hxxps://discord[.]com/channels/1374108923782631490

Resubmissions

19/07/2026, 04:49

260719-ffxknaex616

19/07/2026, 04:45

260719-fdkhbaex3x6

Analysis

user interaction
yes
max time kernel
203s
max time network
186s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/channels/1374108923782631490
Sample260719-fdkhbaex3x

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 6 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
30	discord.com
38	discord.com
43	discord.com
7	discord.com
8	discord.com
13	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3492	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134289099350438735"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{50177A44-1E94-4C5D-9821-E18A20D1445E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E49F433B-E3A7-433D-B668-BAA657B1C2FF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3556	4580	msedge.exe	84
PID 4580 wrote to memory of 5052	4580	msedge.exe	86
PID 4580 wrote to memory of 3492	4580	msedge.exe	85
PID 4580 wrote to memory of 5052	4580	msedge.exe	86
PID 4580 wrote to memory of 5052	4580	msedge.exe	86
PID 4580 wrote to memory of 5000	4580	msedge.exe	88
PID 4580 wrote to memory of 5000	4580	msedge.exe	88
PID 4580 wrote to memory of 3436	4580	msedge.exe	89
PID 4580 wrote to memory of 3436	4580	msedge.exe	89
PID 4580 wrote to memory of 3436	4580	msedge.exe	89
PID 4580 wrote to memory of 1116	4580	msedge.exe	90
PID 4580 wrote to memory of 1116	4580	msedge.exe	90
PID 4580 wrote to memory of 1116	4580	msedge.exe	90
PID 4580 wrote to memory of 3324	4580	msedge.exe	91
PID 4580 wrote to memory of 4564	4580	msedge.exe	92
PID 4580 wrote to memory of 3324	4580	msedge.exe	91
PID 4580 wrote to memory of 3324	4580	msedge.exe	91
PID 4580 wrote to memory of 4564	4580	msedge.exe	92
PID 4580 wrote to memory of 4564	4580	msedge.exe	92
PID 4580 wrote to memory of 4036	4580	msedge.exe	93
PID 4580 wrote to memory of 4036	4580	msedge.exe	93
PID 4580 wrote to memory of 4036	4580	msedge.exe	93
PID 4580 wrote to memory of 3252	4580	msedge.exe	97
PID 4580 wrote to memory of 472	4580	msedge.exe	98
PID 4580 wrote to memory of 3252	4580	msedge.exe	97
PID 4580 wrote to memory of 472	4580	msedge.exe	98
PID 4580 wrote to memory of 2972	4580	msedge.exe	100
PID 4580 wrote to memory of 4876	4580	msedge.exe	99
PID 4580 wrote to memory of 2972	4580	msedge.exe	100
PID 4580 wrote to memory of 4360	4580	msedge.exe	102
PID 4580 wrote to memory of 3984	4580	msedge.exe	103
PID 4580 wrote to memory of 3984	4580	msedge.exe	103
PID 4580 wrote to memory of 5392	4580	msedge.exe	109
PID 4580 wrote to memory of 5400	4580	msedge.exe	110
PID 4580 wrote to memory of 5408	4580	msedge.exe	111
PID 4580 wrote to memory of 6072	4580	msedge.exe	116
PID 4580 wrote to memory of 6072	4580	msedge.exe	116
PID 4580 wrote to memory of 4508	4580	msedge.exe	118
PID 4580 wrote to memory of 4508	4580	msedge.exe	118
