hxxp://tokullectibles[.]shop,

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tokullectibles.shop,
Sample260801-xr7y7seq2t

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2872	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300848681779505"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{09DF000D-C0A4-4648-B0E3-ED6512C65804}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe
5016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 4588	5016	msedge.exe	88
PID 5016 wrote to memory of 240	5016	msedge.exe	90
PID 5016 wrote to memory of 2872	5016	msedge.exe	91
PID 5016 wrote to memory of 240	5016	msedge.exe	90
PID 5016 wrote to memory of 240	5016	msedge.exe	90
PID 5016 wrote to memory of 4568	5016	msedge.exe	92
PID 5016 wrote to memory of 4568	5016	msedge.exe	92
PID 5016 wrote to memory of 2464	5016	msedge.exe	94
PID 5016 wrote to memory of 2464	5016	msedge.exe	94
PID 5016 wrote to memory of 2464	5016	msedge.exe	94
PID 5016 wrote to memory of 4560	5016	msedge.exe	95
PID 5016 wrote to memory of 4560	5016	msedge.exe	95
PID 5016 wrote to memory of 4560	5016	msedge.exe	95
PID 5016 wrote to memory of 2228	5016	msedge.exe	96
PID 5016 wrote to memory of 2588	5016	msedge.exe	97
PID 5016 wrote to memory of 2228	5016	msedge.exe	96
PID 5016 wrote to memory of 2228	5016	msedge.exe	96
PID 5016 wrote to memory of 2588	5016	msedge.exe	97
PID 5016 wrote to memory of 2588	5016	msedge.exe	97
PID 5016 wrote to memory of 4248	5016	msedge.exe	98
PID 5016 wrote to memory of 4248	5016	msedge.exe	98
PID 5016 wrote to memory of 4248	5016	msedge.exe	98
PID 5016 wrote to memory of 5656	5016	msedge.exe	100
PID 5016 wrote to memory of 5656	5016	msedge.exe	100
PID 5016 wrote to memory of 5656	5016	msedge.exe	100
PID 5016 wrote to memory of 2356	5016	msedge.exe	102
PID 5016 wrote to memory of 4156	5016	msedge.exe	105
PID 5016 wrote to memory of 2848	5016	msedge.exe	106
PID 5016 wrote to memory of 4156	5016	msedge.exe	105
PID 5016 wrote to memory of 2848	5016	msedge.exe	106
PID 5016 wrote to memory of 1972	5016	msedge.exe	107
PID 5016 wrote to memory of 1972	5016	msedge.exe	107
PID 5016 wrote to memory of 1972	5016	msedge.exe	107
PID 5016 wrote to memory of 4312	5016	msedge.exe	109
PID 5016 wrote to memory of 964	5016	msedge.exe	110
PID 5016 wrote to memory of 5416	5016	msedge.exe	111
PID 5016 wrote to memory of 4624	5016	msedge.exe	112
PID 5016 wrote to memory of 4624	5016	msedge.exe	112
PID 5016 wrote to memory of 4624	5016	msedge.exe	112
PID 5016 wrote to memory of 3312	5016	msedge.exe	113
PID 5016 wrote to memory of 3312	5016	msedge.exe	113
PID 5016 wrote to memory of 3312	5016	msedge.exe	113
PID 5016 wrote to memory of 1492	5016	msedge.exe	114
PID 5016 wrote to memory of 1492	5016	msedge.exe	114
PID 5016 wrote to memory of 3540	5016	msedge.exe	115
PID 5016 wrote to memory of 3540	5016	msedge.exe	115
PID 5016 wrote to memory of 3540	5016	msedge.exe	115
PID 5016 wrote to memory of 3360	5016	msedge.exe	116
PID 5016 wrote to memory of 3360	5016	msedge.exe	116
PID 5016 wrote to memory of 3360	5016	msedge.exe	116
PID 5016 wrote to memory of 5740	5016	msedge.exe	117
PID 5016 wrote to memory of 5740	5016	msedge.exe	117
PID 5016 wrote to memory of 5740	5016	msedge.exe	117
PID 5016 wrote to memory of 2668	5016	msedge.exe	118
PID 5016 wrote to memory of 2668	5016	msedge.exe	118
PID 5016 wrote to memory of 2668	5016	msedge.exe	118
PID 5016 wrote to memory of 5436	5016	msedge.exe	119
PID 5016 wrote to memory of 5436	5016	msedge.exe	119
PID 5016 wrote to memory of 5584	5016	msedge.exe	121
PID 5016 wrote to memory of 5584	5016	msedge.exe	121
PID 5016 wrote to memory of 5584	5016	msedge.exe	121
PID 5016 wrote to memory of 3888	5016	msedge.exe	122
PID 5016 wrote to memory of 3888	5016	msedge.exe	122
