hxxps://968963[.]help/gls-group/cz

Resubmissions

25/07/2026, 14:48

260725-r6yq7ay1hz3

18/07/2026, 12:05

18/07/2026, 12:05

18/07/2026, 12:00

18/07/2026, 11:43

18/07/2026, 11:39

18/07/2026, 11:37

Analysis

user interaction
yes
max time kernel
210s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 12:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://968963.help/gls-group/cz
Sample260718-n9mljsd13s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4720	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288499632461274"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FBAB1721-0421-49D2-89C3-E256030492C2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4092	4708	msedge.exe	85
PID 4708 wrote to memory of 4720	4708	msedge.exe	86
PID 4708 wrote to memory of 4360	4708	msedge.exe	87
PID 4708 wrote to memory of 4360	4708	msedge.exe	87
PID 4708 wrote to memory of 4360	4708	msedge.exe	87
PID 4708 wrote to memory of 4376	4708	msedge.exe	88
PID 4708 wrote to memory of 4376	4708	msedge.exe	88
PID 4708 wrote to memory of 3724	4708	msedge.exe	89
PID 4708 wrote to memory of 3724	4708	msedge.exe	89
PID 4708 wrote to memory of 3724	4708	msedge.exe	89
PID 4708 wrote to memory of 3128	4708	msedge.exe	90
PID 4708 wrote to memory of 3128	4708	msedge.exe	90
PID 4708 wrote to memory of 3128	4708	msedge.exe	90
PID 4708 wrote to memory of 3252	4708	msedge.exe	92
PID 4708 wrote to memory of 3252	4708	msedge.exe	92
PID 4708 wrote to memory of 3252	4708	msedge.exe	92
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 3188	4708	msedge.exe	93
PID 4708 wrote to memory of 3496	4708	msedge.exe	97
PID 4708 wrote to memory of 2640	4708	msedge.exe	98
PID 4708 wrote to memory of 3496	4708	msedge.exe	97
PID 4708 wrote to memory of 2640	4708	msedge.exe	98
PID 4708 wrote to memory of 468	4708	msedge.exe	101
PID 4708 wrote to memory of 864	4708	msedge.exe	115
PID 4708 wrote to memory of 2264	4708	msedge.exe	116
PID 4708 wrote to memory of 3220	4708	msedge.exe	117
PID 4708 wrote to memory of 2076	4708	msedge.exe	122
PID 4708 wrote to memory of 2076	4708	msedge.exe	122
PID 4708 wrote to memory of 2076	4708	msedge.exe	122
PID 4708 wrote to memory of 4172	4708	msedge.exe	123
PID 4708 wrote to memory of 4172	4708	msedge.exe	123
PID 4708 wrote to memory of 1772	4708	msedge.exe	124
PID 4708 wrote to memory of 1772	4708	msedge.exe	124
PID 4708 wrote to memory of 1772	4708	msedge.exe	124
PID 4708 wrote to memory of 3744	4708	msedge.exe	125
PID 4708 wrote to memory of 3744	4708	msedge.exe	125
PID 4708 wrote to memory of 3744	4708	msedge.exe	125
PID 4708 wrote to memory of 3216	4708	msedge.exe	126
PID 4708 wrote to memory of 3216	4708	msedge.exe	126
PID 4708 wrote to memory of 3216	4708	msedge.exe	126
PID 4708 wrote to memory of 4328	4708	msedge.exe	128
PID 4708 wrote to memory of 4328	4708	msedge.exe	128
PID 4708 wrote to memory of 4428	4708	msedge.exe	130
PID 4708 wrote to memory of 3184	4708	msedge.exe	131
