hxxps://guidedhacking[.]com/threads/how-to-make-lua-executor[.]16906/

Analysis

user interaction
yes
max time kernel
898s
max time network
901s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 19:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://guidedhacking.com/threads/how-to-make-lua-executor.16906/
Sample260723-xp69wsvfpg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293069842456696"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{23EE15D3-87A4-415D-8CDE-1462B6E3BF00}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2388	2444	msedge.exe	87
PID 2444 wrote to memory of 1176	2444	msedge.exe	88
PID 2444 wrote to memory of 3244	2444	msedge.exe	91
PID 2444 wrote to memory of 3244	2444	msedge.exe	91
PID 2444 wrote to memory of 2940	2444	msedge.exe	89
PID 2444 wrote to memory of 2940	2444	msedge.exe	89
PID 2444 wrote to memory of 2940	2444	msedge.exe	89
PID 2444 wrote to memory of 868	2444	msedge.exe	93
PID 2444 wrote to memory of 636	2444	msedge.exe	92
PID 2444 wrote to memory of 868	2444	msedge.exe	93
PID 2444 wrote to memory of 868	2444	msedge.exe	93
PID 2444 wrote to memory of 636	2444	msedge.exe	92
PID 2444 wrote to memory of 636	2444	msedge.exe	92
PID 2444 wrote to memory of 2264	2444	msedge.exe	94
PID 2444 wrote to memory of 2264	2444	msedge.exe	94
PID 2444 wrote to memory of 2264	2444	msedge.exe	94
PID 2444 wrote to memory of 1952	2444	msedge.exe	95
PID 2444 wrote to memory of 1952	2444	msedge.exe	95
PID 2444 wrote to memory of 1952	2444	msedge.exe	95
PID 2444 wrote to memory of 4548	2444	msedge.exe	100
PID 2444 wrote to memory of 4548	2444	msedge.exe	100
PID 2444 wrote to memory of 872	2444	msedge.exe	99
PID 2444 wrote to memory of 872	2444	msedge.exe	99
PID 2444 wrote to memory of 4768	2444	msedge.exe	102
PID 2444 wrote to memory of 3164	2444	msedge.exe	106
PID 2444 wrote to memory of 3164	2444	msedge.exe	106
PID 2444 wrote to memory of 3164	2444	msedge.exe	106
PID 2444 wrote to memory of 2572	2444	msedge.exe	112
PID 2444 wrote to memory of 2572	2444	msedge.exe	112
PID 2444 wrote to memory of 2572	2444	msedge.exe	112
PID 2444 wrote to memory of 1048	2444	msedge.exe	114
PID 2444 wrote to memory of 3504	2444	msedge.exe	115
PID 2444 wrote to memory of 2460	2444	msedge.exe	116
PID 2444 wrote to memory of 3120	2444	msedge.exe	118
PID 2444 wrote to memory of 3120	2444	msedge.exe	118
PID 2444 wrote to memory of 3368	2444	msedge.exe	119
PID 2444 wrote to memory of 904	2444	msedge.exe	120
PID 2444 wrote to memory of 904	2444	msedge.exe	120
PID 2444 wrote to memory of 4444	2444	msedge.exe	121
PID 2444 wrote to memory of 4444	2444	msedge.exe	121
PID 2444 wrote to memory of 408	2444	msedge.exe	122
PID 2444 wrote to memory of 408	2444	msedge.exe	122
PID 2444 wrote to memory of 1016	2444	msedge.exe	123
PID 2444 wrote to memory of 1016	2444	msedge.exe	123
PID 2444 wrote to memory of 4224	2444	msedge.exe	124
PID 2444 wrote to memory of 4224	2444	msedge.exe	124
PID 2444 wrote to memory of 2200	2444	msedge.exe	127
