b16bd447fd5353c0fd4118b27e4728cfec9b2c49fd3e94f4b8f97ef456e68589

Analysis

max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 12KB
Sample260730-s2barsvvfw
SHA256 b16bd447fd5353c0fd4118b27e4728cfec9b2c49fd3e94f4b8f97ef456e68589
MD5 a3244faf104dca3d174e0c8be3d0c10c
SHA1 5e66abb9a7bc9b5ffa728479d72b7159cf3a1f1b
SHA512 e125526c7afe802ead271e96677e368e21e6cc7cc24a740585a784c34c8a70f2fda5467786bf8a3458dd5475c2e0fa657e972beb88f85fad63dafb255d1f363f
SSDEEP 192:Xb9DJhySVEJfU1DyexOOgjyjyyIGaXD1Og4G7qkZArZ7yyw31VzF3K:1yRGLOOheD1OXZFwlVzFa
TLSH
T15B427413EEA00D2B437F16F92FB16789E847898FD24A5C01B0EE7584AF95F13C813586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3560	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298995176228634"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{98560020-A380-46AC-B131-459DBFE7FFEE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
620	msedge.exe
620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe
536	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 536 wrote to memory of 4168	536	msedge.exe	87
PID 536 wrote to memory of 3560	536	msedge.exe	88
PID 536 wrote to memory of 1904	536	msedge.exe	89
PID 536 wrote to memory of 1904	536	msedge.exe	89
PID 536 wrote to memory of 1904	536	msedge.exe	89
PID 536 wrote to memory of 3288	536	msedge.exe	90
PID 536 wrote to memory of 3288	536	msedge.exe	90
PID 536 wrote to memory of 3784	536	msedge.exe	91
PID 536 wrote to memory of 3784	536	msedge.exe	91
PID 536 wrote to memory of 3784	536	msedge.exe	91
PID 536 wrote to memory of 4020	536	msedge.exe	92
PID 536 wrote to memory of 4020	536	msedge.exe	92
PID 536 wrote to memory of 4020	536	msedge.exe	92
PID 536 wrote to memory of 3276	536	msedge.exe	94
PID 536 wrote to memory of 3276	536	msedge.exe	94
PID 536 wrote to memory of 3276	536	msedge.exe	94
PID 536 wrote to memory of 4516	536	msedge.exe	95
PID 536 wrote to memory of 4516	536	msedge.exe	95
PID 536 wrote to memory of 4516	536	msedge.exe	95
PID 536 wrote to memory of 3672	536	msedge.exe	98
PID 536 wrote to memory of 3672	536	msedge.exe	98
PID 536 wrote to memory of 3232	536	msedge.exe	99
PID 536 wrote to memory of 3232	536	msedge.exe	99
PID 536 wrote to memory of 3044	536	msedge.exe	101
PID 536 wrote to memory of 3868	536	msedge.exe	106
PID 536 wrote to memory of 1756	536	msedge.exe	107
PID 536 wrote to memory of 2352	536	msedge.exe	108
PID 536 wrote to memory of 804	536	msedge.exe	116
PID 536 wrote to memory of 804	536	msedge.exe	116
PID 536 wrote to memory of 4268	536	msedge.exe	117
PID 536 wrote to memory of 4268	536	msedge.exe	117
PID 536 wrote to memory of 4268	536	msedge.exe	117
PID 536 wrote to memory of 620	536	msedge.exe	119
PID 536 wrote to memory of 176	536	msedge.exe	120
PID 536 wrote to memory of 176	536	msedge.exe	120
PID 536 wrote to memory of 2628	536	msedge.exe	121
PID 536 wrote to memory of 2628	536	msedge.exe	121
PID 536 wrote to memory of 2292	536	msedge.exe	122
PID 536 wrote to memory of 2292	536	msedge.exe	122
