hxxps://xml-v4[.]redirecthollow[.]xyz/click?i=HkJhN7BM3wY_0

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 16:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://xml-v4.redirecthollow.xyz/click?i=HkJhN7BM3wY_0
Sample260714-tsg8dsaz61

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4820	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285196382667482"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{41583505-A945-4D32-8632-70FABAD5250E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 2428	1960	msedge.exe	85
PID 1960 wrote to memory of 4820	1960	msedge.exe	87
PID 1960 wrote to memory of 1876	1960	msedge.exe	88
PID 1960 wrote to memory of 1876	1960	msedge.exe	88
PID 1960 wrote to memory of 2760	1960	msedge.exe	89
PID 1960 wrote to memory of 2760	1960	msedge.exe	89
PID 1960 wrote to memory of 2760	1960	msedge.exe	89
PID 1960 wrote to memory of 4944	1960	msedge.exe	90
PID 1960 wrote to memory of 4944	1960	msedge.exe	90
PID 1960 wrote to memory of 4944	1960	msedge.exe	90
PID 1960 wrote to memory of 5096	1960	msedge.exe	91
PID 1960 wrote to memory of 5096	1960	msedge.exe	91
PID 1960 wrote to memory of 5096	1960	msedge.exe	91
PID 1960 wrote to memory of 5024	1960	msedge.exe	92
PID 1960 wrote to memory of 5024	1960	msedge.exe	92
PID 1960 wrote to memory of 5024	1960	msedge.exe	92
PID 1960 wrote to memory of 3992	1960	msedge.exe	93
PID 1960 wrote to memory of 3992	1960	msedge.exe	93
PID 1960 wrote to memory of 3992	1960	msedge.exe	93
PID 1960 wrote to memory of 3672	1960	msedge.exe	97
PID 1960 wrote to memory of 3996	1960	msedge.exe	98
PID 1960 wrote to memory of 3672	1960	msedge.exe	97
PID 1960 wrote to memory of 3996	1960	msedge.exe	98
PID 1960 wrote to memory of 1864	1960	msedge.exe	101
PID 1960 wrote to memory of 4668	1960	msedge.exe	108
PID 1960 wrote to memory of 868	1960	msedge.exe	109
PID 1960 wrote to memory of 5076	1960	msedge.exe	110
PID 1960 wrote to memory of 4968	1960	msedge.exe	122
PID 1960 wrote to memory of 4968	1960	msedge.exe	122
PID 1960 wrote to memory of 4356	1960	msedge.exe	126
PID 1960 wrote to memory of 4240	1960	msedge.exe	127
PID 1960 wrote to memory of 4240	1960	msedge.exe	127
PID 1960 wrote to memory of 2440	1960	msedge.exe	128
PID 1960 wrote to memory of 2440	1960	msedge.exe	128
PID 1960 wrote to memory of 4860	1960	msedge.exe	129
PID 1960 wrote to memory of 4860	1960	msedge.exe	129
PID 1960 wrote to memory of 3264	1960	msedge.exe	131
PID 1960 wrote to memory of 3264	1960	msedge.exe	131
PID 1960 wrote to memory of 4004	1960	msedge.exe	134
PID 1960 wrote to memory of 4004	1960	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://xml-v4.redirecthollow.xyz/click?i=HkJhN7BM3wY_0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff92f08c188,0x7ff92f08c194,0x7ff92f08c1a0