PID 2444 wrote to memory of 2200	2444	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://guidedhacking.com/threads/how-to-make-lua-executor.16906/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ffd22cec188,0x7ffd22cec194,0x7ffd22cec1a0
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14613653084032282486,7701997342059192533,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,17564827623796010913,8798840798796938237,262144 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,11621713884145934167,18215214266537955462,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,3153408844034503501,16767122695750793350,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,16159160939936622652,7651826215290766117,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,7215709569462808535,10255667474707649643,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4295046031807976799,15682322955687980355,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,10731307005112382267,495457972711287008,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,15074082340622778111,1226236618016654527,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,12546004339154541255,16045319987673755887,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,12546004339154541255,16045319987673755887,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6052,i,6325329013100824787,14040746714326647584,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4472,i,8357553375654052827,17635870769174185082,2097152 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,13980469063841257965,18068158646148509388,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,3135805508368370421,14785632518048924107,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=140 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,3004933728016406566,12757744421394752626,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,8140798196224205762,11524656262681432791,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5784,i,16505230542950370322,4293702928122087064,262144 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1002383498281033791,3091965158109489908,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2732,i,6144835481460796572,6729941212649788467,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,3470999917150209462,5620212422306124741,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,211899821601303338,16318591527235338846,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,1255265890033701411,10296553765176048564,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,7096846376507696988,5776758447677350697,524288 --field-trial-handle=2364,i,5275973219732847026,12064879646029645762,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 502d12d736546ef64d8f902c0a764e68462c0f0e16ab6d65bc2085a1f6d50134
MD5 62c67e7de8a821c4de60128849c6d1d9
SHA1 c99233ce3ff3a60e7421485660e87500380d8936
SHA512 1d9af18be5c6369f9a8ea5b287c58b403083989f0105b86b2f19988ee61f4a186b925a418613bd6d8ba6b41799e7dc847ebfbe1d1a0f77fa370de0a546fe35c3
TLSH
T1C5E0788444C4C3DD57417947537C434D81907B0BD3C47A15374C864875035C0F3D7970
