78f86174d76caec00b02970c221e0444c8b1debdb8f2b71c1b93297705991724

Analysis

user interaction
yes
max time kernel
899s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260804-228qpsseqh
SHA256 78f86174d76caec00b02970c221e0444c8b1debdb8f2b71c1b93297705991724
MD5 b88ed54e9525c16464bfa4dbade429da
SHA1 7ccccb605857a3ab21ea82c693ce8909684b970d
SHA512 da638b72ac8484dbec4a1d65a2932fa3831b03ef4d7b22ef794b523be8675b6d7028bbd418dc89c1ab57a4718bd7768e88aad63ce6c66cbf11eb2c16eb95768e
TLSH
T1A351F19377E0C9653218916426C6B2B49E51D1CB831828B9738D919F6FC2FF5C2F3399
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303583568394804"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{315A8AAA-E1D1-4991-BAED-6DE08ADF49B7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 5412 wrote to memory of 5132	5412	msedge.exe	85
PID 5412 wrote to memory of 4736	5412	msedge.exe	86
PID 5412 wrote to memory of 4828	5412	msedge.exe	87
PID 5412 wrote to memory of 4828	5412	msedge.exe	87
PID 5412 wrote to memory of 4828	5412	msedge.exe	87
PID 5412 wrote to memory of 4384	5412	msedge.exe	88
PID 5412 wrote to memory of 4384	5412	msedge.exe	88
PID 5412 wrote to memory of 1532	5412	msedge.exe	89
PID 5412 wrote to memory of 1532	5412	msedge.exe	89
PID 5412 wrote to memory of 1532	5412	msedge.exe	89
PID 5412 wrote to memory of 3508	5412	msedge.exe	90
PID 5412 wrote to memory of 3508	5412	msedge.exe	90
PID 5412 wrote to memory of 3508	5412	msedge.exe	90
PID 5412 wrote to memory of 5816	5412	msedge.exe	92
PID 5412 wrote to memory of 4984	5412	msedge.exe	93
PID 5412 wrote to memory of 5816	5412	msedge.exe	92
PID 5412 wrote to memory of 5816	5412	msedge.exe	92
PID 5412 wrote to memory of 4984	5412	msedge.exe	93
PID 5412 wrote to memory of 4984	5412	msedge.exe	93
PID 5412 wrote to memory of 1276	5412	msedge.exe	97
PID 5412 wrote to memory of 820	5412	msedge.exe	98
PID 5412 wrote to memory of 1276	5412	msedge.exe	97
PID 5412 wrote to memory of 820	5412	msedge.exe	98
PID 5412 wrote to memory of 5060	5412	msedge.exe	100
PID 5412 wrote to memory of 3656	5412	msedge.exe	101
PID 5412 wrote to memory of 3656	5412	msedge.exe	101
PID 5412 wrote to memory of 3656	5412	msedge.exe	101
PID 5412 wrote to memory of 532	5412	msedge.exe	102
PID 5412 wrote to memory of 532	5412	msedge.exe	102
PID 5412 wrote to memory of 4980	5412	msedge.exe	107
PID 5412 wrote to memory of 4980	5412	msedge.exe	107
PID 5412 wrote to memory of 4980	5412	msedge.exe	107
PID 5412 wrote to memory of 3460	5412	msedge.exe	108
PID 5412 wrote to memory of 3460	5412	msedge.exe	108
PID 5412 wrote to memory of 3460	5412	msedge.exe	108
PID 5412 wrote to memory of 2096	5412	msedge.exe	112
PID 5412 wrote to memory of 2096	5412	msedge.exe	112
PID 5412 wrote to memory of 4128	5412	msedge.exe	114
PID 5412 wrote to memory of 2164	5412	msedge.exe	115
PID 5412 wrote to memory of 5452	5412	msedge.exe	116
PID 5412 wrote to memory of 1236	5412	msedge.exe	118
PID 5412 wrote to memory of 1236	5412	msedge.exe	118
PID 5412 wrote to memory of 5988	5412	msedge.exe	120
PID 5412 wrote to memory of 5868	5412	msedge.exe	121
PID 5412 wrote to memory of 2072	5412	msedge.exe	122
PID 5412 wrote to memory of 5868	5412	msedge.exe	121
