hxxps://stray[.]bcnstudio[.]tech/

Analysis

user interaction
yes
max time kernel
353s
max time network
357s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://stray.bcnstudio.tech/
Sample260728-arbvfaeb92

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
41	discord.com
42	discord.com
44	discord.com
70	raw.githubusercontent.com
71	raw.githubusercontent.com
136	discord.com
138	discord.com
139	discord.com
38	raw.githubusercontent.com
39	raw.githubusercontent.com
135	discord.com
179	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2168	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296720002530676"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{F15DCDEA-6AC8-48AC-926C-350C01BCD7C7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{0554A593-5ABF-4268-9B44-4277EB0E8ADA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5236	msedge.exe
5236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe
3744	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 3744 wrote to memory of 3572	3744	msedge.exe	84
PID 3744 wrote to memory of 3248	3744	msedge.exe	85
PID 3744 wrote to memory of 2168	3744	msedge.exe	86
PID 3744 wrote to memory of 3248	3744	msedge.exe	85
PID 3744 wrote to memory of 3248	3744	msedge.exe	85
PID 3744 wrote to memory of 2036	3744	msedge.exe	87
PID 3744 wrote to memory of 2036	3744	msedge.exe	87
PID 3744 wrote to memory of 2216	3744	msedge.exe	89
PID 3744 wrote to memory of 5060	3744	msedge.exe	88
PID 3744 wrote to memory of 5060	3744	msedge.exe	88
PID 3744 wrote to memory of 5060	3744	msedge.exe	88
PID 3744 wrote to memory of 2216	3744	msedge.exe	89
PID 3744 wrote to memory of 2216	3744	msedge.exe	89
PID 3744 wrote to memory of 3620	3744	msedge.exe	91
PID 3744 wrote to memory of 3620	3744	msedge.exe	91
PID 3744 wrote to memory of 3620	3744	msedge.exe	91
PID 3744 wrote to memory of 1888	3744	msedge.exe	92
PID 3744 wrote to memory of 1888	3744	msedge.exe	92
PID 3744 wrote to memory of 1888	3744	msedge.exe	92
PID 3744 wrote to memory of 2628	3744	msedge.exe	96
PID 3744 wrote to memory of 2628	3744	msedge.exe	96
PID 3744 wrote to memory of 912	3744	msedge.exe	97
PID 3744 wrote to memory of 912	3744	msedge.exe	97
PID 3744 wrote to memory of 3640	3744	msedge.exe	99
PID 3744 wrote to memory of 4384	3744	msedge.exe	113
PID 3744 wrote to memory of 2784	3744	msedge.exe	114
PID 3744 wrote to memory of 4588	3744	msedge.exe	115
PID 3744 wrote to memory of 1680	3744	msedge.exe	122
PID 3744 wrote to memory of 1680	3744	msedge.exe	122
PID 3744 wrote to memory of 2784	3744	msedge.exe	125
PID 3744 wrote to memory of 2784	3744	msedge.exe	125
PID 3744 wrote to memory of 2784	3744	msedge.exe	125
PID 3744 wrote to memory of 4524	3744	msedge.exe	126
PID 3744 wrote to memory of 4156	3744	msedge.exe	127
PID 3744 wrote to memory of 4524	3744	msedge.exe	126
PID 3744 wrote to memory of 5236	3744	msedge.exe	131
PID 3744 wrote to memory of 5524	3744	msedge.exe	132
PID 3744 wrote to memory of 5524	3744	msedge.exe	132
PID 3744 wrote to memory of 5532	3744	msedge.exe	133
PID 3744 wrote to memory of 5532	3744	msedge.exe	133
PID 3744 wrote to memory of 5616	3744	msedge.exe	134
PID 3744 wrote to memory of 5616	3744	msedge.exe	134
PID 3744 wrote to memory of 2252	3744	msedge.exe	135
PID 3744 wrote to memory of 2252	3744	msedge.exe	135