PID 4708 wrote to memory of 3184	4708	msedge.exe	131
PID 4708 wrote to memory of 4964	4708	msedge.exe	132
PID 4708 wrote to memory of 4964	4708	msedge.exe	132
PID 4708 wrote to memory of 4964	4708	msedge.exe	132
PID 4708 wrote to memory of 888	4708	msedge.exe	133
PID 4708 wrote to memory of 888	4708	msedge.exe	133
PID 4708 wrote to memory of 888	4708	msedge.exe	133
PID 4708 wrote to memory of 1740	4708	msedge.exe	134
PID 4708 wrote to memory of 1740	4708	msedge.exe	134
PID 4708 wrote to memory of 1544	4708	msedge.exe	135
PID 4708 wrote to memory of 1544	4708	msedge.exe	135
PID 4708 wrote to memory of 3836	4708	msedge.exe	136
PID 4708 wrote to memory of 3836	4708	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://968963.help/gls-group/cz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffad220c188,0x7ffad220c194,0x7ffad220c1a0
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,10078024703611093970,5368158229719814578,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,8880035990527058866,8100315783861126429,262144 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,54931954017948320,8255399025465442683,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16062079844526059855,13336866487903412000,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,6441332266252765503,12728910028458919959,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,14641113768780378987,12680799484928388677,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,152667197158381869,7612226352622011681,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,10475841156600721022,431211914988102879,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,5558437457359850771,13491857218958804677,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4855189944392341064,16995368247972018209,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4855189944392341064,16995368247972018209,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,14071279575350626188,8334419713519457785,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,6521293984579549261,7122949072455182619,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,12299194578428231678,17711202910493924634,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6332,i,2347731787983695426,13078846244241427378,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3778570179565924177,18293898114464456805,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6656,i,8930875219429804690,12743108761566716509,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5388,i,16944845206827626806,12913273344549802780,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6884,i,10087211110731959662,9082080181078025595,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,14744503941958950230,1539601645998560012,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,16037462764720678206,1599531521315925853,262144 