hxxps://www[.]mediafire[.]com/file/44sv6blrwi655r0/stiff[.]bat/file

Resubmissions

31/07/2026, 04:33

260731-e6mygacf733

31/07/2026, 04:30

260731-e5b5kstfrh8

Analysis

user interaction
yes
max time kernel
900s
max time network
737s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/44sv6blrwi655r0/stiff.bat/file
Sample260731-e6mygacf73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1436	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299460192503963"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2301830172-776172150-2531349243-1000\{22BEB88B-879C-4EBE-B98D-888D132F8B1D}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5284	msedge.exe
5284	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe
3380	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 4332	3380	msedge.exe	89
PID 3380 wrote to memory of 1436	3380	msedge.exe	90
PID 3380 wrote to memory of 4104	3380	msedge.exe	94
PID 3380 wrote to memory of 4140	3380	msedge.exe	95
PID 3380 wrote to memory of 4104	3380	msedge.exe	94
PID 3380 wrote to memory of 4104	3380	msedge.exe	94
PID 3380 wrote to memory of 4140	3380	msedge.exe	95
PID 3380 wrote to memory of 4140	3380	msedge.exe	95
PID 3380 wrote to memory of 3488	3380	msedge.exe	91
PID 3380 wrote to memory of 3488	3380	msedge.exe	91
PID 3380 wrote to memory of 2100	3380	msedge.exe	92
PID 3380 wrote to memory of 2100	3380	msedge.exe	92
PID 3380 wrote to memory of 2100	3380	msedge.exe	92
PID 3380 wrote to memory of 3164	3380	msedge.exe	96
PID 3380 wrote to memory of 3164	3380	msedge.exe	96
PID 3380 wrote to memory of 3164	3380	msedge.exe	96
PID 3380 wrote to memory of 3272	3380	msedge.exe	97
PID 3380 wrote to memory of 3272	3380	msedge.exe	97
PID 3380 wrote to memory of 3272	3380	msedge.exe	97
PID 3380 wrote to memory of 5536	3380	msedge.exe	99
PID 3380 wrote to memory of 5536	3380	msedge.exe	99
PID 3380 wrote to memory of 5536	3380	msedge.exe	99
PID 3380 wrote to memory of 3712	3380	msedge.exe	101
PID 3380 wrote to memory of 2432	3380	msedge.exe	100
PID 3380 wrote to memory of 3712	3380	msedge.exe	101
PID 3380 wrote to memory of 2432	3380	msedge.exe	100
PID 3380 wrote to memory of 4612	3380	msedge.exe	102
PID 3380 wrote to memory of 4612	3380	msedge.exe	102
PID 3380 wrote to memory of 4612	3380	msedge.exe	102
PID 3380 wrote to memory of 3596	3380	msedge.exe	103
PID 3380 wrote to memory of 3596	3380	msedge.exe	103
PID 3380 wrote to memory of 3596	3380	msedge.exe	103
PID 3380 wrote to memory of 3828	3380	msedge.exe	105
PID 3380 wrote to memory of 1172	3380	msedge.exe	109
PID 3380 wrote to memory of 4520	3380	msedge.exe	110
PID 3380 wrote to memory of 2160	3380	msedge.exe	111
PID 3380 wrote to memory of 1492	3380	msedge.exe	112
PID 3380 wrote to memory of 1492	3380	msedge.exe	112
PID 3380 wrote to memory of 5284	3380	msedge.exe	114
PID 3380 wrote to memory of 5200	3380	msedge.exe	115
PID 3380 wrote to memory of 5200	3380	msedge.exe	115
PID 3380 wrote to memory of 2564	3380	msedge.exe	116
PID 3380 wrote to memory of 2564	3380	msedge.exe	116
