4214e76f9cb398e37b611807cb8ca49cad3f9c0bbbe8a650df7134614f280693

Analysis

user interaction
yes
max time kernel
898s
max time network
797s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/07/2026, 19:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 326KB
Sample260718-yenv8set4s
SHA256 4214e76f9cb398e37b611807cb8ca49cad3f9c0bbbe8a650df7134614f280693
MD5 bcb8ecf00f3b2c0000e3b5b2122c65f5
SHA1 cbcd4fdf310d50ecc71be5244538cea16bd0325c
SHA512 c939935c8156b98b890bd64437321e09986595cb564af51dfc07662e5a8014a66d8b85628966011bf4acd1354cc01bfbc3deb0096d820277a5a390b0b8036c09
SSDEEP 3072:YY1gAkHnjzxQ6KSAiTHHt88aW+LN7jxRLlzglK0f2J/R:ZgAkHnjzxQBSAaN88CN7DB0f2J/R
TLSH
T132643B25E5D2607F682B8033F27F3318B73FA483A101C929BA1CC5D5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
131	4588	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4588	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288773424577456"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{E30055F2-E532-43CA-9513-99B84AF6E319}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3856	7zG.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	3856	7zG.exe
Token: 35	3856	7zG.exe
Token: SeSecurityPrivilege	3856	7zG.exe
Token: SeSecurityPrivilege	3856	7zG.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4188 wrote to memory of 3064	4188	msedge.exe	83
PID 4188 wrote to memory of 3076	4188	msedge.exe	85
PID 4188 wrote to memory of 4588	4188	msedge.exe	86
PID 4188 wrote to memory of 3076	4188	msedge.exe	85
PID 4188 wrote to memory of 3076	4188	msedge.exe	85
PID 4188 wrote to memory of 4864	4188	msedge.exe	87
PID 4188 wrote to memory of 4864	4188	msedge.exe	87
PID 4188 wrote to memory of 2424	4188	msedge.exe	88
PID 4188 wrote to memory of 4836	4188	msedge.exe	89
PID 4188 wrote to memory of 2424	4188	msedge.exe	88
PID 4188 wrote to memory of 2424	4188	msedge.exe	88
PID 4188 wrote to memory of 4836	4188	msedge.exe	89
PID 4188 wrote to memory of 4836	4188	msedge.exe	89
PID 4188 wrote to memory of 4028	4188	msedge.exe	90
PID 4188 wrote to memory of 4028	4188	msedge.exe	90
PID 4188 wrote to memory of 4028	4188	msedge.exe	90
PID 4188 wrote to memory of 2880	4188	msedge.exe	91
PID 4188 wrote to memory of 2880	4188	msedge.exe	91
PID 4188 wrote to memory of 2880	4188	msedge.exe	91
PID 4188 wrote to memory of 4968	4188	msedge.exe	94
PID 4188 wrote to memory of 4968	4188	msedge.exe	94
PID 4188 wrote to memory of 4968	4188	msedge.exe	94
PID 4188 wrote to memory of 648	4188	msedge.exe	95
PID 4188 wrote to memory of 648	4188	msedge.exe	95
PID 4188 wrote to memory of 648	4188	msedge.exe	95
PID 4188 wrote to memory of 2220	4188	msedge.exe	97
PID 4188 wrote to memory of 3196	4188	msedge.exe	98
PID 4188 wrote to memory of 2220	4188	msedge.exe	97
PID 4188 wrote to memory of 3196	4188	msedge.exe	98
PID 4188 wrote to memory of 5016	4188	msedge.exe	100
PID 4188 wrote to memory of 224	4188	msedge.exe	101
PID 4188 wrote to memory of 224	4188	msedge.exe	101
PID 4188 wrote to memory of 224	4188	msedge.exe	101
PID 4188 wrote to memory of 3568	4188	msedge.exe	102
PID 4188 wrote to memory of 3568	4188	msedge.exe	102
PID 4188 wrote to memory of 3568	4188	msedge.exe	102
PID 4188 wrote to memory of 1624	4188	msedge.exe	103
PID 4188 wrote to memory of 920	4188	msedge.exe	104
PID 4188 wrote to memory of 1624	4188	msedge.exe	103
