hxxp://ww1[.]shareporint[.]com/

Analysis

user interaction
yes
max time kernel
898s
max time network
633s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://ww1.shareporint.com/
Sample260728-vn5cssstcy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297321600105215"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B6379EED-5506-408D-A3C8-3185C6C6A1F4}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 4620 wrote to memory of 2108	4620	msedge.exe	85
PID 4620 wrote to memory of 2244	4620	msedge.exe	86
PID 4620 wrote to memory of 1664	4620	msedge.exe	87
PID 4620 wrote to memory of 1664	4620	msedge.exe	87
PID 4620 wrote to memory of 1664	4620	msedge.exe	87
PID 4620 wrote to memory of 1200	4620	msedge.exe	88
PID 4620 wrote to memory of 1200	4620	msedge.exe	88
PID 4620 wrote to memory of 4576	4620	msedge.exe	89
PID 4620 wrote to memory of 4056	4620	msedge.exe	90
PID 4620 wrote to memory of 4576	4620	msedge.exe	89
PID 4620 wrote to memory of 4576	4620	msedge.exe	89
PID 4620 wrote to memory of 4056	4620	msedge.exe	90
PID 4620 wrote to memory of 4056	4620	msedge.exe	90
PID 4620 wrote to memory of 3204	4620	msedge.exe	92
PID 4620 wrote to memory of 3204	4620	msedge.exe	92
PID 4620 wrote to memory of 3204	4620	msedge.exe	92
PID 4620 wrote to memory of 2432	4620	msedge.exe	93
PID 4620 wrote to memory of 2432	4620	msedge.exe	93
PID 4620 wrote to memory of 2432	4620	msedge.exe	93
PID 4620 wrote to memory of 2360	4620	msedge.exe	99
PID 4620 wrote to memory of 4412	4620	msedge.exe	100
PID 4620 wrote to memory of 2360	4620	msedge.exe	99
PID 4620 wrote to memory of 4412	4620	msedge.exe	100
PID 4620 wrote to memory of 3016	4620	msedge.exe	102
PID 4620 wrote to memory of 2752	4620	msedge.exe	104
PID 4620 wrote to memory of 2752	4620	msedge.exe	104
PID 4620 wrote to memory of 2752	4620	msedge.exe	104
PID 4620 wrote to memory of 4396	4620	msedge.exe	105
PID 4620 wrote to memory of 4396	4620	msedge.exe	105
PID 4620 wrote to memory of 4396	4620	msedge.exe	105
PID 4620 wrote to memory of 2524	4620	msedge.exe	106
PID 4620 wrote to memory of 2524	4620	msedge.exe	106
PID 4620 wrote to memory of 2524	4620	msedge.exe	106
PID 4620 wrote to memory of 3816	4620	msedge.exe	111
PID 4620 wrote to memory of 3204	4620	msedge.exe	112
PID 4620 wrote to memory of 3624	4620	msedge.exe	113
PID 4620 wrote to memory of 2432	4620	msedge.exe	115
PID 4620 wrote to memory of 2432	4620	msedge.exe	115
PID 4620 wrote to memory of 2112	4620	msedge.exe	125
PID 4620 wrote to memory of 2112	4620	msedge.exe	125
PID 4620 wrote to memory of 2864	4620	msedge.exe	127
PID 4620 wrote to memory of 2516	4620	msedge.exe	128
PID 4620 wrote to memory of 2516	4620	msedge.exe	128
PID 4620 wrote to memory of 4216	4620	msedge.exe	129
PID 4620 wrote to memory of 4216	4620	msedge.exe	129
PID 4620 wrote to memory of 2396	4620	msedge.exe	130
PID 4620 wrote to memory of 2396	4620	msedge.exe	130
PID 4620 wrote to memory of 4752	4620	msedge.exe	133
PID 4620 wrote to memory of 4752	4620	msedge.exe	133