PID 3744 wrote to memory of 2252	3744	msedge.exe	135
PID 3744 wrote to memory of 4180	3744	msedge.exe	136
PID 3744 wrote to memory of 4180	3744	msedge.exe	136
PID 3744 wrote to memory of 5216	3744	msedge.exe	137
PID 3744 wrote to memory of 5216	3744	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://stray.bcnstudio.tech/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe0325c188,0x7ffe0325c194,0x7ffe0325c1a0
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,2273611136773463316,8729977774021003820,262144 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:2
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1960,i,15031149577912665960,11982302632613873062,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2284,i,14796190411280666608,321099102917103934,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,9787675759715371423,8015857911935196083,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,7019967553336984495,5128345753480904131,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,12069251221063448366,7575900415033319771,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,7849360865024326132,8940443513778348488,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5064,i,5095767663806247925,7891735113023214622,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5068,i,11200782277293677384,5647130458215097314,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5772,i,4503498100743069567,2577621946868252611,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5772,i,4503498100743069567,2577621946868252611,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4600,i,7628598636990305322,15151216266925697616,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5788,i,9386921550987272381,8471217129232698422,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5876,i,18225328925236913730,10389180018360014344,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2592,i,6859554133253742261,14506227635290656992,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=2584 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6480,i,2146349492448172006,8946901180889952106,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6664,i,16679912918617469692,17334248825948474769,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6668,i,14123125896173348836,8377125130909888184,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,1487328720401344810,7363399908790872785,262144 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4364,i,14710089222187049688,16915043287901635658,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6076,i,10706232156496165567,3579144531811208019,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5064,i,1254075780212971722,6195757498100755263,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=1344 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5144,i,4728360676866930840,460049496434963444,2097152 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=4956,i,17879428676561475266,5514315436529841941,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5420,i,7748327674828344898,13290854556431754297,524288 --field-trial-handle=2896,i,7790963477550290258,1261272585131357933,262144 --variations-seed-version --mojo-platform-channel-handle=4000 /prefetch:8
  2⤵
  PID:5216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 a881f2b864d628fd1755dd3cef6fc7142e47d4c32a7b454b8ea9865b26b88168
