hxxp://projectreal[.]gg

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://projectreal.gg
Sample260727-txeytsca37

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
242	discord.com
61	discord.com
62	discord.com
66	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1676	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296431731974986"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{50EB1AA3-6EF4-48D3-B423-3634D2570D5A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4936	msedge.exe
4936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 4840	3216	msedge.exe	87
PID 3216 wrote to memory of 1676	3216	msedge.exe	89
PID 3216 wrote to memory of 3228	3216	msedge.exe	90
PID 3216 wrote to memory of 5012	3216	msedge.exe	91
PID 3216 wrote to memory of 3228	3216	msedge.exe	90
PID 3216 wrote to memory of 3228	3216	msedge.exe	90
PID 3216 wrote to memory of 5012	3216	msedge.exe	91
PID 3216 wrote to memory of 4124	3216	msedge.exe	92
PID 3216 wrote to memory of 4124	3216	msedge.exe	92
PID 3216 wrote to memory of 4124	3216	msedge.exe	92
PID 3216 wrote to memory of 4884	3216	msedge.exe	93
PID 3216 wrote to memory of 4884	3216	msedge.exe	93
PID 3216 wrote to memory of 4884	3216	msedge.exe	93
PID 3216 wrote to memory of 112	3216	msedge.exe	94
PID 3216 wrote to memory of 112	3216	msedge.exe	94
PID 3216 wrote to memory of 112	3216	msedge.exe	94
PID 3216 wrote to memory of 2800	3216	msedge.exe	95
PID 3216 wrote to memory of 2800	3216	msedge.exe	95
PID 3216 wrote to memory of 2800	3216	msedge.exe	95
PID 3216 wrote to memory of 3092	3216	msedge.exe	97
PID 3216 wrote to memory of 3092	3216	msedge.exe	97
PID 3216 wrote to memory of 3092	3216	msedge.exe	97
PID 3216 wrote to memory of 2664	3216	msedge.exe	99
PID 3216 wrote to memory of 2664	3216	msedge.exe	99
PID 3216 wrote to memory of 4616	3216	msedge.exe	100
PID 3216 wrote to memory of 4616	3216	msedge.exe	100
PID 3216 wrote to memory of 3100	3216	msedge.exe	104
PID 3216 wrote to memory of 3132	3216	msedge.exe	109
PID 3216 wrote to memory of 3132	3216	msedge.exe	109
PID 3216 wrote to memory of 3132	3216	msedge.exe	109
PID 3216 wrote to memory of 5108	3216	msedge.exe	113
PID 3216 wrote to memory of 5108	3216	msedge.exe	113
PID 3216 wrote to memory of 5108	3216	msedge.exe	113
PID 3216 wrote to memory of 2044	3216	msedge.exe	114
PID 3216 wrote to memory of 2044	3216	msedge.exe	114
PID 3216 wrote to memory of 2044	3216	msedge.exe	114
PID 3216 wrote to memory of 2572	3216	msedge.exe	115
PID 3216 wrote to memory of 2572	3216	msedge.exe	115
PID 3216 wrote to memory of 2572	3216	msedge.exe	115
PID 3216 wrote to memory of 2844	3216	msedge.exe	116
PID 3216 wrote to memory of 2844	3216	msedge.exe	116
PID 3216 wrote to memory of 2844	3216	msedge.exe	116
PID 3216 wrote to memory of 3284	3216	msedge.exe	118
PID 3216 wrote to memory of 3348	3216	msedge.exe	119
PID 3216 wrote to memory of 4800	3216	msedge.exe	120
PID 3216 wrote to memory of 4888	3216	msedge.exe	121
PID 3216 wrote to memory of 4888	3216	msedge.exe	121