PID 5016 wrote to memory of 200	5016	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tokullectibles.shop,
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e4,0x7ff8c55bc188,0x7ff8c55bc194,0x7ff8c55bc1a0
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1540,i,2780735418259688792,8105956586869769012,262144 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:2
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1672,i,12555185986707354288,7042109349381966537,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,1711765194183014879,9487180397455395287,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3248 /prefetch:13
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3648,i,17574760467787553024,1794992897287221993,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3628,i,3621487373290529684,17332918951405922311,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,3694149249020847648,7527770773659837256,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4384,i,2047492752277372722,7071251986996648051,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5428,i,3480517631269769874,9998490978279785260,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3692,i,4482315474805689924,12883415194080747676,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,2544142464419183487,9365147233123472766,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3888,i,2544142464419183487,9365147233123472766,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:14
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,16472449510824224858,1891701959836404170,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,12288341609600947045,6754156035288586057,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6608,i,17983654291650407014,5202603721133522233,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7826795172381148733,11632671664625720585,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:14
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,15450760816624639046,7429184318051645724,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,18388251998584948921,4015170068338743956,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3488,i,15798735163972032107,18089410618113905930,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5496,i,10384109450507656907,8736381732496855065,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2056,i,1517574277245898102,18297900589460404567,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:14
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=2740,i,16729147680450794361,2619734050799594448,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4772,i,14924151066436074123,2538177424884197926,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6548,i,5621077922414207298,13481916174964512132,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=4400,i,11879469392914562552,12361645547000725113,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,9473873500061995299,17192637052836993674,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:14
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=3680,i,18283725979632354044,8917113476988303401,2097152 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,10823899834256667100,10101461570390303609,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=7252 /prefetch:14
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,15031289194257141015,12363147837618504865,524288 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:12
  2⤵
  PID:200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7308,i,541543732326352213,4578588588732108378,262144 --field-trial-handle=2492,i,6592467275077861463,8683129140415628845,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3804