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,4165068454782802894,14978442971298432271,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6156,i,4045889524768336121,8395815611994590112,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3696,i,17959770919324814952,11034229307209034482,2097152 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,3485405304378144403,4362780166650960415,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,18418995296093752498,4280175195284173582,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7192,i,15006844212647622131,884391764611096625,524288 --field-trial-handle=2284,i,8403942912041109176,7569457819309792662,262144 --variations-seed-version --mojo-platform-channel-handle=7196 /prefetch:8
  2⤵
  PID:3836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b7f070a4d3175a30ab1f73e5c86d8af917125a0b9ba72da395511cdb1d406c6
MD5 bc3e311326d2799984bcb4de5723ee07
SHA1 2c2dfb72259a6daa964eb7a402ee00bfd5f5217a
SHA512 6c40c35ca92f726c413299822798ea8c4de22875c9fdbcb3c3186bfb1444faf40cb63b86b40b1a70191e14627bc482df4bf291d36b77367e2aac76d3c7e3f85e
TLSH
T1DBD0A720BE24A896D23A21B255204700AE5454A321668185A124481CCCBD885DA96796
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 9fb86a7fec6933e2e7a98fbe36c4a8e779818aeec17a78cf87286f96ec04ac83
MD5 35ac1f833c6b6afa685578c694872c64
SHA1 eca2a1da4066f613912379f0fb129471e5059078
SHA512 9645c9c41b7e63ccd071fbc3175d9bb214bd8fd45f0bb9d289934b9d8e48b409ddb7d4e473081cb419eb3633ebd6f541ae911bd24d7ff8dc1b6e56b98feb58c5
SSDEEP 96:aTyYBYyXkmfIuZVpQVjfr6nBhNohC47O+PlwD02g/y1f11:aTyYBYtmfIaVgjfrewC47Owlq0f/+f11
TLSH
T14802C5BC59C22232DF24933A91F868F832BF86F6F6172F5B4050553B25073EDE6104A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 e1c91f732c799af93c013a25744ef20ced4b5adc67b9b2de238652715a3973e9
MD5 d2ba51febfd186fd7d535e9bca71568f
SHA1 bc36507dea950ee24f9e8bfb5e862febaac9cdcc
SHA512 30c911ef385c2af4e2bbd952765f13d7f4af7e6332848ef243bc277389375c1fef76d31fb99c201ecd7b91b57ea5b660f6943da0a5e0e9e62b6558d62a60060b
SSDEEP 96:LdhynBY2Xn9IuZmiQcjDhknBhN0hnZ7O+PlwE12g/VfB:LdhynBYQ9IamyjDhkMnZ7Owlt1f/VfB
TLSH
T1B6F184BC59D22232DF18933A41F869F832BF86F6F6172E4B5050453F64073EDE6514A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c32fd989819c591ea724bdf308db3decdbe98a7649bea733ddccb01ad263c769
MD5 c6878329dba8a7a7f3fcc004ded7d32a
SHA1 8a880c92e7cc44ed679a1901eb568dec2e42026f
SHA512 8b2fedf7c67cebeeb046ad0e5717e680da9cb1cd2ec23d0d478925b7780ed95ff21391d15276a60399e7719b47001a69ecb12625101906020555edb1b00c900f
TLSH
T12A71C5710A9322B1EF14C23294DD025D3677C6F7FA1B6E8990809533761231EF3549AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5874cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5874cd.TMP
Size 3KB
SHA256 33693cafc29ae2a6bde6b39d729c959f11f61987c0c1578d809bc47be795806d
MD5 735f73041b6f9a6cfd022f0aa5cdf6b8
SHA1 8e5761e07b147bdf7462d2d6ccb178714aa408c3
SHA512 c7bded9a2854edbd101de1d0bd2eb57de641783ba7b5fc55ef3c64def45e47231d2a12c24893f87b5a6613a99e6938ee532229e1cbd2b4cb12f1c830a6c91cfa
TLSH
T14261A5750A9312B1EF14C63294DD025D3777C6F7FA1B6E8A90805633B61231EF3259AD