PID 4580 wrote to memory of 4508	4580	msedge.exe	118
PID 4580 wrote to memory of 4196	4580	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/channels/1374108923782631490
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2c0,0x7ffe784bc188,0x7ffe784bc194,0x7ffe784bc1a0
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,10885261418758192854,3204358340628322396,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11716927574724413018,13279453019497219011,262144 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,1153572664640702753,1915463856086486383,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,8172690412542821161,8969837331918402763,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16143440398598509500,11414607866206877609,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,4822850201598863663,5988466879018729996,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,3468771453629370803,12974556355379691429,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5024,i,9105629795739660312,13541182930170071423,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,12719873771959689813,11069481591765449921,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,16374132032192244527,17437989163953784922,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,851122481168253759,297938567363793130,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,17676322269605036069,10960711860202251934,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,12490184930247220868,17848991599800210191,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,12490184930247220868,17848991599800210191,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,5130990732327066307,7028698539366828859,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6992,i,10079317040877101201,15947090448719623798,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6988,i,10048783079434756446,14827306104929534377,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:8
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,7337033651142778059,10843066043510072492,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,11874732902197255494,11193220183091267015,524288 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6912,i,3594386981760971875,4616509652117196508,2097152 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4460,i,2895602705232513516,5051028932719029149,262144 --field-trial-handle=2332,i,16720856006698951894,1503804219915167786,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2deec6a95ec52614194a78a23d73e7d01a237bb1c36f177b2d079e01904bbb02
MD5 1a081c1a44490c52836d469b86ac0024
SHA1 afd36b8efece8f0b6da93e52448b0b0b92b7f2e0
SHA512 19264593eac6e8fc2b1fc661bfd6a9ea2c8b80318a9fd4358c9f04722074d457d449cbd4766b079f4cbed4f9218c79e4304ea56aee93a1d3484cb9deae7c7b51
TLSH