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1284

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:4072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b50b98bcaa03b9b90e2d0c335d8f75c46e3a86545a9eb814c9bd297b2766a244
MD5 6cff3fb88b933ff101e0c085842946c4
SHA1 8fe9302eb764d43cd3c531487c644e64c21f4553
SHA512 67186e6262e7c79370a020e13b2cfdce7b4028045c9fed258022a03e3c3b38aa501cafc93e081e8b74459f964f19df5ace9a7a13721a64757648b2104293a44a
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7i:fwUQC5VwBIiElEd2K57P7i
TLSH
T174B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

8a04ff42-894e-4795-a285-0e7e173d3ae7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a04ff42-894e-4795-a285-0e7e173d3ae7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 1024KB
SHA256 375902a9c78251b2193b63711973cfdb25a4650523202747b386c0ec6d997dd4
MD5 3e544e838ae9900bd4a7911484588b2b
SHA1 94a601e3437ac7da903e69befe2174d21e8dbd25
SHA512 3800fc330dea5f061180381ab70a55eabe593097ddd3fcf4e90e4392e1c079a917f0dc54adf043db5175fa2e018c4b2d9a2c9bf39eb69ae61e23180d86440216
SSDEEP 12288:2I7tqGaMrgSQuDESsokU65FB7aIdgxyElChMBxU9Q3u5hJJte2HpPZv93HHJ2EZ:2ITz9Q46bUAF0J8ElCmEh7HpPZF3HZZ
TLSH
T1632533D2F261D74764C5F93089ACEF4427B88CB11CB526F6A10E275FAB75692BD38C02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 76bdd50362c6262fd8a4496c90d102fa4e357182e3121acdc7be5e3fc76f5043
MD5 2f20053b4182282fe30cbf0cf3de2ea5
SHA1 75409768ebcec54bbdf09e69bafe3d4eeba228b9
SHA512 40720854814af5083b956d1439d3acbe658706346d86c9e16c4412f6f953128666bd246fe043eba056690bb6c5ac9d69ea3255249d193ae3e391d9b48a642290
SSDEEP 48:ARvE0IqEPAtrLItWjFjlBSyvbnfs/qa+6dL938WVbdYo6p/K+j236WC0x:AhdIqVgtglvLfoqfMsFo6pL236Wv
TLSH
T1F7B161CB73623980EBED88B34CE0695DF6F2600705131FC1409E1EB38ACAF9192DA053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6ca8dd176e844c9ce799c47493423a49c4ce0ca42f04b67fcbce5efd9f91b66
MD5 818caa30bb16fc612fe7cc89335fe8ee
SHA1 651701f3f34e751ca7cc6d211bab4993e992c2ed
SHA512 f2ce1d98519c05a61a701ed84bc4a97d007b7a6a7cef8605bb6e80be91468f47abc0081251dcdd7791e0f5eda6a91903a7a463f66b246344592edea9027d273c
TLSH
T18D510D4F037679D1FB699CB318D1B559B2F3B11906131FA040A21FB089D6F95A2DA093
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cd91a380abf26dc4835e4c0811309b0f50011b0ed5de5103f13288f2e516e123
MD5 647737d25a9393a617ce454d4d8d709b
SHA1 47cdd4ca8fa0cabe676d4bf758859c255805800b
SHA512 1f4737470c456c96c447231e6bf24d2b37435117665566719d424f2c8f462eee590743a51eea61d6cc60c3cae54332d6ae22cb2fd2621cd5d521e33e212e87ed
SSDEEP 48:4RvE0IqEPAtrLItWjFjlBShvbnfs/qaT6dL938WVbdYo6p/K+j236WC0q:4hdIqVgtgyvLfoqSMsFo6pL236W0
TLSH
T165B160CB73623981EBED98B34CE0685DF6F2600706131FD1409E1EB38ACAF9196DA053
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598284.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598284.TMP
Size 3KB
SHA256 0fbc7e6e2c8516436226f66c32e6fe1a832f84f86af74c3cb2fb39b075c32191
MD5 1f9f97db80dbe7082e0868fd88dfb122
SHA1 a93680d1f8bdbcbc399a5a1d7712281d97066b64
SHA512 36a53a5108f220f7cbae18e06491d1db7795a60d1376bdb7cc796c2a8d41a115c1bbfcea4fd14b36b568a2449629ffd7ac02a78d5e40e9bcaa6a810a68587e21