PID 4188 wrote to memory of 920	4188	msedge.exe	104
PID 4188 wrote to memory of 920	4188	msedge.exe	104
PID 4188 wrote to memory of 4956	4188	msedge.exe	105
PID 4188 wrote to memory of 4956	4188	msedge.exe	105
PID 4188 wrote to memory of 4956	4188	msedge.exe	105
PID 4188 wrote to memory of 2080	4188	msedge.exe	109
PID 4188 wrote to memory of 2080	4188	msedge.exe	109
PID 4188 wrote to memory of 2080	4188	msedge.exe	109
PID 4188 wrote to memory of 4248	4188	msedge.exe	120
PID 4188 wrote to memory of 5112	4188	msedge.exe	121
PID 4188 wrote to memory of 3568	4188	msedge.exe	122
PID 4188 wrote to memory of 5112	4188	msedge.exe	125
PID 4188 wrote to memory of 5112	4188	msedge.exe	125
PID 4188 wrote to memory of 380	4188	msedge.exe	127
PID 4188 wrote to memory of 1852	4188	msedge.exe	134
PID 4188 wrote to memory of 3944	4188	msedge.exe	135
PID 4188 wrote to memory of 3944	4188	msedge.exe	135
PID 4188 wrote to memory of 1408	4188	msedge.exe	136
PID 4188 wrote to memory of 1408	4188	msedge.exe	136
PID 4188 wrote to memory of 3116	4188	msedge.exe	137
PID 4188 wrote to memory of 3116	4188	msedge.exe	137
PID 4188 wrote to memory of 2220	4188	msedge.exe	138
PID 4188 wrote to memory of 2220	4188	msedge.exe	138
PID 4188 wrote to memory of 1740	4188	msedge.exe	139
PID 4188 wrote to memory of 1740	4188	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd39b6c188,0x7ffd39b6c194,0x7ffd39b6c1a0
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,1415779274703943564,5407764833701958157,262144 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:2
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8298058538675269880,10100567543346139695,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,4279335577048034492,12948279277632801748,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,524781787689949216,8951212071603118855,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11078177289480387247,11939484660901937749,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8392853992463239062,1721808061848667616,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4172,i,7854440756733595970,4038733534841908572,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5104,i,14961291736313785857,10925450337261773847,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5248,i,8435255742099213063,16199848740808804224,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,6361483675355995937,3853381014587706452,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,5437222825799555561,16907785009034600222,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16997943617886412665,6604402343810173331,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16997943617886412665,6604402343810173331,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6640,i,1483207452464348507,16325399629163971556,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6616,i,15362592317153305329,17411188842189936342,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,7691548887757447555,14034131507186009472,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6752,i,5756999996167410516,13357763780056196745,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:1
