b16bd447fd5353c0fd4118b27e4728cfec9b2c49fd3e94f4b8f97ef456e68589

Analysis

max time kernel
899s
max time network
800s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 15:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 12KB
Sample260730-s2barsvvfw
SHA256 b16bd447fd5353c0fd4118b27e4728cfec9b2c49fd3e94f4b8f97ef456e68589
MD5 a3244faf104dca3d174e0c8be3d0c10c
SHA1 5e66abb9a7bc9b5ffa728479d72b7159cf3a1f1b
SHA512 e125526c7afe802ead271e96677e368e21e6cc7cc24a740585a784c34c8a70f2fda5467786bf8a3458dd5475c2e0fa657e972beb88f85fad63dafb255d1f363f
SSDEEP 192:Xb9DJhySVEJfU1DyexOOgjyjyyIGaXD1Og4G7qkZArZ7yyw31VzF3K:1yRGLOOheD1OXZFwlVzFa
TLSH
T15B427413EEA00D2B437F16F92FB16789E847898FD24A5C01B0EE7584AF95F13C813586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298995346136943"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{AC8DBF88-0929-488E-9110-5DDE1D760B73}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4760 wrote to memory of 608	4760	msedge.exe	89
PID 4760 wrote to memory of 5644	4760	msedge.exe	90
PID 4760 wrote to memory of 5068	4760	msedge.exe	91
PID 4760 wrote to memory of 5644	4760	msedge.exe	90
PID 4760 wrote to memory of 5644	4760	msedge.exe	90
PID 4760 wrote to memory of 1228	4760	msedge.exe	92
PID 4760 wrote to memory of 1228	4760	msedge.exe	92
PID 4760 wrote to memory of 4344	4760	msedge.exe	94
PID 4760 wrote to memory of 1416	4760	msedge.exe	95
PID 4760 wrote to memory of 4344	4760	msedge.exe	94
PID 4760 wrote to memory of 4344	4760	msedge.exe	94
PID 4760 wrote to memory of 1416	4760	msedge.exe	95
PID 4760 wrote to memory of 1416	4760	msedge.exe	95
PID 4760 wrote to memory of 1652	4760	msedge.exe	96
PID 4760 wrote to memory of 1652	4760	msedge.exe	96
PID 4760 wrote to memory of 1652	4760	msedge.exe	96
PID 4760 wrote to memory of 3656	4760	msedge.exe	97
PID 4760 wrote to memory of 3656	4760	msedge.exe	97
PID 4760 wrote to memory of 3656	4760	msedge.exe	97
PID 4760 wrote to memory of 4808	4760	msedge.exe	99
PID 4760 wrote to memory of 4808	4760	msedge.exe	99
PID 4760 wrote to memory of 6108	4760	msedge.exe	100
PID 4760 wrote to memory of 4436	4760	msedge.exe	101
PID 4760 wrote to memory of 6108	4760	msedge.exe	100
PID 4760 wrote to memory of 4436	4760	msedge.exe	101
PID 4760 wrote to memory of 2296	4760	msedge.exe	103
PID 4760 wrote to memory of 5648	4760	msedge.exe	108
PID 4760 wrote to memory of 3232	4760	msedge.exe	109
PID 4760 wrote to memory of 2272	4760	msedge.exe	110
PID 4760 wrote to memory of 2680	4760	msedge.exe	111
PID 4760 wrote to memory of 2680	4760	msedge.exe	111
PID 4760 wrote to memory of 2680	4760	msedge.exe	111
PID 4760 wrote to memory of 3080	4760	msedge.exe	112
PID 4760 wrote to memory of 3080	4760	msedge.exe	112
PID 4760 wrote to memory of 2940	4760	msedge.exe	114
PID 4760 wrote to memory of 2940	4760	msedge.exe	114
PID 4760 wrote to memory of 2940	4760	msedge.exe	114
PID 4760 wrote to memory of 3980	4760	msedge.exe	115
PID 4760 wrote to memory of 2032	4760	msedge.exe	116
PID 4760 wrote to memory of 2032	4760	msedge.exe	116
PID 4760 wrote to memory of 4908	4760	msedge.exe	117