PID 3216 wrote to memory of 4888	3216	msedge.exe	121
PID 3216 wrote to memory of 3732	3216	msedge.exe	122
PID 3216 wrote to memory of 3732	3216	msedge.exe	122
PID 3216 wrote to memory of 3732	3216	msedge.exe	122
PID 3216 wrote to memory of 3752	3216	msedge.exe	123
PID 3216 wrote to memory of 3752	3216	msedge.exe	123
PID 3216 wrote to memory of 4936	3216	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://projectreal.gg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,15447503233248815754,6628735922699586836,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,5123986303647302246,14102972518407380976,262144 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=2540 /prefetch:2
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,10743782720244570142,5409969103393564809,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12275814576404027187,18434968920852604182,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17822136224734381525,6694896110377956711,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,4396397275264410495,3791708786534577172,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4140,i,11213117405962679202,16705592398674745315,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,7594081648612097374,6282052091244748090,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,14170896837729029018,5115353887921206444,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,14917932553885277960,12243219545425445343,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,17587447385189135901,935926165737532984,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,17587447385189135901,935926165737532984,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6332,i,6303202547016188246,13341712084060607682,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6140,i,11769995232272112810,11831771677125726671,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6588,i,1292340630042076931,4018354328816547854,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5276,i,9713654999130237227,6044467482528642735,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6848,i,6786397118837828563,17401254682771278817,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6836,i,6900368248738438639,9123947695668471893,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,1254819022049688055,14056012093256628625,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4404,i,8521720178726509927,17253596761843038285,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2168,i,12671747431071664285,15076001113886117234,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6760,i,7945354585666857362,8471025454160722567,2097152 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=2588 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,7364169594749581761,3090279309253207361,524288 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5920,i,17343634530495751259,3593464816671807253,262144 --field-trial-handle=2544,i,14407682574655045186,6115460510963563994,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 ee023e1225c1bbd2b4092aed99b2ed5c38335e4af15c6577744ece6637c283db