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DawnGraphiteCache\data_1
Size 264KB
SHA256 f7e61393bbf196d0fcd537011e3a36ad73a3acbae63a772656ee22689bd0be1b
MD5 d3e60be8fc4919d07c5d34bcd8f17cc5
SHA1 29cbcabc87641f84540839ddc9e23d249fd71307
SHA512 1764abdbddc45528604e0074ae8964da7b9821924884ea4b9e6e3b27cead4209232722de01c366ac96f2d2ef3dd4b3e22b6afec1836f45097ee3dc1d0d43dde9
SSDEEP 3:MsEllllkEthXllkl2zEL7XK/t:/M/xT02z0K1
TLSH
T1484404057FD00407C5011034C05FC3701374D4100513D7433D7154735CC57405C00000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a99f475016bf5bb2a225e31372fcf7d3a84365e92a68aca3f78bb3d8cc6fe8c6
MD5 7ac1408ae48c9afdf8ab5b13d64ebecc
SHA1 369e4fd2b3d0964c4900f658ad5cc3b5a9bfb34f
SHA512 d8cbd0f8611a6af3c2f2d57cbac9575b641947661f3a85d16ea19a753cc778a483ecc3e465f0f9f2c2ab5b3299df9d158a4dac4541770928b6120c7ce5f69325
TLSH
T1EF518DF7C7E5825DD81516F0AA24BE1FCE1D0D55832C3C1AC5E4AF1BA3E2471E242A9E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 b88348185f10dde0e63cc9f7a3d91aa5f4c031f3fc9ecafe6073de4e4957cb71
MD5 b133b5cd95e9a61ed5f6152dc3b26806
SHA1 1091c7affe75bf3f0cc9b0d871353343846fdc8d
SHA512 54b981aa3967ffc8ee130b2d7438608e8d74dec092f5337666343d3d9e8bb85350637f5aacf24aa03a5ddb899957ec75e7a66f86648fadde6fea7229ba9d5a1c
SSDEEP 192:DiFi875cQ7dJsxJDSeTGSX2GDtIcBmGtkvj44LL7cGRqzlU1SqGiyVT/WXWO5sax:DiFi875cQ7rsfDSeTGSX2GDtIcBmGtkT
TLSH
T18822ACF7C7E5862DDC2152F1AA147E2BCE1D096443293C1ACDE8AF4BA3E3471E14169E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 d64cef05ce2e6331840cb2ce543a46739f04dbe0ae6f8941a663a99717eb95fc
MD5 ce0cdd7bc3c6e3cdc3e7d93dfdeba3dd
SHA1 25a2926da35b5d40246fc95501335d799b5879d5
SHA512 998293a6cec7a4248f22638663afb7dcd2f652761eb5c4dfda659b69e5a44acac10c5a15cbd8f0632ef7a3773f4c2f8c252bd4caf6a6fb0de0b6a5f0b2defaf3
SSDEEP 96:D7Ou6i875cNzBuGT2EXvwBtIcBmGtt4u3:DiFi875cN152GvMtIcBmGtt42
TLSH
T1AF919CF7C3E5822DD81116F1AA14BE1BCE1D095583283D1AC5E4AF4FA3F2471E252B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 12811614d7dc0a4487f221a2229ad4c0707a5ba0447aa4fb6949cd396fb95a8c
MD5 7d0c15031a223924b13b77f6676b1e88
SHA1 ad5903f54cd22d5a7382d1b9cf83a01a56f24c63
SHA512 2fd5645ab16d602517338c3f1f0f8d6f644d3225de18a44c4d4a3741237d9cf6b14f7d98fa73b7e925646289a79717479f6ab4c2228c7d46d4976499f2bb5c78
TLSH
T10FD022631A0070BAA5BD7E8680BAFD8FC32710703803DED620D8B9AC1631CAC950B195
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe593ea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe593ea5.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d4df131d057e43702072a666becbb56a2eafc6ce7bab4732ab60668b1077a102
MD5 a613b02e31d3d7e22f99dbcc06f6f2d2
SHA1 b086e649f942b47972ff0e0be555068c0ada77c9
SHA512 4a239ebecb6f67c3269bb4fc4a8c130e3105d16e0d2ff3280e767b74df2e2e8459cc2cc1b460fe99f03230287656b1d02ed16cbb5d89782cd838144419766985
SSDEEP 192:sxZ41RlyM/jK1Ml8Mk7/fXsyeoVrd7VVIdprPHW6+WNwQo/Yv9AjG+2KIgrJ:sxZ413M7/fXsyeo7YTHbQ/BGg9
TLSH
