hxxps://romenix[.]net/list?system=9&p=1

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 05:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://romenix.net/list?system=9&p=1
Sample260728-fsvxlabm4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5360	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296889326013253"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{28149546-5CA1-40B5-8DDC-0BE48091EBC8}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{5E730343-67F4-4CED-BB47-3233CE6D7244}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe
1980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 6040	1980	msedge.exe	86
PID 1980 wrote to memory of 5360	1980	msedge.exe	87
PID 1980 wrote to memory of 3148	1980	msedge.exe	88
PID 1980 wrote to memory of 3148	1980	msedge.exe	88
PID 1980 wrote to memory of 3148	1980	msedge.exe	88
PID 1980 wrote to memory of 640	1980	msedge.exe	89
PID 1980 wrote to memory of 640	1980	msedge.exe	89
PID 1980 wrote to memory of 4132	1980	msedge.exe	90
PID 1980 wrote to memory of 5268	1980	msedge.exe	91
PID 1980 wrote to memory of 4132	1980	msedge.exe	90
PID 1980 wrote to memory of 4132	1980	msedge.exe	90
PID 1980 wrote to memory of 5268	1980	msedge.exe	91
PID 1980 wrote to memory of 5268	1980	msedge.exe	91
PID 1980 wrote to memory of 5064	1980	msedge.exe	95
PID 1980 wrote to memory of 5064	1980	msedge.exe	95
PID 1980 wrote to memory of 4472	1980	msedge.exe	96
PID 1980 wrote to memory of 4472	1980	msedge.exe	96
PID 1980 wrote to memory of 2024	1980	msedge.exe	98
PID 1980 wrote to memory of 5668	1980	msedge.exe	108
PID 1980 wrote to memory of 1668	1980	msedge.exe	109
PID 1980 wrote to memory of 4328	1980	msedge.exe	110
PID 1980 wrote to memory of 4024	1980	msedge.exe	117
PID 1980 wrote to memory of 4024	1980	msedge.exe	117
PID 1980 wrote to memory of 4024	1980	msedge.exe	117
PID 1980 wrote to memory of 2440	1980	msedge.exe	118
PID 1980 wrote to memory of 2440	1980	msedge.exe	118
PID 1980 wrote to memory of 2440	1980	msedge.exe	118
PID 1980 wrote to memory of 5900	1980	msedge.exe	119
PID 1980 wrote to memory of 5900	1980	msedge.exe	119
PID 1980 wrote to memory of 6108	1980	msedge.exe	120
PID 1980 wrote to memory of 6108	1980	msedge.exe	120
PID 1980 wrote to memory of 6108	1980	msedge.exe	120
PID 1980 wrote to memory of 3824	1980	msedge.exe	121
PID 1980 wrote to memory of 3824	1980	msedge.exe	121
PID 1980 wrote to memory of 3824	1980	msedge.exe	121
PID 1980 wrote to memory of 3336	1980	msedge.exe	122
PID 1980 wrote to memory of 3336	1980	msedge.exe	122
PID 1980 wrote to memory of 3336	1980	msedge.exe	122
PID 1980 wrote to memory of 1876	1980	msedge.exe	123
PID 1980 wrote to memory of 2332	1980	msedge.exe	124
PID 1980 wrote to memory of 1876	1980	msedge.exe	123
PID 1980 wrote to memory of 5184	1980	msedge.exe	125
PID 1980 wrote to memory of 5184	1980	msedge.exe	125
PID 1980 wrote to memory of 5184	1980	msedge.exe	125
PID 1980 wrote to memory of 6092	1980	msedge.exe	126
PID 1980 wrote to memory of 6092	1980	msedge.exe	126
PID 1980 wrote to memory of 6092	1980	msedge.exe	126
PID 1980 wrote to memory of 3288	1980	msedge.exe	127
PID 1980 wrote to memory of 3288	1980	msedge.exe	127