MD5 feae2a09cbeb7cdbf3c96acf2e4e9e3b
SHA1 819fc5b0fb8c8a1c5ca9fc548950d58fe0f0c1cd
SHA512 ab98c783128a07b18a8a5a9efa6d4c3ada613581027bbc245198af8408b6d791c1a1892e806e80bdeae30b7747c2c97d2e5d749941f6454fddf3226ede344bd1
SSDEEP 48:TRSZjbgDvz4TKrCWIlLYdnzU1Jholn4XFXFpmoVRnaFk:NMjMP4T3sB4XF7VRa+
TLSH
T17091950901F9444DD325A330F9DA1D0A7CF3F18B0E076D8A316CC4BC513A7B6F46645A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0372a6d34c5d89b82b0587de73d6d2e2c75afa3c1607ece66cb05578d32cffd5
MD5 7876e585185c4a9458baa06feed3772c
SHA1 e706ec1a222402c92fe2b4b4bceee7794f729f5e
SHA512 f0b11951ab11b6a807bf7fa784ae19e4acdbbcee73e6e3c1a6bd915e3c912f84fba7a140104d1e1a3c0cf353ad68b3892b071119a06063a9526328c05f931b5b
SSDEEP 48:gR/Zjbgqpz4TKoWIlLYdnzU1Jholn4XFXFpmoVRnaF6:OxjMO4TpsB4XF7VRa0
TLSH
T1A091811911F9444DD325A330F5DA1D0A7CF3F18B0E07AE8A31ACC4BD623ABB6F4A6506
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590863.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590863.TMP
Size 3KB
SHA256 433234b91e6290c022c9e499227a8257d1e1a383854c81eda7643f4928aff1a0
MD5 adb1f0c429b7434f6a440bae89248cf2
SHA1 8a28fde9ccfea1772b4318d1a4de230f52d435d1
SHA512 182ed36df60ef05b847e27fc6a9db7f2bed577fa29cf483ee82cb1a54f99678ce5cc17655fa49279a35e58782473327355ad24ef3448151d6d1a671f019926e6
TLSH
T14A712B1A02FA489DD721A330F1DA1D1E7CF3E19A0E139E89319CC8BDA53A734E4A6458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 f80faf2e9292f1586393f117d81762e5d277f5b978cbc92b6354b2ed4cb5a000
MD5 efad9a7a92f96461352ee0dc8add2e24
SHA1 d1591e2e524368552d0d78d53cd67ce196abd7ed
SHA512 a688322668aec59844bbc91b327457f40d3b05088c7477d8f8025c089861b774ef8a0c33d5c88008da445fd1a8444f7d3a1e37a443f2624d781e12a01ae4de30
SSDEEP 192:DOxbeXPVPf8PplPOJPrPBPwPNeKPdwQPIAPOP6pDaihGOPfIP/GPjPPPoPyPmQPo:DOxbeXPVPkPrP2PrPBPwPEKPdDPXPOPl
TLSH
T1FD3259A7D3D4876DD96152F4AB142F1BCE2E1D2443283C36CAD5AF4B97E2871E30164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 04c45142c8bf8761d456db81114dd87384c23eb25d396d22f440992df3aaef25
MD5 ac420f50978d9a534507952e407ef420
SHA1 0e54a19d8f50e1ebba11d89516650e851012b11a
SHA512 4b70b949c907448a8fb1f884cd0cfe18ecd8330432fae5319a3b74a5a8f1105219a84caa1b550c901af32ee40aa1503cefb39a8861d6d2f2d0936ffca14f47f0
SSDEEP 192:DOxbeXPVPf8PplPOJPrPBPwPNeKPdwQPIAPOPhDaihGOPfIP/GPjPPPoPyPmQPjq:DOxbeXPVPkPrP2PrPBPwPEKPdDPXPOP6
TLSH
T1CC3248B7D3E4866DD96152F4AB142F1BCE2A1D2443283C36CAD5AF4B97E2871E30164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f395a20af763320f5dd864f9e8cef501035ae67f50761dedc750ab4951130e7
MD5 0e46bdf7744db58bb4b58cda67da0362
SHA1 b4fc17dc83bf4dab88551c0d73de9049073a5dad
SHA512 1000b7af0ea5352f8d61e8be48725d18d986d13bb5b93e75d14f022fabb249c4dc3a99b3b82eb2ccf201e54d3df0cdb2f55f32b268daed0de2df33c45f5dfae5
SSDEEP 192:sxZBRtyM/jK1Ml8Mkg/fRskSFjIdpoCHW6+WN3ns/Y4/9XVIgrJ:sxZB/Mg/fRskSF8HHb8/p9
TLSH