PID 4620 wrote to memory of 3316	4620	msedge.exe	134
PID 4620 wrote to memory of 3316	4620	msedge.exe	134
PID 4620 wrote to memory of 4272	4620	msedge.exe	137
PID 4620 wrote to memory of 4272	4620	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ww1.shareporint.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x23c,0x240,0x238,0x254,0x7ff9f3a4c188,0x7ff9f3a4c194,0x7ff9f3a4c1a0
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,4528436649373696620,1534481647509191660,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11369201917168632436,8346320308666147412,262144 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,7478551986400770009,4398242160274575250,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,3209462246068709439,13154316589512373398,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5599130121379223884,10374068064942266310,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,14659405598149920378,13648325711871431633,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,454531787439129016,14084690280168229858,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,8362019154620725138,16385511177543711445,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,1444868483979018637,8216397702143163432,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2257199040343438316,5982629716175177339,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,2257199040343438316,5982629716175177339,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3416,i,475362845598481630,2938306567238778920,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3516,i,1896131865858111404,10520021009425052676,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3552,i,12709924798663931091,9969568495290512335,2097152 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,2279026331673215888,7891851544634671785,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,8334211923298718881,11086169021788470423,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,11296660233476523584,14532897601183154680,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,6020609276663391605,2159898194175634634,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,2339919462945526139,16064131803418395160,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,9060769130839119133,14741293053642589855,262144 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,4420514029676733454,7908207037793939576,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,99944110927391736,10027209160533961053,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,1274804463009452589,11418539029372791240,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,16214139324733268190,5816288002165321474,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=3972 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,1211492583574061056,9260308325365801429,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,6669286631659133132,5246078789463102361,524288 --field-trial-handle=2196,i,9852860480456159387,10680176175503928760,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:4272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 acee708329a4efb4671af20f44f1eba68f2b5f6c948913affde652f214037732