T1B542D7126A349977CCDBD209FA51BF93D6F51473A3940E44AAFCCA0C04E6AED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 c6487e38540ae9988167ea8e4316792960e3a1eb474151108783414d973551a6
MD5 742a21ddacfeb5b2853b65a00fa74439
SHA1 e1ac106828b0f6240b7abc09fa8bf24cef1dd5a8
SHA512 724f70132c06d9b3ff09a2bb4297563bb64b3b449148ab3f86dd0ba40028daae5b665737a4de193ac9fd1f826c20b17457a38f9266347fad94fe232f7e8bbef6
SSDEEP 384:sxZ4kSqfm17/fXs9eoZ6d8Hby6/HGgESKv:sx9fm17/foZZTHbrHG77v
TLSH
T16E82E753A52089778DD6C209BD65BF53D6F51473DB901E98AAFCCA0C04E66ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 77c3428f56006e211c4bc990b7f1aacb2fd4bb5c5228f410a0e38e5747a9a6b3
MD5 52d03fd36f242fbd98e185397bc09bcb
SHA1 1b5e69463cf49f4ace2c8440ee1f907618651fbc
SHA512 53e66e39d6ad18ed76322f77f5471046227ced2e8f8a1ee0312b2042d97a8bba0bcc7351e8ef54240b326d590ca68d897a0206750fcd378165d5d0636bb29621
SSDEEP 384:sxZ41Sqfm17/fXs9eo37dOHbtQ/2GgCKv:si9fm17/foZ3IHbY2Guv
TLSH
T1BB72E753A62089778CDBD209BD217F53D6F51473DB951E48AAFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b6f1125c7c8369365b996f61a4aea87ce1daccd43ac424f465b73e62b35419d7
MD5 e8ab71eff4747cb2b7418efd5f28f5b7
SHA1 d8ad7bd3a9c4b74da7d8107f5de143d513a5587f
SHA512 21352527c391945a5315e427c288caa9d5393463dd588f8897b4431f27d7a165b28e5662b2c9d4ca8728058e3becb06908c115dcbac4dc81c7e56f15a0127903
SSDEEP 192:sxZ41RlyMojK1Ml8M0cB17/fXs9eoVPdpVNdpTYy6HW6+WNwRG5XM/YvDBojG+2Y:sxZ41Ssm17/fXs9eo39sHbdO/NGgCKv
TLSH
T1ED62E852A6248977CCDAD208BD617F53D6F50463DB951E48AAFCCA0C00EA6ED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 70fff8d5de3416c391e26f289cdadea49dbd82975e5ecd0dba035d3650de5349
MD5 ee51c304942a88c43176c723047f9164
SHA1 97fee4cea0b3602682c35f78d378ad886d402e19
SHA512 ae4574a997761412e1c277c4ffa5756e950eaa37dbe57b0f156fd1af7c98730d1c1b2a2a8f32129fac04086eeca0999388d068bc2656ed5f0d60bcc278e5bca7
SSDEEP 384:sxZ4USqfm17/fXs9eoZ7d6AHbyPc/8GgERKv:sp9fm17/foZZxHb/8G7kv
TLSH
T1DB82E853A52089778DDBC109BD25BF53D6F51473DB901E98AAFCCA0C04E66ED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 915307e1fa4ac612ea23c70ed1aa7dc0d29c7327a3cde8ac259840866e693bf6
MD5 3d47efca322608af51ce59f5481390bf
SHA1 eda0ac3190055f5fe97d9877345a3c64d0ac92b0
SHA512 f88820d033af39f02e4bf54d2c1cbc69548fba2819c994ee0a3629ca93a71765cd698525defc20733cad588162fc600c799cd70bef3329d5f31b7265774dc7f0
SSDEEP 384:sxZ4USqKm17/fXsXWvaeoZzd6AHb4Pwic/DG3WRKv:sp9Km17/fwYaZZZHbZDGmkv
TLSH
T1EE92E753A92049BB8DD6C109FD25BF52D6F91463DB945E48AEFCCE0C04E66ED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f00be2e6c4e2642b0f67f100cbe46d754cbc3e7239747a7c98231ce131aadd9b
MD5 f54bb72fb013d6acb95d62d538740f09
SHA1 8596d9960eddd0e104d9bb3e49c0d99927904daf
SHA512 e3586d52d3940e3a6c91db6b4ea5867e84b4ba0f84527908102786d6bf23294b02b3f212265043e827753d3719d84bf7105aa184e3ee7cb0aaa0f42cd72cc7e9
SSDEEP 192:sxZ41RlyMojK1Ml8Mk7/fXs9eoVPd7VVIdprPHW6+WNwTcdYvMsBojG+2KIg5RJ:sxZ41SM7/fXs9eo3YTHbldr1Ggt
TLSH