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d2e81bde77ab690d0de8e639ad698af5c2ed417fd7109424e1406908435a0537
MD5 94713be2499358e02c3ec6af02a16615
SHA1 fc7f9c8dd19c33bd0fad27d3073cf6eb22d3f188
SHA512 69eee632ef9a4177308bf9a39b55ca59b6419ac7d37ec41e84594b4782bbc4f8fd2e14fa89257d531d3d736658452342235ff329cde21b30f9fd79999f09ce72
TLSH
T114E0DFA484C8C33EA680B4C74168438DC2A03A0B93C8AA1A27088C85F8020CAF3A66B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b463964ce0eab216a481222685b9de38dd928c39eca1aea093467f7a6a859215
MD5 8146961c18768a98b97c0c6a488f58d5
SHA1 2777ec54edf8a970759230d92dd4f994d244fb1c
SHA512 2e40a0e5091cd16a5c8c05fa56a3a7d52c8e8e96d01d71dfaf4dc856a8db7b6274cbb9016534b9afcd7bb849705569cc54fc7e5fb432b833222a1b3f1a7d5186
TLSH
T10FE0789805C4C3DD96C5745741DC774C81D0360AD3CAAB15375DC45474814C4F3D35F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 28KB
SHA256 6672e6a25ff27fb35f4a259d660959bd5581382a5e6d82f386379ebd3f285637
MD5 715fd57ef8cb9e99eb69f5cd370f52d8
SHA1 f407d02c2894e65369410d532b53b251d2917941
SHA512 afe412f57346186e65cd7e89716d0dab59272c040c0b11b9f10e114f76c174da9bf9c6e44e2c7e9c208549309bf21d8b25bd9cb0474deb247dd91178407e0cff
SSDEEP 768:34T6ObSF7Ej76BfxFoFRJ8oKPjuXiQFQZw:34JbP/IFoFPvKP6XdOu
TLSH
T144D2E0F6A188E96BDF34AEE5023E1525F2120AF51467BCB1EB2FD21D17C957352BC820
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 f921ce30280fbe41652d6f54f2591ec9d83096c99f2ceb0ac16f95d99542ff52
MD5 406ffc6dace5f58801879ef896497988
SHA1 3d1b16693aeac36f13570ac775d32ca5527bd409
SHA512 e2c86b631805c15190c08b419987713151fe43907d86e11dd5f16c70c91287b738c7044ebc49eb32d002337f96670def7e119085e8396154fb356d586af9adc5
SSDEEP 96:5FROGZLholVMcN6+NGyWgl6ujnuHhLwMEymMMKs/mhL3cwst5m/jdQ5wBEdjD136:5FfKHGXSk9RBHQRGOpwF
TLSH
T1DFC1C8B484EDA051EFE8093251D209713EFB45F5FE67BE8520449D3A1A3A3538E5733A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 20ce596d8cf3d85568a6c068236eb78a2e780a4dab4ebd5eb7039597221ceceb
MD5 a3bf347bd91862521cc27558bfc2585c
SHA1 f6622f0d09b7bbb8c592c5ccb6c0fd50736cac9a
SHA512 146599d724c397ca832f6afa05f3a7000943dcd561b35e3541770656637d410d43fadaa6867ed493570034a9de553541e00d200881b1772bf2a50db0048aece3
TLSH
T1E161DFF3C7D9832DC81112F099687E2ACE5E095983283C1AC8E8EF5FA3F2471D15665D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cf370b731eaeb6db960e3a83b2f6b59da0b07b08ae2c1f433bd2ec992851b72f
MD5 d41c5eddaa08fdcf21645ee65df67aa7
SHA1 67d23deb0ea9124aa73b3bcac665baaa352608bf
SHA512 d951552a6257e25ab746b9996d4fba295d98e4055f75b43f218de915f640c485b778dde59c3639aa7278e6e74da20f52accf5d5f9f81daa4477f61964d356224
TLSH
T15041ACB683E5835DD91112F0D948AE2BCE6D0419435C3D6AC5E4EF5BE3F2072E092A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7a0d4614c7ba92c7e85294d9973828dcae46dd70bd0ebbe931662adf66f47241
MD5 1b0938031e57080884e78681394bff00
SHA1 878bf4b441c3b4a0a70eebbab775bdf269d9912a
SHA512 75c4980a6153bf8be8586f296f49b96e96cb4e0661647d7cb81d66eb15bccf10b9a3b9983e22877173ae238eca2b4407be49b374bca56ccfe51f08028cd4650b
TLSH
T1C861CEF3C7D9832EC81112F099287E1ACE5E095983283C0AC8E8EF5FA3F2471D15255D