PID 1980 wrote to memory of 3288	1980	msedge.exe	127
PID 1980 wrote to memory of 1964	1980	msedge.exe	128
PID 1980 wrote to memory of 1964	1980	msedge.exe	128
PID 1980 wrote to memory of 1964	1980	msedge.exe	128
PID 1980 wrote to memory of 4328	1980	msedge.exe	129
PID 1980 wrote to memory of 4328	1980	msedge.exe	129
PID 1980 wrote to memory of 4328	1980	msedge.exe	129
PID 1980 wrote to memory of 4200	1980	msedge.exe	130
PID 1980 wrote to memory of 4200	1980	msedge.exe	130
PID 1980 wrote to memory of 4200	1980	msedge.exe	130
PID 1980 wrote to memory of 1944	1980	msedge.exe	131
PID 1980 wrote to memory of 1944	1980	msedge.exe	131
PID 1980 wrote to memory of 1944	1980	msedge.exe	131
PID 1980 wrote to memory of 2348	1980	msedge.exe	132
PID 1980 wrote to memory of 2348	1980	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://romenix.net/list?system=9&p=1
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffec1afc188,0x7ffec1afc194,0x7ffec1afc1a0
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,12074755156753448659,11039567930833665864,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7451479907024740769,12909751027358847043,262144 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,1295993080582713802,6523056152436253163,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,4354739537844557649,8918687914647990911,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12733089596932954064,4319837610304034560,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,16961253591363903770,15399847112450161941,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11180242433918196435,6578185610693184843,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10735391215433563447,16413848164304272675,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,10735391215433563447,16413848164304272675,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,6976330592526027910,14177086819416005495,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,18268290485936400627,2340606091895795723,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,12143723415081565691,10549968034326910580,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5080,i,9630389986897855422,12423043985836191507,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=2996,i,9592542282356184538,10150453389909337249,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16346481827053733868,16295217666075755939,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6616,i,17161821023266065318,11544384046864585212,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6788,i,17245394771840094766,8730945721305618384,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6840,i,17138861300049138300,4196721351412859711,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,7058171666229506183,14763543356063206029,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,9311636989269645883,12026780946953274051,524288 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7412,i,7336964787456203331,12564235167897340781,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7664 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7684,i,4947372742674924043,12320205564266938292,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7564 /prefetch:1