MD5 b020a607799005bf8d8215b30ca128e2
SHA1 e9c9ca50d86e3703c3ae0db35d220d670e790d6d
SHA512 82302cc6f7ee12858ef8e7df356604d32699c1f3ec8cd30d86dc22ef2654407d0675576f0a62d865bf3be4cc8163b1eec753a4b5fba6fc4815e09654e5774c57
SSDEEP 192:KjhTaWccddegRyEEiOJWvUUU1TT4pppuuHMiLO:KjhTaWccddegRyEEiOJWvUUU1TT4ppps
TLSH
T1E9E1455286D5D7AA9B0610CA4DA4625C41B23F0AEBDCD90807CCCDED314F5ABE6F5AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 071c001d8e9ac11073f0706fb954bb8e3f0aea474d37b0a10c28bcf638f267b6
MD5 c0227be7e2d0e8c028f39f0931d1b18b
SHA1 704c91f54ba05138a6cd46daaa9925e7eb2bfc05
SHA512 959503157a7b754b06b752ff5b392833cb7c9e3ee1cab99eafa9a665d0cbc10cc98bac7b939dde2612a39beb492d327209c4b98382ff9e099d62e878eeefdc06
SSDEEP 96:/LYSjAMl24R6ZBJCve8oNrzHsoTrr0x02i9vqci7L:TYSsm24R6VCKpHT03iU77L
TLSH
T1EFF155F401603456FBD1153159CE1EAC34F16AC4FA0FADE392834B7A825B7A66325FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 2cd7583d9b28bc7ac9677b6cac1f458969e08ec6e17c17f321bfb49eb9c58af0
MD5 cb2acd3c43fe143d50e3f4f6efcec6eb
SHA1 b2eac08155205f7d406706d9c81e3a81fd1917ce
SHA512 b382d310173fe093741cd8055fadfe6b2a30e9b01098fda13725ec3aa8bafb47432cb93e39b46ba61996f2f90a01b93c021f033d74533fdc913589f566b579fb
SSDEEP 96:kLYSjAMN24R6ZBJCke8oNrmHsoTrr0x0kjav6ci6P:OYSsa24R6VCl0HT0xjn76P
TLSH
T114F189F401613456FBD1113159CE1EAC34F16AC4FA0FADE392934A7A825B7A66324FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a958b2586d434642166ab2932dc93c0f259291c8c345b13acac205fa52ce5d32
MD5 5df008528322257f1563bd52ccd724c2
SHA1 8fc18ffa9e8813826cfb36847099d5bbcf4e3c3e
SHA512 02e85b782c29aa6bfe3b3bbadff899600042e3f1549124105bdd14031ed96a334ae0a7cd55f30c1ceb2d5b3c5e6f888f486e0b5aa3aaefb2190e51ce9ca88e74
TLSH
T103515EB8518164A3EB252431A1CB2FAE3875BFD9FE4BCD7360908E32881FBD09359474
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591294.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591294.TMP
Size 2KB
SHA256 911af488965f63fe8a2b414dcd6c380b1a7126f31497a38fa91d1b9dfd66526a
MD5 a0cace775804ff447ec665a310e38cbe
SHA1 8e4ee01192ab0ce8e8523d87ebbf0549d12727cf
SHA512 6e35770c56877c58949a5b84d59fec831d26a34daab8d73b20316824d377b0021750ba72b769b4dce8b8375ac39f439101134d8806efb4a6180b86694b0dd314
TLSH
T1495161B854826523E7291031A5DA2F7E3876BFD9FE4BCD7740908D36450F7D18369474
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4e94144de821621aa7a5ca611d2c4ccf31416e0952b34390000a769cccdd9551
MD5 a2a48b425cc45abe67253382495f0a24
SHA1 df858c428505e77f362856099e85e14a8c8171b1
SHA512 c4dc0ea68ae03f1c6c7359375a590017cb1cc7c4f108582ff125484da074ec1d343fda8951f0b2d7c4328d2efd5e58e73afc65b2e8e65efa645302fa30deb0bd
SSDEEP 96:DwO8u+uwuQuquauauWpzBiCInpqwwuiu6ouCxuQutuXugG6fud:DL8f79/rTR1iCOpqxd2Tbc2zG6f+
TLSH
T1EFA189F7C3D8876ED95116F45A143E1FCD2D1D2483283C2AC9D6AF4B93E25B1E281A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 71ff4d3f953d34ff6819f7232989965cb22799fdd20fa9d513d27dcc51510d86
MD5 fd2f6b42a1c14bec58c5cf9232c51812
SHA1 b57959eb4d5b80aba1ed0c3be86fa171c2a75e18
SHA512 0431c49c16d08b14ddda990310462bb6bede819bccad64164c5b351f540c5dee6ff8235e6ade814f2dbcd4ce77cded18515b5d9453ce4fa87819b6f1a2d46d7a
TLSH
T1235168B7C7E8866DCA1152F45A146E2FCE2D0915832C3C2AC9D5AE5B93E24B1E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e7d6c4c39be8b6d62439a68d00d91cb7f5682b3a87057ef229095bfae483afa0