MD5 df1971b0eb44adc221ffc423f13a7962
SHA1 056814449474982b7f8052de5b45f49ebbccb9b5
SHA512 0046d9eeba5e171e5c149c654a65836916556486aad10ed57cf38545d1acc2afe114b859b4fa5c5dfe0415e1738acaa163f7b9b7704125c90cba429fec2c0f5b
SSDEEP 192:uj+8aTTTTTTTTTTTTTTTTTTTTTTTTTTTTTMZLO:uj+8aTTTTTTTTTTTTTTTTTTTTTTTTTTH
TLSH
T1C8E1404346D4C75B8F1911CB8EA8629C40713B0AEBDCDA1C135D8EFE308E4DEB6B6690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 9f36c22f39ab4fadc7237dc38005d0806dd936b5a1e87be8bd58abe541a0c169
MD5 6cf7eccedd7b05b739af1798affc210d
SHA1 0570772e43094ed3a76e7d5b14a2dfb68671ef0c
SHA512 6f5abf12b092e8e45d787d4dc2958d7b8889b85175db60f9d168b169deb2f8d466f671b47dffed70c6c23953f14a2cc55121aca0517acef22a82fa83abb8ab97
SSDEEP 192:qjlUGddiizVfffAvvveeelll00jjjSSJJJMaLO:qjlUGddiizVfffAvvveeelll00jjjSSY
TLSH
T132E17B4AC3D4CBAAEF0950DA49B9635D50713B0EEBDCD908139CD9ED304E89BF5B2690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 61bd3e9cf29669fa39636ebcb728f57212dc223d299b6c62c9b4cf9bf560c983
MD5 aa15ee80d2e90e213c7c9722e5482311
SHA1 89f411e0fd445efa021770d00de0d543ca65c0e9
SHA512 d4181fbab01141f40dbcf56ad182bb5d1d8d66e30bdded3622bb581dda14837ef3765240407bfb1f83bdae2ec1961e923da7771c7029d06a392356ae608ea7ea
SSDEEP 192:zjs3R0BMMMMMMMMdddddddddddddddddddM2LO:zjs3R0BMMMMMMMMddddddddddddddddE
TLSH
T14CE15D9387D4C29E8F0590CE8BA8639C21713B89EBDCD508175C9DDD304F49EEAB6AD4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 da2e8b6c9d83f5238d592bc4c9ecdfb818d1a51fd17322d4f0f27a7dbd81d3da
MD5 8ba468c29382445389cc01a5d6c44b05
SHA1 918c3432cd76051d4775fabb081678c8f1a599c8
SHA512 6c8cd84d0485c65f5b1ea036111a1dd0551a226a13184be935d28215656f32cb4252c866498539685666cc0d55760b6954fd95b92d36a45b1416b78a9947bfeb
TLSH
T16E515D24C3120D91EB911233C0D02764367AD6D53BC76F94F28868F91E0EF2E5E7E119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1da2400d2e4cf1bab1aca69f61aa6c50ebace945f3c4fbdcb9604c712598ece7
MD5 77fc8c4481bda1c10a355de11d064127
SHA1 a0ae4819fa89015c14c03e4987b764b80c0c1043
SHA512 d9b8f9b298a5c2be438d316957dee8c37eab00d4142f42001065efd1bd51316dc8ad74f2a2b2381fcbfc64d156a9873f1d3cab793425d11023fc74fb8c58b7c1
TLSH
T198516025C3520DA1EB915233C0D02754367AC6943BC76F54F28868F51E0EF2E9D7D119
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1ed.TMP
Size 2KB
SHA256 07f6943ba39bcfab8d971fb47620e647c3a5e5df5fe2422bf1ef19951ee48340
MD5 e524f78afafec25dfbbc3114f524190a
SHA1 6a7a1784d5dfdb97c4acf1f751d7e401a659b6cd
SHA512 2db85146e3c933f2a31e1b708021b9e05abe19da17fb7072f553a3af4c947ad7a7dd4e87585c5806f7675f91ff6bda12368d88d55f0fb0375f1a263bc0911b49
TLSH
T110513D24C3520D91EB915233D0D02754367AD6D83BC76F94F28868F91E0EF2E5E7E219
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 36e36eb0ecce2e334553ce4790e07d3cbef9d4025e9bdcb103f9bd96f18662db
MD5 7b37b70e8e62444db1aa4c84c1d9fb43
SHA1 f95f1afd79a92713c2e80cf88a2a472a851e9875
