda95e5b06e8bec54ae3206a256e4299cc9b60b77bc4b90e16883ef65caf8c7ef63b2571bf2dcc345874483e10f7b179b55af2e1c8
TLSH
T1D44187255D616E0BEC1140776B8A048C333BB9A11384D70B10B4A13C7CE7B393DB869C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a54b23644944fee338f95c037051de2d888fb8fc21c080922c49826cba72d453
MD5 775bba894561280e7ebdfe20856dc35d
SHA1 1933dc77d3a39b20c254762fecc25573f1981a52
SHA512 08c08348601bcdd09fa46c630a2f094d1630adaec7663fd9c7126b3c78fdfb2b351f14645fe335b61951d15668840af6f2f124a03a24e2d83ce83848454e2ae0
TLSH
T19DE0D8B778E31860F96FC7DA147158E605057D6C8541DC4F246A62D31471218359AC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 c2c074321b7bbc5759d35a7409c0d20ad3b26c98d29f2def44c77075750a79e7
MD5 79963af747792b29c05485c885c475c9
SHA1 ff737c9398d90b91ef50e6ccce53fc5e91b47bac
SHA512 05e0da7a7021506005a06e29dc2dc91cfe5d2e926effa599cc2df0afd4b88d34fa9e4ed0b7fcbdcabaf800131481f9e7d7ab05db4d2a852668b1426e2814f490
TLSH
T133A0027439946612D2011A712183D9C162156C76D71A8B1168E108479DD2161C116011
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 4c77d634d63942b0a7ea2de75d6f3da1eb1a8d50f6482a468ff74f20922441b6
MD5 4cdecc5e10a6c762913453b1737bcdca
SHA1 c00501765cb0c3e2dff0a987a32793710f597d30
SHA512 c23ee5d5b84332fb84b68cd5ea82cd30e2d06c2505d91979d10e6647d6caeb9f25e8084f5cd006d176d2ecc572f778d1ca3575073430c4b44fe6ac0d3ce24a69
SSDEEP 192:E61PhSGGXWL8MMLOi70MjSEJB3BPorbu/drtBZnZFHzurTu+zC+4h:E+PKFT3JoPuVr/ZZFTuH6
TLSH
T1B5C22A10733A32D1397D390881A4952F52C27467321AA96B7BBC64E64F6BE01DFFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e37f5d1733ac63bf485a8f8a7e359c91486a8b2382351f64fd3ced3ad200831c
MD5 1504c49546e0d509dffe175e6b71947c
SHA1 3e211fc0c06bb281c3d0462b039cba34c0ccf390
SHA512 1e813466eb890c97ae620f602af8dbdf1eeeebcaad3ad1bccaf1eb1660ba102299b5b300112d6194a2955a3a5ef071552631ef9794887ce2ba1c58f576c58999
SSDEEP 384:nwiF1tNn/s3n9Sn8No8TUNTUlIRJB1He+xQstsfUGV8aDPvQup4ldrjxAOObjI9I:LF1j+9+FwgXzxHGV/unrG29MD
TLSH
T13DD23936DC54CE77ECE68FD9B74A765ADEE042638288A9C4D9C96E4C01C71ED4307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 91d10b99966c4fba1b14d61680652f58153f8dea42ad396dff455ac9c7af8dbc
MD5 e054fae5ee2514703841ba8884e83eb8
SHA1 6447e755a3bb7c0ab122997cc40303411aa84710
SHA512 8110e089a0835e2449db6b82411bc703ae1efcedc4834b80b9166bf375a6cf3854f23b269feda860dd6cc12067a4fe35a7085930a17b29d3cf36af8599b5e0d3
SSDEEP 384:nIiF1tNn/s3n9Sn8No8TUNTUlIRJB1HU+xQstsfUGV8aDPvQup4ldrjxAOObjI9I:TF1j+9+FwgXVxHGV/unrG29MD
TLSH
T1EED24936DC54CEB7ACE68FD9B74A765ADEE042638288A9C4D9CD6E4C01C71ED4307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 9d0844b94130a9383f0796731b397912693834f3a6a3ff1d851ebf07f3d596e2
MD5 b5bbfc2beccac94fb924cb5aef1b0fac
SHA1 ce76919e95c27befae470b22c5d7879b92435fcb
SHA512 80ba67d9510d2bfd1343db10b382b108a872a61908f2cc125465b284fd46b2b96e1c90b3ac3b33a76e24f96cf1daadd1a86712a9b57f55533cc37626936a42de
SSDEEP 384:nHiF1tNn/s3n9Sr8No8TUNTUlIRJB1HUbxQstsfUGV8aDPvQup4ldmjxAOObjI9I:CF1j+9CFwgXcxHGV/unmG29MD
TLSH
T1F2E2A2F298D38A77D8AE4B87637E2D469AFCC153B1885984B7895D0CCD871BFC206815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 e96e3a437940a8be12607498357ce973e11fddaaa0fbbc8953dc082c7f1cd258
MD5 1b26cefeb6b2693074f4d14fd59d4aff
SHA1 b1f2fd3a8a09aa8f9ca25d47b9fe5476f3005cc2
SHA512 ddb467f971af16ef7f68944a21439156dc3d2c0b785f65b17941c056878a9221322bef4d6999d00ce7eb3f64d898146fcf84ac89e6c9beac32893f34cbc958b6
SSDEEP 384:nniF1tNn/s3n9Sy8Nj8TUNTUlIRhB1iiESZstsfUGV8aDPvQuprXmn15wbAjEbeB:iF1j+9X+wg60wGV/dXmn12bfC
TLSH
T1E3C24936DC64CEA7EDE68FC9B74A775AEEE001A3819859D4CAD94D4D00D32DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download