TLSH
T1FD512E4F037279C1FB698CB318E1B559B2F3B11906131FA040A21FF0C9C6F85A2DA093
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 54004f8c3a63f3a72629a0d8731d15db2a079fca3e71022db49ed5cda3dc9208
MD5 2ad51f2a2629d450064747b3702802ff
SHA1 d359b80f0f4a0d50b4349f15c96f9f8cdd445bbb
SHA512 47aa75636c1fdbf3e5935b175d423962b931973a44d00bf4593e0bc4bdb3b04fb9be93b3838d8aae130b9e04d799631738df583d478c2ad258b562a4b7c5f99e
SSDEEP 192:DMWo1H2P5CUeHmPRwFXiZXQ6UzDRkqUG59/RrKnnbUmcORA4u3:DMWo1H2P5CUeHmPRwFXiZXQ6UzDRkqU0
TLSH
T1A202BDFBD7E8466EC91162F0EA143E17DE1D094643283C5786D8EE4BA3F1471E286D4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 24de007abf185030a8d784a8b22c98883554107ce3380d3f397b7cc7c47b15f6
MD5 e68cd961809bc521e15fb649586b0dcc
SHA1 dda8a305bface9a03895375a5d6d6e835c2cbcfd
SHA512 4ec7f4c24d19104f325a89af680dcdc0ef1fff2a87c7c378e40731dba75bfe8ffa7177b79cb0677e6683ff7d02438fd644e5a0b20d6e43a3881be9becacfa445
SSDEEP 96:DM/Oo4SHWRvXiZffzBwk6IfzEiv6/kq5x:DMWo1HWFXiZX1Z6UzDvkkq5x
TLSH
T18691CEF7C7E9866EC91152F0EA142E1BCE1D0946831C3C1AC5D4EF1BA3F2471E181A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 6e3f5cff9ba20833244e51c38d2c84f4631be76bf404a2ee50ecf7dafedf324e
MD5 442eddea9be3533804420fea39394174
SHA1 63d0cda49580694f7764e641ed8b06dc20b7d03a
SHA512 fa7ed4cdf8795460ad3f79dfa2adb9dfffa1e6b0b8d0e1a112a8d6c426a65143749f7c6e6502f1c5028662bbd8f7febdc131d6587d03581787423e06070e0187
TLSH
T114D02353654470B9755C3ED55055ED4FC73B20154C51DDE418D054D9093595C1607144
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d31ab85b4f7dae0670b18d3ebba5397737ebed76f8adfbc9d46b3190856a207d
MD5 6c3b1f57571e18e2e7afd475e29a0329
SHA1 5dc654b3c1b685c20576db60990577e483132f1d
SHA512 8592b7853b01a03ae238daa65f14f93b81cddea1802e46e9e18c131a7a1f36432cf286a09ad831cdfac51a970e88a573ff386224189f57b72f5488906fd50fc9
SSDEEP 192:sxRTRAPyM/jK1Ml8wbi/fmss7KCA94/EzoA8p1R/g6+WNIYD98tSZ+Ge/IgIJ:sxRTKJli/fmss7Z847/5I1SZ8s
TLSH
T10E52D8156A346D7BCCDBD20DFA557F93D2F91533A1901E04AAFC9A0C00E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f26a50a749fa18942ad0bb30d316743b6ba49733db8bf11488c7b7e13036d37d
MD5 7eee2f35ee6ed30e77098311cb63d10a
SHA1 987163e37a42848e226d58883ec002ed621bbe89
SHA512 84374f08f8cc76773f0726e761cf65f9bbac04bcb3ab40dd9406867698d217f0ef74946e32a5db6168248130f926cf9d800a04a54d8c9ce45034f236f8da2acd
SSDEEP 192:sxR0RAPyM/jK1Ml8wbi/fmsW7KCA94/EzoA8p1R/g6+WNIYD98tSZ+Ge/IgDWJ:sxR0KJli/fmsW7Z847/5I1SZ82
TLSH
T18C62D915AA346D7BCCDBD20DFA557F93D2F91573A1901E44AAFC9A0C00E66ED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 df918760b293c455facd6f1a104960feab26f08b147738476492021194ab04a7
MD5 c712fac335822e063d9aee127904c503
SHA1 0372527d1a751498643b433bd478dfc0142bd899
SHA512 e4ad78a81a397cf1a31dfadc335fbc9af29678b887c693e7b97bc30eb897de27dc541b9dc84fa565227d25d7da85be989f5be4ab1ef7caea4aa22e9bb0fad92b
SSDEEP 384:sxR0KrZm4i/fmsWoZ8Ue/5AiL/JSZ8Xyrx:sQKlm4i/fQoZQ/5RJSZkyrx
TLSH
T11282E752A6249A77CCDBD608B9717F63D7F9156399901E1C6AFCD90C00EA6FD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f8418f261ea5799145ea5b58d7fca5a0eb6ff375d8f5a8089cf6c5d05cc1fbd3