T17852E913AA345977CCDBD209FA51BF93D6F51472A3901E44AAFCCA0C04E6AED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5d6d34217c500cf31dfc39b5a871b4c60305b030eea1901eac783043c2980cd7
MD5 6276cab6968387476151495a57e369b8
SHA1 7ecc162e4b9b2880d4e0d248f33e4eae03ed0de9
SHA512 bf6538493c3df7a9901a5db7b4321ce84a057c9376bd62258794bc89f0831ec87cc1fbccfab098319a743694b6dcf1bffa41c1f6e5016cd0b8684fa6f1b94754
SSDEEP 768:kOseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppTro1x:kOseJ3xWvhfynu1jaVcL88pgj
TLSH
T1BFD20B2B280CCB7E4F844E6DEC266F966EE801CB67984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 2c36ee7eadf9a1e1a7f37596697b6a10e8a7a30ae75bece7636542116f46d492
MD5 bcf7c67bb115886e898c057a54933e67
SHA1 0991240166c9f537a5ad12281db248ada610c10d
SHA512 8bb2f4637e452cac0eac27907fc8dde7fce05f69309af005cf851094814a5d0b5501540fe14b2da928ffbb02ff63f2b83d09bc0541ffd015a82582df63bf1f7e
TLSH
T1C931338E8E41999BD9E884B2157674E833F0C9CC1B11A2534C7C763A3C6635A6A4F0CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 2KB
SHA256 6d301258f47e924c2e4406aae9c521d9f52c7228e4f9120893a3635216e4f94f
MD5 059753bf7814781866aee6d15bc14f38
SHA1 84377cb423073b5c5348719d238b856ee0bd0e68
SHA512 e2ffb5251aab3a70f1d181e54f7a23fb8956d58c96046d671d429d0c811bf134156c53578ea8340b0a030fe0471d5018b50c10e7e287b8a58d8ecd41b1dda306
TLSH
T12551AA4E4C8B6B66CD2C10B329F71DC1373534EE59888B1754ACA935ACC33287D6D558
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5936c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5936c6.TMP
Size 1KB
SHA256 b4395a9a8e28f661d659b6aece0ec4c5281df499008f67c4b6d4c9a1fa6cfe67
MD5 75d37bd0944916b07233285a1e0faccb
SHA1 fe7c4d5cfa5bcb8ec04d08f467e81cef469b4621
SHA512 106a115ac3ad4e3ef167ea27d63d750afeaec01c8b2e9bf0f296a47932256ad8a5cacbeffa6a57affab7ee2b7bcced11a0eacc2ef4c8711b9cdca0ec586d932b
TLSH
T19E31428B4B81991FE8E440720596A4B83375C94053227783987D673A7C757AD6E5F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fc379579d86d5a3b5f13ba78e6787e84b5af4c52611cd66e9f1529cd1cc9cbc9
MD5 7a78b80e87c279331fba6b51beb09d18
SHA1 eb8eaf1e6e7620674ffd58842baabd4b2715a9be
SHA512 57c8bd1a73e628a38e0fbff9aea9945142a119f1936cc536ee108e35508667348788d08eeb11df34f2b3b09e7e0f34edd2e1b4e639860fbc82b21ce1599f53c3
TLSH
T1D8E0C0B62DD32810BEAFC3D124308090060A749DE901FC0E941BF6C310B235530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 ba942780ae4fb38b3b91623b6846cc31eaf64f2ac2d7889d184e761c6517deef
MD5 6b907b00dda8671aa86a67807a8eaaae
SHA1 839d5e4d7409b8b1b13fdd534e8e5ca83fc5cd59
SHA512 cd06b55f41cf16b24c1e1f148a79947f4f41d1488cb8e07818590039480f895ac73e720903c0bf1899f1f44c2f6aba659e82b02baa4b72b8253da9177961ce55
TLSH
T196A002199D55D0C7D0C00270B0A1068837D688DE070D22B5C2BE045A8C5C38141F2204
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598e5b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe598e5b.TMP
Size 48B
SHA256 40d04cb3a699bebf8586a991978009f0a8d02b345a8afd96cbb4eec1458e3af5
MD5 7ffa703d85b33397e0317893690f8368
SHA1 d6518afd988c8ea315bf8d1ab46d07224d56983c