PID 4760 wrote to memory of 4908	4760	msedge.exe	117
PID 4760 wrote to memory of 4812	4760	msedge.exe	118
PID 4760 wrote to memory of 4812	4760	msedge.exe	118
PID 4760 wrote to memory of 1972	4760	msedge.exe	119
PID 4760 wrote to memory of 1972	4760	msedge.exe	119
PID 4760 wrote to memory of 5132	4760	msedge.exe	126
PID 4760 wrote to memory of 5132	4760	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaddb8c188,0x7ffaddb8c194,0x7ffaddb8c1a0
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1568,i,3288488335051568663,13796953813665649316,262144 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,12206523510542357711,11826822916926123603,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,3853854330842132500,7307527743438198180,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:13
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,8291168435381255770,17889448686044988772,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,17642586183317875696,8595929941875520098,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,12647112432005730380,3588572147949969835,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,14828125350778717791,11610342993455953641,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:9
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2667235287946957696,11157144479657530045,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:12
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,5727576427489530923,9061969781560757761,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,3836126053837447255,4687601959879423810,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11457780635341496621,11580744488315562685,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,11457780635341496621,11580744488315562685,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,1750978389602852071,971863206144001423,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,5359545763353795915,8201832012047682545,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,8975281431351418039,2443836779822642109,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,11912998005913925050,11444798921877119704,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,1931323401104903840,5593167611106410178,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:14
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=812,i,18128694955824672809,9509868012175198996,2097152 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6688,i,14017931333603266582,16147846514681978844,262144 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,15586278821766670058,944646473617443340,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,18145493029473691644,12437269589045657875,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4624,i,1322094045388220292,269965681333145700,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:14
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,12096408035617099949,13291634736687131689,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,12820990681663932971,8503931805658530390,524288 --field-trial-handle=2232,i,9282858417041825373,577215718655771523,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:5132