PID 3380 wrote to memory of 5276	3380	msedge.exe	117
PID 3380 wrote to memory of 5276	3380	msedge.exe	117
PID 3380 wrote to memory of 1844	3380	msedge.exe	118
PID 3380 wrote to memory of 1844	3380	msedge.exe	118
PID 3380 wrote to memory of 4796	3380	msedge.exe	119
PID 3380 wrote to memory of 4796	3380	msedge.exe	119
PID 3380 wrote to memory of 1108	3380	msedge.exe	127
PID 3380 wrote to memory of 1108	3380	msedge.exe	127
PID 3380 wrote to memory of 4760	3380	msedge.exe	131
PID 3380 wrote to memory of 4760	3380	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/44sv6blrwi655r0/stiff.bat/file
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffc2b16c188,0x7ffc2b16c194,0x7ffc2b16c1a0
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,13121914299946288680,6531055723938132830,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,18015927630871724014,11985282393529792493,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,1535928235569195577,6685637140740985962,262144 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:2
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,16350113329148348449,7834143274754726661,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,9608271343703947482,8360123624731420182,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,11886391272108539166,2425917787996932936,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4268,i,1294635393130421514,14531243311854933854,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5400,i,1337033109150233196,11943564692556875165,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,422636822305275743,10739012607551757385,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,10139742706718720118,8807042686637803064,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:14
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5992,i,4958192655361530234,5664621712120413288,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6052,i,2740443306962875969,8481368459812989394,2097152 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,13125656683402751451,1794829173798179908,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:6032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,13125656683402751451,1794829173798179908,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6660 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4568,i,16495418882298922632,3407455206575948344,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,7303387536765274235,293250943497038172,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,7351288440228137176,6382472833571205264,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,1053188100197377629,513938433240741419,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6868,i,9101043215226651214,7703731012361035166,262144 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,6039742534803012702,3546908569183930846,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,7392562670420387505,15109798462812583497,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,719856043769441900,3121251647138582746,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,141392416338148613,17640758486817823838,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,2656300431792223912,16170957968948453673,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:14