T1F8D02320763CFCC1C628117191218F007B355452315BD14AF2558C1D5CB50C197D6BD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 3bc1132307681c123a87f419d1a1d0e4d5dc2280e89e9d28bddc58344f290ad4
MD5 7bb721b5e8619a8bc718ddc469d766cd
SHA1 843651140aa25bafbad6dea34c910ea3371f66f9
SHA512 709eea8616338a4169cac81ef0d4352d275ab4361035a7e19b774e52cdf9641af12716e82d81107bee9133f965ce4f6d9cfe9bc376c1b347f5b7b2b32b76ca7d
SSDEEP 96:J92Oqs7I6q5+t/fUjIjBrgP+A9MKDQ3kJf58EKnELG4:aOqsI6hfUkuHMKDQ3aHG4
TLSH
T18702B6E289DB27C3D77502B4EFF21993B9F18DB1598B5E0219B8447C65B77E2F422808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 15KB
SHA256 7e481b9e0af2e4b456a54eb5948e78f270ab60cce59579b0ee728646ab9a341e
MD5 6edf3ae4ab1cb3034e509c83e7944719
SHA1 484b791ccd16ba0049bcd4639b3e1f5ab7519716
SHA512 2b30b7ef1637afbd3c37ee84ebdb04989808708bc83be10c61b74fad37ab2ba65c0f480f3aea863ac8223b5a17f32b5147ce8156ba87b116f7c9ada3e85a3db9
SSDEEP 192:/Fs+98ihgyfNJbS2pX2t6riBGpqynFt8AXpoCQQy8tCV:ts+97OsJVYAnf8uPnU
TLSH
T1AC62B6D2879AE3C3D76401B4EEEE4C52BBB148B219C75ED108B840BC57B23E1F312919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 14KB
SHA256 faecbd73c1027e7516130ad035486afb468f57c247743c15dba01579460e7de4
MD5 cbdc64167b934122d571c38e8edc5a24
SHA1 504ab6e8eae5e76ace8e612c8a45f6021ef4df35
SHA512 345801de34085b84c75a5cc86fabd1df0f921746018f5169315f0e1661ecbd43f57f682efe2db41e6e241a66a7fb2b0da2e7de51c1b183d7867cd712ffcf52ba
SSDEEP 192:BiFs+98ihgyfoJbS2pX2t6riBGpqynFt8AXpoCQQy8tCT:B2s+97OFJVYAnf8uPnu
TLSH
T19A62A6D2879AE3C3D76401B4EEEE5C62BBB148B219C75ED104B840BC53B63E1F322919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5935db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5935db.TMP
Size 3KB
SHA256 9ba9d1d828b0ba3a84633858bc88288e031030528d8cd998054472762e840f5b
MD5 05bbaa6789187fbc80721c1aa8acc7d7
SHA1 7ef41b13553e87d0c7efb3aa67f7d5d71f313c37
SHA512 20c43993ac20161e7ee6a27b45efb21a47cbe92b3f48bcac0461b99c10ee9c38163596959016c2eac27056417ae83e245320c7940a86d6da970c4c9772e8dcc2
TLSH
T1FC612DF4C1C20783E32114F1F6E006537E318AD65A439E662E6049BD98E77E1F57BC88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 563ba7350d7216b6d5f3ce5655bd4c69762b23a63b8c195de60dfec21ddf0eeb
MD5 9b06a7bc7fe499afff00f23fe60f3918
SHA1 bf82af398708ee252033f709e8e1ef6347fa0cfd
SHA512 b64f22a20feda5cfb975e596b5e4726b1625ff8edffad78d6e4ba6a1478b6f7397ff8d91b19f83423bab6278ac80242811295c13021d84ed269006fe2d9d2f3e
TLSH
T13D3166B383E4866ECA1152F49A14AE1FCE2D0915832C3C29C9D4EF1B93E3571F141A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 72e82ac04e1472d1a23a821eec7511ef317d51aeac4e29d2deea3caaf9e95750
MD5 7a1322a9f4c5258acbbe023b383bbe36
SHA1 63c1488b164da50a9f31bf79ae0f6ffa8eda0f54
SHA512 0214ebc7b9f5d3d8e3572f7f6eaa66f2a7c09e54d46a8e665bce6363ed4a084e179cfa6ec0ab0050a218f90a7f447e8379d654e72cbb8951d2487aae92d53586
SSDEEP 96:D9OuHucuhuruYuZuPuMu6zBqw8u9utur7uCXuJu+mugG4fueuu6nuM:DQ+bIOtUkrN1qlmuE7hirmFG4frutx
TLSH