PID 5412 wrote to memory of 2072	5412	msedge.exe	122
PID 5412 wrote to memory of 3924	5412	msedge.exe	123
PID 5412 wrote to memory of 3924	5412	msedge.exe	123
PID 5412 wrote to memory of 4484	5412	msedge.exe	124
PID 5412 wrote to memory of 4484	5412	msedge.exe	124
PID 5412 wrote to memory of 1404	5412	msedge.exe	125
PID 5412 wrote to memory of 1404	5412	msedge.exe	125
PID 5412 wrote to memory of 5256	5412	msedge.exe	128
PID 5412 wrote to memory of 5256	5412	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x258,0x7ffc5410c188,0x7ffc5410c194,0x7ffc5410c1a0
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,683390710796925441,15851245798576267460,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,7691877111368168260,15686170279652217557,262144 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,8774225443507560997,4931889240123819426,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5136871702794339626,16660289134996079598,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,2334472610815350481,6304917395415816729,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,6618426782307615019,229402850035038412,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,13781489050620105,18049943365420686085,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,11935383266501030207,18313845692920945268,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4864,i,10616546646187833258,17027986170012347516,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,5637795376613534200,3018365933661095692,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,5637795376613534200,3018365933661095692,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6208,i,9775137779826107359,10567674287324607693,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,11944808495925828920,11263575411093368445,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7028,i,4598482764334062012,5083913366718003524,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6892,i,14142823039816576733,1082025560411916738,2097152 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,7727202744471708714,15844140809726858409,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4372,i,6427396692904145934,2151843117693898859,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,2008543457173227864,8531629178184762219,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,16358539695817799602,16885389908379945227,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,10055773049827656821,10376306401319854374,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=756,i,17995265900466140884,4388823384135626045,262144 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,11507376555743203984,2294265597953060692,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,2723473228009572901,4670575288962517184,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,2100587414656099687,17992138491257598376,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,15360629111971654736,3936701112408787002,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3156,i,16227328747971272902,13826193855986554786,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,1909553825400864354,125015459477538765,524288 --field-trial-handle=2296,i,15516186476535762955,17671945189198186507,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:5256