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,5689493051314155228,16499671550770000208,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,10787343925474206322,18206432453647926767,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16725283716326202926,5376813941288650923,262144 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,148656682416044433,2717819581396498910,2097152 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,5962793642617582349,12716827558063477358,2097152 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7900345763164713528,15534842408631636126,2097152 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,12856643354603829553,409715477023998633,2097152 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:2
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,7068096348638582509,9156378678991608465,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,11923595472523715222,6509371747869716165,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,13950529171388399945,5839927528104588191,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,13950529171388399945,5839927528104588191,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2145033982375863068,4183411860083727723,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,11168171752627298808,9736094928000894458,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,12570017604148028435,17881056039372334211,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,11464994592059549942,6754667720386181800,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5728,i,12359856874036897433,14780492324711689124,262144 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3364,i,13023135483999004990,6119734670536419498,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,1950326830206570559,5763936077874548775,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:8
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,4676870412042103087,3084363622178860997,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,3834694329820497431,7341007222900623808,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1945844779749906853,16941915740747541769,524288 --field-trial-handle=2640,i,13318525749549483271,17762015649453576646,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:4004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

91c0a9db-3f01-4d98-bd92-46370eea6210.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\91c0a9db-3f01-4d98-bd92-46370eea6210.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 11529d8f90a17f5977ba7bc1fbdbcaea81aa2105217340ab9bf85b2a6d4d3f80
MD5 cd4d27ebb07f6c9598ec2428cc51cb29
SHA1 0e58f59e4105a60fd9ab1077c3b068b1f86531c5
SHA512 7ce6a6f2c2a2316fc9e50ea3ee0fb7aca414ca10b0258745d89d098bc5838c2ee27e8e88675f4b1d24cb39fc4b4cd155806b206175e0fd25759c86f2a761d884
TLSH
T18BE020DF2286C7F69199978F815CB31D8130735F95CCCFF9734466D45E8100043446A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 7d952d7b13946ea1ebd402f35f4dae53b19c179e0abb4739b98f4a6cb3032b88
MD5 be6aad83e65d760455418844da9393bd
SHA1 b17f43d9dcb2611cd70541e8f12c47e267e5fef4
SHA512 dccaf3ae8ff71a5ffd9affd1da6712e837fa6e92f24af4710d654b9e2204aa07767764b592c66023c9f8b5907d21e970a2e4eefd5f3be81962bbc1130f4aa1c7
TLSH
T18CE0268602C2CBF86188A687C0BCF31D0055330FD7DDEAFDB2C8B0A42A02800AB57E80
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d23ee68c5be814c83cd3eca9cbcbbd546dc6dac35e840916769b019e34580d4a