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,3407128635113641875,13711667688360917276,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:14
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3136,i,1336876710815456119,7120418230635686345,524288 --field-trial-handle=2556,i,12590321026149188690,3393261604884879278,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:4760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2588

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4931c105-b948-4050-b96a-ef018661f54c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4931c105-b948-4050-b96a-ef018661f54c.tmp
Size 42KB
SHA256 2c99c56ec61b9a4ab4b432da7520eb0ed9f54961beaeda07b08db8b0e846271f
MD5 0540c25861da2d4213313b0517a3dc84
SHA1 5fd319548a54a12515066004ef91ed8beef54986
SHA512 56322bdc64ab742b079bb7b1df5e034f98127d7abb7a29b8868d2d828ec26162a7f07b0d1e3ddc1d4c61738e8ee5b1e66f3be7ea7309f19b9f42f5bb9571d248
SSDEEP 768:LFQF3nwgfikKL2LnF669yrqUjWiIwwxMthvG+wuAY:eF3zznF66INWZTMzvG+wFY
TLSH
T1C3135BF158C34577C9AE9B87A33E2E42AEBCC053B6845A54B7C8960DCD560BFD307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c36ac766a384a109222b8b647d2f5c1c2e6c4672a4a2c6b8a01f6eac0a5df074
MD5 f9f896b0e6f281d55b1ca3fa3c1ccdcd
SHA1 db44df3874cd86a961c82d25f3ae2004f249b2df
SHA512 6b8c8d305c2d7e4a3b5efb6e1967d7db1b1ffdb7979edd315013037da369c923060dae4ef8a7219176aa7e0bc1fa4cb98e48470ea2f569243a95d3301f5a40bd
TLSH
T160D09BD575046A14C5A1303A21D1935392604835741945874051E55D5C5479743FB5BD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b53c58762bff2a5723ae446675e8f65fd50818b95383c8f3c7efef01af06e466
MD5 629a18fe1b7a241215c77a30d7d8d7ee
SHA1 5e7bd5b514f4e46a4b986c8b89d0025cf81a1f36
SHA512 04fd58619789dc107f680a57dba3aec42e4bab7c29c0defd7e1b8ca2d078ca4c91317932ff076171bae60d370b28de32c94039c6ab690d5004ddcb857977f38a
TLSH
T182D09BD575146914C5A1303E21D2935392504835601945874051E56D5C5479743FB5AD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 595820ac92ecc028137bcf1357e95ad4592e7e9d4c6c8eba1298a782150df044
MD5 26acd2a86a338588ebee3eec5216eb17
SHA1 c57262215e5e5023f851bb14346dabf7b24cd6ac
SHA512 3841de6dd7df38989a92699844ac2979c89aa60e8c9277409d3ac506a4e3cb317b4998051273b4024fbda0ac29662bb4f1f76fcb84246a77d19d4c3975776466
TLSH
T1AEE020C408CCC2BE6B506987817C934C82D8370FA3C4B9153730844C704207463DD565
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a0af0ef63cef865938c81157a257bee3f57ea00e909ef86942e9cb559b925efb
MD5 7306d079e2439cba92f0eea92b8352a7
SHA1 e380d48468ea405600e5e24c3d4299c9170c33f5
SHA512 217e795f5300b6050d785f1ee4f5de548584a875a478d6cf15cffb21b21e404dda18c9a704b0e9c16d76cf443aca812e1826f3f6eb88a0ecdef0f5f9f668b97b
TLSH
T133E020C408CCC29DD35364C781E8774CC1843F0BB7C4AA451724888C7083060A7DD554