T173B199B3C7D9832DD81212F55A187E1ECE2D1D6483183C2EC9E6EF4A97E2571F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 87b3335e766dd1d75ced11156e1068444a956af3028d9418a53cd5af891f5981
MD5 0d3e8c997f0155dc04490dbade7b8986
SHA1 68a8a068563a5876828bc06bbfe748a5cad6df7b
SHA512 e8bba6d749ff76cdfe69ae8bb471165bb22421973d4f9be3326a9855d031c43b00190d9195db1e7daa1728dfd080995a16eedf92374b46998c6b95318dc7cae7
SSDEEP 96:D9OuHucuhuruYuZuPuMu6zBgGwBqu9utur7uCXuJu+mu6LuTueGud:DQ+bIOtUkrN1gGkqmuE7hirmZorG+
TLSH
T1C6B199B3C7D9832DD81212F55A187E1ECD2D1D6483183C2EC9D6EF4A97E2571F181A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6419ffed3fb58327474b0d2fab4a97f50c194441f71b78275e984e7de152fdf1
MD5 0460f4c15136845b67a416a4ba7854da
SHA1 b384184ec7983b695536d5497b7c30dda908a415
SHA512 7dd2acf9735802876c945c7493b674c15423f205a3b819a8ee0b7ba54eacbb2aec5d4c9ef4b00fb94ef84d30e04044af83d133c1f989bd84262c30ebb894aaa5
SSDEEP 192:sxZ8RdyM/jK1Ml8MkV/fksOf49IdpEgHW6+WNzlb/YLUPHZIgrJ:sxZ8fMV/fksOf4+tHbV/79
TLSH
T10A42D8126A34597BCCDBD209FA55BF93D6F50572D2900E44AAFCDA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1a9d02b82cfa7b2a766bec3dc528f7053c5b3234b2c7d848ea40cb4c8bd6f61c
MD5 4e181012350af4a5aedfcec58259af87
SHA1 42c539c1a22ec96aed90597ec00050b317c83ced
SHA512 3f7801c3d69d14108d5132ee53e0363e2a8e742db0a5e88ac71a3069a8389eb9ed5b6bc41de314e94622cc3237375666b04e648bac4ea5edf181a40c25e044e7
SSDEEP 192:sxZGfRdyMojK1Ml8UQs9V/fksgWpVjfR9Idp+gHW6+WNshftfphxdYLkQNsbIgbX:sxZGfqqqV/fksgWvjfR+XHbClfxdn3T
TLSH
T17062C612A634597B8CDBD20DFA45BF93D6F9046293901E44AAFC9A1C00E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ba3da0bf49b21f99706702fc9e7d6a05f3dcb3f4de58fa8e4e7ef65531e5ac94
MD5 2d72cc4337ffbd3f5a5a78109c326735
SHA1 adab1fc222ba99bdf00309869f00243ac225666e
SHA512 447193022939f87d158ed05c149df0ac54e9e56a32560a8e76cbebb31416bb49d6d7dac71222aa530393e51c78b6fc7979999dffd1feb7fecdcaa64f3a4551a1
SSDEEP 192:sxZGfRdyMojK1Ml8UQB9V/fksJfR9Idp+gHW6+WNzrpBNYLNCHZIg5NJ:sxZGfqqDV/fksJfR+XHbDNvR
TLSH
T16A52B712AA3459778CDBD20DF945BF93E6F5447293901E44AAFC9A1C00E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6f7157a87e2eeb717d1b933b16440c15c43dcd527420934d98bb3a1d85bf31e1
MD5 9e5475f60ce997daf0ce28174ee68a49
SHA1 aa76f5904414dbe571efc260e4bcc41c6a46c875
SHA512 1a448cb656091f61da5d18ef9a019ea966671e336939c1339124a671c9e7fbfb9ab4ae59741af34c0f9fae65b8e6d79bf570e93be653714bfc3f322d2c426e3f
SSDEEP 192:sxZoRdyMojK1Ml8UQB9V/fksJfR9Idp+gHW6+WNzVNTYLlCHZIg5NJ:sxZoqqDV/fksJfR+XHb7T3R
TLSH
T1B052B612AA34597B8CDBD20DF951BF93E6F5146297900E44AAFC9A1C00E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4a5a844bd029009b79590e4c55279ba44b1c2671f65fa3cfcd9b220111a969d7
MD5 4dd631621ef43a955327a187836acd76
SHA1 2630d6f8e68c084332fd19aa53c433270058b05b
SHA512 141f8e84d5ef42579bc8154a4420291ab654780e17ee9a81636d303376f14a6500a9ea3cf90bbbb4913a60b67793f326485d40f53cc0b57483161e0f4d911d59
SSDEEP 192:sxZ8RdyMojK1Ml8M9V/fksJfR9IdpEgHW6+WNzHkZYLARHZIg5NJ:sxZ8q1V/fksJfR+tHb4ZtR
