hxxps://github[.]com/titchmixgrange/Redline-LummaC2-Vidar-NJRat-DCrat-Raccon-Panel/releases/tag/Panel

Analysis

user interaction
yes
max time kernel
598s
max time network
569s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/titchmixgrange/Redline-LummaC2-Vidar-NJRat-DCrat-Raccon-Panel/releases/tag/Panel
Sample260731-av5a6aaa76

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
47	camo.githubusercontent.com
44	camo.githubusercontent.com
45	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2964	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299315874835382"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{36C79117-9156-4B36-9D6A-7D1FBE555AE6}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1648	msedge.exe
1648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2748 wrote to memory of 3844	2748	msedge.exe	86
PID 2748 wrote to memory of 2964	2748	msedge.exe	87
PID 2748 wrote to memory of 2952	2748	msedge.exe	88
PID 2748 wrote to memory of 2952	2748	msedge.exe	88
PID 2748 wrote to memory of 2952	2748	msedge.exe	88
PID 2748 wrote to memory of 2200	2748	msedge.exe	89
PID 2748 wrote to memory of 2200	2748	msedge.exe	89
PID 2748 wrote to memory of 4132	2748	msedge.exe	90
PID 2748 wrote to memory of 4132	2748	msedge.exe	90
PID 2748 wrote to memory of 4264	2748	msedge.exe	91
PID 2748 wrote to memory of 4132	2748	msedge.exe	90
PID 2748 wrote to memory of 4264	2748	msedge.exe	91
PID 2748 wrote to memory of 4264	2748	msedge.exe	91
PID 2748 wrote to memory of 2096	2748	msedge.exe	92
PID 2748 wrote to memory of 2096	2748	msedge.exe	92
PID 2748 wrote to memory of 2096	2748	msedge.exe	92
PID 2748 wrote to memory of 4324	2748	msedge.exe	93
PID 2748 wrote to memory of 4324	2748	msedge.exe	93
PID 2748 wrote to memory of 4324	2748	msedge.exe	93
PID 2748 wrote to memory of 4424	2748	msedge.exe	98
PID 2748 wrote to memory of 4424	2748	msedge.exe	98
PID 2748 wrote to memory of 3220	2748	msedge.exe	99
PID 2748 wrote to memory of 3220	2748	msedge.exe	99
PID 2748 wrote to memory of 2552	2748	msedge.exe	102
PID 2748 wrote to memory of 1628	2748	msedge.exe	103
PID 2748 wrote to memory of 1628	2748	msedge.exe	103
PID 2748 wrote to memory of 1628	2748	msedge.exe	103
PID 2748 wrote to memory of 5052	2748	msedge.exe	105
PID 2748 wrote to memory of 5052	2748	msedge.exe	105
PID 2748 wrote to memory of 5052	2748	msedge.exe	105
PID 2748 wrote to memory of 648	2748	msedge.exe	106
PID 2748 wrote to memory of 648	2748	msedge.exe	106
PID 2748 wrote to memory of 648	2748	msedge.exe	106
PID 2748 wrote to memory of 3704	2748	msedge.exe	112
PID 2748 wrote to memory of 3660	2748	msedge.exe	113
PID 2748 wrote to memory of 2624	2748	msedge.exe	114
PID 2748 wrote to memory of 380	2748	msedge.exe	115
PID 2748 wrote to memory of 380	2748	msedge.exe	115
PID 2748 wrote to memory of 1648	2748	msedge.exe	123
PID 2748 wrote to memory of 3364	2748	msedge.exe	124
PID 2748 wrote to memory of 3364	2748	msedge.exe	124
PID 2748 wrote to memory of 4876	2748	msedge.exe	125
PID 2748 wrote to memory of 4876	2748	msedge.exe	125
PID 2748 wrote to memory of 3576	2748	msedge.exe	126
PID 2748 wrote to memory of 3576	2748	msedge.exe	126
PID 2748 wrote to memory of 176	2748	msedge.exe	129
PID 2748 wrote to memory of 176	2748	msedge.exe	129
PID 2748 wrote to memory of 3416	2748	msedge.exe	130
PID 2748 wrote to memory of 3416	2748	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/titchmixgrange/Redline-LummaC2-Vidar-NJRat-DCrat-Raccon-Panel/releases/tag/Panel