SHA512 3fe6e1321ab893d52d1ed9211497f81302406c13d8619a3263d301702bf8963858f20e912ed97d0bba4171f56658a869a2e92965f747bda4cb15b925ae97e897
TLSH
T165517FF793B4C66E8D1261F0AB14AE3BCD6D0129176C3D2699E4DE4653E2073F14264E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5fc9b2019fb5cb31f68378116e338e07d1bc690fe94e751de477854a78204bfd
MD5 1c1cdfc7c9905ee1610d35cb41de1b2c
SHA1 f59d2fcb37ec218dae4ce94c5e32ae49c450d46d
SHA512 c395f1a673bba7c963b759efcb5f1964f4f32708d29c7f240d0c2695b8d533eaa0723e0887b10a1f51eee2943b58a14a2d5ae366587f6a84177e91de13724358
TLSH
T122619CE7C3E8C62E895262F06B186E3ACD6D052953BC3D2799E4DF4653E2473F20250E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ed0a93a6659e9fc10d67fe1b2e2108897d96521376dc851d2e71d9b10b4bb640
MD5 7b48db1835e9a7d8d0630bcff4dbdab7
SHA1 def8d47fd82adcda098d5c6d3a6ddcadd88cb00e
SHA512 e03dcde034feb82da3274e82dbc754ee6e481619e47f6d5ba459a0009c69cc7fa006e23c357b8f549e624da3e63113cb25e1c6b85df559aa760e40e0655f7574
SSDEEP 192:sxZ2RayM/jK1Ml8MkD/fDsyGiBIdpJHh06+WNGY9Ioyv3IgrJ:sxZ2IMD/fDsyGxJH7Gv9
TLSH
T12042D8166A389977CCCBD20DFA557F53D6F9097292940E48A9FCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a8d5bfdab660e2bb69487e845dfc9e4205cd685fd721d16463c2673a9ad13e9a
MD5 4fd418b8896cf082bd22ca26e4c81d65
SHA1 462f30419c75e171cb1a008910f2c0eecf363094
SHA512 5ad36c95fa4b272ab64504b3365560c5d866d1237b962cc6aba2fc0396a480571b01d756370f87bde588f8df6a1b2fafaa9465174feefac72c46bf5d5461b263
SSDEEP 192:sxZ2RayM/jK1Ml8UQlkD/fDsCbLBIdpAtHhQ76+WNXBB/Y9IDxl3Ig56J:sxZ2IquD/fDsCb2gHTf/f8
TLSH
T1BD52D9166A3899B7CCDBD20DF6957B53E6F94972D2500E48A9FCCA0C00E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f3399647c4914b95bfb550488a4208974905fa46ba33facb9dfa859a9488e2b
MD5 e1cd37b306b65a3a29b1f97beb1b8c80
SHA1 a45d0c63b60272ce4b95bbb009856a757013c0f9
SHA512 72c9803a3a80da4c31ee4020220c3dea825243287104a7b29a4809a217da9e357d06a79759c94f2226960ff8af3b25762d76227d31a3d0ee6bb1c8220ea1837a
SSDEEP 192:sxZ2RayM/jK1Ml8MkD/fDsCbLBIdpytHhQ76+WNXBB/Y9Ibqv3Ig56J:sxZ2IMD/fDsCb2iHTf/28
TLSH
T16552D9166A3899B7CCDBD20DF6557B53E6F94972D2900E4899FCCA0C04E6BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c7c47ec61e2e78b1dfcdd024054fa55f8d03217130a2e5bd89f3c382a477e997
MD5 de128e285ee52f8069001573e606d907
SHA1 63cae6ca1c841eb717a381dd66c8a81e1a9e58a2
SHA512 9c0010e61d5619690489694c4aa938976a99def7b66c1922ec6939e5ee10461a78a5789f790074bab0cbb836d1cd36c82ff246eaa9ba4becb673ea219b1f7fa5
SSDEEP 768:G3cv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNJrogg6T:G3cv21wWvu+Z+u1jaeFLeRNigj
TLSH
T1C0D20B2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2604dd1e-a3fb-4e93-969d-11e04bdef142\index-dir\the-real-index
Size 816B
SHA256 d9e740817f224e05a81eacfbbe5c05cd574e25c6f1598707a3a0eedaf557dd0b
MD5 55f7e4b17db36b5b32c6bb89d7a6da79
SHA1 e18ed8e07a1292daab43d4b037769a6781908d51
SHA512 b7efdcdef2325bb1cc4e65e0a326818fb1758e761403a82c2675120176326ccbc945332e101d640a88d0ad3f10679ff7045c4f49a9a81349aed007c1cba69725
TLSH