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a38114d99b6c05875ae9468596abb7e823cf9fd18f4fe2b6bc2180f73cdd21f
MD5 734ed32369a33092e5af169a5f1c6400
SHA1 0ab00a2f996579fe58c514dc8b219803cba9de47
SHA512 04030ded30cf60d41eb3764dfd5642f0188adcd4a84f6e384aea7e06d243aaac8ef80b76c3db8872468f568e5519ff4453a83b9566726f9db3ac7fbd22e36617
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 83436829b9974902a5a015a81870b01881491171bb5eec45c6c5d735f14923c6
MD5 735632ed1014828c65c6a35970513933
SHA1 f48e1b7253778f794a76a846fa8eed464da54f6a
SHA512 cd23d20453eaaf9f4ef75cbdfd8f283fa6399e7f010abe72076dec77ed804eb5c5968006ffdadb6f0ffb86a8df19e02ee853e5f40622106dcc70c25117da1163
TLSH
T16FE020E504C4C26DE50465C75178630E42D5360A96CCBA166B08865C3145540EA83D64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 78449b25a6ddb9aa25d90271a7475fd63e9c90dc302b20639b2dedc473d62891
MD5 61eee39bd2f3762a036cf12eef309ce1
SHA1 8f0d19e4521dc141057719a2e556a376fbf08318
SHA512 cc4fac845ea3992bd3ef050190c2ff1aa84d40625d1e395d64732456f9d7cc2237d709e6151c67c74600ca6197eefbb580f5f0f68913f1934b121b2022cfc391
TLSH
T10BE026B41CECC3AEDE00A58F516C534DC3C0B61A9BCCEB0A3B0089893002040E282DA1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005f
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 68KB
SHA256 d57595fa250e885e5c20572a24bcfb95db9a488a89cd7c702763b483abd28a66
MD5 c82330869a91007bffdf44b4dc71a7dc
SHA1 7ae45d2c48db838cfbca4be2b503283aa32efb7b
SHA512 f4e75e29e08ec30e596dcae8b195c8ce8aeea3d07a4479c8da06c167c019bb8f07a5da70850fc4c2f5bdcd619dd9d3e621ea7c12202cc79e7d4a4cfa36af0673
SSDEEP 1536:viBhuVtgXan5fzAzOz6iuHdZl6eP+eUViPr1O+sih:vi/XW5Up9SO+eB1Om
TLSH
T1E26302773D91A313B54A09D60B74719C1B386A9F0642BD2C32F6F962317CB8B69F9C44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 405KB
SHA256 af11c5d2374cd8fa7cefc5be9c78f97211e0b9c3ae3605c35ce843e2c540240d
MD5 63d15bbba31b8c110f9dc44ceb974fdc
SHA1 f633cdcd45232cc0d5f1fd98b6ae0545069371a4
SHA512 feb6072a99b34ddbce9f9dd1c8c5e1cfaab6d7e4aa61dcfef514aab9534c6f4c0991b3aea447f152d2df72645ed5c7d31692212825a47030c1a039b6a3917db9
SSDEEP 6144:TFSrFg2IHB/y5xSTX6XxgVyVrE/iFJnmHNsXvKihMOeB/5ZqzGa4HO5JY26cYtmf:A8yDSFVytEqekvKiK/ba5JY2eKJ
TLSH
T13394238F54906E3C6B9B0E91A49CF7F2376536C3063DD05EC81AF9C229C9105ED99FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6406bf2cc79cc5e7a82acd03e978371a1fc1d1e5af55a65bad22ca5666d652d7
MD5 f8587b53ba7545325ebbe4309c754b13
SHA1 568aa5710102696089cf4675a22d9a79487d9468
SHA512 be805a9d673bac31b4b0a82b86363ce8b47955d3c5a98645054e28644a3b2ba315e29d95867674f846beb28e189fa348db22a1ce83bf0f7ba728fd251a757afc
SSDEEP 192:dYljo3aSkJqF9XY0vJnRe0pXDBBPImY3Frtjs54eimm/Xs6h0fhzhwfCw4mb3FdC:dYlk3aSkJqF9XY0vJnRe0pXDBBPImYVC
TLSH
T162D1E97F43A55893FB547C749FED4D242B30C0BA3A5FAF4A21247929AA0B3A585C6039
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8451f3089516900cf0d9151043a24d22f8e38a097fda166e057211677f4ea3be
MD5 fab6c0b4159acde4e9bf46135ca0c036
SHA1 0171794fef0bba08fe584685a657940c000248ed
SHA512 68596c26199f2dbe73050b0ca9a09ae3d5574cc13746283ccf5344d1022eb59515753f91b02bfd304b107c259e9c01532c2f3b55343557144283a54e3d4f2365