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2734d5b1b794631ef2053fcf60b3bd6279f7c914b1817b1a4f546b609a5d2175
MD5 ee58bdceb3b35cc1a310538a8e4fbbdc
SHA1 b39949191763783b11cf7422030502edc14abbc1
SHA512 527498200a3e0e724182e81c1f4196ed8906185dda7f95da138364d5102b79d6ba230ae7566c21ee0129db8ceab01658bdcda5becf1a91ebb8a0cdc1a7e05dbf
TLSH
T146E026C40EDDCA6EA35178878169938CD280370B93C8F90A272488CE7182D68B3CB698
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 9ae46a4ef69225d141c9967dbe5ac062f72d6ff1d7440da9f998560739fe5d34
MD5 3a485f1c12d993ff7673015ad18837bb
SHA1 f12b2f4a7b9d503484e42187d0fe492c03bbc0e0
SHA512 1aaeae8c1ea132ee6d3b535fe257150e61efe54fedaf0b7a0316379b0c23aaf66bf6033c0d3ec7970b47f5ceb1cbc7bb0f2478d6c8dd47db2b86b063061efafc
SSDEEP 96:5Y9iTvViIXOZlb+FjLbVKRe9Mnh2e2H+KFUixUwAHkL:IiT1OnabVKE9Qh+FNa9Hi
TLSH
T1D7911B5AC31DA8D2E76410B316E518E4393484E4DA8F2ECBA376F43CA00E7D4720073D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59cb36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cb36.TMP
Size 3KB
SHA256 58ded9056d38a71348293259cb106b984f6094d1b4b8c07b18e721d8b0f0a9b7
MD5 c2a5598f3cd4d43d02c9101767bd20a7
SHA1 d6f09e6621eb5858c52dc25160b86d5d9dc4a5b8
SHA512 5d847df91c3dcffb0761083bb5b73d3db040d5ec82c6a29905721d636fef70764673c520aa52b3b1b4bccbbfbb8193f59d805aad59dd53441dd30c8c5cf45fb0
TLSH
T19F61C55ED32EACE2C72490B315E208C9367484E1E6CF2E9B82B6F57C940E795761433D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 b56573299312fa02da15939ebe5b1de99aa678f4457d70a0f23dbd4538692925
MD5 a90b2abb8b674a89a8c892830e61a62a
SHA1 a1caaa6b5e13949565391b9a158986a9d7a862f7
SHA512 256de70b04ce5260bc97189649202b72c8dcbb65f6be5262028c1be7415ee8042427df25635eab51ce7927f76d76047dc53e913a8beb4019194d563651403daf
SSDEEP 192:DVS7hHYBLUYLQAEEe0etx4tmWOqSiYWYbfHpf7CmaLAYexVz9TRAs8QxJjt4QfO7:DVS7hHYBLUYLQAEEe0etx4tmWOqSiYWL
TLSH
T14C3268F382E5D51E891117F8A654AE1BCF1D0619432C3C2988D5EE8BE3E3432E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 667dc02ddff78379f258659dfae646be12cce926408d375bbb14101c6c64faf2
MD5 740c120dbd4eb8e11e3c9ee638a11d02
SHA1 4579a84d38b92f8882a0c4b7aaa21789db5ea1b5
SHA512 259b6db8f50c86e827b6b93d1bb344855aaecc0c634bd247107b548230df104d20d51dee65cdeb42a734a29e09aacbaf1b88b0cbde7d0f82feb7310fe848e945
SSDEEP 192:DWdWueJGk4b7DBtrefeOZdB4IyWk6SiYmYKs9f7CmaLAY+xom9RAs8QhJRUfO+Zw:DWdWueJGk4b7DBtrefeOZdB4IyWk6SiS
TLSH
T1AB0245F753A2D55E89115BF49604AE1BCF1C161A832C3C2589D5EE87E3A3033E06E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 e54882dd9a2ac7291bc0557c2415336edf9aced0072bd0ffbd4e9c7ae50a4ba8
MD5 493e32da7861b384c92a92c55532be4b
SHA1 ea3331d396b65e4f28e4cd472931ba5b92af82e9
SHA512 8dffc0f321854c15b4a87a61a1150629dfc9108b34e6f237196b76f7c109426d3f87d66518ea3a684112b8b610809afbb0f895ddda218b2a14d29b2f0e6a425a
SSDEEP 192:DVS7hHYBLUYLQAEEe0etpl4tmWOqSiYWYbfHpf7CmaLAYexVz96As8QxJjt4QfOx:DVS7hHYBLUYLQAEEe0etpl4tmWOqSiYl
TLSH
T1DF3268F382E5D51E891157F8A654AE1BCF1C0619432C3C2988D5EE8BE3E3432E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 aa504a45c145c47d8df4df067dc62b99dd27e6900beba5276c6131c75e6ac462