SHA512 c33fa29d3de5ad9ed44d19e52e16e28bcf64856cc26243373b276153516a02805420de7a41ef05d671a2ddfe22f04a8386fbee254482fd141055894af6fddffb
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a0a011862115bc3dd08ef558461677e022476590577121e329f707dac601739d
MD5 a6262c2fe34f46fd69d39d55bc978588
SHA1 b4b1b658b3c5cfe045b6ae3128d4a1b0c9fbf275
SHA512 0704a8a559e7d72c227ad754be9197048031642502779ec428b4d3486f2c88cfb3ec83dc192a55adc6344727b4668703491c08bcfbf99fe89f4a901f45e37baf
SSDEEP 48:KYHIhKggkXySdIxK+cMjyxkIrKha8Lyhz:KYH+KggmBd+K+ciSkoKhaKiz
TLSH
T1A3917E16B93A03053C7D694CB291DA76AE8270B33458A4AE7FB904511F67E120EBDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 69588a7f8dfc896fea8359e5f67806b126e130eff8d08c878df242a1624cc6d4
MD5 b6f2c2a158ea5893d8d3391f3f5d25cc
SHA1 0e6386cff813e3bfa5810770fb5c4d75a9a5dd8d
SHA512 a6774d23954c0b29ef0fc0f383a18d88958648984344b068ee1c37d1d51baeb571b83064cd5664a89f3e2b859179e82c72629e6d99ecb7aa58786fb55cade1c0
SSDEEP 384:CtNn/s3n9SfsNAUhuBjw79UywzFIKPlb8aT:Cj+9UXUVSFxlb8aT
TLSH
T1B4625C736C249C6BACA7A594F54A32075FF8417BA2C46E54E6DC3F1C00DA26C530BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 dfdc8c5aeb9298f49feaac908a5efee6080b5441cc2035321c61ecb64d0fca97
MD5 1435bdbf68ed58f52a31c43d0b85cb5c
SHA1 f4ff5c36fdaf826d8a8c56b331ce7e7d49ab92cd
SHA512 ee9570eafcffa631a90f2cba02339ec66041c27165eb151202d85a91a4ebc2f279a97b2dc270f6cf35a25c22c4ae0e765a58408e48b44184faa42c9f361b34d8
SSDEEP 384:etNn/s3n9SfsNAUwuBjw79UywzFIKPlb8aT:ej+9UIUVSFxlb8aT
TLSH
T1EF625B736C249C6BACA7A594F54A32075FF4416BA3C46E54EADC3F1C00DE26C530BA2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3d879dce37c98f5d03cc942c76b9f33cae6ef3eec24f3498a231d9c38a539d34
MD5 b9f905683b7c7ba683066a60e797965c
SHA1 da149fb4a5039c9981507c7efaec1969b0c91ca1
SHA512 6fdc4d682f09c74915060320ccebce032b4e73bcaffdf7bd60fc9d9f65f68a43294e5a9a2ddc81683a40f9adb62b05e3a3007cb982e1f8723c11311331571d15
SSDEEP 192:lONG6vMtPQmiUyQRThTobWCIKp847aLU/u:lONG6UtR1TiFIKRUU/u
TLSH
T170021976BC685C7BAEA3BE45F48E23171FE4116FA6905B40EAE82F1C00D765C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 212beb76f32022e0f561d4f60ffb2fb0d92514e087dccc856a67c2fb3b7a4dc6
MD5 d78b4b17e88e568df5ef0bfd3827aa4d
SHA1 304923b168429009f25b74a32bd00ccf6fc01a61
SHA512 9777ac7a84c05f84130a1c90d9c966433e77c3172703dac6f2a5576e9fe115ba37fa7292da861a62ba52f2e8527490eaf27d6580b0f340e2a1b6ab04dc9d80b3
SSDEEP 384:K9tNn/s3n9SszsNAUwuBjw79Mth2zFIKPlR8aT:Uj+9XIUYhcFxlR8aT
TLSH
T1E1A2D6F258E75C36D8AE5347A73D2E064EBCC167B2845A44B7D82A0CCCDA17FD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 79603c7fac4710b3f427376332e9ccd09eef9c7c9a29aca2efae7679a30cb043
MD5 f408693e66b8436346b3c536cc86919e
SHA1 d9f457d2ec84d6e5d2f91c36334b3606ec6c5c01
SHA512 a63f002a4cf21753e356c5500d44935b8e3b27c89777e3185c26a24f1feb6f4870b467fa39efe7b02759904f25c6bfc0831ae05238b636e2e9715e5528058cc0
SSDEEP 384:K9tNn/s3n9SstsN5UwuBjw792wczFIKPl18aT:Uj+9p9UX+Fxl18aT
TLSH