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 70bf1c62dd1331652217375b3a7d1b3dca1ee4a4b8887e7e579c038a40d39b27
MD5 62ff1b47ce68888e0fd660fae6bdd860
SHA1 a17b52ec59f3c2279e54cf55d6c23f035bcc5fd7
SHA512 9f5962266a281ba10dacb13826bfda3e3077d37f7afe5978e54db9724dc21484a09a22d14fd8f3a1970f37c8a04ac9a5eb53c75d05ddf3c5689d82321cc57adc
TLSH
T16F51CDB383E4835DD91112F09948AE2BCE6D0409435C3C6AC5E4EF5FE3F2071E192A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 e30074dc11e9395dcdf96f08987c7095adc5c10f09b7627f1fcae76819d5b4c4
MD5 e7d419bc66b43211b99b389c3e133bce
SHA1 3e5d7ad90a5b0524421d55cb7fd8d873c50cde31
SHA512 0ffe2b5f9f57ae14ad96687d08ead6f92060548dcc55ecae15efbb3b0e23b34ec43dcb8a89437aa7e2d89bda7863c7e664e52b37521b1222bf8585f101e82b7b
TLSH
T146D02373170130B5D57C3D856097FC8FC36600100439DDD971D064EC8D3386D054B145
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58b1f6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58b1f6.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 844552cb0c98d2f3bb64ff76c8d8f19975a6a5c0f71c3fa71caa78b5386ef204
MD5 f1537358acdf6b31a986c4b7e9710440
SHA1 ab2e59c6a8e4492ddfb4eb2df13df29d6c33fe53
SHA512 b6452c0b9b427554d6602a199bb65d040ae719c4886c67fc75eccc27b79e5a53ef92c5af30c7e53de132b2d5e9fdd055da8931819fdaac9406073a7001ce9705
SSDEEP 192:sxZqRx0cB1X/f3sGIAwdpTCW2HW6+WN7rcbHLb3k/YCxx75TSIgrJ:sxZqMm1X/f3sGIAgMHbYrjk/FPm9
TLSH
T16E32C7136A34A97B8CC7D219BA15FF53D2F95032D5D05E98E6FC8A0C08E6ACD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 54439a509ae86e2a5ba28e9ee95e7ef395fcc7fa0784b420fcd4e3a1bb949f76
MD5 12e23f8190d416795b591300de699f48
SHA1 174eeb37f72e4a261200cdb492c8721b55b7661e
SHA512 9901fcab24706336ce02a671e4e4abf06b20b2bb7ec9452bcdcda89e43320cd32267a280ae4dce8825a629d219e48ad2791723fb95693e023d6c0f1ec0cc2642
SSDEEP 384:sxZqMm1X/f3sC7j66s8qMpRiYnazAW8pZS15posJWeT+MA+FWnHbYrjk/FQ2b2X5:syMm1X/fJj4Mnc7WeT+jfHbfqh5
TLSH
T194D21A069924C8778FC35D18693CBE339AEC50625AC5DEDE1AECCA1C019E1FDAB0B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 318eac92a1973183f9c08c753869b28815b7278b5b1277b57bae9ce0422911fa
MD5 b7173b18f29b976cead0209a17ad96a7
SHA1 dd6e29394bb1aa5bab4b1e4a832cf253db706b70
SHA512 690d45e394d7a747ddc59d4994962c71d34ea6aa8410a993d8eedccd4a20bebbc5fdb5ef87110ae8e89b43ed6aeb6fc2c3894ccd21c17b2472682382a8bc6435
SSDEEP 384:sxZqMm1X/f3sC7LA+7WnHbYrjk/F1mb2X5:syMm1X/fJkVHbfHx5
TLSH
T11C52C6626924D9778CC6D619BA35BF13D6F91072CD911E9CAAFCCA1C04EB6ED230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 943347e6573eac83ab8297c0f527062827d358635210fe457147c1a01dc091a8
MD5 310cb4defd3095e2bbcc15fd2e730fab
SHA1 9933c3b1078896ec343ed1456e53b1f54077b03d
SHA512 ef9d90917d4d4febc6375f385064b03909831caf87903cbe85f1435142c7496b9cca942c075d7d64293879ec339727f51f7d0e381afa326f1798000a65e9c4a8
SSDEEP 384:sxZqMm1X/f3sC7IA+7WnHbYrjk/FPmbUX5:syMm1X/fJ/VHbfxj5
TLSH
T1CE52C5626924D9778CC6D619BA35BF13D6F91072CD911E9CAAFCCA1C04DE6ED230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 df69be11576eb6312c1163054f13a58741ce38f873d2090bac25a21add634d30
MD5 1fbcce3ec2e54807c0cfc1f942c86bd2