PID 536 wrote to memory of 3320	536	msedge.exe	123
PID 536 wrote to memory of 3320	536	msedge.exe	123
PID 536 wrote to memory of 828	536	msedge.exe	124
PID 536 wrote to memory of 828	536	msedge.exe	124
PID 536 wrote to memory of 828	536	msedge.exe	124
PID 536 wrote to memory of 1204	536	msedge.exe	125
PID 536 wrote to memory of 1204	536	msedge.exe	125
PID 536 wrote to memory of 4956	536	msedge.exe	126
PID 536 wrote to memory of 4956	536	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7fff287fc188,0x7fff287fc194,0x7fff287fc1a0
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17411888590869285996,13811206676152766704,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1784,i,17560117754386997769,3407122200709472938,262144 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,7277515033458338014,15715903481412465858,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,12531295517605329420,5674223005708962108,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,5696245043225656921,5612047209408289365,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,2782224930547634587,958841877345889602,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,221570184729110402,6204822090774148012,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,956059239929783499,17558679768067235764,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,4079787766245100723,7138319031844682298,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1581278228134262183,13323540396071287085,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,1581278228134262183,13323540396071287085,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,2996772935095878357,15380690404620697236,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,17533065028674493741,7186535248881868137,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,9932988237306795792,11380300987021294854,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,6032579357561126178,3823538673926274936,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5816,i,8130837348899612161,7402939828780674162,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4496,i,328800103344594071,931429163970576169,262144 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,4457023748370140797,8551655130258269556,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,1881474441895542976,6061821834592723158,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,860166252877983378,17834260254412059816,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,3908987331351513626,14026953413409770777,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4528,i,4553954023747137371,17663892813865742370,2097152 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,8198853296146385476,17835030526916338661,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4016,i,5802132626901760051,16368925301226140540,524288 --field-trial-handle=2116,i,13774611963266008913,1929403576476649933,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 2e04a37fe50f4db6066fa166eb39d4eda6775f86a8844f8604b4de94bf6efc9e