MD5 fd56e0cb173820f33a746e6d64c03b27
SHA1 f959aa55dc6adac86722d2137336e67920cb39e0
SHA512 fa85138e529af2806f31cbbf4f75211b828cf0793741acf0d46cf3627c4f4e9cf9df0614a585c9d70b1e7c90e6316faeb32d2911cf45e2f8b0e29b1f6700ed76
TLSH
T1C4416DB7C3E4866DCA1156F06B146E2FCE2D0915836C3C2AC9D4AF5B93E34A2E101A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fd696ebdf2529379ada40989b5ca87f24744e8aad9fb316e78ab1b52bf3c48ff
MD5 a0ef16545d37849db7846d6612985643
SHA1 a3ada952df67706a4745671efad6cd921e65103f
SHA512 03cc1751dfba47519c18ea505cb197a3b1bbcefb573e56a3a42111dc57fc911122015f8aa9b8729c3f52c3c5daac48033f017d5c47e09726d321ac6ed1f4e684
TLSH
T19B317EB7C3D4856E8A5116F067147E2BCE2D0915836C3C1BC9D8EF6B93E34A2E101A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f0d44cdd51e6adad213e5cbf706a248231380a1840c24bf35a1179a87dec437
MD5 2249e6578e0f22e61fcbffccf5894196
SHA1 4a574ee9bbfa02a78e346da62ea80d41c78fb05d
SHA512 28e9b707e761f00154731a99287c89bad86480e0685d78d06a5897870c7227d0c5fc608682744e7f0129a90cccec5d9378f1f591cff4733de58775efb0bbe3b3
SSDEEP 192:sxZcRfyM/jK1Ml8MkX/f3sekt9Idpe0HW6+WN52r/4/Y9IrQoYIgrJ:sxZctMX/f3sekcnHb5+4/69
TLSH
T1BC5209166A349977CCCBD209FA55BF53D6F91432D2901E48A9FC8A0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1e983c7aa8a7361e87a95b1f8c4d08feb096198e9382c22b2630e9ed75b44cba
MD5 5d75c1a7a25e0596f6da6517851e0e41
SHA1 d8571a4fcd1866779381554ee975776c935ea800
SHA512 6fc81fd6881a85de7310dbf7850386fc1ce3bea0eb270319caad202bd2be68737f15288a4385995cd70bec0e0e07b466c9bd994ff38a0f42629c556973ce1aed
SSDEEP 192:sxZcRfyM/jK1Ml8UQDkX/f3sfWt9Idp87zHW6+WN5NGKA62UiXY9IyTEYIg5KJ:sxZctqoX/f3sfWckHb5C6QX0w
TLSH
T14F62F916AA345977CCDBD209B945BF53D6F91472D2941E48A9FCCA0C04E6BED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 4ee6e3f295d0abef6a9b2135495363837ec667ce577eab4d37bd8baacc443060
MD5 4f2481d2c84ce4b0d7184963717d6fdf
SHA1 27d11c4de73a87410928e618a34ec360bb1a4dd3
SHA512 d208dcf72f00450bc264bc90c097a0c2221769474219f997cef9d87e1c61dc273c29aa9ad2898cc5c2c1307434328112299d3790fd0321f58908349cd9cb0967
SSDEEP 384:sxZc1AqoX/f3sfA66s8qMpRiYnazAW8pZS15posJWeT+gckHb5n0QXiw:s01noX/fQA4Mnc7WeT+gtHb502D
TLSH
T14ED20805A924C8778AC35D18743D7E73DAEC50626385DEDE5AECCA0C01AD6FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 df24e281036f9fb37058627fb7f8d37dd8ee11463d74678e7f7473fa47bd4f64
MD5 bc1124cccedcc54ff8de6c0cbf17f3b0
SHA1 e8003dc1ebb5666b8150d2898b93281add854f0c
SHA512 8f011d9d8b8e9dee859b7c2f2957438d08cc94d1bf6de0f416f8bf0b95b19c0d5caea6bb4b6c3ee726de17491c9dee535d31d896ec18f16b5e08fa2dc17eb2ad
SSDEEP 768:6fcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNxroDg68:6fcv21wWvu+Z+u1jaeFLeRNKDs
TLSH
T102D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 e097b689324e644302e4d80efca9602c2e549e66e67ca1349e0569777c790a12
MD5 17035dcda10f0303c8e5d491ac4c6fef
SHA1 420c7fd4d9afcbd18bfa2cb4b27645e3ef714640
SHA512 30707948ac4bdf32ee406c6f93aa0d5906c89e96e91c7a0f6f8bb5735bbd79779d29860dbd1d1d652d7a8325002d646dce566d3b931bad0a04cbd45e257e1666
TLSH
T1C8E0D8BB2EEB1421E9AFA3D2247114758154B9548649EC5F292AE59324F22C52446D22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 0f4cb3c937896944c5c7ceceba41ff94276cb1ce18e498560969bfad815c7034
MD5 2b27ba372f21027770b6371c5fbcb17d
SHA1 4d9431b2699cf8950a5f9da568e87b24b97981ca