MD5 26c53b1cb54a18cc380ed81ff461f2b0
SHA1 9ce7791103de013f9f218415b1b67bd1e42de28e
SHA512 40a9ba286c79b92ff22390c24ebc33609abc240b6d79c86570be8c7a4aadd716144832f0271644f9f916ec82c5c5a983cba394ea9672d87872aa3a9bc800e861
SSDEEP 192:sxR0RAPyM/jK1Ml8wbi/fmsWoKCA94/EzoA8p1O/g6+WNu8y/YD9ytSZ+Ge/IgDQ:sxR0Krli/fmsWoZ84g/5A/XSZ8E
TLSH
T15662C915AA346D778CEBD20DBA557F93D2F95573A1901E14AAFCDA0C00E6BDD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 97fcc1ed97a37e6f1687ebf7cb5324209402e96e1d572b2be4e7bcbef2e74db7
MD5 7fff3062934ab010a245c0d431305693
SHA1 d9711ec41a0d235b897c6b871cc7a1127329f963
SHA512 b76e275e387aecb78976d34c103bface6a4951ca2087010d6f95c920b0a09f66ae2d1aaea1d28a0bedd5999e5e7cf3be027b36f9bb2f08fa69406a72256af02f
SSDEEP 384:sxR0KrZm1i/fmsWoZ8Ue/5Ad/2SZ8Xyrx:sQKlm1i/fQoZQ/5U2SZkyrx
TLSH
T16F82E752AA249A77CCDBD609B9717F53D7F9146399901E0C6AFCD90C00EA6FD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 f31779f154f558f74cadf7b448a5a21f566ec4fef9c19ab9c81098671fbb8e4d
MD5 2ffcc230282a6a0c4eb3d99427444b3c
SHA1 8a0a9d7a73ea59f0f90123147efac952f7f16e8e
SHA512 2895562b3fbf959671dc2997b1a9d10f951d1cf9836fa5ce48bd294eb84732e6dd40b43ff1d2aa1820a8a3a881ffe537cb804965bf2c9d5408bc3dd33b4202ba
SSDEEP 384:sxR0Krqbm4i/fmsWoZ8Ue/5AvX//SZ8Xyrx:sQKGbm4i/fQoZQ/5a/SZkyrx
TLSH
T15982E75296249A77CCDBD609B9717F63D7F9146399901E1C6AFCDA0C00EA6FD220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2dbd22681a3feb3b53fe89c6e56807b7c647dfb4883c0a5791c3f63376119d39
MD5 382daeed4c3b002b269775d90e58bb39
SHA1 ccaa0048b3e3ba4b1d651166b9038756d800ba94
SHA512 0d640208d1d3143389bf1180673c7ca44ab53874b4b4fe7f10bda755749ae3570e93bf31d3eb96205ff68a5ee90e16b7e3000282eb3f5a99621dd9410e370cab
SSDEEP 768:aW5WP0Wg/XfCf8F1+UoAYDCx9Tuqh0VfUC9xbog/OVyc1smro/0DdxO:aW5WP0Wg/XfCfu1jazysd/06
TLSH
T191C2FC3B240CCB7E4F844E6DAD25AED76DD801CB9B988D5447EA890C03C77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 f857e74d31709750dd5e8bb57f7ec228b11e57b0f663cc5e446bfeee10a3b2d8
MD5 78ce21afe4d563d8714653447b3c898b
SHA1 da79e84223897702619bc0dcc8fbdc2fbb9e6ba1
SHA512 adeaa6c3f4d44424aadda6369a8e8d944d4982083c34131035b54a308fdf139b0ce559ae23ad56f6182e6e4d9325a4085f4817797f6b5c91ef1e5ebab2ffa3bd
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHc9oMmqesWa33gUsK45gesc8M32c8X8A8q:C3gFB31lERe1JDggH2vHG5FaHc9oMmqf
TLSH
T1CAB11610717A06D538BEAA0980BE8C1F81C174667315E52B3FA902E64F67E339EFC5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\4d932027-685b-4eea-8d80-61c83731af17\index-dir\the-real-index
Size 168B
SHA256 2021d2573ca47ac71067126d57d7f7b494e29ceccc9794cf77d6b67a2e17a18e
MD5 7318c5486e792b01d2a27c7bc51e28c4
SHA1 b713929b0a3a0802893cac0dccbef58fb4cc586a
SHA512 625148a646c53891ae794dfc2e5542746c3fc28aa17948f171cc17af36c6b86baadf700fd7b86e695b295257ee09cc0eaaa360665b2d63986df9b5956c582dff
TLSH
T1D6C09B5DD0710181C06515B45475175139381E54EF45131254D93654745615555F3278
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\4d932027-685b-4eea-8d80-61c83731af17\index-dir\the-real-index
Size 72B