MD5 99a33907fdf69227c399f0e2ef5956f9
SHA1 59bc81ba4e35f777ad30821b255e217dad5e88b5
SHA512 f06ab39746c53e411ceef23c416762c0622ac521b3cda378670faa69ea092566b3877540f74bd57ec2b35ca0f053716503aa909096d4ba0649d2688158245f1d
TLSH
T1DDE0205C97CAC396910F96C7804C739454707147DBCCF56B7207E8A6144184847479DC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b0acde13608253874d935e587bf9660bb7d46910623c8181536c518545672983
MD5 05c5d30db5360c8825ab2116ce56fd87
SHA1 071a050807a41c866f537bde89de0bb62905267d
SHA512 74df77b8742ae65e9df24901f4f0a06bce1a0033dde3d24de4567eec6e91055c207c79d11022a7d793db9ce7d15dd81a6fa7f1f5eca36b7b989ab2ffcdb0a8fa
TLSH
T127E0209445CAC35ED10D74C741D4A74C4198370B96C4AA07270489D534424D8A7815D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 218147919231f3100443c23abdb72aea4d0d3d5ac888813de308b50aef8e823f
MD5 13373bc5b908234630d738915ef0b07d
SHA1 f97b95fc17b76f50ff3fef8132921ac8af64a9b5
SHA512 63ea303f21a10f4809853244a56effe93204bde48d5a3034cbc914f180a4865c55da709333b4883360a73f35e4c1a9dd6e97752291539223cd755c63322dee4a
TLSH
T1C4E0268454CECB6ED21CF8C742BA634C82A0370FD3C8790A97008CE4308B948BB82DD0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 931KB
SHA256 67c86a586f6b161f4d6a1af4bbe1e56ed6438506cf0f64dfddc4007ded81e930
MD5 92bd0176d32816ff19d657f93c193a4a
SHA1 018cdc548936d8ff36c3896f67949022ed5600ca
SHA512 99e8e9b0dfaec1ded37dc403813b43d96c1bc981c1dc057205813417afe1dfacfa991d983a8b5aa0a6a22472d1a642cf5fd4232963b228aa6a8e422557ebeecf
SSDEEP 24576:9HUM2kF8JKlw66MukDgy3cnr8xepIWGgT:90M2kFAKlbDttxe1T
TLSH
T109153364E1D79874F3195E3632E201660C60FCF46AF2AA03795DE5682BA0F970B4CF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b4
Size 45KB
SHA256 dca066804877053c91e0343f385014f3128df28b514cb624df42709a629566a7
MD5 eb1e709af75b44898be7d4aeaa29f0b2
SHA1 a416b2d81926e67a7d937b548f7d0fd73febee1b
SHA512 d9c6172ffb894107921fb3f0836acebe8c7898b2b3a3e37b2c51f5dcb31a91b30497350d50d82fbbb03f437d3dd4ca3f523fe44df733efe7bde675aa341e9db1
SSDEEP 768:bMgSYrWbLtlcnlJL9UJXcGQnqR5dd9JcntDX67/MR79Dy+49BsjxqSft9NN73S:YZYybRCxUJXoA5ddnxS9Dy+4sj0SFV7C
TLSH
T19223E16523666C20C8279A7E31D15A2A2B3AE3F2B6973B4FD760C669FD573421E804D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2ea8707802abbced7588f4acf684fd5bcc73bca5c5ab30c337c7253900ce52dc
MD5 61191a769ae801c40e476ec907359c39
SHA1 c446c16a67a271ac584c2ddc3c723e7c1ec99c4c
SHA512 288e399ef2f5d967afac535215a98fd28080db472878466be277bb855762c68f1b467e5a7c1307b7094ca6459accd92088b849d63190cc42179cbe86329f94cd
TLSH
T1837118B620010153EF210F70909372F27DFCB6E8F2579EF92D7089BB65063A096AD90D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d8b53d612350f6257da87da8e0531ac6ab766625ec58d72fd4f53a82fc9021ad
MD5 d5d4e743bf206ae46cc305572c4d591d
SHA1 a1b56b72badf032918e7c51e7dcf7fdf138e574c
SHA512 2d0c38ce0580b3cbad50b9f0446a7ffee7de79753bfc462f5087307f2b20c9049a75b06341dc6896a78ffa73ef4b367959a078d044b55c29d241e82e4e75b6c3
TLSH