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa0844c188,0x7ffa0844c194,0x7ffa0844c1a0
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,2336944788651703008,10155450598391823989,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,9848928468987629892,1877060087617278511,262144 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,12366089250516433509,6879190300345407503,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,13908319670700969767,9901871321918172334,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,5460224894178659906,10191550749028586878,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,4530905980733233439,15902275579575775815,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,13000973662586414855,5851784543316146781,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,3701486429512576734,10958665586791866697,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,4804966363315983673,16354922459895517056,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14467736515928798169,2251443877544347558,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,14467736515928798169,2251443877544347558,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6000,i,5584573221559327236,6802365996301664782,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6300,i,18250742063163669454,4157850546138789137,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4436,i,6032175789225204193,346775234463910670,2097152 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6600812339861304004,7550268552079345844,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,14550158042169623244,7189197502563330568,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,17876114030331266781,17736345177377955566,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,4582172551345956929,12933005958974546885,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,5855713861869826533,7885185011347679557,262144 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,145585979571637140,10264709349813890013,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,433962944761583181,2566458401901260326,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,2702462955613511137,6052850396066992816,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3208,i,9865279000086418826,627600215000656236,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,12571050069788887479,15136490431797483155,524288 --field-trial-handle=1720,i,10029381509438456996,536945705124302095,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4708

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cf65f6f2d0bcc0d1d010918d77b14c6b9d36513b86cdfcc0daf42fa5904500f4
MD5 d46cfecc02601d85e8f94e5a32a2aeb2
SHA1 e23aa106be45752688e7b63767d8eee6db52887e
SHA512 3909831c2aeca6c88ea6e6bfe5e7f7b9197c4f783bcb084266c659908eefec8e161925b7ae870e5cdcbc6c7151d01114b9a1516a6313dcd1c855dc0d27ec25a0
TLSH
T194E026E814CEC23ED380ADC78964734CC2C9370BE3C8A90A5B1088D8F00125CB3AE6AC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 dd95e694a0925ceca257b02c51b6fbc1b183e0fdce95fbe8b77ba3148fbca5a5
MD5 48e7b0a632c658abe78fd4cbdad33cf7
SHA1 0f5a4b8765c790e0fe30d4335fe5193ba14d9549
SHA512 e2e6488b793e116a7a0144b3eecff11a97da5e969ed19c21dc7cfc763486941961355539f05eae5f29abe44d28c9ac5b0e9d296ef6c61bde74d95afb8c84eba2
TLSH