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7540,i,7326712197645976892,12915996916527493610,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7936,i,4988244918334740417,15210592286165520263,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7912 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7896,i,15870921615573063919,16758516201326958805,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6632,i,781188562648951891,6776052677267870592,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7556,i,17047778017470993929,8996873075750799352,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7520 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6888,i,9228416320967771223,13839456751487193141,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7944 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6656,i,1320819409850882197,4327425801617972740,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6676,i,11404330250021377698,12787126042508760069,262144 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7840,i,9237271586074525948,17423385925516454345,2097152 --field-trial-handle=2272,i,1949621460402172378,17562249505194385266,262144 --variations-seed-version --mojo-platform-channel-handle=7472 /prefetch:1
  2⤵
  PID:5540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6fc6833fd30f37080d7e7d9bdec1158a9491bf242fa00b3a8586a0571b93e91d
MD5 ac954d0be72aba09a2a2c46fa1fbcf8e
SHA1 0fcdce0deac3708092fb42ab0e9ea38a328e4a41
SHA512 8c8d5aadfcc35f255584384ae7db735b25a5b63b8a2b62f1b1f308e5adbebcd3cd7705fe4a75f756fa8dc4d58d179ca62e6db1620d1bf079b2df8e27375a0141
TLSH
T1C2E02BA6CC61EC2B0CFD0759B4198656E70113172640595F3E3D82098FF062B86C595C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 30KB
SHA256 2744617fa630b4944dd5122482c3588e72e3d53eb4de05a993fc7e5fe84c6fb0
MD5 ced6c625c977ca1426396f4da8508595
SHA1 144cb30d5479f9085fcaff4b43725a6dfa914f2c
SHA512 29b036d7759cf91cb16227a2a680ba82dc61e537d6cce801fd63062d33673dffb10a24b1848b2aea317238a491c3925d0f6d170ae92408ea9fe1b21f4e18a6f9
SSDEEP 768:Cn/QdsTo54Z9eqTwJQXzHg7FiEK0oWHOpIwoTsx4Us:Cn/QmEI9eqTwJaHgAEloWJaA
TLSH
T1CCE2E1E5B871E9A1823345C33FBCA559F709A8F82CE4467658735EB08EB063546D3E90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000099

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
Size 26KB
SHA256 31f9d8a8b289e3b552ef472411391c400c086488d06b94e965bb7083d2e01650
MD5 7b43a8ea0218d5e5b5dbfe7d950f9409
SHA1 ec7af63c028d45e64f69717cc57b1b499b680b70
SHA512 6059bca16243c40dcd929eb1301183c44f9129a394000cf4fe364a433bd884fb83d8e7b6ec3b08843f1b883c59d063a1e45398b03664fe5035eacb6afcc1eff7
SSDEEP 768:9PwofDfh3qhl9F9t2UFh8mlNeO7wu5Bt5XVtk2M9:9XfhaX97t2whmu5BTXVtkj9
TLSH
T13CC2F2D52B8DCD30896DC6CC3FE33F09911C5DB7360FB48159D48A09AC6968B1D2AEB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 68fc36c661667b3742cc60d286ae4b16379995c188040f21454bfb0023cb28b9
MD5 6a50a1f0c11d80504b3e293b13448dcb
SHA1 171491efd564258fbd820079c90e13087daa2a0c
SHA512 1b3b99fb5420c8ed2eeda90024d462c3477f15ba8a15495d5094981798ab80d267c2006cfdbe725d67449c15e0d9fe1d60671b0077e7f377cf69139e5b66afef
TLSH
T1F581C67D85127AF5E3224332B8E286153C7DF9F8F917BD96099420792303B12386CF89