T1E17108B621010153EF210F70909372F27DFCB6E9F6579EF92C7089BB650A3A486AD94C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bfcc6583e79d387995f5651223abc9d01a25e2ebec54e09a434c5d04b804c0d6
MD5 8b9064b49903e2322bd145bd9d54628f
SHA1 b1c15abdd4659e4d3f8721603337ff4bc38b47dc
SHA512 9e62119a7aa5ef9c6319a84505e9aaddda08bfc682f686b9f6464ed6e7ceb9ed3c0902dc16270ca5d9c6015e817b9cd755e15e08c936eb5e6b1f61ee25562122
TLSH
T1FD711AB620010153EF210F70A09372F27DFCB6E9F6575EF92D7089BB65063A096AD94C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af65.TMP
Size 3KB
SHA256 033cb9d8ec18f28e6fe45c5a10c04ad9d0fcf71c2f653eedb3594930cb371734
MD5 e63ff087b75dcacd55120cf5d5a938da
SHA1 c950dc8324d07f88d475c41e5bbdaa15e5dd7817
SHA512 933b3d542e14abdb4c7ea830e5f2bdb05f05090ca4443bb9925959151411e1934310bd4deac544405a975874cd45e4f55efbcc0caa9b935c88fe1bc42dde8a49
TLSH
T1057129B620010153EF210F70909372F27DFCB6E9F2579EF92D7089BB65063A086AE90C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 fb56b6334a7a3d82dc66994ef5b13b784f560451499f1b02868a2b71f84d4ef4
MD5 8ace2efb23f16cdba44d7dcd6bbbc8fe
SHA1 1d1080c4a1d1b80777769771ea3a185263514f24
SHA512 f13f97500a39790eae30a0ebe4371a3c5da4c106fc389be47621d9fbff97947ed2e5481f0a3cc18c0f77ed40a17b3a82efee3d6f56d5df056d9189c7c9940005
SSDEEP 48:YALlNJOhjhbhgh1lZxJghTQsKzBwEsj9soQtmeskkzsaQI+Nsetsh7syrQlnfsnH:DXO9l6rlZIh2zBwP/QtmiEQI+9aXEnIx
TLSH
T15E818BBAC3E447BE891192F59A35AE1ACD1D151B432C3C528DF8AF0B63F2571D10269F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 dfcfc69fbcbf5ecca3329d595e81e4d443e39838c061922bc8c2b4de44c71c6a
MD5 2297d9d55086ef89329871b5e3bc1420
SHA1 3b9ac46eac5d50dac0c1420af32048b0ac04e237
SHA512 336b47fe440dcc8f24418aca5421f0f523cb901943965306fa64547f7551e7425d0129ffb972499a6790c9b3deb6e54db883cf7c1a173a0aea596760505d18e8
TLSH
T1F7519BBB83E447BE891192F09A25AE1BCD1D111B432C7C6689F4AF1B63F25B1D10279F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5d0d448ca608b76a72ac10d1f7598e870d2c6493bc2a89f1b48138879392a95e
MD5 db0274496a07790abefddb6c37c96377
SHA1 5ce2d67ad59dee628bad96f3b1c099cf33655a32
SHA512 d43c3297eb838f4369ba689fccbc6095042c80831c49c7f32f71f5d2b5cdffce82a5dca1a3bf9448d786079982328fd69ca1fb6e201c29cd9f20eda6c124b0eb
SSDEEP 96:D/O9l636lZIhpzBwP/QtmiEQI+9aXEEKx:DW9l636lZIhp1O/QtmiEQIIaXEEKx
TLSH
T1EA917BBAC3E447BE991152F09A35AE1ACD1D151B432C3C5289F8AF0B63F2571D10369F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e7c175dd31352b5626907590b1b4fbe13602a241d930216dc100ef9ea368ba40
MD5 b2c8cc945f48d3b2b957a8746eeadb8c
SHA1 eaaf197f33757c568a774d3438f55fabee30d534
SHA512 db62ded676ff2f120af0f6322fa1304e176a0165b759b5dfa328c074b1b8ed2ccb3fa5f9026b688e4652717f8a33f5fb7eab3d95151d130c9bc4399315e5e6db
TLSH
T133317EB783F046BE9A1192F09A24AE1BCD1D0117432C7C6589E0AF27A3F34B1D101B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0ef18eb1a662e2da6e3f200de556a9d51bcf596464f27dfed7746e469268720e
MD5 da1936f35be2043851b0d689b5f4d77a
SHA1 c077f13af7d1e978826e7be8d28fd3a1389a7eac
SHA512 8ff07231ff1499d4a6c32106d1ab450bc1aa9d93990b6e75378a51b9c3ec7750ef87a2f5890112253f653f09a71eaec78e149a6b1b0fa914680adb5aac1d24a5