SHA512 e84f4e2b40d69587f8d3e90f22247b28b86ccbcafe9e7cee332c21cd2e41e55d04924159ec7492a5d5fc6fb289cb089d203d089788e3318a50b6c37e08541b12
TLSH
T1E7D0A767E0588570D7EB4F511F22253E46A57CCC28D95489B40205599550B8BD521E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 348bead84073c4aed53b2bea936c4e0fe1dd8514c548c619ac5b128b491e4335
MD5 02ea2a773ea86b67672f9263dd9854bf
SHA1 7019a2a417062ebb7726aee34e4c6c53c61f22d5
SHA512 b15e2350463c45e04e5b63c9f9dacbed37e8327ccdfcb27878b38a0f8652ca74fb8c493ead5766b40e5bcc99a173c2811568247eaebb76980714ce8b2c26f226
TLSH
T166D0A767F0544470D7EB4A515F32257E46F5BCCC28D95489A403255D5570B8BD231E92
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a036c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5a036c.TMP
Size 138B
SHA256 5ae31c5697aa96f25ea17e5454524c848673184b6cc06616fdfc89a1a7b6905b
MD5 48dd9b52c47fb3f32f36d3ff37349320
SHA1 c5c64adf19baf91a4ee9369d69f3034ac3fb4ffe
SHA512 341cbc4fdd0d7169f6d4a7a109e78e4837a6fdb538d2320d8aab95809199f27afe08f8568a19d021c5597da816add06644c0bf94b413985ff8b89ca875f4a1c2
TLSH
T129C02BA3B0040430CB5306914B33113C43C53CCC4CC1808D701338141070F57A201EE1
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f9c3e7e1c4e2e6f3c1ebf223991ec1c71e62ea8f193f1791483c1c669c78b47a
MD5 6bd58ca75029cbcbf67c052cf7a8bf2a
SHA1 1506f61cd9b8f725768e85d2d702a90562ec60c0
SHA512 775f5787dc2723d781f2f9b0be20f36a0e1dce5d296bdb1b12ea0d9d0f32c2b6c5a3c4249342f295f305475cbfb82dfde37e968ea187482f1f6405b21a159dbb
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDKAIKZSGON2KWwCnr+JFTBBdI9UQqtdKCcZ:mT3LVxnr+JFTBBi9UBtXcqzs7z7cG
TLSH
T16CC14412303F0242297D7908B36A8636AE4172677814A8BF7BB910B15F27E261DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6bf9642-698a-453c-b6af-c36bea3f5e50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6bf9642-698a-453c-b6af-c36bea3f5e50.tmp
Size 14KB
SHA256 0c61372188c3acc37befd21858274fdb6c9c63b242494c0ea79bbefee42c4a70
MD5 e2273cdf82f54d8c73408ba093f1103e
SHA1 40cd3a8b746fd1d6f9ce1ec519dce873f0ed7ab8
SHA512 fe71ca1f0abc18afc3a7dca6ba3fd921f7b83fb3f78ed37869eec6a58dabb09ac126131d743f4ac9cdd3bf7a898c309adbf1f9f6c54db171d2833a0271c19a68
SSDEEP 192:sxZcRfyMojK1Ml8UQDkX/f3sfWt9Idp87zHW6+WN5NGmqC2UiXY9IGTEYIg5KJ:sxZcAqoX/f3sfWckHb5kCQXIw
TLSH
T16762E716AA345977CCDBD20DB945BF53D6F91472D3901E48AAFC8A0C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5999e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5999e5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c2000e0bba9e4a3cfc58024958830cbb2764434abbca385f929d7906dbe856ab
MD5 6034fb89bbfce95b580983f97c50b2b6
SHA1 b2892ae03d7338026d2ea0c858a2b95c9927f8f1
SHA512 aa0a83f93c36b39640596929177babfa949ac6b9bc130f4932a950dc523cd22804d57ce90cff819a814e773f70aebf06c0854ba0a0f62db10ae8bc2d1bae9834
SSDEEP 384:BZcIhsN1x9d6Dzimb5e+CQdi++6IlOObjI9G6w7g:JhUf0TA4Ex6Il29Mg
TLSH
T1D4929D36A8340DBA96E7A511F48739135EF8907BD7D93B84E1ECAF0C05AB5AC1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fe6a2a0cc7423f10a8ed67ca40c305ae73d8491bfd2edb938d56969f8d0fcfc
MD5 04823c913132045482520797cfc660ba
SHA1 e5563544666bbe550da585a848b3575e522b06fb
SHA512 58baa58a8cbe49709763599620cb41e1eccde81f5f620c9e2ee7e1c259b9f4e70c9138f613a3cb2806425ca51c40735c25d968cc862224e6edd0ef543548236f
SSDEEP 192:JONB6v+YLNQmiUy3iZh+CG6+FdetRLusI3LTU6:JONB6vz/3Zh+CQdMI/U6
TLSH