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d556b47c0437e335bf995540476e3faf6c2c866e012068b4be31c4abd1460c96
MD5 36e6b3bd1c39e980b2e09c83d0574f35
SHA1 adca73dc05b0ba2033e08933cb6eef3bdf3f9662
SHA512 1859ba16b457975a4246580460425a445970725aaa0b7c90c078108c8db6ce7c19d209879c72808c6bc0759de453ef5ad14f4f7f44a35e2742d058dee0bb79ee
SSDEEP 96:u6oMuvJ2rGTqyQy0vdScXJcJ6PzB8ayzEhbSmRUSUgTB8:uveGTNQy0vcc+Sd8ayzE1VRUSUgd8
TLSH
T1CAA1197C855276F5E3324332A8EA85453839F9F8F903FEC22994297B2603742746CF86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5887c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5887c9.TMP
Size 3KB
SHA256 b68298279b0eeb0e798b19c38d7f274fbd50dd2e6ba42493137afd0296782eb8
MD5 3672dfd8ee47cae916be32448d4b92db
SHA1 40b4353d51b26b84deb3f196fb8563e74b7cc477
SHA512 66b4d1a5df86ca33ff6494babd157f7f50d534b97cf0efe59f1f04de3d5d3b1903781f92c457beba5d3c2c4344969f64c08aaa1ef1a19330f0ae909952fc52d5
TLSH
T14271C63D855676F5E3324336B4E286023C3EF9F8F913BE96099425782707B527869F88
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0eda6c7e4f7c74e00db86e132a69f08fe9fc09b7ba1deba92414c4650c640c19
MD5 106b4980dd3eac42958bbeaa30ddb07e
SHA1 7b838dd193ea10db5444ff1104b41b53c379e39c
SHA512 f754c0fded8165d140c0e7fcd0db1f5a52fc9d6003336dd2612fe266b7f476d1e74a868e14ac3e79c51b71b4cfe645a4a96d47083fbb47e6fe87a4cb01c995c9
SSDEEP 96:D1qOuUuPaaij6UzBsGwBu0uku8urugugquOuKEpuJr3uBuQuRuMuyjupVu5:D1ZB4aaij6U1sGkBJDoPFqP6pKr38xgz
TLSH
T181C1C0F3C3E8C57EC91152F4AE542E1BCD590924431C3D6A87E5AF0B93E2971E20599F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 4e2964d54eefd669790231e774bff440e1444533c557f77f52f13a8050e1a6f7
MD5 f4ca43b121b7842611e581261ed702bd
SHA1 047903b5e3dbc22a0fd5a7014021cff2fa6e699b
SHA512 d1a82d02c56e182db7ebf3216fbbc592c549dd4233a00a3dc297e3fdb3727515cfdf5d927bff959b172b720c050d8fa93ecfcdcdf9787d204a77e953d90d15de
SSDEEP 384:D1ZB8FRHecscztKFTdxkg8HaaiGU1qmmP6pKr38xgEMJkFiZGkoHmQP4P+Y0Qi/y:spx
TLSH
T19F52D1F2C3E9466EC91197F5EB142E1BCE1D091543683D5B87D4AF8BA3E2931E180B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 2b448d67d9eaa09bfd66406958fc36b2d3d954a61088c74191503856c863784e
MD5 5b9795d93943a0b81c5f587712b92751
SHA1 c2dbacf69e4f68d5ef2fd877744146ce1ee4de2f
SHA512 43eaedc39b8182285bd9a5fa9afbcb6d5c66ffca07341cb9def29850cbd597fbdc4620686edfbe1ff0c2674082caba19602cb2f3f99e792a2186e8f290259d9e
SSDEEP 192:sxZoRLyMqZjK1Ml8UQvkt/fusjHZdMzodpGFxl6EamHW6+WNxlCqP0dYvAEzarz8:sxZosqct/fusjHzPiHbO1dHrz38
TLSH
T1F872D7166A348A778DDBD219F545BB53D6F91562E2905E84AAFCCE0C00E7BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 69e9884f159e75886ac3f38edd4aa706e8a57c6a088d43eca07b1533a1189bc1
MD5 ef8c7f15949a327e114eca5887d955f1
SHA1 651ce3d75ead0bcdd98573d478a314f3cf55a2f7
SHA512 db22799c76755b47e172b389cedbf9d97d870dd8ccfc7f01d0b96308e8e27f4c4d24a5b8812b02bc733064d1f9d5691a6c0d13e23e595d1da8cee607bb8dd5bd
SSDEEP 192:sxZoRLyMqZjK1Ml8Mkt/fuss+iaZdCzodpEGHW6+WNZpO/YvVuEhrz3IgjYJ:sxZosMt/fuss+iaz5PHb+/grzj8
TLSH
T18762E8166A3499778CDBD209F6457B53D6F91172E2905E84AAFCCB0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 2016384d1f7d04c7f2d6e85b173306260a4da3655d72570a7b670b13b6e8f42b