TLSH
T14152C812AA34597BCCDBD209FA45BF93E6F5557292900E44AAFCDA0C00E6BDD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2f6ef5bad99dfea0aac344de8fda29521247e9dc38a86397e28e128021dfbc0c
MD5 ac17628b40046eb79323c48c07e1382f
SHA1 9f5cb3982cc40a665b49a67ed69ba76aa5cbc2b2
SHA512 1ffa0370b8a6be4b9ef06f3eafaf501c3761cd36a4b630fee7be1616c37b12ae86c9f459701f3f3921444ec44f31ff91f3a13b5e7a43d44802c1ece78249328c
SSDEEP 192:sxZ8RdyM/jK1Ml8M9V/fksJf49IdpEgHW6+WNzt6XYLwPHZIg5vJ:sxZ8f1V/fksJf4+tHb4XbP
TLSH
T1AE52D9126A34597BCCDBD209FA55BF93D6F5457293900E44AAFC8A0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5cf791cf151cbdc3a6af0292fce266918852c0eedfb9902de36940e6bf3d06fa
MD5 94e822271ac7ac9130fabc0cdeafe07d
SHA1 60c0b4db7d05d6105ef65b9196619700cef0b6e3
SHA512 e5b1938f9de5b7ff8c125d324a71cc2d39789efa7cfca1e11f7d8036211ca456bcbb639b8a16367f49f1dce8a065c8754b43596a95d640325b379009c7657047
SSDEEP 768:aos6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNmroce:aos6pD1WvxzUju1jahILIsNdce
TLSH
T145E20B3B680CCB7E4F841E5CEC2AAF967DD801CBAB94895447FA484C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\10f9c695-1a16-401d-8f4b-eee3304dfcbe\index-dir\the-real-index
Size 72B
SHA256 61156d83ea9626d8208443de38df8cef0fab81c76f98f9e8267d9fe67079cc09
MD5 0d2cb00a34713051ec339e2569ecc2b6
SHA1 96af8b8d07caf01f540ba0282fe803f2bc9ae1c8
SHA512 10e9e703cd4983c5b175ba59a5ca2b978bd0cc576dad3e3ce6e0aff00957ccbdc7848b9e89fae569b474ee00b80f13eba00d09f62228dbb6cf73ced31f8a317d
TLSH
T10DA00235DD61940BD21607F01CF1264537305EEA5D95C20163BA3548CABF2D0CA850C0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5af82c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\10f9c695-1a16-401d-8f4b-eee3304dfcbe\index-dir\the-real-index~RFe5af82c.TMP
Size 48B
SHA256 8632baee40f22cf1c365b6ca80cd3abaf84676566f4aa3b9a85aae312a187c49
MD5 ee67450b28516ea7f668cde186063ac6
SHA1 bfb4b450471685e533b8a1e90da0aa8af523605b
SHA512 f3cfb191c17508d1da04e37b51f0c585865e5f34930463ad75ad2b897dcb1452e5dc2b7bd2ce46ee67550ca1c9fc6b3b7956737b4aa94081766a9973a10eabe6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\e670bad4-3d05-4b86-8a01-e94a5fd41be6\index-dir\the-real-index
Size 72B
SHA256 fd75201d3406672f11093e65b754cfcd3126164f8e8e5738d8298382286c8ac7
MD5 61404eaf7a84e69fede5944675741bd4
SHA1 d1ee1320c35dfd42fb438f8cb61f685b43667ce4
SHA512 a1d0e217cd2204b6fae4051a1286a2d967b0d752608b76d472a208dc7c909f3cf6de6b3c2d051db74a48f9e7a5d24998a91313165e893ae5850f065a46dc4c19
TLSH
T1BBA0021483450207C3185BB134735550367958114102429751F0908AAC502C44713410
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5acf77.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\e670bad4-3d05-4b86-8a01-e94a5fd41be6\index-dir\the-real-index~RFe5acf77.TMP
Size 48B
SHA256 9149d6ec0562f996c1c235cf61ca9f7e14112f4305b00ab76feb4de0b25974db
MD5 6c7ff8c8e8551441f2542f2613cc9a98