SHA1 79a0f5bddaab8749c39862b552cfda3031e2aa51
SHA512 3957c0f245ff2521c2cf4f418fe2a7a6db47ef54ddb144a4f9df4243eb42f547d3e52bfc5ddf61690f73ec78629ac2f45e3e13e125e7b7afa29bef12bc6042da
SSDEEP 768:zxqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrkrol:zxqbUj+WvSCU6u1jaaZLbWrvl
TLSH
T12DC2E93B340CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\temp-index
Size 816B
SHA256 2f3cfe748d19fa80725aabc8d3e3741eca144ac58b5839480fc949552a70d91f
MD5 9d1e5260752c70d610d35fa592398505
SHA1 caad2f6ecf514a9f5c39584a34b4cab13cbccab9
SHA512 7bf9b17389eb0a0ecda3eca72b0f01388644d84b1be6f63bc2bce79853b089c59baa623b915ae118dec71b368f5a07a092f463fa56e06b5f60015fdb9d201ee2
TLSH
T14C010C9A5EE64C2FED540AB304B974F473B0C9DC6721E223583E21272C36389692A0C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce5b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5ce5b4.TMP
Size 816B
SHA256 3a85ca4e106206a271141a2f99bae514c8972c26367527504e0ca856a4bcc8bb
MD5 7040252e76b34640449478d05131ea18
SHA1 f0a81f0d3e89d0d9359775b28d2614a23fa0d762
SHA512 38a74f6fc1e2eb90a9d5ade8cf5bfbfc29c93c9d45cdd5892fae556afd43a3a535f6c460746cc144aaca39d506785edef3e170eea43b2d443104a1e828483997
TLSH
T1780126878BA74D5FDC5406B7098560F47375CD006332F793947E253E1C7A38959170C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cd2ececd37a4245da199f09f77b0ee7c502a3dfb00ac379178cf1c1ea0b20c5c
MD5 5dcf30d9ab2c39216b77468efa6f5008
SHA1 b86194a1c21d2a926f28f0a3c695dde90c9e9549
SHA512 3e327b4b8997bb074855ab26114a1cc39fc0f21e2a7ac2a665d5a6d48bda8e88cdc37a6ccfb205932dc28e66a3f87df2699f6e3b077997449059510f03098eff
TLSH
T110E0D8BA29E72864BC7BA3FA247058E002597998C98AFC9E1069A1D750B3361385AC61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 772e3d467c06a858d49ab7196157f1588a9d6f4224c1414be8251ebf9088e2f3
MD5 9266169e062b61a946cefc642f722c04
SHA1 d43bbfcf63fe27a6d7f757168e2255b04c150f06
SHA512 2162a76a0ed2fb62ed9fb24c7e5882e889d48a7aee2783fd02fa519d2e52c62050a4da1d57b1e94f3a12d5bfd68505b884f8fa8d307114d91ff954af5a9508e9
SSDEEP 48:KQJI5Ky8sjyhOIXKzacnyhjgXz1xFgRZSzI+bgKz1btgHrwsCNU:KQJSKy8KyOIKzam64YKBWd
TLSH
T16291F01A313A4292687E2588F3979A365F4235A33154E86F3FB804A21F67E120CFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ad9010b-7f10-4846-8799-5617e580347e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3ad9010b-7f10-4846-8799-5617e580347e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 591ba45e7bd1459b84eec82e592c54b2cca1a964ae7e5bb7c5582657055be9c5
MD5 8dd28091e18edd80c8bf5e322c62526b
SHA1 2ce23a755eab7188c3775b570a07c5abf02ff5d5
SHA512 c93f143632039d5358a35e65b96af55da7d81071bd5c5c84090f84e245eb13972b50e43e56d3ad9099c9b92eeefe331dffb777968f2ef632c22add92598f0d95
SSDEEP 384:SZcIhsNDZu/YJyEa+SdPId+2cElbhlDzzwAiXWv:ghhC5an2dlcElTDzzRpv
TLSH
T1D0928C365C745C7B5AE6A145F84736174EF881A3CBCABF80E6EC9F0D00DA5AC131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f64336100bdb8294530928f07453eaaa0e9b0b8ce003e6ac19596cf97c0253a2
MD5 9c1c079de78cab114cddc411f40792f3
SHA1 46a7651b832cfb988c296ebf6084a341bff9872f