MD5 341d3484ef2ba6ddc134a81184a1bc67
SHA1 b9987cdae80498c4bf86fa3ce2da524ba80ee56d
SHA512 46ce335427269a1f299faaf1f10c4858b4ca9c5a158f467a578cc4b4163b80acee725c4671483bf8d410df5acc30d48898c28e004d84976478f086019770d79a
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGZ:05ppxnY753RNBvRJJdt7p5J9XP53
TLSH
T126B2565A713E0211397E2988B39696364F4235A37058E4AF7FB814A14F67E224CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\579d1e63-42ad-4aef-abd4-17575af11500\index-dir\the-real-index
Size 72B
SHA256 2de0bce22823cd415447a1fbf0bdfff4b47c82f39103aa1efdcb31cb4f091bfd
MD5 8bc948f732a4002cacf58f31073ce793
SHA1 2313a1ba718bcdd360f1e04975f3e81ad57e378c
SHA512 2dbf6da133502db8c1e12d79784382eb91301bf37e508ce93c8ee24cd1f3dfcf6a4b01494fa05a4c80bfb9f2a207845decb7eb41b1c32feb2ec1f880a7b85509
TLSH
T166A0026D01900243D4000674245B056537714954E95E1382C1E03584C8D61956347538
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59408a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\579d1e63-42ad-4aef-abd4-17575af11500\index-dir\the-real-index~RFe59408a.TMP
Size 48B
SHA256 756618c0beb4ebcd55b0e3ff42d6939e2a84ee6392797871463fc3205d6e2103
MD5 9df7134d5f1ee19e36d2563772936194
SHA1 abb35a625ef80d09f044e099aeb22a2e0eea0848
SHA512 60ffbbe4776b5b1ee73aa45bb32c812995ed47d5cc518ff96c6a41eeaf1bb1b8577bf62939568fe0630dbd9e84b794697701d0862003f42e4b962956d4c87f3c
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 77B
SHA256 23d00af3c13050d35add13f8b5ceb899cd709112a93eeef1c0754281ed4fa685
MD5 ef36df218eb35a7128cf24eb84005031
SHA1 9b5eda88341a0e8ffb7a49b0705d8f3b80ca439b
SHA512 596ec56f4216ce577ee35b900ddbcfe3307696c37c153a89a3893b5a8dfbb31c7793fcfd570a604c9453b41b100c7b25eb967e58353891ff05be78705e750ab5
TLSH
T1E7A002F70800859A0F30A8E939B4B21DE40F958C8CD0DDFCC80880822378F365002D31
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 158B
SHA256 143344aa8dcc143f42209f99f8e5312887924014f62ee58ac5523fb94383af75
MD5 559b92ae38fc615ca009be3a2a0f8ef9
SHA1 dacc3037ce1c84f9180a820d521abf3cb9301371
SHA512 a3aed6c8a1f028d73837308721b3c80ce02e672c2e3bf9eda1664625a11fa170c474adabb379c3d8c1ca3f8390c961005497cc7367201d8d0ce9c370fe2eb2d5
TLSH
T10AC08CE319208982077099C22034790DC20B8C088CD4C9F88D0AB00233B8A228901D70
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 152B
SHA256 ec7e04da8c0df1aef33ade6eea2144808f4067d285ebc5239a5fbfbec5a3aa92
MD5 547d6d9e17f3ae31d029fda14a2bea31
SHA1 3cdfba50c07c676ac941d395ce3a4fb21ccfe1b4
SHA512 2177b5e3d1dfa65fe8648490340d409a2a392f3107302eedb6c9a75c810a90ef332b04bc1329cca5e0d3d724f29587fc03209f931252c19dc13100e4f391d51b
TLSH
T10CC08CF3191085860A70DAC62028B90DC20BC1088CE4C9F88909A00223B8A228C02D70
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 236B
SHA256 57d28045cfc7f45bf757e5203fead9d15537cb5613254af5e444626d1e512c64
MD5 9410a8c372024326c498b8e3db1fbd8e
SHA1 9751bdecbd29b63d2d9eafea58471906d80b184d
SHA512 d8efbb381bef6a489f91c38b20e11c245aa4b4c8c0fe90da82c253b03f4a529bbe60c421c7c5fd379ee5a3bb34b92235bc12f5c3e0c56125a7ed24754ef41034
TLSH
T18CD0A7EB5530C5860670DD875124745E8107DD148CD5D8F85E09F04A22F8712DA03D71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ede5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58ede5.TMP