SHA1 e80694bb701548a96c5797470e1000f624c9ae76
SHA512 04e507be09ee2660a3ad27e3c99405a8a82952aee882c59d4f236bcbac7bf624fac229c107100104e81289c9b39930b1c248ef4ae8a6418d4e54b7b7ee951109
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 0a7ee0d4c2d3827411070f0da638fafd19f568573117a5654201697ed75ec329
MD5 e9878aa5e1ba730cdf60fa9bd2beff61
SHA1 185d8885a819f89daa1ea87b1ac33eb1c87d32f2
SHA512 5d3b5bb0bfb168a0517bd1c1aa186f35616dcbae224eed7c9e83fd68105c1c1a66d99e8b1b771801346a44564be96f642da32ce01a0e12c39403cb743776665e
TLSH
T1D5D0972BA0420980EABE4B802B221066C22438CC288D90CC602101194852A836203E62
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 cb00ddba6cc51dbbeb20bda6ced769036fc112172cf0d1e4a1054f4740a8c23b
MD5 d63993089ea85f3a337c3c6136bd818f
SHA1 c8b1a81a25909f286c40b9114f67558a574255bf
SHA512 f68843db1a79d635e2c4fb11627cc542f70dafe3cc360a863a1bfee46168dd8f9f4f59f8bf174aa2990a66b389d366742fef89b24c4f6646d6194234fecde5d3
TLSH
T100D0A56BA1521980E76A57811B31105691683DCC694D508C5515255D54719C35113D51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 229B
SHA256 efa27a845efe5bcd29a19e843f304446d089b02c21c24b3fc596e1892d950711
MD5 d1f36323a126fdda35b95efd4737c99f
SHA1 75b8f2c4526f552b9c7fbdc6bc2ba8b4f539c134
SHA512 16656029d216e9b0b385bbca7bce931cbbff93d3d17c026767982da9109fbd3fc674d34c4dc544f54e05d277b17e1149b3fd2be32bfcff7ecdb80d31505be6a0
TLSH
T1D9D0A76BA1521D80FAAA5B852B221166D66835CC689AA08EA135455A4452E836113EA3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58be2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58be2b.TMP
Size 138B
SHA256 34c9042c034cdf5b0aed56bffec173513fb48dcb011fbab8d7b5360966fe948b
MD5 19eb3879256dde8615f08ad5976c4eb3
SHA1 9bebd2fb9188f0c957f1ccc114ee0b817a595b3a
SHA512 5f01c2bb877fb4def2833492caf192a04a343643f4bc52a4544844bb9618c9609fd518acf114726825a21a531a278242304d6ce9b1015d0806563ccbcf4174e5
TLSH
T13CC02B73B0410655DB1923800332809C53043CCC8CCB80CC706335582070E633343EE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4f7575f26610c46b3520c81bfa4aa874e33e138fb73373c0bcba4d73917b2296
MD5 89dc16aa0df9dc295ba80049bcaaad19
SHA1 2a19b8908984bd164a981cbae17ac068e69e2a68
SHA512 a3231217e46da833e2e812bdbd17aaefd080f41400d8f30e6ad17640295f05425e9928055589a8a1b7abbd993693282cabc756e7b0ff82c0d2c8096cd2660a40
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyqwF0AO6egaCbzInogKA1oGgk4whLmQtL:KUAAKtePubCKs8e+nCKQUsLg1RLq
TLSH
T10891F513727B03122C3E690C979597778A42B5A37028A42B3FED40764EA7E604EFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe599c17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe599c17.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 8884b848b8ff54209f37054154dad93f1366ca04a16dbf7c07636da088aa6b4a
MD5 841bfd72789483d67abdf34cabda1086
SHA1 33034aa482946dee0df11d8992aaf67f3bc6a95b
SHA512 a800be158f148a474baf4f8c1b63bf18be268c814d51928c382b2ef8aae6d3c57482b6b8e23752f4481c588090da00433798a1442b4e7c31c4b164eb801c9d46