SHA256 589b9bab1ae2ce838245c7f42d4e6066dc115df67976b44220fbd80469a8e7ad
MD5 efa8a0979a397f9e94cddca5fde462ad
SHA1 fa20acd0c4af3f0ce967fb89663dacf1cc4618d6
SHA512 cf4dd0e8edb1fdba735b6241425c804d1d629ed0d611e040bafb23c02e7841f12ec95463e673d4d21ed94093b8eb5d5865bf162b37547897b70bdb7aecb4d182
TLSH
T10DA0022812702641C41457702557556576755910F909020383E22194CCE11B7850393D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a8f80.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\4d932027-685b-4eea-8d80-61c83731af17\index-dir\the-real-index~RFe5a8f80.TMP
Size 48B
SHA256 3de7483b9a8dd61f1262bc57f82ec7b67cc2667646ece8f7558a13c2eeca3578
MD5 f0fbbd86a58484471efd9d88281bd70b
SHA1 f42c36c514438573412f8c2ce2f74b5f968a45ce
SHA512 c97629d0a74f865409db82579a4256d0830647c7652d3e951554a7317fe33a0be204e8114c9cff068e36e0f9a6054189122fd4829b8d9f9a63ab5351b1e9af30
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 147B
SHA256 c3e09d3631fae947e14da1093147ce5c24b785b43e564a53a7dd1281651838e3
MD5 1ec85284b3f0c48f6c311c834baf29af
SHA1 bef6b14862ea288c6f979a926e2c9994e5567f0e
SHA512 0f89e22ab914feb2cb0b3ef44a283ae40c6c805bf95aa7879d529a4a1483abe75f28350e86b24fb342ebda4d8db0b65bf84530bde936d78d0ccbd459c0d5484f
TLSH
T16BC04CF75421858E4B74B5DD6029761DD617418C4DC4CCE5B90941162078A2A8843964
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 146B
SHA256 3953ed4e15407a586e50d67f416e736ee6f66ff416d88e8f536c322d3da06101
MD5 46bf12fa1b903b070470a90f079c81fd
SHA1 9e7ffe7f1e07ac1dcf851cbb66e317ab3c59b1db
SHA512 52d224c71083d0704eacd1e1771d8dbd57069ea5d10bf6b4e75759cdbe2164768e584b71b27b9640716f16f3d847a446fef90ee8aedad4b2b7a63074588c7c4c
TLSH
T1F6C04CF75421858E4774FADD7029761DD61B418C49C4CCE4B90940162438A2A8842964
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 147B
SHA256 abc7b4701736f8168cac01ac3d0d6852017f9374513a4374d765141bd60cbdbd
MD5 cf5a2763922425f83a4df995914fed10
SHA1 9e3d1062be73f65ed46550fc28d179fd26074d1a
SHA512 7a0c5a4b375c09c67c8954f91180828ddbbf66d97f4d5ea9edb33190f29c8fe3a1144615e472be102e9ed3abf36b0016e7acd59a29e1d6f277663f4d67dea92c
TLSH
T1FFC04CF71421858E4B74B5DD6025761DD617408C4DC4CCE4B90941162078A2A8442974
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 230B
SHA256 fd74b4e45cabe4b2728c977598146b851f83b5a88c207871fe705a0cd2e1cabc
MD5 b1f2c6c983bc1a88dd474c0355fa4b9e
SHA1 587f75844eb9f2a33d35fa8613847f2a73594840
SHA512 b74158966c34a08c47c07912fc94c5a5d2810c3dfcf701d4296f36bec6775472e5bd62cce816bb1ffade24aa42e7f7370411855185793e95347638fc19bae91b
TLSH
T17ED0A7F740314D4A1374BAD9B029660D821A4D489C9DC8D0AC06B0133078726CD41936
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a3f6c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5a3f6c.TMP
Size 153B
SHA256 cffb26ec58c95abd83f48e283ebd251a35dbbc8effbdb1a160a59eca0fed775e
MD5 a71f630757bfb95d071842bf0cd17c51
SHA1 b343fd47cf67124d4052243c9fce318639e2cb8a
SHA512 ad89ea567fc5cde6e2f904edc4af6399452ca89193060c38f307ec940677bd7f904c4ef64afa49806ed23e44eb623f62b3456eeb3ee2c190445edd0f59b2b360
TLSH
T150C04CF71431458E4775B5E96025760DD6274C9C4DC4CCE4B90A71163038A2B8541964
MD5 SHA1 SHA512 TLSH