SSDEEP 192:sxZ0R+yM/jK1Ml8Mkn/fgXsUYl9VhIdpdbHW6+WNGYvrD9kNn11IgrJ:sxZ0cMn/fKsUMy5HbGcqNz9
TLSH
T1E342E8166B345977CCDBD209FA41BF53D6F91472E2904E44A9FCDA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fb5e1b491ea86f3df5bfcd732db2bd223a4efd425976e9a2baebe5057cea9d4f
MD5 966bf66ff31ecec3f60e38719163bcd4
SHA1 abf75702e61d362672b6bd329a8cc22c9f24a73b
SHA512 a3951e55966e4a2d3cc42b257adb994c77805c04f5298fa83d620901d3d2ca7d28c7b6d0207b1dae03a6fe3c93a78866078754287b2badbbd7e7760332190876
SSDEEP 192:sxZ0R+yM/jK1Ml8UQwkn/fgXsxYk9VhIdpHbHW6+WNGYv2D0kqn11Ig5kJ:sxZ0cqDn/fKsxVy7HbGFlqz2
TLSH
T18C52E716AB345977CCDBD20DFA41BF53D6F9547292940E44A9FCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 316f72614c15dd2cd804f03f61ab17b0a901c4e1f1259b847c9fadeae060af96
MD5 e2a897eea28ff5a95595af21ea878ffb
SHA1 7ee85d123758de664bfc470ca66ceed41ce78e01
SHA512 ea4992e52182aa1e334fe42e3ad157d6844da03a4e17e194d7a2b6ede4d2bfc0ccc0ada2abd4d079f187256a748de17f53056ace00a53d1987cc41f43e796e30
SSDEEP 768:4CseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppHroDi:4CseJ3xWvhfynu1jaVcL88pUG
TLSH
T1C5D20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 ec7c41faf0de789503849a62d484d9339b3770d77c56b2dd342731f844243588
MD5 08eeafced471f72fa4af4210ac41506c
SHA1 c4a001fdeb0584680cb48743d1ecf0b8ef7f462a
SHA512 9709e9af8d11b55f8fed3ec21b924e62aaa5c235cfde207158ebb28351d67bbf93fc5811bf94e026a5f3f1e545f64a5ab796e414114d4268337fb0a5df254030
TLSH
T12231634E8E51D59FE9A888B2107661F833F0C9EC1B1162634C7C363E7C2B39B1A4B19C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf8b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cf8b0.TMP
Size 1KB
SHA256 c60dd1e42cbd5a34c4dc61e928c4515c99da122b9da2c9c337c8f8b8827e0d41
MD5 30df736dfe6e2924995d4d4167def0bf
SHA1 b501734eb6fd0205101f755dd9a01b7e1eeb9b6a
SHA512 f2cbe34a2bb4cb3f887c52223b50ee35804f782191d4944f777bb691dde7a7a43c3a68bf5cf4029f25934334621a8b9b01bb4f5a87d7ed5fe395d3d3339704b2
TLSH
T18C31468B4A45991FE8D440B20556A4B8337AC94053127783987D663EBC757AD5E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d333348791b6b931e9c0461b0740d8c8641257fcf875c589684ddeae3aa71345
MD5 ba3b3064b9e6b9b964b433d7c9ef8e8c
SHA1 821be37c1d8ae5c258aba8f0514150fd3db4ea04
SHA512 b032e3ae4bb03564799ebade05cdc1d60dd12f92137865aa545af40326e5cbfa840daea354fb29d877a03b15ec2f593572c660eac85b623c0807cd80cfd0307b
TLSH
T112E0C0762DD72460BEAFC3D120308090060A749DF941FC4E541BF6D310B235530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\71b1d6e8-d462-49b2-8ee0-c0a160939619\index-dir\the-real-index
Size 96B
SHA256 a23f17c1595028dd5b8acc6ddeb1977459c4c25c58ee404d8fe512e32c9b9b85
MD5 086e13c8c824844de14f14e31254f1c8
SHA1 4f7984d0cfdc3503771f284c21d3787e1d49f991
SHA512 d93e12c0abbd99ef4772332048b1766e468bac94afa97631b581994393cee063dbe83424706b8f2235777922a35f1e04c473348d1494b99382ceb163981ee483
TLSH
T186B0118000200202CEA002B82082380232388BEA2B8300AB02A08330AA0A2A0A202000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\71b1d6e8-d462-49b2-8ee0-c0a160939619\index-dir\the-real-index