TLSH
T17E71AFF783B5866DDE1096F0EE14AF1BCF580016436C786A89D4AE57E3B24B1E111B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c699217fc1ce0f4ba6061181c01c7448af1b44de84fec651740336f928658d39
MD5 eb2937c857f63e298a6ff00b56e7880e
SHA1 1a2215420322d5fb8499d84c922c9e61f0eedd10
SHA512 600890c80f2878aa7ae91c2777201bfb0bea525f1ec4cbfb540575feedf7b87d22d835d459c32abc43fdb379100a1af4cc585418e805c6e5626507ec6b4cd2e4
SSDEEP 48:YALlNkOC8bCCDA7tCDtaICDSRQwiGswdzsD1zBC+sjCwCKCnOCYCsEC7CYksfQtQ:DOOhCpEL9l+zBCt5GOHaGtbQo6wHrGNk
TLSH
T1F7918DF7C3E5866DCA1156F0AA147F1BCE1D0556436C3C1A89E4AF4BA3F24B1E111B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 db73d64067e8d7a1fdd3e6ce3554aab77701c8a57b01d2404d05089053adb7b7
MD5 72a50ad46420b9da34859eabef2009d9
SHA1 f346a7b7fefecc72e76ff0e963fa470bd43b77b9
SHA512 398200f470a733a5987cc7397bd77452070183e51dde68c02d85576f9a32fd2993f7a8598cf4732af5d00a7c2840d08fce940dbe60a60bd41e1f309c44a78d21
SSDEEP 192:sxZLQUnvRcyM/jK1Ml8MWOV/fksixtbkfdpmB9HW6+WNB1S/YHIdK+YIgrJ:sxZfnvKuOV/fksixOb0Hby/eR9
TLSH
T14F62F7166A345D3BCCDBD219FA027B53D6FD1432E9900E58E9FC9A1C04E6AED2217C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1e6da5180d7a3503956115628ce84bdaf41d7e45c3004cc111a115959b92ae80
MD5 6c8409f02eb47b010313c8d60436c961
SHA1 7f21db106e79e5983946f6656e4270d41f8cca63
SHA512 34cea85328f7ff6bc2641a70e6be00946e24d646abef225033c8f4f41b4b53395d8b33230890a13ce03d40e91c577d76bd17f0e1520116d5151e5af9c5690702
SSDEEP 192:sxZLQUnMRcyM/jK1Ml8UQQkV/fksFFJabkb1ddp4BqpHW6+WNPbZeW1S/YHRQX+v:sxZfnMKqjV/fksFFJDTtHb8V/XR+
TLSH
T13072081A66345D77CCEBD219F9027B53E6FD14269A900E58A9FCDE0C04E6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4526f03a7900aee5a3be8875ad209bdc64bd6434c85fdf176ac694cc490aa028
MD5 0726f2d853039699ce4925b448e77119
SHA1 910c2a1400d32b77538764d297a81e9dbf11fda9
SHA512 e66bbb2f4c213fd7282b4ff6944ca41001f764187784acdcc857f286389316f6b50127895ce114e519002080a0a20378f94d65a6408d6815632d1c0f99c6f089
SSDEEP 192:sxZLQUnMRcyM/jK1Ml8MkV/fksFxJabkb1ddpmBqpHW6+WNPbnnq1S/YHu/K+YId:sxZfnMKMV/fksFxJDTjHbjx/CRU
TLSH
T1C772181A66345D3BCCEBD219F9027B53D6FD1026D9944E58E9FC9A0C04E6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7164c11d6e3f58e8b54fffe19f780c027a0e7754cc241c6647ebe7a9edfca80e
MD5 069089c86121d1b1ae6ab5b4d1f7da14
SHA1 0fde22b98842b5c42d78df00c209bac646e9fe8c
SHA512 7fd20ff4aca31a0bedde0a26f8c9185e88ccdd94ced74f0a83f99f7b9866854544b5e671312373b0095e2f8f881b60e9bf5ef71b7ec1dc2e92d6a450b2949e26
SSDEEP 768:QvUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R3roV106:QvUZYTMWvg0Pou1ja7eLZmRkI6
TLSH
T12CD20B2F280CCB7E4F844E9DEC2A6F867ED801CB5A984D5447EA894C02C72EF511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 e9113d3458a3fc522b25b4d92a9ddebfa2ac12a6dfb4f4cad2c147668664b1f8
MD5 0c1fb382dbd292ec64589c1a1354c845
SHA1 0db9533e330199697029f35ec130ba14e02aba20
SHA512 1d94d86d1c511aafc02f2cfad0c54c5a639aecc235a42ec33170d69c57cf7d89e874a66398d9cdac2789e3e0bc2e97c5fab66950639bffcf55aac342b777bd4f
TLSH
T17BA0022B53C00005D81211B2257602512340DE512350A31B90B14154CC525C04DC500D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\41587525-1d82-4d4b-9c66-0bde8fed8399\index-dir\the-real-index