MD5 30a4c3b22134848b951ac8f9636262ef
SHA1 148fb11b4efa942effeafd3936e0cf235c6866e7
SHA512 ec6529ca1629e95d903e381a9064b9821d4433ee61e4422bb1d20b6f145b1b043a9abdc84e83e7d06641dbb524c1cf4a26b637e5b316cf937462a76ded6e1f16
SSDEEP 192:sxRlPRhyM/jK1Ml8wlM/fIsLbQsmZCzoA8pNV/g6+WN8Od/YxvJS+GxIgIJ:sxRlPDbM/fIsLbQdD/5r/wSzs
TLSH
T14052E956A6289977CCDBD20DFA527F53D2F81533E1905E44AAFC8A0C44E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 473ee6d0af6249db6964953aa50e570500678a756918357870c661ca20067bd1
MD5 599bdaa49a327b36d32d645a8dddad62
SHA1 7dfd857cdd83e1b3382dfd85b4bbd19ff64ea724
SHA512 722c2d4d0bf4ff9510f2b1bdb65d8bf7d5ab6ab7b76f0e853d3b9621e14483241ec01fc66abccb93942f745111fdc8a05fe8709389e0e1b17f862dad947ae58f
SSDEEP 192:sxRlkRhyM/jK1Ml8UQ2bM/fIs/aJQsmZCzoA8pjV/g6+WN8Od/YxvJS+GxIgDqJ:sxRlkDqIM/fIs/8Qdh/5r/+Szi
TLSH
T16C62C856A5289977CCDBD20EFA527F53E2F81573E1905E44AAFC9A0C00E66ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4c30411e1ac19eef96cfa2633cd5fc8bae5c9973adac19d80d80bdb2344b5503
MD5 eb8c34d978e78ea56db190fe336d61f3
SHA1 3584101c8675b54326c270fece2480f6557ca095
SHA512 edf1a61e607a4fd3226825e500002866a02b60f9e0f40abe275d190e374a165c369ab7562beb6bf0d8f81823530f5b13945fd8e558b688adf5ed5106a8bcb572
SSDEEP 192:sxRlkRhyM/jK1Ml8wbM/fIs/bQsmZCzoA8pNV/g6+WN8Od/YxvJS+GxIgDYJ:sxRlkDlM/fIs/bQdD/5r/wSzo
TLSH
T17862E956A6289977CCDBD20EFA517F53D2F81573E2905E44AAFC8A0C00E66ED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 3d824a2d2a9c0448c3f618495e4751777f8087c639f10d90270edaba3d067d85
MD5 ba3b72815dcfbdbf6a804dc60b366182
SHA1 38701fefb3879f2f9640542bc0e1e7ce231bd50a
SHA512 7d6232477919f3f9a9228830e390c3b3a85bff5110b3922b961bf41cdb84626b5e7eef135a24c337f90939fa77c182e95ee4d8ce6388f74032f822d7e3a7f84b
SSDEEP 768:0xCyAjWgbrfK18F1+UoAYDCx9Tuqh0VfUC9xbog/OV9rVAKroJC1NI:0xCyAjWgbrfK1u1jacpAhJUNI
TLSH
T112C2ED3B640CC77E4F844AADEC25AED77DD802CB97984D544BEA880C03C67EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index
Size 840B
SHA256 8eafa7e695b8c9e7946ce4e069a048ab6c85cba7649945b704d03257e141b8cb
MD5 52e3066893bd18606a472ce8a32023cb
SHA1 12036f98d1a6dc9cb160609bbf72a1262f2f968b
SHA512 6fe2e141b9386006e450d168268ba99af35830dce02f10cde6ab3bf4050bf80365d4124152d991c7d26f301029e7721f26c5d57fefbc64024c59f30c818b9d5b
TLSH
T1A5010223CCC2484BCC32AE77A63F348A377A06DC210ACB5B101D4D399D8753D5A01268
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd9c9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1bb2e5c9-57b8-4e31-9c73-5d8ed2e3fbeb\index-dir\the-real-index~RFe5dd9c9.TMP
Size 840B
SHA256 25a887de77f63a13476cf068cd890475b82db98d34845b84a0870c0490bd4fdd
MD5 b44cd3e4961b6d02a5d88a6363c63942
SHA1 4dd91af9105a7db804d152088f09fe2a1865096c
SHA512 044ec1399c0f063cd57cebf8e1b5d1a53fa54c9d960777576475b6e60104ac5e46deb9069e587775b8ade3d6c8e6616ad63a498cae3edf129d850cbe92a4fb1c
TLSH
T11D0196A380C2ECCBCC22A5B8F557609A337F8410210EC70F30DF3D71098366C4E01525
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ea292fb1d294151a7d450e5b441f86bde2514df511d3008d4b8c423910977550
MD5 6d1288e24293b4332359f6879e73407b