T1FEE0DF55529EC9AA02C1B7C6E5EEF3D480B76309FBCCE89A239A609C344040947AC4E8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 04ce766b8ceb94287e8d57df74c4181b1d1d2a60421f26235966237451deba08
MD5 3a25890cd864354f90230e5aa7857179
SHA1 e40df44c41c849e1b6cc8c9eacd836cb16d09263
SHA512 ed51b10c741195819522bd64796a320248b8de28c71ea540343b7c00bfc31f8c03902978c101ab53038b7f6fad0e992eb97eced3f1403b0ab08cbbeaa18b41ec
SSDEEP 48:Et+6fj/841OJAWgpDXVMirObhArW2axLYs1mbBiPPb03Vkx5ftWk+0khE+:96b/8UsALDXVM7bmWpx4UPPb0ApDkhE+
TLSH
T19DA1F5F9A253C4A1F760013BD0EA06717D350ED9F8371EEA40E49A783BDB791C052889
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58ced4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ced4.TMP
Size 3KB
SHA256 eaea680b5d2d8226b50aacd7445f3902c20fce102b52845ee67c1406cdd56b1a
MD5 3d74d956a805d61e78f8550203bfa576
SHA1 5ffe08c2ab3886c8363c99b083034ccabd972a70
SHA512 9ce7e4d426234a9fa2855d768c9f0c28b557b06fae092f3cc679b7e874b3aa32e4d206895104d12d0093310d98714092bf60c460608430617520f2299d04a299
TLSH
T11F614C7DC65244E1F3B15238E0DF067279360EC9FC276E7611E0EA7436E7B62C05288A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3f68fe0a9488821b1eb66deae2a5408d566069e925440ddca27ccdf76db798ce
MD5 29888d7b5b38a7c0a5c1eca41f502b93
SHA1 4403c8c15bbe002bd4cc0a5224b97efa6fa753c1
SHA512 02fe6d11b242dcfb65cc7cc74d467bdcba0e3dd071af85a1184e4d688f596c638bf2482da9da6164cd7384e0f419f6084c5b55e4ba6d569339169ea1b5cfa4f7
TLSH
T158618AF783E5996D8A125AF0AA14AE1ACE1D051583183C2A89E1FE5BE3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5d61143eef78ce0e7ba631839c578e0760e1e7b8ef79624b982d1331122abb76
MD5 dc9c05bf4965e8c12366bfdafa7d3d7f
SHA1 30c9a3eb5f89a4b13fc37be2425a7e510cc2470f
SHA512 4ab94bb561b8a9063bca3abc73918a5008786c99d3f667dd244323a81a5d73b283ab07b271b70c1b87c6c66498bcc1c199bdccb02b7729bc3e6a0ea5ae45bfb7
TLSH
T10551BCF783E5996D8A021AF0AA08AE1ACE2D0515831C3C29C9E1FE57D3E3871E10175F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 5e29923bc1a9ee5469f4235fa132f841fd95b566ee7267c641ba59e18cb3563f
MD5 5f75745a24de0d5015b71c90b10597bb
SHA1 225057a4024218149ce8ed509e49ea59ba61e930
SHA512 94590ab1ddb9497d0105aeecf00e23eae385cc62dbe7d7a74158325b1702b304605a273b48008552143526a2fede02c9ea6f2478a5093f68c657587cf56f0d02
TLSH
T1E1517AF743E1966D9A1259F0AA08EE1BCE6C0514831C3C7989E0BE57E3E3971E102B5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e195d37475c0d0d1b7aa9b3a305df3f62842dbab28824224b66fcecdcc6bd74d
MD5 0d08c707f7f9721ab610d9b2ce9710db
SHA1 5a6805f44866f0c539c8e7cef9a9a266b660cac8
SHA512 266e18da3d82755919205e1e549113616f4d2d4b8ac430f2890df6e6078770516f37889338d7847cecb910763342e6b0d2c6e4b00828ce0566cb3a40506a5f39
SSDEEP 192:sxZiRzyM/jK1Ml8Mky/f4svVr8Idp9CCOHW6+WNY+U/Y9IuKNryIgrJ:sxZi7My/f4svVBMHb2/y9
TLSH
T1E552B616AA345977CCDBD709FA45BB53E6F50462E2900E48A9FCCA0C04E6BED6217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6df246886e1354cc27e39d1b04cc9e0ce5a8a86c7e56973517c7fb95a9ee5eae
MD5 528a2fca95872e08ae048f2894332d17
SHA1 46f0058b6b59235ee036e03d3cecb492151fa05e
SHA512 e9ee28026e4e8baf5e691060a77499cb15147034eb2475301a1bfc5436d4508e37c4eaa58d271d47833104e5d4e7c7879e997055146d19611ba9d306194ed4a2
SSDEEP 192:sxZiRzyM/jK1Ml8UQeky/f4sjC/8IdpvCCtSNHW6+WNKsJnXY9IdDN0yIg5lnJ:sxZiVq1y/f4sjC9VqHbhXFJ
TLSH
T1EC62E7566A345977CCDBD60AFA45BB53E6F51462E2900E44AAFCCA0C00E6BED6307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 380459ea541781e49ba70bd65c5e1e5749127450412f433756650729cebbc38d