Size 72B
SHA256 59cdd8c91d11ede6f8eab73e0102c0f4367b492fdaf45783368581c82f7d4310
MD5 011405e300bbec2fe80b12e6ab712467
SHA1 7cdfe19bb6f27332b16a7bbe4db8b7b3ea8d8f77
SHA512 a3f9fc67aa5ef603bb3609545f644457c1773fc9a7730b8f1ec60309d10652a1ac3aca42630006cb9c0d8c632a251dad5f5b6fa1d436f4e7722cf7e4edfeeca0
TLSH
T1D2A0021412C13006E51317B636D7126323205AA03211932951D6805CD9E07D6554110C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 eec701c730657a77ff9c08bce22111f16ecf0838252290d506628598a2f0414d
MD5 5174cd8fd4c2db926b41fcd659973889
SHA1 3b6f525a1ced4839606921fc23ac296819b55c92
SHA512 d828f18be0de63fcad107aff58d6cdedc2023c9fa3d40c63e36e89eeed942a61bf3a9508902c143fd9a95dfab4c685f52039e011a4996a52892986881f4f505c
TLSH
T119213E8D8EA0898FF8A481B20072E2E0737098CC4B22E2239C3C31316E2334D3A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 3KB
SHA256 43f7b70916a6882f8964c03865f8a5e03824aa4dcf8a68b1bdd9553ef91e5c73
MD5 917ac6ced7ae5df042ee17bda12ff287
SHA1 6e24d14ffee58690f92283d556ea36a1017fd496
SHA512 9b37b0ba2d2e43f7f9396fe1137e6760191cb6899c4c0172baa183b938050d38d870252cc370de709c516e7195b0b949bbe8e11d6382ca0fe4c25554f1432f8f
TLSH
T10651F84E8C461DDEDD6C05B26CFA144133797CEE4656DF0B679DA1307CC323A2E15114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe581354.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe581354.TMP
Size 1KB
SHA256 242b5aebe5687f5c727a62f3b777a66568b588833ea50e464f56d50a0dd408b2
MD5 6f6f8221edc25864a115b504230ad061
SHA1 a2e2619a43ffbb3d34c2443302184cc23bd6ea95
SHA512 c78426f355e82c216beea52352ca222dffa8f77eaa178f1d18b2ecbd32594a7ebbf12fca896a5f42cfafd0d88cb7a96770ba454b5c4302723a5e8d596a33d466
TLSH
T1AE21108A4AD1890FF884517B0A63F8F8733188005722B3A3693C62395D21B8E1B5F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 96a54e5fef08a495d7ae600c7214e02776154564dfac458189b1913fe6fd1931
MD5 bd970c7bcc2e3a1ddbf1134f042bb812
SHA1 8093c3da9effb4d7903b2c7525d0be4619329df7
SHA512 ca52c2efb5ef90da8e991fa7e4526b41c1b437893fae9f0e596bef4f2831d22fd9436ceacb38548b045ade780cf59ea1cb861c77683cbeb5d7fabf1ff5ebfe1a
TLSH
T1C9E0D8F77EBB1814AD6BD7D65471A4A4050278A8C64DAD8E01AAA2A310B2355290AD62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c45a4eca11bf2f2e34dc99dfb1f1c75ba3dd4c45365a5ff8d8b344a173a7930f
MD5 373f1b247737aa9e7425f4659963c18a
SHA1 c58b47b9ffba8c45ac8dc39376150708eeb259c7
SHA512 66e73e72422412bb8dd58814e8af691cb5daed9c227a78201c8a7761417bc857cb812ce3edc4ee3e1a4ba3aacb1c1b9d666d0d256d740e497af1ed6f9d5a1d7b
TLSH
T1CCA00221DB899005C40547701B655250BBD14CB9610623064B98A1B88CB558D51D5101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586bc5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586bc5.TMP
Size 48B
SHA256 f30961b3354cf4fe7f0ad4d3f34fba2df6814a335d351233b72c8bc29242011e
MD5 44f344e430d9ccea0f47d6387fc0b5b6
SHA1 f641f154806aadb1f07189c84dd74e038afeb222
SHA512 3ee7ff5475227758a71cd086b753ad1a3361d14b287402b0f4e57e7bb760bab94f59663d870dab471058f29d090a9b0146fb98f863bf01c2ea70edfef4b1e9d8
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 dfe5fbef3e39d57a1849fee0a0e11bb3798ec551feb4858aead8faef5b33fa04
MD5 ebf15b069d3434f0718b33bae51064a3
SHA1 c145eb97a1f0f4037b2f1bc30b56be92f2809e29