SHA1 7bfe302d6c5071c1b0eb1b73ba873d974342c448
SHA512 d17947cee5f09f9a07e69d9c396992083fe4eb9239e68f747408cc566a98f780dc49ce2277a598656e516778fc24c11d0a4e837ce4457a7eab724dc889087ddb
TLSH
T1B4E0C07B3EF21634F87FD3E3283089F1458279588900FC4F702592C75071350245AC32
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7a86e4c049b8caed237cd5791296188191dc0ebffd41e10634d22a6e17ccf993
MD5 af40c6585b9aaf50f15f4873426534a0
SHA1 802c15e2ecf028cc3ce493289c0c1f5474594e18
SHA512 b33f4dbaf7a655c8b460a229ee0111afae8368fbaa6cddffa98761145f20d4411a69eb66e62c1873260925c9d0574a46a7d6c7efc62479c8b245305a64df48c1
TLSH
T10EA002102651A54ADA4086F29BC2014533114C100701025656D00768CD9C14F42A1B14
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a6869c3eedcbe479022657e0ed57cb9050105562379bd822953e913bee9bdd2e
MD5 773b943cef973a3851bcbad107075d6a
SHA1 5f907c18a9e2831ba97dfa66a7a3936b9ff7fba0
SHA512 d0222e9aaeee06731458ba87b25f19edddcd6ea733c2f3dec6d4e1826b90ef0486ac1b0be6067e672df0a939e3e40488d243e17f2f6d1f5316269c43545b81f9
SSDEEP 48:KyOXQse8IXVhIpKKcM7ypGIPK/aU/LIFKEMAjyD:KAVhWKKca6GYK/aILCKEMmg
TLSH
T1BA910E95717A134229BE68099595D52AC6C2B2F33018E42F3BE800BA4FB7F424DFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a66f5528-cf0f-4477-9ec5-e70cf0a5b049.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a66f5528-cf0f-4477-9ec5-e70cf0a5b049.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 74e568b87f190f87731bfa412dbbfdda2724e3cecd6603b82f54de6439b3ecc3
MD5 a3a681d03490179cf3a622b9c74b2126
SHA1 4df14cbeead7f203061e12ed4d727669dc795dea
SHA512 052eb5ff8e4bbeb302a5e64af7e84e696f93914601a7f7ae7bbe383711e06598a07151074d6517767b7df57c26912d080f73e45e3d8a5f6870239c64f00e13b7
SSDEEP 768:h+3MikKL2QjF669yrqUjWiIwwxMthvG+wuAY:h+3CYjF66INWZTMzvG+wFY
TLSH
T189F2BFB07C505A77CDF6EB86B2137782BEB44053E7C80F9886DD970E0A6B5D9134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4e9ee2fcc53bbc621493b8c359f349282d08a62ef91b7f46bdbf60189d558b2e
MD5 0f5ceaaabed7874ddda512adfc113249
SHA1 51cca8be356902a4ae6f0cff11d56c1a05c9787a
SHA512 bc2c9ff351527b045c1e3cd51f887111fb686f2f5e8773f3b6d9e269a665992db548eb0aaeb6f448a61a59b08eca29587008fda456e8ad43521593ac65dcdff5
SSDEEP 768:p+3IikKL2PjF669yrqUjWiIwwxMthvG+wuAY:p+3+XjF66INWZTMzvG+wFY
TLSH
T130F2BFB07C505A67CDF6EB86B2137782BEB44053E7C80F9886DD970E0A6B5D9134782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 a1e58f7586490e4cdd1067108c31f956bb66e8145956c02d80a91ac4c1d58604
MD5 8ba4d710962f5a87ce3b2363fd9b2b33
SHA1 829efc786b1fabcf0bcfdd54255bb3f3992f7ca4
SHA512 371da18956ba39de2c67bcb550c3cd83281d86e4fbeb58ad97e89b6e5622c10eb40615f3878f07aae19a9c56afbdfed34f6eb51b952f1ec1686c8efd50d7bbe1
SSDEEP 768:arv+4UNbdl32PkKL2+jF669yrqUjWiIwwxMR8Uiler:absbX392jF66INWZTMWUsQ
TLSH
T16403BE35AC589AB3CDF2D28672437783BFB4509396C40B98CADD670D469B4DD2343A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6126cc31-716b-4f31-a765-4283d5bdc6a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6126cc31-716b-4f31-a765-4283d5bdc6a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download