Submit Download

889b3e4b-6b1d-4d23-9272-f72a2dcd32a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\889b3e4b-6b1d-4d23-9272-f72a2dcd32a9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9c67afa1ae2ddf88315d0981f29b77c79b3b7264dbd3c8758c204f6aeefc6637
MD5 4b682f9f654ee0ed5355e9cc8b1b821e
SHA1 c8e691b2df0489aede234977dda35f457fdbce1e
SHA512 6ac8dd956d52d30729cd484919653969baf16da9458a6a11ddf038044dcf6b761004a07802c6bb98053244cf2da12927b6a6af644759de26dfc593fec7dacec4
SSDEEP 768:Irv+4UNbd03iECAi0norEnjN3Gac1FjoP:Ibsbi3iETnoQnjMaAoP
TLSH
T1B203AE7168B88EB38CF6D785B0477A037FA0474385D50AA88ADD6A0C469B5ED230B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9a54afea80545918c769f5f6198519a350c5860bf7222b5392fb5908b8618fef
MD5 2b24ffe692c00ee3a51141123bba38dc
SHA1 ca1503771779160f0240b96c7d53fecff6ceb099
SHA512 faff8ab2d62389c43fff5cf500913b59c90f3fcf63618a28e2ca790aa9e217b092124ddcc377ae6ccb74e9030d08d47dfb3839b7dba9d59ef35eac0aa213786b
SSDEEP 768:I/3P4R8Hi0nirEnjN3Gac1Fj2ewBKZOh30d:I/3P4gniQnjMaA2evZ+y
TLSH
T10FF2BF706D749DB38CEBE38675477A03AEE4475391E41AA88ADDB60C05D76AC230BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4996c89204706be644208aa87e06f6e5ee6a77ff2b5bbcc134b443a43737b217
MD5 a01f2cc378b7df0ebdf827b96dbf9bb9
SHA1 a961428cfc9e193fbe9758afa575b35b959a492f
SHA512 5250d522d686e0430855a592b66c1ed2389074c0f833e9d21055495f261b1f262a2a273cda0db8c8e81af0784c25c58b63520bf1cdc79488935b263f10da5143
SSDEEP 768:oH3PyDAi0norEnjN3Gac1Fj2ewBKZOh30d:oH3PyqnoQnjMaA2evZ+y
TLSH
T1C3F2BF716D748DB38CEBE38675477A03AEE0875395E41AA88ADDB60C05D76AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 c934968e7f7dfa7aaa668a9a3b4921f5e074251b5191090b809ba2ec65e18cb0
MD5 396c4b65bc0fda0addfc81b1176cb546
SHA1 91ebcc550955ebd1723355d0d9a3d9b161543ae6
SHA512 fee605ee18dd4768276e6c4f23f9a18ac637ca2d6a169b78ed4c1c7d1193d562be7b20c2ec0b84e46e8cdcaa7479388113c55d172811c9bc07613307af77f3cd
SSDEEP 768:kH3QyKAi0norEnjN3Gac1Fj2ewBKZOh30d:kH3QyLnoQnjMaA2evZ+y
TLSH
T116F2BF706D748DB38CEBE38675477A03AEE08753D5E41AA88ADDB60C05D76AC130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 43KB
SHA256 0abe7e7df67809941f37c15b6feb9eb825104a7ca28cc15242fc9cf4d7db9170
MD5 81cbafdadf53385557c96a59ac955d8e
SHA1 ca8203021a1e556bca16d8b5b9c376ad74f0a0f5