Size 161B
SHA256 b93afd1f7e83d0839fd8885eb6b0447aae79f74f8d285c3810f98a807f757c10
MD5 fcb60645197767661d81f3479f5427e0
SHA1 2513fb6d72c8d78f0e66bc8db28439d8aa9683f3
SHA512 f88f7c3ee8276ca0a76ee65e928f674f9368189157ef23819ae881b65e2eddfd9ce538d69af794d0f7b706d25f48c66965ff7b8baa1f165cee61fe7b5b258a74
TLSH
T1CBC02BE34432CC85172094D97C34764CC5179D4DCDC4D8FD8840B18222FCB22C002E30
MD5 SHA1 SHA512 TLSH

Submit Download

bdc10d30-8b2b-4a99-8d27-6666767dd292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdc10d30-8b2b-4a99-8d27-6666767dd292.tmp
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 bc1de689abfffcf5b13aa8e64b059968af1dbea8326d5da0dc30f8656f4b9eb1
MD5 f9305c4253f1c9dfce9d542a4e6b585f
SHA1 7428600110237f15e37944be3e1904bcec5312aa
SHA512 a723078a1c2924c122bf7dda1b3511f274a10b352580b19570e8dcfd23b03f9f580c4589e87f6d94305b3519bcf024784546da85edaef3feeedd45a41faaeec0
SSDEEP 384:np3iF9CcmyWCs3sNC8TUNTUlIm2QckCr9l2Kpv4fxGgxiz0yJUH9BJpwe4KV8p0p:pyFccps3fwgbkUYkkGgGJc9BUI8p0YM
TLSH
T1C5B25B36EC58DABBEDE34F89B74A7A07DEE0126785D85AD4DAD85E0D00871DC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 cb34007e0f07b48071ca8fc72c896c18e2560fb197d2233db2d93aa81264756c
MD5 9555ff11080b86c88be79e94174454be
SHA1 dec7899150caaeb9303379356987440028cbb327
SHA512 51034df7464a80f75b281e9e2270ca780704ae8753a4e17de71c196cfb0d1fd0224a0d8ed7def3667cb0f6386f1fe181ab1b3973bb28af444b50403017c138bd
SSDEEP 768:pbFccps3fwgbkUCxkGgGJccD6BofI8p0YM:1s3pSTc3wI8p0p
TLSH
T101C24B36E858CDBBECD34B89B74A3903DEE0426786CC9AD4DADD5D0D109B1EC430B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 01bf78cbc6096b25ee22b130495f4864ad95210c1bbd487f0f3e53dd58b1916c
MD5 2d75ccbdd24c35a91fa8b94e47596155
SHA1 fd4eca1bd022445fb4de63d395415ffcf80222df
SHA512 f55906bcbb6c12c2584a2dcf1e4fdbab4ad13a53a50c7b4bf6af9d566dcafa8c41de2ea12188115dc425a6c8da7045ce4cb9522e4a2870076153b40886c34f9f
SSDEEP 384:nKiFiZcIU3sNa8TUNTUlI4Q5QckCruaOpv4fxGgxiz0yJUHcvrBfBofOObjI9G6l:BFQU3PwgffkawkGgGJccDdBof29Ma
TLSH
T19DD24A36E864DA77EDE78B89B78A3913EEE04263C6DC5AC4D5D99E0C00971ED430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 465695bc737d401c85623ef5d8a753ed9434015c561fd24a3ee02bbc7f73697e
MD5 a4437ebda331dfc3bf677483e9388815
SHA1 3208584f52323e35d1db50069359ab61b323e958
SHA512 19ad82ba51aa43ad47d046211727dad7e77ed75e3d8cd0f48a93528ebc61d869cf004a773deeb72f55e061a71c6f6dd836b7e9b72f45e40b4176eff31c0c038f
SSDEEP 384:npWiFiZcIU3sNa8TUNTUlI4Q5QckCrxaOpv4fxGgxiz0yJUHcvrBfBofOObjI9GG:p9FQU3Pwgffk7wkGgGJccDdBof29Ma
TLSH
T183D24A36E854DA77EDE78B89B78A3913EEE04263C6DC5AC4D5D99E0C00971ED430BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ec3f8597b20b8f643215f935dcf031c3b5fc51c820786d4c74a86baa856f2dce
MD5 4c0120d9923814fa817a6fcafb725532
SHA1 3d0328038bbcceae45153b7845c10d583a0b96f8
SHA512 d933090571c40ce6312d0f8424d86d31a9c516b8fa40f390a5d738c9803f92f6dc14cf37b2bae7b359cd8cb4023626fed84d8dbc51fbf0685fbe12200313829c
SSDEEP 384:nUiFiZcIjG3sNa8TUNTUlI4Q5QckCrutCpv4fxGgxiz0yJUHcvrBnBofOObjI9GG:vFQC3PwgffktMkGgGJccDFBof29Ma
TLSH
T171F2D3F598D78976E8AE4B87A37D2D029EFCC123B6885984B7D95D0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d1a57c33090e4c1630453a0b1c3b1ef73a3e1f432a9346ee70021b369a864c7c