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2752

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:540

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 97395285923b26361d2b676434b40efc74ad160ccb0934f567047f1218615ead
MD5 d7488bd0d29b43163769545f64ffd162
SHA1 c24bf96a0be47eb780fd15c1fac30938d56daf8f
SHA512 a7246bf2ad73b6a1abd01d380b8a79f749c5670d5ba25645de345061b9f1e9dbf8ca67baf5e954a37ddf6fb5d5f4101dc85bb4313c34484c2bf577ba9afacf51
TLSH
T11BE07DC64ACAC37FE20D65C74268578CC2E1360ED3CCBD0A27068CD67085048BBD36D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e1b418cd2216ce067be3f898c5dbcec4ee2bc22284e83d078d11f83a254e4b34
MD5 4dcb2249b4e84e3918035d6cb1f8abde
SHA1 07a88158de2e89849765e5b4cda193bf1f2fbe5d
SHA512 9397778b77204b01074dd8a0e12ef67bdadc83c84cfcf77c24e0bf7a6ddadf14d5e96d1aa1964804373542e86c0af420fdfc533bf2d50423e95ec03afe4e7b82
TLSH
T1ADE0269494CEC32EE61C6887527C578CC2E0360F93C8A90A37098C947005488B7D66D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a71414127e1c0877f496b7bc08de4a3bb34cb0dba8540538ec820cd97f440fee
MD5 06b6a31049aa495dbf2e2a495b26cb41
SHA1 b89e311b1b998cc48ac8b81707e00b6f2ae93b0a
SHA512 a7729683a9bc0cbbc0bae73799c7c3a6a7ec63fff446d0f1c9458ebd5171e848674e2de6b4c6f37f46b4eced0a2ed446430cb3e8e4a9ebff9904d2d650c8ee90
TLSH
T15BE026C554CAC36EE60C788B42ED6B8CC2E1360A92C86D0A2B09888A7101848AB92AD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000038
Size 931KB
SHA256 67c86a586f6b161f4d6a1af4bbe1e56ed6438506cf0f64dfddc4007ded81e930
MD5 92bd0176d32816ff19d657f93c193a4a
SHA1 018cdc548936d8ff36c3896f67949022ed5600ca
SHA512 99e8e9b0dfaec1ded37dc403813b43d96c1bc981c1dc057205813417afe1dfacfa991d983a8b5aa0a6a22472d1a642cf5fd4232963b228aa6a8e422557ebeecf
SSDEEP 24576:9HUM2kF8JKlw66MukDgy3cnr8xepIWGgT:90M2kFAKlbDttxe1T
TLSH
T109153364E1D79874F3195E3632E201660C60FCF46AF2AA03795DE5682BA0F970B4CF76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000045

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000045
Size 412KB
SHA256 0da83fc67d88c905403920f0d0627bb4e62885d6f107e323a9778e544edc73ab
MD5 df01b289784e97c2c3f0576ba3e615dd
SHA1 1d38bc8ec89026c518bea36a98a0ef7e8e25f677
SHA512 650bdd9232c65a1566ac04f48ccac7dd4d6045ac10fc15aedaf9a0660ff375cef54a12e1c6139b03f7fdb8f465c19dca4772f6d71f37a4209a0a3e5e72748f6b
SSDEEP 12288:CCTVnSZm1bXq/95lBOfrxKn9K63Lxq6geqZiWMv3tE:CUSZm1s5KfmK63Lxqr54v3tE
TLSH
T1FD9412206B66448DDE3E5D3003C93B22B669C525E9C7A7ABDDF0D2696E1E3980C035B6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000046

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000046
Size 682KB
SHA256 8786d5353fc0ef049ae2f0bb1a6ecbb6dc0af397db24d5eb2a00af88e102e29e
MD5 971661e78060ee0b6e81b46d45ff5eda
SHA1 5f7b0802386b1e03f3bdba4aa6775ba6f2d7649b
SHA512 981b49a14098204104cd0980fdcb9344e77f05f2aa3169be72e720e55869224ce613e4045a5f60835ae12fc4d09d720bf80ab4150c3c550d4e9e2ff6b7e2b3a2