SSDEEP 3:MsEllllkEthXllkl2zEglt/flllll:/M/xT02zjdXl
TLSH
T125440405FFC14547C7005430C433C7543370D45507515743347714135DD5DD04C40400
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f3d11b940456887650723ee66ba8a4dec6d72ec5be8da2f458dba8a757d4293c
MD5 1af2dd1dba39079051b41e6c0dcdf9fe
SHA1 d29a07f6adc45d9f53aaa6d7f258d21d6e56dd2e
SHA512 5c27662ea67b3383fc694bc07866166526d814486cef0459a49437bdf4bc2d2130168bd2d71335828471122d8016a2b3e473c593404c5f878fc49402f04b8d02
SSDEEP 384:etNn/s3n9SfsNVBHtrPWa99dFMsOM8aOObjI9G6w7U0:ej+9U0XDsa29MU0
TLSH
T129928D32AC389D7719A39556F58739178FF4826B8BC52E40E6EDAF0C01DB6BC531281A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 48a785d5bad2d3ef07c324d2b18d0f2493ea4da78d54a98a203959afe6be273b
MD5 81ffeec0edbb74fd4d6fce0ce9280e8f
SHA1 cf7d1d2a01b8c3d7b967b7201626f8881f399988
SHA512 7f0cb6bfb227da3a86ac287aa1871519424d2ccd517200f0ca6439b8803122a2c09b10a20a4c622885f24f7253f698694db399a3065fab2b0bec21f56c4fc042
SSDEEP 384:LiF1tNn/s3n9SIzsNv8TUNTUlIlMHtr0Wa99dFMsOM/aOObjI9G6w7U0:mF1j+9X6wg5XDva29MU0
TLSH
T1EAC23AF248D78936D9AE4B47B77E2D178EBCC167B6812A40B3D95A0CCC961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 2eda68f9cbb8da13b13bd287a915ea385c00d77fb61297fb4ae10cd6f9027226
MD5 7c3c88ebe634f0475c77fbd9886c69af
SHA1 b0cab02949981b1d86f538146271f0bf3f230b31
SHA512 56400a8b517d3fae90c147538804109aca995fb9481a161fe2b161b8fe28c363c0c7260aec8344e68ee5a46ed7b714a64de7ce2f1c1e9c306d2a5b4cf1f46ea0
SSDEEP 384:LiFStNn/s3n9SInsNs8TUNTUlIlMHtoIWa99dFMsOMTWPer3usTMBDxKBb437a+3:mFSj+9LXwg2XDDxr2BlKBb437929MU0
TLSH
T15AF28EE184D74DB6C49D87C7A77EAD1259BCC177B5885908B3E9AA2CEC4B1BFD301800
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 55db18bfa8e6495893ee6df73b3ffd2c0e11f5507a136fbc1d1699d569ebb039
MD5 649a350ad8530209edae8896d6be4382
SHA1 12c346f7eec68a010d3e01b0024b873dc4e08b85
SHA512 27acef76a77bd87a4acfabab467c7dcc5346b83968faa38d029093163304c3dda01b87bcfbe3fc084fc9e6b9245b2b3ff24915944f646c35609d9b22b96b0e48
SSDEEP 192:qONC6O7+3hQmiUyEVE3Gttb0b+FdFh2SgGdPU6:qONC61oGt99dFMEFU6
TLSH
T1ED02D9356C786CB74AF2AD4AF58737135FA5112BAEA52F44DAE81F0C00D765C2346C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 86ad19c77ef77f2625c44d1a618a311bb0de0420aff1aa4e36e8b922a8243213
MD5 1adeaecace84721add991606ad0ea4ac
SHA1 0cddef886bd36e642baf37e156fc2856b3e0caa7
SHA512 7d3cc5ee952eb756528c2b0f57c253aa643e3d0e488ab9816452213dd4fdd46dca87fe585134860eec7aab73f5855ff162959ffd1a8dfa0e1fa1d8a67648caf9
SSDEEP 384:htNn/s3n9SfsNVMHtrPWa99dFMsOM8aOObjI9G6w7U0:hj+9UpXDsa29MU0
TLSH
T140928D32AC389D775DA39556F58739179FF4826B8BC52E40E6EDAF0C00DB6BC5302816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d9147ab3eb2761c6f377bf7d35f861998dd5fbba199053a467643876b321286a
MD5 249b7e587a39b20f9370c5522fdb9329
SHA1 b0e2ac25576785e779fce77ec1f85c1df7e7bb31