SHA512 dc9db3c9397243245e7efc2a8b69943440d01a460ecacce63e68577df59f9fc48599271f9da840442bb627bef9d1f9093db568df48a213fd2db055a69b915c93
SSDEEP 768:EFQ/37wgT4U8Hi0nVrEnjN3Gac1Fj2ewBKZOh30d:n/3t4lnVQnjMaA2evZ+y
TLSH
T14E135BF159D789B7C8EE9743673E2E029EBCC253B49415A4B7C9650CCC921BFD30A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 27a0f3678668eaf08eb9232af018cf3b4dc35e7e01329c47d7025191369413ee
MD5 2e3ecad11d982833d06ed1c3d0f73528
SHA1 cd29fcfb3a8bd2759bc99ec1489e4aebc61969b7
SHA512 eab1e98a5990258335bd989767bf3ca82aa53c75e7decf111c48854eb7a5ac57529037f5b570176eb31a64218b947a7c34c2b5a1179143f7d833e2f84bc68a57
SSDEEP 768:rrv+4UNbdS3cmi00rEnjN3Gac1ZweVH1SCz:rbsbg370QnjMavEH1V
TLSH
T18B03CF3269B88AB38CE7E38571877A037EF4525386940BE4C9CD2B0D46DB5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b90bc407f3d7b9fa62464d6c559823f3c1ba7f01711936ac77c116358daf4585
MD5 99dcd0dda80840f76820491086a0e621
SHA1 8ef6ec857f9f59a04950ecc83bf589f1ed840090
SHA512 1851a45150a2c19a028a72c178fb1e0cb15e673b3437430b695649a806a4cc9f236fd0605b6f640efbd611063aebf9965cabc155cb869320d34b134bdedf2cad
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a4bdf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a4bdf.TMP
Size 392B
SHA256 ff85e9c277beb1ec2726a182f23925eb280edf990867c02c0c96bd050844ba19
MD5 6d33fd5f07bd72b9a841b1ca0d00f7f5
SHA1 cc3780638c7fd8ff8edfcb2f64051da4c037ac60
SHA512 6539e8a75829e6a28263137a928e7d5a10f775caa90efa0cc19e9eaaf17d553e1b60baa8920b5d57ac2b232b123fd65619677c39e4d170a88cc2a1452cc39fb9
MD5 SHA1 SHA512

Submit Download

e61a1388-98f0-4b34-9d42-c8b7f2beb53e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e61a1388-98f0-4b34-9d42-c8b7f2beb53e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/2356-181-0x00007FF8C6130000-0x00007FF8C61BD000-memory.dmp

Download

memory/2356-183-0x00007FF8C61C0000-0x00007FF8C61DB000-memory.dmp

Download

memory/2356-182-0x00007FF8C61E0000-0x00007FF8C61EC000-memory.dmp

Download

memory/2356-184-0x00007FF8DA4C0000-0x00007FF8DA4CD000-memory.dmp

Download

memory/2356-186-0x00007FF8DC970000-0x00007FF8DC9B8000-memory.dmp

Download

memory/2356-185-0x00007FF8DC110000-0x00007FF8DC142000-memory.dmp

Download

memory/2356-180-0x00007FF8DF4D0000-0x00007FF8DF52D000-memory.dmp

Download