T128010C025EA14C1FE96102BB25BAB0F8B3304DCC9721E723A82C12662D3A38E25575CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da0c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2604dd1e-a3fb-4e93-969d-11e04bdef142\index-dir\the-real-index~RFe5da0c7.TMP
Size 816B
SHA256 251701bac4138f26e33f3c11730e61ad1347da7b2ff7f900472b11d701ad39e6
MD5 61de6dc74f7f19987e344f1f56aeb8f4
SHA1 2dca39bb09168f4390e244f99bf3b012d9fa878a
SHA512 99e18b89fd6f96cd44a1d7cab0f9ab86f593a962bba77901b0428385236843adbba7f54ce7051f232b93c9d541e11171cfe7bc1e181e1216d3d0da13189a72d8
TLSH
T11A01E1578B964D1FD84811BB2DA5B0F8F2314D409322F3A3A42D253A5D3ABCD09070C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7b663ad6f9c224ee9194e24656060a64ebdc3d8098cdf74d6e2df16080bcbb3e
MD5 47a551c70992bf953ccd68970f5539a7
SHA1 3ac6802f9d40181b004b1cad11fba3a61950f8b9
SHA512 b8f54260a72270d0646a984399c5ece09ed0ac735a4c4944f4ccd58682c219a2f1a772d98beb74882a3c170dc3799138d6f30847a4e1515359ad331e425b353b
TLSH
T101E0D8B72DAF2814AA7F57E96571C4A400457C99C448EC8F142AA2C720A1355359AC61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 18a607d7aac9b402a2a35e813f51b1aa8d7d74712f742b17d34e603b2fb682c1
MD5 b7da69af72dd1e98896d3a662bd0cf75
SHA1 3975b0f9b37ceddca241c2e47948ced70c739fc5
SHA512 891267fd3ace47eea44fc64d83d2e16a202602665577a4d1340854720b6680862b7a1fb037d6f7719008edf0479892bae3d7a80c56acf4afb350bfe47f315088
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD6aEKPaGO1WKO06C4AKFeR:mTfLRl76
TLSH
T10CC14216B1374642287E7808A7D286374F4535A7780CB4AF7FB800669E2BE225DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7450ac18-fb4c-4e5e-802e-c0c1b0a9f2d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7450ac18-fb4c-4e5e-802e-c0c1b0a9f2d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cb0033b15fcb19416ce90b4c5665595d83c63fd54a539c2b5dc8d7d47fa3612a
MD5 53e7a21888091791f57958a7f0bd6164
SHA1 bfa115b807432375a10a703b55bb825129b02d6d
SHA512 225543eaf1fca59e1d810cee565ba60fc42b507f75cf90b1f3d34fa405f8ea30c3f8fc55ac631160d70420387d0a0a288bcc26491abaaa46dd116adec0fbfb53
SSDEEP 384:MsN/v6Syzibd1e+CzO4eyfzAOObjI9G6w7yo:MES8krOXyfzA29ML
TLSH
T172727D3AAC388CB78EA39651F5873627AEB491BBD6C92F84E1DCAF0C06DF59C5301415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 39a17a7361050e6c8ae1c57d611197b0db92fa367f3dbc69b80250db567a67c0
MD5 170eb39b17ea7a5e879f14b907fbadfb
SHA1 ab1a8e3b0940040675f29bcbeb38bfdd25c19e6c
SHA512 377bfdd0ccb1231a794339903fb300461527fd3fbc8a2bf724d964f3ef2367a8e1a396319a0c366a9a7eca8cbb239d5365c34111ef7033e9001372bb4996819e
SSDEEP 384:gdiFzzsNm8TUNTUlIlC6SyzibR1e+CzO4eyfZAOObjI9G6w7yo:RFXJwgoSkkrOXyfZA29ML
TLSH
T14CB206F658D78876CAAE4B43A77E2D139DBCC1A7F5856A40B3885A0CCD9A1BFC301804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5db0d7a4c0f83ddfc892eb975e3ad5b8b6abbf2f0c50c89acb89a9ea8c8cf542
MD5 826d1cdeb281a7e8f97eb2e3b4b3e925
SHA1 5c61e6b5adeace215bfcffb94f0e96f86f4f8668
SHA512 56d9139b15d02e8a23762b35d84f00829bdbae4dd34d3b54adba8341a599ad8551dad5e118dbae903686fb33d4200593b2d2625759f99ac2e041666c41cfe3c5
SSDEEP 384:gdiFiZcIfzsNT8TUNTUlIRG/SyzibR1e+CzO4eyfZAOObjI9G6w7yA:RFQb6wgFSkkrOXyfZA29Md