MD5 4630be48571dc19f959ca66234e7de65
SHA1 0da20a4b1c4383f353b92b9188e1e8dbec80b423
SHA512 d62c0d558670f6913255ec0efcf9b8abbd8bc16733f00febb50ca0fbe03c7cad0c1f74f94be53e4e20aa1c104310ab3670dddb283a087ae11d31f4ccffded271
TLSH
T108E026C854CAC6FEF248A64742BCA34C82A0370FD2C86A9A971488943202040A3A2E94
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 00a8234236ffc09e3c41e6213933e87f6a63eb5f69f64a94f345a4a414987f1e
MD5 088abc29efc4f213d9ac015e3db5c545
SHA1 e7941139ea11668aed2ffc6c55e0647d22f4a6cb
SHA512 22a3e22734e3050e429ac45f4103e704ce49c37e2e0f5d0dfc9625acc73c7e7bc18958097550f264ddda5377a9c5168fc4f0251a97964bfe77b1395daa2b72db
TLSH
T11E8119B6225242A4FB9001B1A9FB9AD2F071E8FEF5BF0F5E8150987E4D31393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b5ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b5ed.TMP
Size 3KB
SHA256 353dd214e6a258b865f73c86a6a05ce42c7d706c8e3bb3f61e4e713cdfc186a5
MD5 c64fa52c335fe776e57e417e803c02d5
SHA1 09c43cfda28aaf14600b0137c3d0a5d373538b31
SHA512 1ab8f60823d9a99e889629eef2bd1d0f1f5140a3f3f6500f15baf78e357ba7bc248ab9543cb93c6915f670b0c43282b2ed64b86e366e95edbc7b76e7d7212ed5
TLSH
T1D4810AB6125242A4FB9005B1A9FB9AD2F071E8FEF5BF0F5E8150487E4D30393451972A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c4994578f51a40fa53746b1399f901c36f0836c126c6ba60977d02115e5502df
MD5 6d7e5aa1e3572bb9bbd117ae1a691411
SHA1 e2645c70bfabc9cee5bbc65702a8b6fdca29e3a8
SHA512 ea4a9c51b683c661c6b4eebb66e75efe75f7e7dd77db5de04e722bf698498496e8306d47c574e58f7f3f86aad1e1c55b919bbad29fca959a1f320ce456924e89
TLSH
T1EA218EF383E185AED91156F09A28BE2BCE2D0506421C7D6986E0FF27D3E3075E102E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 55447b03eab52a62aac56f9e9e9150c64ad0804d4fe10a3fca9506ccc5ffbfb2
MD5 58821d60439672c08aee51572e0d58b9
SHA1 3bb067bbfc520bf8745ac032e2ca7d3a86ad1a60
SHA512 15e46c7e4c39390694d69ad0c6ef39027a82d6662c10e50b2d082ba34ee74a7e4feb679037185db6cace5338e5b47c732709f3b4f79153893c237f968cadfe57
TLSH
T1AF218EF383D5856ED91156F06A28BE2BCE1D0501435C7C5986E4FF5BA3E3465E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 0f374f80807fac09f7c4f29a295dd0b83b4635555c77df1e939ad0acb4e4f236
MD5 f2b4e9058ce92a2842468ee0aa69e1e1
SHA1 6370f2d86c4d1538d60a42fcd7e266bf13baf78a
SHA512 e5d1ebfb64d64a4c8711f67ea919bd21e1c94c65dd5797c5d92d53a0f1fda5322103579155fd44e77cf4cdd7fb77a0661eee97a60859436862a23fb84c2a7200
TLSH
T1ED115BB3C7D5856E890116F06A24AE2BCE1D050643587C1985D4FF6B93E3465D10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 517687af72222a6f741bb1d55c2c0b5bf0379c17b29a72785a03a758fa254393
MD5 e97dd99f07591d9d4fa3eb12e7fe88b8
SHA1 2b6f2fb11e5f501529bb54aebd8642eafc21668e
SHA512 e519e53269b0e2568215172e6024def8982553e7a02116802c047cc16a1b5954caf91917251f48e1d944bffd6b0d465812ea17a67bc010d50aa97d9f26f992ca
SSDEEP 192:sxZyRNyM/jK1Ml8UQGEki/fksuICItVIIdp/FpHW6+WN+B2XYvjmjifIg5yJ:sxZy3qGfi/fksuIRxfHb7XBkY
TLSH
T15C52D8126A34997BCCDBD20DF951BF93D6F5047297940E48AAFCDA1C04E6ADC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 dcbbe2c08c3f66e74c3c9dd91d3ccdfcaeceb6a1995d382baeea62f443938aff