SSDEEP 12288:4MNVWJM3/QNq3gFAClEA00v8fpVbDWWXdXb2qVzxfO3ztZEyA98HwvpHfo26vhh:4Kp3IA3aF0AWVbPdb2k0tZEy1CpHQ2+
TLSH
T174E4231A8B61DA49ED990979CAD9A3047D79C948BBC7434F60DC90BAB2C3FD37D821C1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000048

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000048
Size 772KB
SHA256 4052de1a6b91d44dfd0fe74dc45661442ff7276c593de54113c2bb8a0fc67d9e
MD5 8501eea35d0fd6c99814838d58e91e12
SHA1 6158988a6c8703843d5af9522304cb3a49365199
SHA512 24049d3b5182c08c8be5ed1b8fdc21508a65cc991d4d720195990a266eb6e47f59a0a4b2e9f59f3b31c3f96cda237014562e9493cd901a657486e91a7d781cde
SSDEEP 24576:VcojxZ06gQKVukScIK7PH1t62ZufTlFRhmdDEdVl:Vvjxa6gQKVut4PVg2ZEzRsNeVl
TLSH
T134F4234693A38530CD4BD93FD4E8AF361A30D0F02D5A934F0E0D7EBD589BA626C652D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000049

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000049
Size 365KB
SHA256 0d6fbc2426f6fad8a7e698f1f957aa7acb880708762f07804053e5a7f62dc14c
MD5 3383aa6749e75f1c27bdced8c839e775
SHA1 0c55b1e9d9ab1e16ebc3892d6d7a7f40c34a5c37
SHA512 5d2ab5215fa1e33aa9d682357e2bcc61c0691c1d07ac39fcdd6454a48e5a940bb86d36cfa4c2d7e5f95801fa36c045f61928adf7a55d38cc739177abbb862d46
SSDEEP 6144:ciBZISTfMJSgdaU/3xAXFqocTFv5u0BfEmyRZ8Jbp0P2CnEX9LDJTyg1orAhcIr:DBmJSYP4cJvcafEN8Jb42KOFwEokb
TLSH
T1EA8423E25BA38668DD3973B24ACCFF21B3B5E5B12472973BCA5118F9FE01A784D11019
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 568KB
SHA256 c441154580dae09ef4e6a2a8494a11b715e0c1af58bed90006c25b990681d465
MD5 c13905878768e80492d699923493f521
SHA1 4b4dc0e339dee1c34794526f4de9a6db8ffe288d
SHA512 6d7a36071615f4b7ef38d32d40c049e969b17de87c926dcd328584d12597e3c7bddfd1106100ee729e5a88fbd8c9ea35fbcd1c9a15ad2b385e0bc4a44726f82f
SSDEEP 12288:7MGEESbYxS4foCjQpWGgAdYtd5RtK5o6i+Er+FrMV:AQJQCjZUYt7Oq6FrMV
TLSH
T106C42324CF10802CCE4CD8395795B372B52AE89F95001F7BC294F06CA96EE25DD6B9AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 d268fed547a85c631d4f1b8e0a725b95d7c7fe2ec22be017571b0326a489c06f
MD5 7a6a0c7b590b56f46a452f228dfe5bfa
SHA1 9ca5981127e40fdc88908a2a22dc8efdb17d7203
SHA512 fc17d99b90004f42e2ddbcafc13ab7ca5d0610f624fb0551dbf9ad3e070607ecfc1bb2751dbc3ecbba0e7d73a245f11f4b0eef1657f4b40612084b700144bf88
TLSH
T1AF41B690DF2409C1DBA4EBB6D0E58F8432F4B09A15076E3075A05E748B2EFF811C246F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 866f1b8084b347f1edd68659d8238c45fdc103816667c499ed28042c1dd57ce3
MD5 57d58d08c08bc3aa61b68373fc77c018
SHA1 96acdb8f1df95fd1a950bbdf9b3373730d460541
SHA512 3d336857c0cd80751723f20ccdd6d885579ed36fc03ea996d0f0941ac5cb55f94b39dec7e829a7f8b0221335034d7797f1ba376e6d135ff659be737149b408de
TLSH
T17C41A490DF2809C1DBA4EBB2D4E59F8432F4B09A49076E3075A05E749B2EFF811C246F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1677436e258324fecb0fada395e9f33e88f79cbef4e953c6ce1156f0a7e1d8f5
MD5 501f286433ee14409b097629e9e019fd
SHA1 2a6a9b354cd6ad3323d366c4edb4da5a69d6c117
SHA512 b7b7b9d39b6abc9edbd117d0f48bf8d8c447dcf772e47e8b9c2dd2facb4b1d21fa00e3ba3b6ef9fd6e5230b29eb4df9ce2f62d5dc04ddd66288185a5a7d2c43b
TLSH