TLSH
T193D228F658D78876D9AE4B43A7BE2D175DBCC167F5846A40B3C85A0CCD960BFC305814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 3d9ca319dfd83d3dd2d51b62f289a76970e8edca6460fa794b170bfc24930e42
MD5 525cbdc4b480c1a196efc1e2d2b1d8d8
SHA1 5cd5c18307108484405894fc243538511b28d146
SHA512 a7b53bf65e0209b08ba763b3eaea63935b730e97d74078e5f0656b7ef5b0f3c696295a2f20e426a6aa5e66afda523912562e7db8c4026db4b56576d74caabce9
SSDEEP 384:gdiFzzsNh8TUNTUlIlC6SyzibR1e+CzO4eyfYAOObjI9G6w7yo:RFX8wgoSkkrOXyfYA29ML
TLSH
T189B2F6F658D78876DAAE4B43A77E3D139DBCC1A7F5856A40B3885A0CCD9A1BFC301805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9ed060d3ca9fba4e708fda7174d32562575365054da5cdf36505a86463ba36c6
MD5 132f6e67f7795929f8a24a10fa25a0bc
SHA1 451a91f5a401fb70582471d7cd48b841f1156069
SHA512 75e39049ad91511f993f308c84f7e6e32c9398907ecf92d0e53a14ca83b9c81a067e325e1e0e42ee9711ef85361895fd9cc2a301a0c74b43ef591f273c57ddab
SSDEEP 384:gdiFzzsNT8TUNTUlIRC/SyzibR1e+CzO4eyfZAOObjI9G6w7yo:RFX6wgBSkkrOXyfZA29ML
TLSH
T12CB2F6F658D78876DAAE4B43A77E3D139EBCC167F5856A40B3885A0CCD9A1BFC305804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38cd794f83453447135a85968360162229305bba487d1ebfddd9b82a33ff3e09
MD5 48485be743ddbbee749cb61eddaea995
SHA1 908e8ae59063f47c2d19399df1517371d4415b26
SHA512 5e9cc20daacfc6730510d9288f330de4e877e739b7cf9c72bf8f77fabe2411451f88cdcf27f6403ada4ad39e2c28a179bd58ccb4be38f93ba9a3ef0d12faef54
SSDEEP 192:JONW6v+YLNQmiUyqjZh+CGSO49oQus8tU6:JONW6vz/LZh+CzO4eGMU6
TLSH
T11602E8357D281CBB9FF2AE45F58736275FA81177E9952F84D9E82F0C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 997f8cd49d9b2ed3613c66c5723cc0d1b1e0a7fb9b60d2d3378a19f970e4778b
MD5 882269de479723288325f2238633faa3
SHA1 f71e3df5127afd5b9e59cb82cb95bf8a18767b49
SHA512 cc3527003953639456e003f09d58e60dc24be1deb4f38b99efc0197d9fb8478ea30e1f30d4155eae6d691ddb4f6e3ad03d244447f0e338acaa612b21eb29333c
SSDEEP 384:oPsN/C6Syzibd1e+CzO4eyfzAOObjI9G6w7yo:EtS8krOXyfzA29ML
TLSH
T19E727D3AAC288C778EA39555F1873627AEB491BBD6C92F84E1DCAF0C06DF59C5301416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5f2acac164e9522cf9f3d285d23432e5aaa1edbd30c8684cc05da9fd7bd371e
MD5 029e981386c0083a9bdd163aac6d379b
SHA1 cf27e1fc199786c5e04335df5b5ffcfeaf8ba94c
SHA512 712fabb4273ddc38bd96c24b86c3f2a46c78004c3f9a460589dfb1565f341f93a4755fc0b71981241e458b22ae58b72c40886a7d8fe67cca73cd25f95aefa514
SSDEEP 192:IONS6v+YLGQmiUyEjHh+CGSO49oyfOCH+qkU6:IONS6vze3Hh+CzO4eyfPAU6
TLSH
T15B123C367D384C775EE2A984F48736179EA85167EA857F80D5DC3F1C02DF69C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c8d38f112c617a77dafdfa0d57e79ee46c012d5f593e73f9461d6ea4669b6223
MD5 4e42f1aad7ca617ba994ace25d7484c6
SHA1 744eb380d9e8c4b5b0da04e6285b1950c22ff6fc
SHA512 12d211fb3b07ecc5f7b70efb574071ef081e9359d6a18941e506501c63fdeee2480cc55e7ed8bf919efeb0a9787268fe773b56b6e83c4fd3cc59a78e549b477a
TLSH
T1A8412B68A6EA1158B3B77F5AAFF6A86D847F7D372F07D15D10110D4E0622A40C8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download