Size 72B
SHA256 5f44188f9b7eebf7b541ee3ce3a22d6a1e0272c563a18bee44d96d65a66c0b51
MD5 4f4df0651e8feae3d0cc54b96516bf1d
SHA1 456496f198b4a4b9756999e8f657eb416eab536c
SHA512 85a172b612477f6775feee08a565a676327e9c50c53d18b9557ddfb35e020ff74496757d5857c9677b187583b8b96a02e9b37ff7b46f1ec4bb855fd0271ee43d
TLSH
T179A002905AA40213CD5047F520D66543B7148AA306224B9F63D4016ABF5727C8751015
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b726.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\71b1d6e8-d462-49b2-8ee0-c0a160939619\index-dir\the-real-index~RFe58b726.TMP
Size 48B
SHA256 371a2aa734f7f24f13ad4d97fad6b2cde0e28b29ff8e973e7a8e4678433fc258
MD5 f7117d21204a903729b9af4aed00c6d3
SHA1 04f4b8ff1d28750549120803b94480234e6e90b0
SHA512 619c8738e8ec01430cadba24e04346a24bebd6e0e76f25c76a6d4c8b134a7b19b5dd0c26be8dfcecac2d0465e2288b7809651564180dc8a7375d418f5c9966d6
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 109B
SHA256 43bff2d202f4381ce270336a43918113afe7e42bea96e854141d3db05b12c848
MD5 cb00a0d01de08018dffe719a1da5e668
SHA1 bd5562467447f7f7c8a96cc5163f1d26e20bb73b
SHA512 f5f33a9f5221029b3ac6f1e90ae60da95d98c76c91af75cfd3f368b855f33c42421763e5af2a64f5a72e1e97df7ebba7996ec42f19142a022e9bf45b5112e390
TLSH
T1BCB0121185972A30E35E4D5B8B6D52823E3FF040B8102E8FF17E62024438E240CE2DF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 109B
SHA256 5935931d7d51911779b063b024a5c69164450734649e53e200b057a96f528a4a
MD5 850b46c14056ba9e537cbe75ceaa9813
SHA1 5aed563b3c4f0be9a50880563833089c47bf62b8
SHA512 9f6ef1bacb756333ec4d024ce69d12dbe213372075ca3558779d1cb86785ab5d356bf516b4543d3a96cb8a57691db2ce6f3996d188d778f82db66dd116e13767
TLSH
T185B0121185A72A30A35E0A8B8B6D56467E3FF040B8102E8BF17EA6024439F180CE2DF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b755.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe58b755.TMP
Size 114B
SHA256 6745f5732785d513bc719d49223922290282918077185b2228accdef8ffddf6c
MD5 b96accae692f434183287643eb2b2e6c
SHA1 4f6196cf6f9e9d0f93c7e9d782cf9a18b2423e4d
SHA512 1822505081ab0c3b463fc59765b8bbd3d0b43b28ec9a5ada2d56cb98a633dc4c1107e3b4a235eaa3502f4d95e65650be19255f567db61a956642df6a49260bb2
TLSH
T131B0921181A61A20A34A084B8A2D52812E3EFD44A8002A8BF16A72024438A144DA59E2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c72b3b2fc14ad6beba69f209010fafe645b204587e1ba2d47e82fb6f8b90caf3
MD5 32a8ca3217863502e24ecafd7c90f99d
SHA1 a5e43ae5bc30de350068598e0702f34971746cc0
SHA512 9b535da58beb93d32eb377706dbb585258431c48ca2e62f1aa7a367a4fea7340ad78a4ed0835b9ae63cf64ddc7057843ce65200a8530f63fd109175eeda8ea15
SSDEEP 48:KYHIhKggkXy8+FCuEA8kMADPIDmkKqBickWO0VjEO5y083ocGO+2kOh9ILc2KWT2:KYH+Kggmu32KYAe+ReKSoT0pua0+K
TLSH
T1A2914713357B020238BD664CB697A63B8E4172A73458B4AF7B7904A20E27E251DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a32f6784-672a-413e-8250-6bd32529b6ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a32f6784-672a-413e-8250-6bd32529b6ed.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594b48.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594b48.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 da3ffe748251267da203e92b0590e4c3e1527d9efd8e77c905eb09b85ad5de78