SHA512 9aa918ca51f657ffda9210b2aca6766e26342b49a3df0892ccb7419e2eb0f227bf9d29abcd46db178673f6c123dbade2195da2d0e96f38f36c854f646373480f
SSDEEP 384:8iFiZcI3zsNd8TUNTUlIlQu/YNyEa+SdPId+2HElbhlDzzwAiXWv:nFQjYwgZY5an2dlHElTDzzRpv
TLSH
T196D208F648E7887AD9AD5747B77E2D024EBCC163B685AA50B3984A0DCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7c1d946d381b4daf7deb497b11a7acff0280b91144371d686ae487ed8dd4d6ee
MD5 90895e611e76a93aa4019a30ab7d4288
SHA1 a42d07f8c447a6602a6d4fa37567bc2e60216fb5
SHA512 0b3a35bb33146fd573a96cac9073e174e2a99995b20971bf8d39eca5e86e74b4bca77c7ebb02c0953cc916c7b6f6f04e32b85d97c77fbe9173e0d0c45d67f192
SSDEEP 192:vONGV6Db6QmiUy1B15HBa+jx+FdCYHojRgDipU6:vONY6uqHBa+SdPIampU6
TLSH
T10002E93568386CBB9EF26E49F88727239FD4107BDA962B44DAEC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0ff844d5b034aa5f6127bb130f5c046205965ee9aead3d5f353d1d0d87d02c99
MD5 70e792d2ae3c7ec8e0a46a5a0455f2a6
SHA1 20a07917c6317ab463cfe451ca386105e2d3ca8d
SHA512 90898b359a4344510d6840d14c5fc9e632e63ee4c5a4001b7b1e4b10fd0f8983f9fbd2aa36e266cb7d6ff1f938e73cb9446cd9f617f123bb91d4bc81ce27a85d
SSDEEP 192:MONm6DbjQmiUy1q15uBa+jx+FdCYHodX+28NzxqFU6:MONm6NvuBa+SdPId+28EU6
TLSH
T17D122B3668385C7B4EE2A545F88735135EE48167DE8A3B91E6EC5F0C00EFA6C134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 601183296f1efab874199fd27aa14133c3e99ce5efb78cae198ba02e99b9bf74
MD5 8b07334c88be8765079f47a687bd32e9
SHA1 3c351ab9e43e4c47f1ce7b023bcbfa63b05a7438
SHA512 149e07426c483494318580086b659092846d9f08eeefd344398a8e8833da842fbb64fb09508e2b12856838af764889ccd88e3880104dda616e009cf27a5e1caf
SSDEEP 384:xZcIhsNDQu/YJyEa+SdPId+2cElbhlDzzwAiXWv:ZhUC5an2dlcElTDzzRpv
TLSH
T122928C765C345C7B5AE6A145F84736134EF881A3CBCABF80E6EC9F0D00DA5AC131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 24a7be4c697fb9c092710c719cea3d221b56094f062851cf9776ccff7ae3fe2c
MD5 3ae6d73d36d96cd26c615419d301a6e1
SHA1 57068f0958f6d0817c3da0651534ed76facd1e1b
SHA512 48e2d6db1c7a9ac9c162d20b626475dc78cf422065b8e9cc59501ed00bf45d9838408247a291f1c253f5d158fe6bf8ac5c3b3ff64160c5c7a0ac4704378fc032
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58943c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58943c.TMP
Size 392B
SHA256 1f6dcb364261c1f565651805fbed31efb10ac442dd2f76389293a1b8b2684bd1
MD5 d026b475cc4e02e8cc6240c1045bdae9
SHA1 7037ae08461b8ee1babaadb20f56dc2945bc2e97
SHA512 7c5a7fd554c6874ac38a3f15cbbbf680138d7367b4befc99995c49a6c23c6e194c78375aec6dda0f17b5e63d7729dd742df58a06114aa84c938bfeeec70ca054
MD5 SHA1 SHA512

Submit Download

9f05f989-f4b7-4e32-a314-47ae5fd28679.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9f05f989-f4b7-4e32-a314-47ae5fd28679.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d99be2a2b19e433d2cdc043d9749ef014e8ae74d60e1a2b84d176904cdd133b2
MD5 40f7a23102b982edd19ee3334f5e4b08
SHA1 14ca443392ae01f6ea960b3d39314d156000cf5e
SHA512 6a686365a8b070b11440d04fd25634e2237b432bb347ec10a994285244818f6743f06db749fd305bba67c0fdd13a752d3da5d8b3fb35eed8000d86faf2056ece
TLSH
T12341F558B6F91148B3B36F469BF6A96E487E79372E0A945D00510E4E0A62E40C972737
MD5 SHA1 SHA512 TLSH

Submit Download