T13042E816AA349977CCDBD209FA54BF53D6F5047292900F44AAFCCA1C04E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7eee7b1a5c7b85d68116b81f617d2664ed67a922fff5b33085f217a2b81490d9
MD5 d1c96bb1a03217402370f1eea9456ab1
SHA1 5d3f58c53a4daaec1c82207dde86e5f8db06e490
SHA512 fc5dd40279774ad8e557cf84ebc43b8f89d9f8aa4e32288ad9817496776191dd9d3b3bf23061ecab419c468859a597a26388d2a98198357654dfc7925c1d6814
SSDEEP 192:sxZBRtyM/jK1Ml8UQekg/fRsWS+CIdpqBKWSyhvw/HW6+WNyMpnFN9KagHXY43CA:sxZB/q1g/fRsWS+rA9WHbjaJXW6
TLSH
T1E362D856A63459B7CCEBD219FA40FB53D6F51472D6904F44AAFCCA1C04E6BED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d1a6e914122c384aa1506a28f8ef32498f0465738ce8750e5d5aa452d0fae4a2
MD5 017d8b6bb90a9665c775e45f99d6fa4d
SHA1 7cd983e14a52b80826ebd3f782a800a3b16e0ea3
SHA512 0da710204a7ebcd0de0ec12a7dc5003ea761caa2f4aa3307158425e0946e905c4088d44d46ff3f683a294cb0caa99c07394ecea09738b564f9feb15dfa0d3646
SSDEEP 768:Lf8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdUroQkbUni:Lf8iJPNWvx76ru1jahALocd/vUi
TLSH
T139D20A3B680CCB7E4F844E9CEC266F966DD801CB6B948D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bf7dcfdb081bf1d54ce90834b748cc08a755647a697130e4c51afbf9d9f1cfde
MD5 b9613ccb09217031f3237bc48fab1bc1
SHA1 c1920ded638fb5a51b2ee450b397d4a00481ecf4
SHA512 77bbf32846bf30b933bf1af46110dcbfcf90a15c14de35a49dcf593a4f34f8c71fcc7cdc6b85fe45b94304e246d5bc07d348533871aa88a47f356f2f8e7173c6
SSDEEP 48:KsgIvKBWMPyNPK7/1pNkdpgPIgXkKDBbtkHf0aA1r9I9KeIAPy7:Ksg4KBW2qEgKNCG9eKeIqI
TLSH
T15E916F5230BB23522C7D2C48E65596664681B6A73258E47B77F904B24E3FE220CFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595ae8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595ae8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a824a42c8ac6e5fc7330c1a137ce576e175c70a33979495aa54c4d8d9ce7107f
MD5 eabdaf447adc5b2a0260da5ee0a753a4
SHA1 5f99c18d591ca3b59aad8e39b5fe9ee8b8bf158f
SHA512 6bf23b659f4eea895f39792676f6f04051704f67fa0b4879f6969df09de57fcace9361efae8e5b1d9dcdbc6782c4f87fa31438645843ab3e2228bde3a546cd35
SSDEEP 384:gZcIhsNHsLni0w/4kkTiGsgOObjI9G6w7/E:ehhny/0sg29M/E
TLSH
T1C4929E32AC38697B9DB3A552F4863A235FF49077D7D85F84E5ECA70C09DB4AC031681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 fc13557bcb1c070420f0381390edf5ec7bb44396f40acb1adb7dcd2426a2e825
MD5 5b2ab2bc5acfc619db3092131da3753c
SHA1 a31155bfe6b9015f346fb16922c17a5636859041
SHA512 9301dc738bc1cbab490fa02ee313e19f8f3386be1a9234b47cfa5c3cc7868e68e726dfd566355f8647816b03d2debb7e2bf9a4668b0ebef0bb5499d10c7a7b69
SSDEEP 384:9iFiZcIPzsNZ8TUNTUlIlnLni0L/J2kkTiNsgOObjI9G6w7/E:0FQrkwgdnR/JJsg29M/E
TLSH
T160D228F258D7853AD9AE9B43B77D2E134EBCD067B6949A80B3D8560CCC960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 18e666eaccdc3a59daeb4613fc6b057059e440b5baa6bfc693b7862bd4e14032
MD5 5e1e7edfbbf7d69ca86d4e9fef9797b1
SHA1 b5744f5a2fa10327a3afde377afb3e725af7a8bd
SHA512 0bffe6dafbf0d77706e15928936b1e7d035aadb19089429c44b6b2b62ec2c4be1d88aaa7074e98af88851c37239087ae42b65d21b7b6efd189f2c744d01bd4ee