MD5 8332ffe032a4b3f4a017428142b7a709
SHA1 311bc187b7cd051441c399dea9cbe96b87f41d0d
SHA512 6fe3a38b8465cc70339172dc5cd829ea52496434d91c3f1006bd6796fe4a93981994f31b74e8bbd8d6f2414d6ed6ac42a635580675ce9d3c294fe967bbd5b891
SSDEEP 192:uIUm+xasuheOwQxMGsNvq4QDTzM7fr+QmiU1eXOC4MT/hCi0bcvNh8z1cq8h4TjN:FZcIhsNvq4mg7D6Ht9dcGeh4TR
TLSH
T16A626C726C749C6AADB7A241F48A33034EF49167D7C49F50E5EC6F0E01EA268030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 797413b9e387bca162d04b4f868851daf467481813d23e9f1e1b8330c6a9f799
MD5 c92355961121bd786d9b0b82c8723433
SHA1 898fc3b3e8ae3db85ccaf6abac79e236a6366cf0
SHA512 80986fd4e0c0558d3fd39e33be7e28b4f9229bd3b71c6b73a3c6ae9189163a4f5826c4f2a2295a27d3089407d7389790befce32e6de9732da9d420fca13eda93
SSDEEP 384:8iFiZcIPzsNR8TUNTUlIln4mg7D6Ht9dc+eh4TR:nFQrcwgLgYrd7eKR
TLSH
T1EE824A735CA4897FEDB7AA41F58932134EF49167D6C4AA50F6DC6F0D00AB1AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0cb187d3ac77cd397bfe8a81815c9e7861def102eda9380019e0990a6651e138
MD5 a9f06d62754db4221027f6d6e6f41f08
SHA1 5f3b261cd7d50dff4b32ea28196b062aa0663fd5
SHA512 1540b010875ec0ff329c300d371b362dd9069ecc3d0c8d5c93fefe21782c70d87b6c7bd4170be3178c5732059aa53dab87718f70b04300a831cf5936cb1f070a
SSDEEP 192:lONV6vMtPQmiUy/sThT/hCi0bC847u1U/u:lONV6UtR7TSdM2U/u
TLSH
T1AE020A35BC685CABEEA7AE45F48A23171FE4216FD5905F50EAE82F1D00D765C130392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 3c7b2e56812883ea538df4643cc913d5c9d584104c3ffa14c620f02a8e51d868
MD5 e5f66f556ac9a659cf87d5eceb6204e6
SHA1 19a134426e6f805d70fffa1b5bdc02c6ea16e395
SHA512 c9366209e20176a20ec0a97d50fd3cfaca32796d74d06598ffa5b602efa846bd65cfaf03ce50f621fa0cb227e99aca5ae087c7ae065d631f72bec0eacea1c511
SSDEEP 192:uoUm+xasuheOwQxMGsNvn4QDTzM7fr+QmiU1eXOC4MT/hCi0bcvNh8z1cq8h4TjN:xZcIhsNvn4mg7D6Ht9dcGeh4TR
TLSH
T13D626C726C749C6AADB7F241F48A37134EF49167D7C49F50E5EC6F0E01EA268130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 126d36934e4b27198090286dda71d48532ba7b97c5d2b90c9e00a7d1a2b767b3
MD5 1832ad329eca5ed1f68cc55a925719ec
SHA1 ae35268511ebcac470b34e6064e91804205676e6
SHA512 61f7c87c73010e0a701a244223289cd7e318854a5e56470f9d87ba45351dd2f4cf5e741a6c5d611ebc608d769c56e20588c130c96522fb9fef4819d8902e7739
SSDEEP 192:y2ONK6vM5PQmiUyqksvhT/hCi0bcvNZ80Icq8U/u:PONK6U5RLvSdcOeU/u
TLSH
T163122C73BC689C6BADA3B541F08A22171EB0826BD6849F50FADC2F1D01EF65C130752B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a0a7af6f4ec3e77f0ade3b3a070fd3c3387f4bdab3a52621b733ad4a38ef16a
MD5 75c26691d66b2450545ebe95bcb6aaca
SHA1 62778931c0bc9fbafc2ba3317c45ada326718e15
SHA512 3edc015fe15c91456a888906559fe0c43bf4644b4fcfa35e4f43464212ae7b5902ed36a8316911b40be0eea6d6c44475c4eab7c3a968e39d57dd39735a492750
TLSH
T11D410498A6F91158B3B76E5AABF2A86D587BB8773E06945E00010D4F0A63B40CD72733
MD5 SHA1 SHA512 TLSH

Submit Download