T10002EB3568782CAB9BF26E05F4873A135FE4107BEA962F80DAD81F1C01D774C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 73fa13ff70d310f4985ed0e6f37d51c3029def0f07d2c28fcc883419331adf06
MD5 c3a04880bf1c40b093d5ca7bf039e587
SHA1 f818cd696569e50fc7d4cce2db76be946a2e7109
SHA512 b8ea5a21d2e1fdd57f025b2d1d04dc7e76d1d744076262bef76cfb906b29b963ef65d1a0bdb1ea7f3051f54fa53e3df4e6e7bf9ea0887d0b60bdf469d012c570
SSDEEP 384:MZcIhsN1U9d6Dzimb5e+CQdi++6IlOObjI9G6w7g:ahHf0TA4Ex6Il29Mg
TLSH
T123928D36A8340D7A96E7A511F48739135EF8907BD7D93B84E1ECEF0C05AB5AC1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d8db6e920fd5486917dbec58b041494cacea64eff5d00f88f511af5762d939b5
MD5 ec2fe9154a814d2f0c8fd72c417f05cd
SHA1 75e2bcec7e1944dcdc51ac67ecb2a6cf28337392
SHA512 d9c0609267259963d229945f4ea4fcbfc17ac3c4db5f25f6940dce32da19e009a6c98749e43765bd046bdcdabece9940d80f50f05a09b46fe5a6b3852a562473
SSDEEP 192:BONA6v+YL8QmiUyAi7h+CG6+FdetRLXx++4CHIsqHU6:BONA6vzoe7h+CQdi++ZIlU6
TLSH
T1B7121936A8781C6B9EE3A944F48735135EE85127DB8A3F90E5DC2F1C01DF69C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cd9456f6051c58b224108da8051a31b8490c72897786924e9cd357cb78bc3af4
MD5 c63fb7f0f999268a5f7d37b2aaeee550
SHA1 0e0fdd1f08342b13d5a291f40f9310d93803c709
SHA512 01ec5effa01d08fa280063b55dbc74cb7e0e88ab58235adc27f1ce6cfb8d1638c9d622689f3c18ae7fae3260623f1d94d3a495669d15b3949e1584e2f107d07f
SSDEEP 384:wiFiZcIbzsNP8TUNTUlIlU9d6Dzimo5e+CQdi++JIlOObjI9G6w7g:LFQPuwg2f0gA4ExJIl29Mg
TLSH
T111D239F248D7497AD9AE9B03A77E3D124DBCD067F6946A84B3C89A0CCC561BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b0d4dd797f792b375e12713dc299656d58b03a75b392b26d23af2e48d3b20dc4
MD5 5c4297f939dca4b047f9b356ba3fdc60
SHA1 6c9be408c3bfa0f387b4df248a46580aa7085f29
SHA512 58cee7fec5b963d489f41e0a1f83b07077b2eb91f788e76c09e47771f95e9169d5f20ad87465ed9f1b855b5fac7783e5d06d61869202c8abc151b220a1ad3c44
TLSH
T138E002126200659DC03C0330005B19302AD2502811F10155897002584CB32001B30FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8c10452a75986ca090beb014e99c6bd3d533135dcf8d7c5ec50ec4d871399599
MD5 95f9db341a88bd385d7cd7362572d93d
SHA1 ed3df07772ad31eb5d9f53600827ec8d801cecf7
SHA512 e55bd7172647471126d5889455609ac20b4aa72a4026fcf113060014982ca42debcb16cf0f7203c7e0794a208dfa7a8ee14249d997455fcca03a9587c58d9f76
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a25e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a25e8.TMP
Size 392B
SHA256 f1dc9987cd76231958d3f032ecdc935468120dc9665e6f0d4520b187d0c39fcf
MD5 38a29cd20e70111a3f27f809e07d0814
SHA1 21b29427209fb553745127eb63e1463461d65222
SHA512 fe05a4da4e05b32413b5b325b5a7ff4a35aff3ae82d74ad32ced9cc9c5b0e710f7d685a877f0916a4df89a146717aa5b0ceb2d0ba9196428a6027fe5ba8242bf
MD5 SHA1 SHA512

Submit Download

c1612e67-0df3-4fad-a5a4-8902e7d69f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c1612e67-0df3-4fad-a5a4-8902e7d69f0f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 48c0c5dfa8d28630035b8b1be39594da04ee305a67fbe949ce879d5d785d6ab8
MD5 a1ec344916ac883ea5f0b32f9132b4a3
SHA1 837b7e633b0d8553f0915c0af921f8151334c635
SHA512 63a888661a1dc54ca699e2502ff5692493fb8249160725a24305ae78ab243326fdae154de00544272465c1b2f1f4ddc2599e7766001e907c12eee7b736fe8c9c
TLSH
T16A41F658BAEA0108B3B76F56ABF6A46E447F7D772F0AD06D10010E4E0A62B00D971B33
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download