MD5 36b4cff2b90db152b76b693e444e3fd0
SHA1 25de023e6747506ea3c62ddab048fec42b878a82
SHA512 e69a249a6672d74a34369b929c4a8636434c7a3345ab1484a8d2a988245be06506d76e5ed673778d4f2dfc7a7afedd8970aea4053b85c7858608ccafe4c4b731
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b6a2182eb4578f402868bd84511cb6d12e07338a92da1124fd0d35f5f3e66ad8
MD5 14d86b3980dc5c39e6055a537c8a4afd
SHA1 862c5023b2a3ab2e4e104a769154f1ed76b57c26
SHA512 2ae5bbb71203ba0f6db70fc05f25ade3acb37c66782275187656c19a4b8976eadb722fa5e69e377814fa8b22144f9b88155f67db81c44facae67d52cbe38512c
TLSH
T144E00143D30104DBC094033010D35F223EF28434437742454B32857DBD337447E29788
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 cf1138c0b5d2a3ab7f6c79322dc83ace513e961a0a2b2ec40aa419d3eab13959
MD5 f6e2ae6136feade9f3e5883be3d6af1b
SHA1 f30c3a961d3806e9ccd3a05b2115a56e9e7d2b63
SHA512 27a707e9517e21724f96dfd5cbcafa5cb9016af94cac831d2bf34df3e57d37f5ac8215a64f7d513a98f034d677f8a0a278b7055b71a1772b026af31e9083d8a9
TLSH
T175E00103D30104CAC050033010935F223AE28434423642064B21456D3D333446E14388
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1b714125e0ebc83b8e7a2fc82278de8905017b71dc159fb6855a293cc9360688
MD5 733239169023f05f51372ea25be79621
SHA1 4901326e6ec825b6e7ad260e95069b37730cf2a0
SHA512 15caa5e3309edb7410d825defa63d1f065483a626a7bb467e90b596bf4892a6c1e2ebf1a6910ee9e7254ca387e395d398ef9541af9e8e91e3c8a113dd96677d4
TLSH
T1F4E00943D38014AEC1A8033051D35F227EB2983843A6468A4A32967DBD737447E29BD8
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 64e1143107ff8a4f1a89abc56e60d18dad3e3e866039075d0a9cf34268070bd0
MD5 3c425c38a8bf5a636315c8e24486fb84
SHA1 746a5900a1b8e269f2c946870b32809293684fa2
SHA512 af1f8c619d030b2e85f9c775464ed0e1f23b09069912b4ac4eb7bcab189d2cd461dc3e4ecab1a12c0196b489f79a813a623d7b8ef89323c6befad266ef8dda3a
TLSH
T173E00943D30104AAC094033051935F227EB2983843A7828A4B32967DBD337447E29798
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3c0995a3909c85a0fe94a539ff887e0d4896d2eb554e3ec9cd38329eb42e712b
MD5 a745c857ebba8b68eba7d724d2f6cc07
SHA1 e4cead8e43b7be81c55ec1f66575ddd0b1f317d3
SHA512 d8bbfb7fa9db51b32c6e94acff15999a0eeb67753c8601fada16f3081fafa13eb64f4cd1412313c489e0d2a0efc71acdb72a68e79e9a367db9246997c1f36efd
TLSH
T1CBE00202D30104CCC050033010535F3229D24434413541044B30455D3C333446F143CC
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58f9bd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58f9bd.TMP
Size 392B
SHA256 0b6ba12213e050229a0eea8c0ec2a1c7c676e33ea2ea8cb5ee16cc4dde601dbf
MD5 cf39a35d302248c28b957739c6de9ba6
SHA1 4a8711367582b495bec30cdad9ba7d9db7eb22d2
SHA512 f0ff01fc3fa117df5bb44be1a316898fb6735ca384845cef821190746fcb190c040ed48f7ec528761d15b0c0c719e52bdd4ae1657f855a12143b0f85b5c3ce67
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bdd493876b5948ad809285bd39f67cb7a4701d73fa90d316b9e44e3f3b3b7fb7
MD5 99e60151eebd823da38d2f7bb5f4c363
SHA1 14c65c22b8b479f5b428118a8641b84a2ef5911a
SHA512 66873ef658bd75c2f807bde82cb4cfb684fb24b47ee308c6ad2d59be017f280fbce97986d03dcf97d29a9df6c2e7dc7dd0f5e0089f778f68763f3dbfb6d12565
TLSH
T16F412959B6E91148B7B77E169BF6A86D487FB9372E07C49E00010E4E0A66B40DC61773
MD5 SHA1 SHA512 TLSH

Submit Download