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7328,i,892996528990799279,10751308924209898012,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=7356 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7052,i,18072294990692442905,18376338197522521831,2097152 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,2335472836334866309,6100280507237227475,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7848778963422759365,17806605055566246464,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,15787492708176635105,5987720545955370717,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,2240506430300154864,11058400114221637604,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,9509182703768931257,941884729325320150,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6216,i,14189680085889364976,17208303469812291831,262144 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,1047743405506577328,7182501550421099989,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=1056 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,12081373777569080294,9076427285579189522,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6296,i,11654895196230864228,16787620542463427608,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=1860 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,825169264553963997,7628591374229005222,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,11957321141867112868,3425905092195819371,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=3956 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,4672218960565413558,3921341365954894648,524288 --field-trial-handle=3016,i,13123992572841275888,5617012467450605290,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1852

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\UnlockTool-COCOUT-CRACKED\" -spe -an -ai#7zMap25889:112:7zEvent4273
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b7f070a4d3175a30ab1f73e5c86d8af917125a0b9ba72da395511cdb1d406c6
MD5 bc3e311326d2799984bcb4de5723ee07
SHA1 2c2dfb72259a6daa964eb7a402ee00bfd5f5217a
SHA512 6c40c35ca92f726c413299822798ea8c4de22875c9fdbcb3c3186bfb1444faf40cb63b86b40b1a70191e14627bc482df4bf291d36b77367e2aac76d3c7e3f85e
TLSH
T1DBD0A720BE24A896D23A21B255204700AE5454A321668185A124481CCCBD885DA96796
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 dca9556e56f2a5a21b4314bddfaf155623d8714a4e511604da1efccc386bf222
MD5 cf728c7a2a6dfb587c95a5a73e08ffcc
SHA1 4b660f83f62d351f3d3d65994ed73e72231f00df
SHA512 f5ec06ba34897f387a3c5b77b487222c23081908287a8b51fee6512a9f93e7b6068265b561f9cf988b5d9f7df0de3437ce531475d2bd9c7db13662926764512f
TLSH
T198E020C594CCC71E574474874374734DD1B17F0BA6CC6EC51B0084F57006A446BC1574
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4e31f70ff20bff4d56f97861aa473b693cf286bffd0e6332f858728f097c4086
MD5 40bd151f249d9205bf389d42f802c44f
SHA1 ce67395322ea5401dfaeaec90bb3508b957b4d69
SHA512 550c4fead0ca6b1dffff874c3cf8066ac34cbb2d990c0fb80867bc4b3ea5b307c080dd1c97157c00cc02c68851257a21f8a7c9eeceaafde9010ca5759f861d9c
TLSH
T1DEE0788415C9C33D7750A897599C570DB3B13A5AE2C46E497F0484E57305444F3D1572
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd145a61977b4c66213fb42db26d4c81a33e26760dc3ddcca950e3d52685eed7
MD5 bc17cc53a44e7ca0ac25bc3b01bed01a
SHA1 1a14ca368ab7edc8ee933c052dc198bfbc556439
SHA512 54f330f4594e965c6ce8b2a8b8c891f04bf8f50f6ce05175b048dca6b817ce15fe5a5eae90244b0cfdf16c27cc8d1cdc9b8b404aee179735566589ba431d6ba8
TLSH
T1BC71707403410062EBF20171B7E125C9B875A8ECFE2B9E4A316C54F46AB936CE41DD5F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d01d3b6ab46ef200123971468f403986d293f8d6ea9af72054859ba4ff3f644d