T10EA2D6F258E75C36D8AE5347A77D2E024EBCC167B2846A44B7D82A0CCCDA17FD306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 e87a8c9e63c25eb357a58cb74b605e880ffc046d9ac4775f58842f8346a3319d
MD5 4337aca028fab92279814f697f40e496
SHA1 2775d8ca2ce39e6814844bd015da01983da9a90e
SHA512 c41f0f5304b117f5b6d83c17530de43d6e63ce11bb687a7456d0dbdb194be3c9bfc131b2773fd29d68ba19261fec7648d916ced2c920eaf35bbbb142c7ac23ca
SSDEEP 192:fONK6vMZPQmiUytRwhTobWCIK++Wyi/80IXqTU/u:fONK6UZRywiFIKPlx8U/u
TLSH
T159122973BC689C6BADA3B551F48E32135EB4826BE7849B50EADC3F2C01DB56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8c12a1e7615019747a2e121de07bb1b9745e50dfde5d3cd7c18a0448b4a45cc9
MD5 50463c765e0b0eaebc0da29bb77f5a6b
SHA1 cfe7ae5d00650b5085252a29fde17bcb5ba12063
SHA512 399ef5471ab202abf8245be54edcd1f58cd72f66f6268b8031d7d82b24d8e7e9c3eb13026589ac352045527c95d3eb92d6dee46d00c9b38233f368143e9e0530
TLSH
T137E00180D300006BC02C037104C36B203FB1E10003E70B07462102B83C727043E35E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3e550a7d93ba43c26ddbd2d3d26f76035582ad61b2a36387df30340cde0e5755
MD5 773e73e4c194ae59189981340becb4c3
SHA1 b175e4f807649f6a88ab4a352c81d882ce78783a
SHA512 a0a32f580c60440e0a10e19fd5bb99c1b88d143c8e692c319f5a4593df513557ea3fcb630240b26af2d9b4684ac4329fd88014797a2b36fd765ce1aa2911288e
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe591db0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591db0.TMP
Size 392B
SHA256 2073dc0cd0a80571a1c1daeaf9e68d4f0c59136c74dc24e3190817b7ef84ed6e
MD5 6b02f68cbd6ec2e76859ae217f2f2e74
SHA1 f2ff6422e67575d46169d1057dd5bb11d3355d8a
SHA512 e4f6c86fd31854ab83708228b8480f9656e1729ed233123cf0235f6d9ce66a92249a57ae04c7960bf903579f9a9c1377cae648aa4aa3e68288ae440fbaeb31f5
MD5 SHA1 SHA512

Submit Download

cf5a33ea-5b1e-44b7-bfbc-1e7fd151192e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf5a33ea-5b1e-44b7-bfbc-1e7fd151192e.tmp
Size 28KB
SHA256 32c54cee01ed97146336780372468a1dc2e2d9084cca1445cd77d8cd14dad655
MD5 bb3292914716e673de4ac789b8f49b41
SHA1 63910d1d1b86de26eef423ab7f65d1fbbe7e1389
SHA512 5ff73353913693dd23b8b901821fe3263203d393de66cec3e7583f492f665e220f85ca1d9802b2e9ae190ee572f6002b0610f84e0a39683ffc630007afd9786e
SSDEEP 384:KCtNn/s3n9SstsNewZBjw792fczFIKPl1XBPSwDuYnLENQOK+Y4Mk3gaT:Fj+9p2UW+Fxl19SLNzK+Y4Mk3gaT
TLSH
T12CD216E198D74CB6D09D93C7677DAE0229BCD037B5884908B3E86A2CEC8B5BFD316015
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d3258bc5-9bbe-43c0-ab97-e47b2e8d1b68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3258bc5-9bbe-43c0-ab97-e47b2e8d1b68.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a261597b366e9315bbd89dabbda70ab63d8dc2936ca8cd18d53826189975a37
MD5 711602b3171579e1ee3c55fc20c084d6
SHA1 7cdebe5751fafec1368691632ba884e799dbaac7
SHA512 7ba18042c6e80975a9375501c460d9655e4f13ac493577edb5247868f334925e407e0052996914edc216cc0026e9686812709d529a133040a3c400bd4c1b2cc5
TLSH
T12641455CB6EA1148B3777E1A9BF6786D483AB9772E0AD49E00010D4F0A63B40D972B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download