MD5 b1af2a2e077e4a5656abb292da847609
SHA1 d8d2aaafa1956f1d360ed67d4e669066671d6117
SHA512 f0268b4d38ada079a1de13337d14902d8b4b5f4a527eb49fbe3aea100e008743851c4c09f87d49e5ddc88fa7afc4830a7155548805a419b34a6855e309ec7f7f
SSDEEP 192:sxZiRzyM/jK1Ml8Mky/f4sjCP8Idp9CCtSOHW6+WNKsJnXY9I+ENryIg5lnJ:sxZiVMy/f4sjCtXtHbhXGJ
TLSH
T1C462D8166A345977CCDBD60AFA45BB53E6F51422E2900E44AAFCDA0C00E6BED6307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 56306aa9ce3f5449eb1a63075513f60dde0745e9c896f2cca4f1d276a6658bed
MD5 d76e747820a0689aaf6ec7af7f7e5d5b
SHA1 5ba3ff803c409b25e6669ed49372a86c6928b6ff
SHA512 89525cb1c2d122f23079d7f758fa55f9e7af3572afca46273d2e131a87aa2d4fdf36083881dd9cb4afa47d881b7809590d22ad0c1c7c43906549889fb15fb3b0
SSDEEP 768:4Vcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNLroEg6t:4Vcv21wWvu+Z+u1jaeFLeRN4Ed
TLSH
T10BD20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fca47c61-6877-415c-b77a-0fafdc855bc3\index-dir\the-real-index
Size 1KB
SHA256 c530e8ff8688c73e5f2b23c58dd9a2c90693c821d7f79578956e5ab24a094f3a
MD5 154b0a21ad1d2f5c827060703e9be880
SHA1 62ee8a33eb39cd56ca1117c9222726af0992796c
SHA512 357d07fcdab07de4aa2eaab336c2f17ed44132685a01c61ba0f95f656e5a8eb90104fc246212a5189d6bea622854164e468f7c2d34f3b7dad558b65603198be3
TLSH
T19331755A4DA0C99FFC5041B205B6E5A4723498DD5A11D6178C3C6131BD6373E265B1FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d139a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fca47c61-6877-415c-b77a-0fafdc855bc3\index-dir\the-real-index~RFe5d139a.TMP
Size 1KB
SHA256 faaf70d4e4ff4b94511a1b28c5e4d4be7b325859e6d177fe8b3d68a443ef6516
MD5 e13754fef89991abe5aaef164eae472f
SHA1 97d22475bf78b98ffaa877e7511c667f7a01768b
SHA512 52df3f4a7cba7409a4abcbd903096b6e04b739c0b06949443829d693b3a1c0735315109bb8c0b65335cd4affed1241007126f8d3e4edbe204549f18178a05c4f
TLSH
T1A731775A4D948E1AE8C440770EA3E8B8333998404712B797957C5179FD62BBE1E4E0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f65538c2b1da1423259ad674c17754fa263de13402a1c33505cd3ebd5584a323
MD5 c1790f8bbe81ce1bf6aec15e594ebd79
SHA1 f86bf0263dcc1d7f77c877472da2a95d5d52d326
SHA512 ede58c973cdf2093a18e8a312178fea8cc97953654e17debaba622a6f8d0a528eacdecdb3747689265e3e1c347bbd747e397a685ea31a059c013e084fc3df6e8
TLSH
T152E068BA2CE72840FC6F93E21432059104027C5CC684AE4E2466A28360E2780A416D65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e97866ae4d1734dd0f380344ebb8adf904113390046f6fe002204b015aead9ab
MD5 4ac0ee2c6b5312c4226a70d1f8046a32
SHA1 85bd8443d5a514a4cb115cfdfd27f69c5ed67da6
SHA512 cb63eeb8e9e02927e19b945b672acd19b496b110f1195f24d2ad2a8b098ab27fa72fcc242a5ae74b23e97e5ae65ede0d77d71940fba6f024dca5d79e8278a8dd
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDauoKf6yauIKXKu:mT3/XF
TLSH
T1D991FF1A303A02E3787E6948A39385365E4139A77819F56F7BFC40A14B2BE121EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c1db3dd-2240-4e8d-a175-77887f2c6cf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8c1db3dd-2240-4e8d-a175-77887f2c6cf4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c617848743e6ec155fdb965422f27814af93ad3a1e90b3a1c2395181fe753ea0
MD5 1eb9c83347a13b6cdb2990893cde5a70
SHA1 5c675f3a9c637f1df8f34b854284adf54ae5e63c
SHA512 7a6c70537863edb024186f72b7dcfcd81ea9190f972876f75e971b713b9b1171a72a45f10f65f46944db85c932409ef0e6065ecd78a82488004b911d8c98932d
SSDEEP 384:eZcIhsNFigsziQBGe+COdPeTJrY/OObjI9G6w7ZS:ch8YjR2cThY/29MU
TLSH