SHA512 47687800f3b45d7a67cb1b5acb6ddc6a0502d1ddad6a47b8fa9b0536df5a85b3dc6bada99c79874c568dd1990e11988d5f393b7b939351469538250e839d4135
SSDEEP 96:KA1eK2AEK0KTCqyuoKfq4NAKtyiiCAK7iEz:E2//3PvD
TLSH
T1DBE1014630BA02923C7F2A1C86D5A7264E5272633118E52F7BEC04B24E67E619DFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0b30e1a4-0796-44fd-b2f8-328a0bd4af66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0b30e1a4-0796-44fd-b2f8-328a0bd4af66.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 f3182f5ca052f53c35fcc84a4cf9db38535c9c39c0dce3f61f2856e7bfa176f3
MD5 a8cfee35ad30fea8a773f28599666912
SHA1 148fa4855bb6212100c5f35b619ad86f8a65ed71
SHA512 4ca0373f914d5b693a910f04de822617691cf2be5bc7d6ddb3548b03980c96b8d6dd200f491b8948bce76124ef0217102c26e2801849b266781eeb23384feddb
SSDEEP 384:niFiZcIozsNd8TUNTUlIRuTTzhIQM2zX5od+0ODn7ktJrRfBeRs9JKgqijU5j:iFQUIwgUzxMqOFOn+hRfTjKgqmU5j
TLSH
T11ED219F244E79936D9AEA743A77E2D134EBCD067F5806A90B3D85A0CCC560BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 119480b9989cf76315bf2a21177fffabd4b582d19eb4d3e916c0bda21aaef11c
MD5 34551d46a7b75144093ea56c34e2101d
SHA1 bcc66de75eb22d9d8cca465c8164b4068099e76d
SHA512 352c83a8a9b6e310a2ec1dcd255d2120010c128ffee9532d4e14f024b7c81ff8a7dccc77fd9b35ba118dde395cd47bb3332b9e840207ca879ff39926ef950a30
SSDEEP 384:niFEzsNd8TUNTUlIRWTTzhIQM2zX5od+0ODn7ktJrRfBeRs9JKgqijU5G:iF4IwggzxMqOFOn+hRfTjKgqmU5G
TLSH
T1D5B2F8F644D79936D9AEA743A77E2D135EBCD057F5806A90B3C81A0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 fbfd090ebced60b08a4921c5ed601d6a7a99930d03fe090f99a52896a2f49abc
MD5 32e97493ec1ae872ef5318bcc9569495
SHA1 63bd3b8dd61839e4917e37231f3409d5ecb85edb
SHA512 57de170a5a44a989cfc9bc490755127742fa665dab4adcca05d4a5dcab3240a915814759241a43b37a73aa78f703fe55c5ee860153a873c9a2d7ab786da5bf3c
SSDEEP 384:csN6UWTizhIbM2zX5od+0ODn7ktJrYfBeRs9JKgqijU5G:c6zqMqOFOn+hYfTjKgqmU5G
TLSH
T153725A3A6438AD779DE7F684F44736539FF8506BDA846FA0D2DC2F0C019A19C230AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 73d30bdfd0a2429ea1d94201976ee319769ca0cda9bdefe5ec66de17b93a8ca6
MD5 ceb7534edeebf49f5a88a701053a04d3
SHA1 6797d0c55b44407e4505eda2cc7a35d51666989a
SHA512 970bd7aa89cc32562fb0edc976e4e026e6514626a355ad46d1ad0d307c186b2a6efc61c1659a5d3a24dd9a692394391c8494b97d0d8f6e6f1606dfb9524b1698
SSDEEP 384:niFEzsNf8TUNTUlIlWTizhIQM2zX5od+0ODn7ktJr8fBeRs9JKgqijU5G:iF4OwgLzxMqOFOn+h8fTjKgqmU5G
TLSH
T1E1B2F8F644E79936D9AEA743A77E2D135EBCD067B5406A90B3C81A0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 eee8dbe4fa7d34f1ae4ce2d2f643f4bfc5e7ef617479a8fa9b6e846946b622e5
MD5 6d974951eefa516316ace34ef6096c90
SHA1 8b8bcf36338e46c02b6694f3602ea3bd63ed382c
SHA512 25ad4e8fbb75b8b71b1bdc18c5077e77b96a56eb08b2cbbd4f34d2e829b948dad28ca8bc117e5a08198d5a93f4b73b50db29b8c6b421d7e31fdd5abcd297736b
SSDEEP 384:niFEzsNI8TUNTUlIlWTizhIQM2zX5od+0ODn7ktJrRfBeRs9JKgqijU5G:iF4XwgLzxMqOFOn+hRfTjKgqmU5G
TLSH
T1ECB2F8F644E79936D9AEA743A77E2D135EBCD057B5806E90B3C81A0CCC861BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 79ab1e2fc5b7a80b5ff05a7aeb406e9c3a614c3a04753e4e8dba1d7ec175018e
MD5 4fb2d1a4d7aa2de4c5fa545181ab9864
SHA1 cf804c9249d44652ba2e18b677dfdcdc9b70e268