MD5 7e8802efa63930b83f90f5f81c4e9a27
SHA1 1bcb4cb409d8677ff1471bbcc777282e4a16f104
SHA512 c253df2a583e904f81c7513b897819b62c7d14f35f9353613b3ef78c14bb8187df39c9cb620f7a34616210a34a3bedd6b0cc7b00902387e8b9b80142f4ca65e8
SSDEEP 192:sxZyRNyMqZjK1Ml8UQGEki/fksuICItVIIdp/FpHW6+WN+B2XYvjmjiEIg5yJ:sxZy6qGfi/fksuIRxfHb7XBfY
TLSH
T14652E8126A34997BCCDBD21DFA51BF93D6F5046297940E44AAFCCA1C04E6BDC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6568e179d23eaf45acf1645e21cad0869d7a8b8fe62e19602f357efbcb2b0f2d
MD5 43bed4b8623c29d8a8f6c28baacbaa5e
SHA1 0db37c65387911eb2bcab1679b871c5d8d75d36d
SHA512 6d508ada728029a4ee48c732b5c28c112fde61a5ddf24f29d4636939f16c084347c04dae50cd3c6f19c8be2f51ba319e6f0641315fa69db383291fcd289b453e
SSDEEP 192:sxZyRNyM/jK1Ml8Mki/fks/IC9tVIIdpZFpHW6+WN+qg/Yv/bjifIgrJ:sxZy3Mi/fks/Igx1HbQ/ik9
TLSH
T11552EA126A34997BCCDBD20DF951BF93D6F51462A7940D44AEFCDA1C04E6ADC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9f101002e9a82d68b9430bc7045cb8c886e57c66b9e8b7261e5a136ad19b5254
MD5 8d51265bbb90f42f5acd7804a642eb34
SHA1 26ef8e5d9b7899026124e4222a01d4997fedfcab
SHA512 2f47054e01d1fbd02060c06d7685a97bcf3f0030405dd17b436bf19634a940e173ced5948e1ad31aaf70eb78189fd1e945891d3c16f68b952b2c59470ccfb1af
SSDEEP 768:pi61seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pp6Wroa1:pi61seJ3xWvhfynu1jaVcL88p6tQ
TLSH
T1C9D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\temp-index
Size 1KB
SHA256 796417e480f3576a03b69b5843eb3888098db095a9dfbf979e70ce715a096e45
MD5 f065d5da5bc18ba018d860b05b0429c6
SHA1 8644d06b88ea40d92bf55cc7ee3bf445e11d0c5b
SHA512 399656e57afd362f5c65e1ebb4ca053e52bb82d885339e8c35990669bc2555be9a940f919a663cb7e4caae11e47f06f77a980d185cadf1314258f3ae5233c4a1
TLSH
T13331868C8E90595FE85945B711B2B4E033B0C8DC072563635C3C36352D373492A4B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfd92.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cfd92.TMP
Size 1KB
SHA256 ce734fd3b7538bbde6ce4ea3f79d1945a1ab2f4961ed9b282c9ff2089a9755aa
MD5 3fa7a56e1dc340434b5f53873c0317d0
SHA1 b8c456798fa80c87ac8d265b945bc780218fdaf9
SHA512 b44de8f723bbe609c8933b51f7c26c61ed694948d24f1d4d1d2c95ddb66f5017dfa02189ec104bd4339d7dc3482a3b67fa4f89d91036615d7b3f7d7702c2d381
TLSH
T1953135894A919A0BF88041B70A93B4F87330C9005322B7D3A97C26395D31B8D5F4F1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0676a2e0bdc14b9cfdcaeeec42df96a66f3c2fa719eb26ae0f989dac44ac368c
MD5 305ef093eb6232dd64312c2986bb6d40
SHA1 abd3f55d12c9e0c5cda7a29a4f7529c709802cf0
SHA512 f2b01dbbc4714a8a497ed0a1d37e435768f24ac37bcdc417925c19e6de6b2df4314128bf0a56900c86f2dd16b42ab7881a3c64902d6acdb6a2da251e5c81295b
TLSH
T142E068762DD72850BEAFC3D120308090064A7899E941BC0E551AF68310B23153096C25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 118d8b93460d0751d382c8af74812fa7701ac13a5e94b3d5f39be447980145b2
MD5 bc25bdc98ea8b4e69c2a8b6738a34fdd
SHA1 edb64c85738a32c94d72d1517515a6b93ed9a05d
SHA512 19458c1f38ea5c56c7228d166d145fd25940ccdcec4079653efb67c758f5e97a293e0fa5936143c83d715cc6ed63de08a9d70d969916d475e5c4bedb9f18dddf
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1E4:KYHIhKggkXyBOIHKnq0jy9TINK4UIK