T15C718BF7C3E4477E891192F4AA246E1BCD1D151B432C3C6689E4AE1BA3F2471D14269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7d2ab160be033c8e58cb3a5485de704c321dd521579f506f1b19e6768592f3fe
MD5 2ec47c4f838d249fa633e6e7c7b19164
SHA1 385e87cf3b5e8e3973d66710e487bd842d0ab21c
SHA512 8536d7e319903c3bc70cda104cfff53617d7b0f21c920dbaa40cc0bb67a93ce64276908c97399d86605fb95867ac5cf650f7e1a1a1f45e98e711c442d6d0ce7d
TLSH
T1CE718AFBC3E4477E891196F4AB256E1ACD1D051B432C3C5689E4AF1BA3F2471D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f4b53c7d766ad7025eeb3afaaa173506019584eddf0570fa2a348334138c48f0
MD5 629c4785519dc8de29086491f05442ee
SHA1 8b59b366ad091629b5c660ab911b1ee74d8f2fc1
SHA512 229f0ed699c025106e0419056356f7ece09f54d71e923932ee6c24401b2e15d7fdd1bbd66a27df39a7a502b94aa2c7c8a6301c12005452d57ae06efde6b111f0
TLSH
T1F7519CF7C3E4867E891196F4AB146E1BCE1D0516432C3C56C9E4AE1BA3F34B1E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4ddb7b44243e18dd9eb1491544c5f29a1ca8f2f09bba74a076232088fd82e053
MD5 23e0290cced8f2d9de308860adac75e2
SHA1 d5caae919693fbcb8a21801b8e7a7e1cd07ef69b
SHA512 14a5499b4cc9037c0bb07bd967e440b0bbcca49796d6faa7fd7ae8a252404703627772104c02553004ef5dd3f81ff2e8f541e7b3e8a8fb52419eb5c0308eb04c
SSDEEP 192:sxRiRXbt/fPs0FHm2Sm7aMdzoD8p4X/g6+WNIY3BLSGKIgIJ:sxRiZt/fPs0F2ae/5IAYs
TLSH
T12F32C7166A28997B9CC7D219FB667F53E2F95032A1D06E48F7FC860C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 1ac79edd2d218c97476f79bebc21a4f8089fd7fd1423635e258aa482fc41d5c3
MD5 8bf7cd28542fb8ed7b47f087bdfa489d
SHA1 85be8d9c9316614f466d70f7d95c3a2533816556
SHA512 2a2bc007dc19bf983aaf71b2b4875bfd027c70a4a1d6c516049a1b25f89d5d3f9b18ed8a935303f02c523c485515556378a4743f00aca50401fa29513efe6ac3
SSDEEP 192:sxRJRXbt/fPsW1RHm2Sm7aMdzoD8p4X/g6+WNIY3QSGKIgDfJ:sxRJZt/fPsW1R2ae/5IEF
TLSH
T11142A6166A28997B9CC7D219FB657F63E2F95032A1915E48F7FC8B0C04E66DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 fff240f84266583cfcdc7238d273216e30f0c1229628959ae2889ed24b480d74
MD5 7ee2ac14ad8ac65df4b42beb7afa82b0
SHA1 2328be1adea4f2a074d9c8f851d24524ac8a7ef0
SHA512 463b6fe9cebe184b06835c8fdff034482cfa90b7f12e0683b106b8873428e953b1752ec121fc77439df5b4b5817f7c1dde3e44c24aefc1748f74290d25be7927
SSDEEP 192:sxRJRXbt/fPsW1FHm2Sm7aMdzoD8p4X/g6+WNIY3BLSGKIgD5J:sxRJZt/fPsW1F2ae/5IAYH
TLSH
T1F332B7166A28997B9CC7D219FB657F53E6F95032A1D06E48F7FC860C04EA6DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7412ae13e9532c8fb17a50d3b2213b0182e369d5863112732342623a8a986b90
MD5 aff38b1267b228a7cc5d098ba6dab91c
SHA1 c0daaddf62d5f794f4f73a1c4f74ad8a5587b48d
SHA512 5cf3240a8ecf7d472ca00d35032da8e6830bb9448c9c6a6b47267016991a18b1ddde04a3d5ce11c704b7c73095d5856c7fac499e5d2c60566436e57100c1ee1a
SSDEEP 384:GMgEbt2fCtg0+FfKsKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVKO9W+RTJroOLg:GTEbtkWg0CfKs8F1+UoAYDCx9Tuqh0VX
TLSH
T14AB2DA2F600DCB7E9F804AADAC59AFD76D5802C79B588D4047FE990C02C77FA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d7297443-a19d-46f1-8ebd-6725ecc18504\index-dir\the-real-index
Size 192B
SHA256 d95ff82027b1780214a332035d5f095b36dbfd5df4175d3d7f7adf30fa76bcea