T116928D366C344D779AA2AA42F48735179EF89177E7D92B84A1ECEF0D02DB5AC0305C19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a27e75bbd491cf4f1811f11291c780be6f1afe213ca0e7bbc0ef55bc37deb46b
MD5 ba785ed4877d76940a89f2cd5ace7a49
SHA1 23497f10c18f0ee750b928cda3a79aa0b2cd0cdb
SHA512 83064476f59d9119c12bcf63126edc0db257d77187e7eb7ddb9a59a39973cd26c737ce7707b8a40ce5a7b347fb2a6accfe8839387bed09819a4204e595a43833
SSDEEP 384:yiFPZcIawsNf8TUNTUlIlzgszicxGe+COdPeTJr6/OObjI9G6w7ZS:5FHBSwgeYbR2cTh6/29MU
TLSH
T1CBD227F258D78936DAAE5B43F77E2D125EBCC063B6842A40B3D89A0CCD960BFC305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0df089cd16fdef7768a245a683b41cad9b233e1d1269126f3ec29268229a94ad
MD5 b04fe054c937b155788e922803d66606
SHA1 e76fdb64612c3300d6858c0bad88998db03a9f24
SHA512 ff90dd8a1029b4c2e0257d5ed78ae7cd46d364dee0fb92faa305a04797a417522ebde436298f91dd2270aec9d5ee44d436092bb02a5faf85e9cbe61b76065fe5
SSDEEP 192:JONVm6v+YLNQmiUy/9Zh+CGU+Fdes9ovtusbEU6:JONI6vz/wZh+COdPeFAU6
TLSH
T1CB02E935AD381C6B9FF26E46F4873B275FA82177E9922F84D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e0dc1ed10bdfeddc91020ae79df68596a7092bac450970b1f17e315f5e392acb
MD5 52b946e93c263780fabb86ad914c79d4
SHA1 2c7fc621d285d9aad7cfe1908c75a0fe92dd8fea
SHA512 d496df66182c803755386fcda9ac0fc7c0fc981fdb1df20567bff882ca944c1ced788a6b39cfa4ea13194986dec49e328681483cf09aed3b96e3e6b0293c2e90
SSDEEP 384:eZcI6sNFWgsziQBGe+COdPeTJrY/OObjI9G6w7ZS:c6sYjR2cThY/29MU
TLSH
T161928D366C345D779AA3A942F4863517AEF89177E7C92F84A1ECEF0D02DB5AC0305C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d35a33c2c2850d5f3537a4b5c208662b442ef494060c4d5d6a355e23ea56e9fc
MD5 0c87dc0c622d66e1314bdd064711b305
SHA1 a3c9735055bf623b778bd3419f862acab6caa686
SHA512 d3a69055a8aa80e819d7ad6baaec38b1618b0cada225b9414c959b1d80eafd2baf3aa589ac67c4ff6f5b01c6b9622f1c2220ab25faeb152517074be0c334fe0a
SSDEEP 192:jONQ6v+YL5QmiUyT9Sh+CGU+Fdes9oveDSJr+CHcqxU6:jONQ6vzDaSh+COdPeTJr//U6
TLSH
T17A121B3678745C6B5EE26942F48735179FA85167EA8A3F80E5EC5F0C01DF69C230AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 49d4f81182f34d273cab8ff9fc4202dc4bfd984961fa622de45f6308091ce8e5
MD5 dc14538ad5ac92feccb756ef2c852230
SHA1 4762cae6242afad4521b4f2b89cdeb9c3a2c0ecb
SHA512 bc87622b1b167c14c3996081f08c15d0df7e020c6088682f35f3290602de36b411ef401cd5cfdbcb10098fff85c280776e0852d66478838eb15379b17946f80a
SSDEEP 384:9ZcI6sNFzgsziQBGe+COdPeTJrY/OObjI9G6w7ZS:l6zYjR2cThY/29MU
TLSH
T119928D366C344D779AA3A946F4863517AEF89177E7C92F84A1ECDF0D02DB5AC0306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 36f283d99bf452be8924fb9997e4f11037be289a9b6212431e5ca7e34ef33e53
MD5 e4543b0029346d737153e8e970546119
SHA1 8f580d9da1304f54f13b887cc9a8bf1f18f01fab
SHA512 974a3a6c8719b9b16a0b735e8ab62a23b0b313fdcc0c63a67c52d8594b3bd844c141602687f3b18df45a37cc17379780ca41338851dcb3650b3ca8c92b0c2059
SSDEEP 384:mZcI6sNFzgszicBGe+COdPeTJrP/OObjI9G6w7ZS:06zYHR2cThP/29MU
TLSH
T152928D366C344D779AA3A942F4863517AEF89177E7C92F84A1ECEF0D02DB59C0306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eebe9b886559db15c9a9a4523c7facf804c66287410aeb62516e203e00747b53
MD5 e9c21a377cbe37a5d553a8985c112dde
SHA1 9b26ae1e9e5848acf76f01e0a22e88d9473db68e
SHA512 82bb18cbf8e7fe8d420e018873b73a96099cd6b78c25acc2b52879e1c6fa162153c3e051076cbc72ca4cf3ab48734db6e15a7871690a0b5381633320f4968352
TLSH
T19241D648A6F91159B3B77E5AABF6A8AD487ABD372E06815D10110E4F0A22E00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download