MD5 e431cb3b358c77565ea579929fe8c0d7
SHA1 f4ff26e506509438cd93fe927b56756ff617efe1
SHA512 8a88601026393b1c5cfdcc9ba35ddfe78716372d774710dfb5cecbe3c0a1aee769166fba8cb23f1415c4f8d5cbe8651fa5162c99a2b7ec16f1abc05447faace4
SSDEEP 192:D4WXiPRNqoeUimMJ111XZIZmRhZKQAZ+MAyLs7eSERR0St8AOIntQK2iJPGj4v:D4WXiPRNqoeUimo111XZIZmRhZKQAZ+u
TLSH
T1ACD1BEBB83F4477E991192F09B24AE1BCE5D111B432C7C668DF0AE1B63A2171E10279F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 7dcf5a1b55b1b5e6dcdc75ab220e0f9deb4df85caf95a5f63b88866215c54b99
MD5 83f10e4168d0d7a1143a934210e41814
SHA1 48ae79973692bb67a9f315ad636aec5b0e1f4b9c
SHA512 5d7fa3d5898c502f586702e46a6e9457339a5726db21200b87a9f094f2539831d14696939146c76de2e0d9c71a3ea75acf748b47b941af7120f92d1581b87926
SSDEEP 192:D9LTbv5Zy8eDOdClP1XZIZsIyZKQAZCk6AyLsPwGe8EOR0ST8AOInvQK2kl:D9LTbv5Zy8eDOd6P1XZIZsIyZKQAZCkR
TLSH
T146029CB7C2E8476E881252F19B24BE1ACD1E155B432C3C568DF5AF1B63E2571E20278F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 304df9517b543f9577752ce8aa6a1c0a9283ea194286ebebb65b93bd4726f54e
MD5 d29e356ea09763e58be8c775d3aaed4e
SHA1 218cd00b9633707d0229673260e80038f47f9b82
SHA512 1024dd7463fcb0c707ec6f7158ca32da722a20028eae3ec0d951882958d3749e2fbb0316dcde9ffe79ede7001063fce5695cfac68b38adbf982fbd5c9dd198a5
SSDEEP 192:sxZ4KSRLff6bh/f7JsN39EnAVLDIdpV24wpy6HW6+WNIABTYvrU9S1IgrJ:sxZo96N/f1sN39EnXgHb7r09
TLSH
T12832C8536A34557B8CC7E31ABA15BF53D2FA503292D51E58FAFC960C04E7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a341ae03fb2ce5819795e4b0ae554080b18018339e123f6b6193b107ab77062e
MD5 bdfa4c20050ff7835639790e4e7f6b7d
SHA1 a5a67f12c168516d2c35ef5b62b50eaf157b3dd4
SHA512 18d47213ab453d161eb736560e7cfd7f7ecc7835a9719bfa21a88d10cb42d8258cd7688c3dc8227d1bb7efbc450e755214a22713af880514ea72accbac1ebe2c
SSDEEP 192:sxZ4KSRLflbh/f7Jse39EoAVLDIdpb24wpy6HW6+WNIABTYvvsEuS1Ig5cyJ:sxZoXN/f1se39EoXiHb7n0yO
TLSH
T1E542C757A934597B9CC6E21ABA15BF53E3F9503292D41E48EBFCC60C05E7ADD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e74d93970c718f4fc9d3749680190aa17349359532670a5aa705867cb1e64c3f
MD5 010df97550711444355f4a1eff17f070
SHA1 c27907170384cfad9bee45441403c2514b8ea934
SHA512 abeb45173001cb95fc7ff4b10867661d1c23b4a0e7a060b0e1de628dde3f5555097f0deb648efcad1b1f106af45dd0d2599cab37b6290052650b96cdcb48a8fb
SSDEEP 192:sxZ4KSRLff6bh/f7Jse39EnAVLDIdpV24wpy6HW6+WNIABTYvrU9S1Ig5cAJ:sxZo96N/f1se39EnXgHb7r0yk
TLSH
T1E732C7536A34597B8CC6E21ABA15BF43D2FA503292D51E58FAFC860C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b871a42606497a3b98feb27466a00bb58112cc340587819fbe0e9d4c16428aa7
MD5 203a4eb4090aa7e326796d5dd4334c4d
SHA1 e3b6cbf519261d812bf5e39d26de79d659a78631
SHA512 2f6cf9248ac8a961ce04ba55177527f71acc18dfdca559e8ed222159e1c313f9386c3a8fc0ec62071fcca70c9be27677a1a7c352fae0eb63eeb14a0ca7c5561e
SSDEEP 192:sxZ4KSRLff6bh/f7Jse39EoAVLDIdpV24wpy6HW6+WNIABTYvosU9S1Ig5cyJ:sxZo96N/f1se39EoXgHb7V0yO
TLSH
T1C132C7566A34597B9CC6E21ABA15BF43E2FA503292D51E58F7FCC60C04E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 e7888f133d00e1a0e90220042949e577f3c2dc576a0a8bbdf51b91627f0a2654
MD5 4bf03233a4d7b379fc81a5d0a32f338d
SHA1 0d605b159b16dc85d037744188fc1f6f78a71b03
SHA512 a52fa2772aae3261e1e1b704b048e7479303e02d15c415cfd708b1bd39c0fc01fed68150fab634d7993acc8f7605e1438f2a48e03ea40f361af6873bc38b04ba