MD5 0732f8db94137893094fbf6871cfe1ac
SHA1 00397b1de78819acaceb41a0755534968390b500
SHA512 9f6c0eae1c872636b7cda021a72ab6d259f57e45913cfa675e1c8436b3d04e749b9f86cb81567532f7c2cde4352ae9209ef935b417ad94720a64b8b8cd16a5c8
TLSH
T1F1C08C49DC7204D6C526903104BF212A372607EE04222E23208C602AA925A58808A803
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e4757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d7297443-a19d-46f1-8ebd-6725ecc18504\index-dir\the-real-index~RFe5e4757.TMP
Size 192B
SHA256 edccc7756c2462aca3368b272e77d8a9f2d4f39d548b306739186940487914e7
MD5 db3e0212cc9c1ccc7c5dc90f4ccc2805
SHA1 ef9de2511ffb8be42c8e0ae6c74db58c90a9e4be
SHA512 f6345b3401b9e6095158052b546f0be473371aa230521b89bd237d8739bc3f75850b3f06377e241b20aea80ace5b749206851e0506a978d5d2343426fbb45a53
TLSH
T12FC02B83C0A258F2C10B5430304B6216277B0C2100117E3372E88C4F5E335CC408E903
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 9da7dea421c871296c71b4de872c2e93afc9aa8fe1771e8a4d185dddb254ac32
MD5 560c94a005ed3d366ecd3534823e19c2
SHA1 b88542d584beb16d2647e6f65c85db3721982441
SHA512 08be1717fec887454efbd0a68ca4207e3005ec58e374121bc21ce0059918d6f7448521acf7db4902bfd35f7d369d3e2ee3b911c2f458dd6b932588db85a5344d
TLSH
T17FE0687A7EA32C60B92BC7D2147204A04411B8AC8508EC8F201AB2C320B0716781BC26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\d2881313-649c-432a-ae09-9064102f1f3f\index-dir\the-real-index
Size 72B
SHA256 aa49fe0cbd7e53eb7a5a01119a163a5389d140ce051d15f0cfa1d14a03e0e76a
MD5 7398b8209c5f3e43f8c947858e3d2570
SHA1 ef0c58f105062a79b38a0c046ca93c7a978ec61e
SHA512 5a4597c45c3d8f45c67fc47ba6c62cf82fdc3ff3a8e5af89dfe1debefacbdaa305929b527dd4b3ff2bae1d24de41f6564de7a8bcb15fd55f6882cc253b591012
TLSH
T1B4A0021613808186CBC042F1305D35443B64BC925A4302839AB4B1448895288B25B700
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b4d71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\d2881313-649c-432a-ae09-9064102f1f3f\index-dir\the-real-index~RFe5b4d71.TMP
Size 48B
SHA256 dbc08a5278541f572c21d1372451c734ada3cc1010a10c6a025f134a013318f7
MD5 836c3f06153149198b0a95de3ae0af01
SHA1 c3dda1940eca0bc06282a0b8fd60a6d76b81d2ed
SHA512 80f3741ede79e0d4c069df0bd9422d4d046bc93ccf1d8a0f0c0cf34f15305740356b66fad7d9626822dd80ca72bda5d2bb163f37b003f8e80e3821bde5ec076f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 109B
SHA256 a850eb1509d745f8d5be37f972a0f23dc507f03b90d3b1be379f02ac0ae6e5a0
MD5 99989daeba716707577330f2d01958d0
SHA1 2962d245b58c1d6b0823e4ce7265d77915448854
SHA512 d5fa4647b0c25b6c38f2903b98ac296770eab3e3a3944fa408a411679bb2551ed5d93435a731f389770e9838d1ac0f1035e35ac5ff3fd01cdbeb47aa914929c1
TLSH
T190B012A2DCC22D20EA05124B1A25084B2C3BB041B155A4C9F5491D43045ED789CE0FF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 107B
SHA256 529db1feb94c6ed0e5232eb609000d61c921dbd4261f716ef3d24825b9250eac
MD5 9a539386030fec0c5ac1f36983336fd8
SHA1 a224fa7694c4fb9ece396be337429c197af1238d
SHA512 d66321a2cfddbf3175933bdcf63994965d0188b8c303662db1da6a3a7d9082b5ca448d85bf931180284e6060ded2bcc8d68ffd5e70d52581eccaeaf928a9585a
TLSH