SHA512 cd96a4f87abd97821252f6ae6c9b90b8cd29ae0b4c84244c1c5356513e31a458283fbf704c5b4f09464bd432fdbdf5c43764672b263da848dcab4cda5d4d5ff2
SSDEEP 192:BONQ6O7+3aQmiUyEdZE3Cttb0b+FdFh2lSOh2lZcNNqOIU6:BONQ64qCt99dFMsOMkaU6
TLSH
T1EE12D931A8786C6B5DE3B546F58735139FE5426BDE8A2F90D6DC1E0C00EFA6C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0274c0da4f4b5d85f3d660214711e9d51ea35eb7a6d1f379043bb2d733bc69f6
MD5 f3e559145709083e71d8efbc62426b34
SHA1 361e99bc4b70e4cd3bd34bb9209fe735e0b94e54
SHA512 e64db1398d67801dab4fbd831f1e96f2d5a24a81e27bff727645b3c5e510a4ae000e9681fd0559eed5e2f7e9177661b8d22b03acd3413049d2fbc07e2530ae7d
TLSH
T17BE00913D32101BAD12A0732008B1A6929F2516107A205198E21416C2DB63156A21F81
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 36e2da6717a2e51e71ddea582042476719cc6d5b26bbc113e9fdcc6b5c81049b
MD5 60147b4fcde2494bb0fcd377a8bb6a0b
SHA1 df12356a12b97636fae67546103227bc8b8cbf60
SHA512 a4684137e27ac334c1ee9b386a90c22c3482a4b4a570b5a9e28eb566cc1b917675c9dd545eb0e527a60b10bd35087c1c36548a9c1700ae08d377159f843456a7
TLSH
T107E00113931011BBC12D0B31008B1B283DF6406103E305248A30416C2DB73103A31F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 0d15378625023899ccbb5658dc0b4b646b6ceedf68ea1e9a909f68dfdc26ce78
MD5 358e7a3336969cf0b3af3315b00c91d2
SHA1 04a873daf9b4802a0f432ab49fba206c29264b4d
SHA512 9030d5f03192dbbd1157d2d08c023c17541749c66aed06ccee2e34c4bfb3a53b2817fc3167c50fd1361b72bc52bfcc0dfb747c3df5f205480dbb8ead1647b061
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 61eaa0b4270643552c3823d627e3749c052ee9108044282241daf86f15dcd4c9
MD5 45120f31d7e27a941e5997375a1b1510
SHA1 1edfab7b6076ddbeade3c35e9af36996c9e475d2
SHA512 a33b1efa8bf586fb0c2c2c7763b3137385c4bf3e151e6529833060f13466f48877715b2258307449f566120931b97217cc396105d97962682669687af181ae2d
TLSH
T1AEE002129310107BC12C0B3100871B2439F5405103F305248520417C2DA73102631F01
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591488.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591488.TMP
Size 392B
SHA256 abb98e7fbc49d8acc7dfb6ad878e2b8325377af01648c9c47d2ddc967353c5bd
MD5 92bf2b155518b59cce637610e4e40d15
SHA1 c8d44a53dbbfbc11632c50899b95148d5f616aa4
SHA512 a1f83c27ef8d07d238f74f15321eb12ac0004c00b731d320faf883293d22ec8b5e0078b11f254b03c2e8300d57dce967d5dbfb39d2bf0d3cfa3081fb4cede9f9
MD5 SHA1 SHA512

Submit Download

9f94663e-5fb0-45f7-938e-5796f463b039.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f94663e-5fb0-45f7-938e-5796f463b039.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e6893a0e71aea042d5b941b8e2e015db347be0bbb9622ef298d0cb09edab333
MD5 887aae10a0b495aecd79967f08c0f5cf
SHA1 b40177884de9f1b4610b7fd3652b6899dac147ca
SHA512 444f9c9edf809fc1e6aeffc5d19edd3bad5c4ce736b4e417e948cd1d54e79f685c8f588fabd5544e40ca924cf285f10c797dbe619644294a07f049652ed48e67
TLSH
T13641F968BBFA1144B3B76F169BF6B85D487A7D772E0AD55D00010E4E4A63B40C872B73
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download