SHA512 63b9f732147dab06cc45af430caa08dffe3b77537c5e13353f4c5d0bd6e324d06e0cad6ef7c3308ceb4588e2bd840fb852bfe78e01932fe599ce62aa04f4fcdd
SSDEEP 192:yON461VWQmiUySqgGX5Obd+jwODyRiV/ab39qXU6:yON46WagGX5od+0ODnYhqXU6
TLSH
T15F02D83569686C778EE3BE49B48737135F94206BE9956F80D6E81F1C00D769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 8819f0ce4b531ebc1827fd123e78500aeab993a61a48e5be1c50b9bcc9b1ecf3
MD5 9ccc6319e52250e0ca32597a3192409c
SHA1 13c68c3a8232d11413f807acdc01104248833fc8
SHA512 051e23812e0ac2444b443159a715c39fceb0c0126115bfe8281cc07ebb313a4cd66b88d811586f565e0aaaba933f6d1fa470d9a43a14374c9d8f5dc9b1e70a27
SSDEEP 384:csN6U9TizhIUM2zX5od+0ODn7ktJrYfBeRs9JKgqijU5G:c5zhMqOFOn+hYfTjKgqmU5G
TLSH
T17E724A3A6438AD779DE7B684F44736535FF8506BDA846FD4D2DC2F0C019A19C230AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 1812d9aaa065858ec53df9ff55fd1fe6ab89d0be209d00cdb0c1182d2c7704af
MD5 a0a990494ada4590d5094563d73a0ea3
SHA1 085c6ee9152a5762341636d44417783e9559e39b
SHA512 31176afbced7a2737017c136a847d7fb38fb557b8c0c4f07f706001abe6894a889ac86ff84d3af46a8abd012f8d8772774a4df9018c74c4173f6042ff4a3d4f5
SSDEEP 384:hsN6UWTizhIbM2zX5od+0ODn7ktJrYfBeRs9JKgqijU5G:h6zqMqOFOn+hYfTjKgqmU5G
TLSH
T1AF724A3A6438AD779DE7B684F44736539FF8506BDA846FE0D2DC2F0C019A59C230AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ed01be7278149cbbe3ad425c1c69ce49193b5c84f41f7f7b8fd912d3d40664d
MD5 b6febfdde62a9d4e3b774f2c06b1afbb
SHA1 f7be6cd8c064eda27945bea9eb017a224628bace
SHA512 b0e90bd14c232e33acff2761fd9a25f3c785e7410cf19a7df5fb263aa11f3f84d82e86919cba450fccad6e74d936014342f57a6ba402e35278a2bc7ac99aae86
SSDEEP 192:lONA61QWQmiUyXqJGX5Obd+jwODyRi7kySJrNjJdqyU6:lONA61RJGX5od+0ODn7ktJr/fU6
TLSH
T11B12E8366568AC779DE3B584F48732535EE9506BDA457FC0D2DC2F1C01EB69C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 57252245b3531bdc2e5034654dd22fe7e92b3092ef867274a21120e2405036b2
MD5 7726fdd03ab9f03869b925d33f65e9e9
SHA1 b0847c96876bc7245528dcfc7905d11ddb51c1cf
SHA512 1c4b2bef6d56c418ffb203290ac94ca462ac513b8f0b1989e9237f32434a3f3d1da5043417932f45b52f8425ede23b775b2fabd41769a84cf5d38677b0dd0f7f
TLSH
T14EE0020252000576C01C03340087116836E1815003F20285441101542C133211930F90
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe584cc3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe584cc3.TMP
Size 392B
SHA256 04221f77bc30b84653fef2fcdb70a5f310b5d20846f79d8db55b4074d7894d80
MD5 0d1d10a6aea963c36d8d2ae4aa670069
SHA1 3fcf5bb4798e89a0be45e2e9566e4df5c1fb9fc9
SHA512 d77dd9a39d7a17b7cd4e6864a3cf02dba0255b08a2f9a94c3f6fa412b715dc90143462d88c69aa6f344ebd861dbf7daf15e9e8416c1e81fbc40c0f8aac1eec2f
MD5 SHA1 SHA512

Submit Download

e5883e15-6fb0-4011-8595-635be26d7878.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e5883e15-6fb0-4011-8595-635be26d7878.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a7fe9366f602474695b27b2d280bf729bfb881768068fb93a92e473cf5bb6ad
MD5 987f91e4cec354f73979443e8c42bc9d
SHA1 e71de54a7c8502ce5eab8e5b762415fede335060
SHA512 0d3a8a1be4948ea336e481479a21b0dbd3daa95f7a53f88d4168ff5c232401b0d0f12ae036034abbacb5a53842957b395423ac5591e2ca5a2b9184e5c8a10ec1
TLSH
T10841E968A6E91149F3B7AF1A9BF6686E487B7D332D06946D10110E4F4763A40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download