T1C3B012E2DCC2AD10EA08564A1A65084F2C3BB001B151A485F5490D43085E9745CE0EF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5af9a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe5af9a3.TMP
Size 114B
SHA256 f9165e24a9de46621c51a51641e034fa13ac92fe0f9088547f2bfd31baca3a97
MD5 9b438d6398e0d6f4f9ea7aca12dc6fe8
SHA1 996b827a419869ed5b5a34f0acf8406a84a5d9b1
SHA512 13c7b18a3d7c52803d7c106f25ce72bc9a6aabb42972913e43c579c094b423f5c5c334c9a001cf7d70a3185ac7ceae2830c6bbfd1c5c4bba0d056f8b2e0cf774
TLSH
T1B0B012A3DCD32D10EA08114B5A35088B2C3BBC00B5416485F54E3E43047EA789DE4EF2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7245ce3b90f4f0ebfcf28bc12b6cf1da32f63c1cf3e77639338a71ded8445c9a
MD5 a095a0814272fa7fbb178fff0027374b
SHA1 e1b6a64f6301e56f9a63537a765f8552773983ac
SHA512 e5b834c273101df0b99840ec2d91f139604be1992f84aa36d45bacc31bd28101059ef1a348a43e3a1042c50a5f2bdcdd4c99ff4f61d7670f129d62deaa48d270
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsH7kh1DZpVW9yogdVK4kgzVcbDa9puHBfBH:C1i7PF/DWrwfX9mgpct1o7zsH7kh1DZM
TLSH
T1EA910515713B0290387EB918D0F9A81D97C278973119A42B3BE946E21F67E438EFDCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 961089ec76f17004b73f8bb6e97f7c7d596ab3dbf54f5862bf2457f93acfca6c
MD5 42fe770827a9269b174a2081e44f3ec9
SHA1 a9fbf4422e1d069c510e77963e97175127b87181
SHA512 057386ad9cd799362562fd640b0f0a95fbfad002ee7f602c99ed44ca7d9ccdd7d10fb887a039d5c27fd83637a804fc2e2e864cb53dea9e1817b82dff37b2f4e7
SSDEEP 768:8N3u/Oc+wfZOQf6M+f6S66yvShCQRmb9M1:8N3ZwfPfSfa6yvSSb+1
TLSH
T111F2D071EC745D739DE69248764A3B62BEE16173CACC8B48D9DD8F0C05836AE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a8db37a3316cbc2ba4a8e2f3a5e4fd052e4a11bdbf069d2ede1bcc24daead0dc
MD5 7ee9b388256fd23300ad40cc412abb90
SHA1 17e45b29891883846cc360c487b6b651137a9668
SHA512 853d76a8c2f95c3409cdc2531bfd5c16bc21fb600e3bbb1a633a5e6e5db49cac78b045d49e866e079cac6275374d336759c6f45eba70f9b4627a5a3dcbe2911f
SSDEEP 768:eN3zbOc+wfZOQf6M+f6S66yvShCQRmb9M1:eN38wfPfSfa6yvSSb+1
TLSH
T1FBF2D071DC745D739DE69248764A3B62BEE16173C6CC8B48DADC8F0C05836AE171BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 a30e5b37637d70bffec1d6d616320ab8bfe270486e4e3c63e9edb238999c18f0
MD5 c3fd71542747d10351c1b770e7e38d42
SHA1 2dede8decfbc5591dd3349a37cdebcb0fd1c890b
SHA512 031a4f37720a78013d8ffff339df42b3ab38efc0c2d3a16520c45b9711a5ebb5942652ed11eb6f0cd3630dc63a1730d4eacae3977da9996cd58c7e74ee3a7c00
SSDEEP 768:dFQA3VwgtbOc+wfZOQf6M+f6S66vvShCQRmb9M1:sA3GwfPfSfa6vvSSb+1
TLSH
T1DE03BF72DC648A73ADE68744B64A3B62BEE15173CAC8DB48D7DD8F0D01831AD170BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fd0e52756135aed4c6adfba2f6cbe50e1bfe527b8cfe555cd899b738ab8f5e9c
MD5 c1b76795967e37139d8b955930964593
SHA1 a769fd7a732349a22873d23c644cdc92e1deff27
SHA512 bcb231b94d472870ce7405fc28403beb09efdab121fbce0d9f6e6d42061d83ce394c1566a4a3af72be0f5291f5735385e43b09afaa5adaabab5bf3b33df41b3c
SSDEEP 768:Rrv+4UNbd43llkc+wfZOQf6MZvShCQt12bwWV:RbsbO3l8wfPftvSR0wO
TLSH
T13D03CF36E96899339DE792487646BB637EB45173C8C54744CACD4B0D029369F370BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download