SSDEEP 384:sxZoXN/f1se39Ee66sjqMpRiYnazAW8pZS15posJWeT+rXiHb7nuyO:sQXN/ftqe4nnc7WeT+ryHb7njO
TLSH
T13DC2F706A920C4779EC39D19643D7E33DAEC506222C5CEDE5AECCA0C019D1FDAB4B857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f5f47630fd2cebeb7cc4f75579f166e5fb1b2515f39b2bd0a5cf2433e5715c60
MD5 63244eff90df99116b3f96f7312a6e90
SHA1 4b7c6a953bb309d13b14e2feb7c148526dfd267f
SHA512 205bb2cb7591de728909fe8029a30793f7b8aec19d09f27d17f9eefddb4d9a233af6172fdbafb9ab81a4f7c3d1f1c22a0bc216a7a57413d8ba680684135e6c5a
SSDEEP 768:L+ee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbgroa:L+ee3rxWvhffnu1jatcL88bra
TLSH
T18CC2FA3B640CCB7E5F800A9DDC5A6F977FA802C767588D4087FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 912B
SHA256 3863639ccf4dfe7d4ef4f4e8b86eff494b133d53002b695e7c3f74f1a0f96b63
MD5 08aa43a62df4a5e4235cc54f83a42be5
SHA1 29da7ac1cfcaeba85ade9ba32a286f0b38b04908
SHA512 7b7649de567dde5b46710ae1ca34b731a4793fb50a8595e8e096aebb2c73c7da89b8efbab60b8c1f3f90286b2b17c616f9bff6fe4d96a7fd6c8f3406d04635c3
TLSH
T1E51128464E95982FE9AC45B710B930F43370C6DC2721A237443C1A3A2C7635A68070C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca705.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5ca705.TMP
Size 912B
SHA256 63a294ea6693c0b2d3108399f46017169ae28544c8232c38a337731fd033af6b
MD5 79879e27ddc1ad4a6a257ea74ddfa003
SHA1 463b4e41006dceda0b56084408989559239b0239
SHA512 dbc549c4a37e089b5d58f8684781d11bbec587ac00576138ab1615a1dc30c4330a049d66b2275a756dab178937e1b038a3bdbba8a36d72ec3173aa05993585ab
TLSH
T1A1112D868BA68D1FE99445B6058A60F87330C9007362B7A3903E263A1C3938D99470C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8a59e5bc4d4faa858edc27d5075f73295d463869cd6270858588b5df41c5d9b0
MD5 d125edc74fcb5fde2863de0fbc011de5
SHA1 ff5a33cb721650d8fc1e73714543eb46032e9569
SHA512 9367f84d7e1edd3603e7c73da66dec4ee7253c5403891ba7edf384e0b3f4282ce4bae090be0749706a889ccf861349f4db633fe78804cd4ad1379f0d82429b0d
TLSH
T1AEE0C0762DD32510BEAFD3D120308090064A789DE901FC0E541FF6C310B231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 88072f02aa11ec8c48e51e06ba659806b63a0e27cd1af207b202cf47f5668ae4
MD5 6824fa65f85a08ff35a6bd62bf9e5261
SHA1 099a3a02a4620b68c90e3fbd6fb3b9e2b2eb0f09
SHA512 79d65d31eb84ec8bff1034a914012a8f670de3ab5d84ecacedf942a689c047956499b0c84cc8027e9590a6fbb7501d19742e585aa9abfe8512a7f8992ea67a0e
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EK:KYHIhKggkXyh+IHKnKIXyxmIHKbaM/Y
TLSH
T1B9916B16363B0642387E3858B7A696374F4132A73458E8AF7FB954A10E27E112DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 040d4705e49eb88ac95b8b003269430dafb43b2abb4556744b76989d6f9c4d35
MD5 d579f1f6ddd0451758e9f08e0e4887f1
SHA1 fb0abebf506ca20a3010a7088c4b87875269e081
SHA512 f64fcaeba6b057cdecbbf23b199c980219610bda058126cb44c96180c6e46f9bafe52abb183e769db1c2d1f4b46cdbd5b1428d167eabe944df0566a3f5f54fe6
SSDEEP 192:uoTSNWMsnMcPPQLz3XX9VoxsNy7Qd3gtykM7ak1VQmiU1C+52MTwz+FdLD1WSJr+:dtNn/s3n9SxsNy747Rzf80dbJrYTZ/
TLSH
T1E4626C366C345D2BA9A3A586F04B37075FF4816796C42F58EAEDAF1D01CA3AC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 825db0de15be004c6208fd32b3ee67f0f958efcc212b0cf69212b530b3fe0cd7
MD5 8cd7df762bc974a632ca02e1810839c6
SHA1 096ee05b8171a2fb669e5306fad9350df407933d
SHA512 46600c7c8cc6c6aff20872a4da86a8b9301fa30b8e5bda0ef7d9d97cf4edeb235ef7877a58a7afa88c5224a3bc6f1dae5d11cb78e7d6302780ba60d67a6e02be