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5G65DG8BhPwivh50xy0SFYKCAxTeN:gONl6kDfQmiUybzZ903plQisFctU6
TLSH
T19502FA3568786CBB8EA3AE46F4477B175FE4112BEAD52F84DAE81B1C04D724C170683B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 aa1f0a90510dead9220ed8f50ccda23f60d07351394122908aa80adc3a3545e9
MD5 88946d837eccccf46fa4dc44ae1f18bf
SHA1 55d2432c701aaaef4e6887761d60716b577555cd
SHA512 e859929ecb103a34db0f1d07ae1eb115ab3526d5e6ffe69dc7cf25cf911ff35b192c3b6cc20df9eaf105548dec1ef1882a6403ea9ad0e6c30da2afa0c665603d
SSDEEP 96:8qONkqQsjpfmUTuK5ih/cIPURHl8h4otop5G6+DG8BGPwivh50xy0SFYKCAxTeYS:nONK6kHQmiUyizg903pTeF3JcRs6qYU6
TLSH
T15B123A36A8B86C7B8DE3A891F48736275EA44127DF896F91DADC2B1C05DF15C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e374e79d75ff014cb56fdcfd105041a91309877f22a8b2bab682a5f4975f64e8
MD5 45710d37249710a480a9799b0ff93e7b
SHA1 6cd79f9bb21ad464f7572e7c2cdd859af84a9357
SHA512 d6c5ce8b2ec2582d16ba1df7734e043a6227149083e9e59eb7264757475d937addfb31941ea9e6be111adac2354c4506687bc4da386925d444a599b48360cf12
SSDEEP 384:wZcIhsNHnLni02/J2kkTiGsgOObjI9G6w7/E:OhWnk/Jqsg29M/E
TLSH
T1DD929E32AC38597B9DB3A552F4863A235FF49077D7D85F84E5ECA70C09DB4AC031681A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 27b45b79a365637d90d200468d19fc2f2c3a159f72475a08c40faad07d0b0acf
MD5 1a08ca82af8da41cb138ddfa20f87868
SHA1 a2fd430558bd320fa9693ad2026967839a7b935c
SHA512 595fcdf7e5a3f9d5f003e8d1fd7919810021fc9475735c9155a27a289c8b570c861391c13d4663dae863999d814158b204abdf61b8e1ad12e5bd3719f224843f
TLSH
T18DE00202170000ABC439133415C31B203B71C01043830316463001785C207106E20890
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b07e8947211f2d322015671bdf2bdd753f27965f9a7b2f5517ed57df0feaad66
MD5 20eea113780e87738ca4078a5f5c2d68
SHA1 3d7f875b7fe8eaca34e4c1347a5099ce91dd4e43
SHA512 753a039121e0ec9b14105cecb57f1b9bc3204619a1e00eae3938aec4c51b9241d1d7ab04c40d32416dbf27e2b922a7e012d620bfec0c4c50e7a3beb82c9b3cef
TLSH
T1ABE00103670000EFC829263416C35F206F738070478303564F70027C6C30B506E70890
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58bf05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58bf05.TMP
Size 392B
SHA256 cea1293408fd79fc5dc13dff7938a07562b5e73c56293738a22e54c7d5f44687
MD5 17700ae9d06f013dc0043d40778056a5
SHA1 be6ca09a7dd84e3fa9c630f51c79d66e0a5afbb6
SHA512 5848f58bb11ca63d66ffc3de33c86445254bf3ca8aef6c9b2dd6cae0877d5503409c5dc8cf565eec49dd240f2c235c18dbe07396935d503d838bbfcc10bd972f
MD5 SHA1 SHA512

Submit Download

f1831774-ce68-4026-a759-20e2c3cbaf01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f1831774-ce68-4026-a759-20e2c3cbaf01.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 64f6a1c8c1cca0afe369e12f9d3aa335d8508485c991f6834b28fbbd98365a33
MD5 57a18852904e62c0523f94afccbd3614
SHA1 4854e9ebc4a708a869a09ecf472bd89e2603130b
SHA512 4e9bf78e5d7a97c37ac36a3f8c8d366352fefd1df2f9a9008916381ebb75734796f2d37abaee355bc1e2dab6c7eacd80f88c04b34b86cb5aa771ed393aa0d069
TLSH
T16141F858AAEA1158F3B76E56ABF2A86D487FB8772E06D49D10010D8E0A23F40C871733
MD5 SHA1 SHA512 TLSH

Submit Download