TLSH
T153910D42343F130329BD2948A7A19E368E4171A37468A5BE7BB840A64E27E160DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 399bb3c86f3f5ef4125cd37b4aa6a74fb9bd8d7ddc6b63665c8aa4a8556647af
MD5 15eec48adde4aded30cbfef42c6eb967
SHA1 ac08ee00c22f9509e4a9a8004872a44dfaaf6c67
SHA512 ddddb98334ad849e8f8fadc691697ce917bb81abb1305c591dc70337d32fcef0b5f72e1ab5f8877b59079e2c8a63b522c80be77f51133958915a64893124b35a
SSDEEP 192:u1WTSNWMsnMcPPQLz3XX9VoAhzsNdh83QpKluM7xL8QmiU1CXqX4MTKcCOxk68vH:/tNn/s3n9SOzsNdCyCD75MOFxOxSfgAf
TLSH
T14892F8F258E7583AD9AE5343B37E2E061EBCC16776841A44B7D82B1CCC8627FD306516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 63a958bdb68020fb05c7893d89a09788e7427a0756a4dccb0f53993da5b3b456
MD5 9fc96803f0a395f548d552d50c2e8e82
SHA1 28f22bc72b123ae779e98c403e9eb2b059c3bdac
SHA512 6ecb019f2ba9fae4a317cd47157e9ef67a735598724ff471e7796bdc4760e74ee0b0f5473f78a78037b9f1f8ab79ad3fe3f5b0a455b1407ea81fd5d8b80aed72
SSDEEP 192:ugTSNWMsnMcPPQLz3XX9VofsNdh83QpKluM7xL8QmiU1AXqX4MTKcCOxku8z1fcg:ZtNn/s3n9SfsNdCyCD75MIFxOxUfgAf
TLSH
T1B0625B76AC259C6F99E2A545F14B33171FB441AB97C82F44EADC7F1D00DB2AC130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d90bdb1ef291a6d2f038a2c3a687c67537346ec26c39667fa7c9cca780ebb9c7
MD5 adea5f9a530227018b3aba7aeb32057a
SHA1 ded7c60ba637b5f53f2aa9487db4ae34c7f261a2
SHA512 578ff148e2ca6a816c8366a24746aa52ea07f3be7e936dbbde484ae8eb6ade5decbb277449659aef28563f78c5c978c219f20b985f3fbd13be8501af3e309d81
SSDEEP 192:lONx6vMtPQmiUyABThTKcCOxV84717U/u:lONx6UtRBTSOx1hU/u
TLSH
T14102F935FC785C7BEAA3AD46F48A231B1FB451BFA5945B50EAE82F1C00D725C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 8fd2efb951fa0d2838ea86ce9925780ec10b830f9ebd4c9b0b2147be80e15fbc
MD5 8d8a4ad557111ac4c0c1e66af6767a9f
SHA1 9523048ba8b90318beb08923c8338b8de9a189f6
SHA512 58eb0fa632f04f2abd6c7c572121c9a0ec5c68d640751c03741303cbff7dc6b22fe596d5be8ccd0eacbcdeabcf4e108d7c8980a19a8936b572f698e979b4ada8
SSDEEP 192:uiTSNWMsnMcPPQLz3XX9VofsNdw83QpKluM7xL8QmiU1AXqX4MTKcCOxku8z1fcg:ftNn/s3n9SfsNd3yCD75MIFxOxUfgAf
TLSH
T136625B76AC259C6F9DE2A545F14B33171FB441AB97C42F44EADC7F1D00DA2AC130BA26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7f5a181102417935069f45fd225e08924dba2ada6b52b409bbabc2443824408f
MD5 a65f028338c0c51a75ffb3237a91f3e9
SHA1 81424ff86e055fa09e275b2857c2d1a3f21491fe
SHA512 7653985597c177c9d41b43557909a214ff13d9362837396cd24172f7f187365ad263f832af872b4744ef9cecb925a88546d035420c950893ef73f831ff147997
SSDEEP 192:EON46vMZPQmiUytBq4hTKcCOxk/80IfcqeU/u:EON46UZRC3SOxPfgU/u
TLSH
T17B12FA76BC659C6FADA3B541F08A32171EB4816BDA88AF50EADC3F1C01DF15C1707926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2bd7b50b17af2cb83d8a1883d226c2ee11791566172696cd55e931825aa84502
MD5 22cf7bee1ef28afa482b881db92235bb
SHA1 9dada0b10761958daa5bfd13b5790bd619656af6
SHA512 3755d19c6f7d0e7776f9937170ca88903bdab4d0fad4f63fbc9e8cced184f3d73ef05c5d929d2d9b86247b80d70acfd5cdbbac846f666a8c966abf07fd51efcf
TLSH
T15B41EB99A6EA1108B3777F5A9BF6686E487BB8372E06D45E10010D4F0A76B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download