SSDEEP 192:uwTSNWMsnMcPPQLz3XX9VoArtsNy2Qd3gtykM7ak1mQmiU1f+52MTwz+FdLD1WSI:btNn/s3n9S0tsNy247RCU80dbJrATZ/
TLSH
T1CE92C4F558E75936D99EA347A33E2E074EBCC02776802A44B7D96A0CCCC927FC306516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fb0a1e3ee70c03d46de07627ca404fc5a05a28b750022c5f11260832a815876b
MD5 d364b213914dcaaf786919389c76d001
SHA1 dd78a9e98557ecee95bcfbcfe5c57a046ec4f0e6
SHA512 ef44fd1dd2a916bd645563ae302dadf22fdd48e3f13c873e185fad99cd8f4ef340624714ab5b7924f8d46586c301189c8578449a45cd060b3315c19b74716d57
SSDEEP 192:uwOSNWMsnMcPPQLz3XX9VoAr3sNyYbQd3gtykM7ak1qQmiU1f+52MTwz+FdLD1Wm:mtNn/s3n9S03sNya47RmU80dbJr7TZ/
TLSH
T14592C4F558E75936D9AEA347A33E2E074EBCC02776802A44B7D96A0CCCC527FC306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b38cf2159d443cb53ea93234d4e008cb5f47a26c9230b64b1e8dc5ab5492b94a
MD5 63bbf9b1b539008515e33eb970f9bf13
SHA1 5ac25786d614983b7b0c6c4902ab3cc59042a86c
SHA512 9d573f82a674b681d1d76c91662815df7a34e1f40b7c9b975043aaac6b98ac53acd15ca4dec333470c5bec69045fe8e4cf7c31996b6196f09494f3e2349cc96f
SSDEEP 192:uoTSNWMsnMcPPQLz3XX9VohsNy7Qd3gtykM7ak1mQmiU1C+52MTwz+FdLD1WSJr+:dtNn/s3n9ShsNy747RCf80dbJrYTZ/
TLSH
T1E3626C365C345D2BA9A3A586F04B37075FF4816796C42F58EAEDAF1D01CA3AC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e929758aa55e43f8e03accc78a6d14f44a8cfba292c07d3e7e26b7be13059ba8
MD5 69f6f98e154a3664e0590152fdec0332
SHA1 d72d413eacf994012b3595f2f4cca25f6322b715
SHA512 26fa4264501cb4a8110487468d88e7ed0cfe927acf72fb3bc97de0e2af33a55e91c6409a6e8bd6e15bdafcc99f2b8c59fb21d899e6ef3047fc4fbad32542b06f
SSDEEP 192:lONr6vMtPQmiUy6/ThTwz+FdLDf847q6U/u:lONr6UtRFTnd/pU/u
TLSH
T138020935AC786C6BEAB3BD46F48A27175FA4507FAAD05B50EAE86F1C00C725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 0725357bae9a0d1746322c074bba5435a833d4717a4faacbc599be772bec4bc4
MD5 0b7c3c7c1e3b13ceee4aad0646380115
SHA1 0d7791de3f62a34238a72cfad6fb7cc18716566c
SHA512 7413954e05c79b71fa14d2b69e1a0c38695acd5c4ab318b71f92af84d9d9567efe36faeec92667f92fef08c08631a9443424937601fe36fd452aee8b3465d488
SSDEEP 192:uETSNWMsnMcPPQLz3XX9VohsNy2Qd3gtykM7ak1mQmiU1C+52MTwz+FdLD1WSJr+:FtNn/s3n9ShsNy247RCf80dbJrYTZ/
TLSH
T15D626C366C345D2BA9E3A586F04B37075FF4816796C42F58EAEDAF1D01CA3AC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 69ddfd018fb4100a3660cec49ec6285fc6fcdc9cdc4a370283db56d9bd04f74e
MD5 a69f3438864d011c817afdcfae64c513
SHA1 2da27e259938e04aaf0dba04fa3e5269d3c397e6
SHA512 5a373c3b2071f20fe91cc50ead5f60e45935b0e5337cff11ae356cdef11268299ce28812833c8bec324b6eabe0a09e8291aa1496355c6c7b2af107a9a4641032
SSDEEP 192:uONT6vMrPQmiUy4/yhTwz+FdLD1WSJrb80I1q2U/u:uONT6UrRdyndbJrsTU/u
TLSH
T1A8121932AC649C2BADA3B542F08B36175EF0916B9BC4AB54EADD7F1C01DE66C1307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aca4c395-7f47-4a0a-9697-3a18997a3614.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aca4c395-7f47-4a0a-9697-3a18997a3614.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 51385763fa73f91490fd50ad22d62f7fce7659e6df59e17eb9f95e44c3ac9144
MD5 736b27f62ef2c7b94c3ff80d8d49ef0f
SHA1 3367320fc129d9cb259b2ce79cbf313e899b21c7
SHA512 9f418a139c014b97321912a1ada8d2f252c11bbfe9637af8cb1c30b9210b9f4a572f6bc8ba1296e364def8d44143f101123cf35d076801db8c46e6603b5053d1
TLSH
T16C412B5CB6F91108B3B76E5A9BF6B86E447FBD772E46C5AE00110D4F0A62B00D861737
MD5 SHA1 SHA512 TLSH

Submit Download