hxxps://sub2unlock[.]io/kUpEw

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sub2unlock.io/kUpEw
Sample260804-28wpqazzb1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3356	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303589547771276"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{9BB6361E-5C7A-4D58-8290-2DFCF031C8FE}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1A72F339-971C-43F9-BFC2-9DAABDF8ED8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4400	msedge.exe
4400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe
3264	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3264 wrote to memory of 5052	3264	msedge.exe	88
PID 3264 wrote to memory of 3356	3264	msedge.exe	89
PID 3264 wrote to memory of 1584	3264	msedge.exe	90
PID 3264 wrote to memory of 1584	3264	msedge.exe	90
PID 3264 wrote to memory of 1584	3264	msedge.exe	90
PID 3264 wrote to memory of 3808	3264	msedge.exe	91
PID 3264 wrote to memory of 3808	3264	msedge.exe	91
PID 3264 wrote to memory of 4632	3264	msedge.exe	93
PID 3264 wrote to memory of 4228	3264	msedge.exe	94
PID 3264 wrote to memory of 4632	3264	msedge.exe	93
PID 3264 wrote to memory of 4632	3264	msedge.exe	93
PID 3264 wrote to memory of 4228	3264	msedge.exe	94
PID 3264 wrote to memory of 4228	3264	msedge.exe	94
PID 3264 wrote to memory of 384	3264	msedge.exe	95
PID 3264 wrote to memory of 384	3264	msedge.exe	95
PID 3264 wrote to memory of 384	3264	msedge.exe	95
PID 3264 wrote to memory of 628	3264	msedge.exe	96
PID 3264 wrote to memory of 628	3264	msedge.exe	96
PID 3264 wrote to memory of 628	3264	msedge.exe	96
PID 3264 wrote to memory of 2824	3264	msedge.exe	99
PID 3264 wrote to memory of 2824	3264	msedge.exe	99
PID 3264 wrote to memory of 1864	3264	msedge.exe	100
PID 3264 wrote to memory of 1864	3264	msedge.exe	100
PID 3264 wrote to memory of 4896	3264	msedge.exe	102
PID 3264 wrote to memory of 1736	3264	msedge.exe	104
PID 3264 wrote to memory of 1736	3264	msedge.exe	104
PID 3264 wrote to memory of 1736	3264	msedge.exe	104
PID 3264 wrote to memory of 3168	3264	msedge.exe	105
PID 3264 wrote to memory of 3168	3264	msedge.exe	105
PID 3264 wrote to memory of 3168	3264	msedge.exe	105
PID 3264 wrote to memory of 3972	3264	msedge.exe	108
PID 3264 wrote to memory of 3404	3264	msedge.exe	109
PID 3264 wrote to memory of 3160	3264	msedge.exe	110
PID 3264 wrote to memory of 1948	3264	msedge.exe	111
PID 3264 wrote to memory of 1948	3264	msedge.exe	111
PID 3264 wrote to memory of 1948	3264	msedge.exe	111
PID 3264 wrote to memory of 5112	3264	msedge.exe	112
PID 3264 wrote to memory of 5112	3264	msedge.exe	112
PID 3264 wrote to memory of 5112	3264	msedge.exe	112
PID 3264 wrote to memory of 2008	3264	msedge.exe	113
PID 3264 wrote to memory of 2008	3264	msedge.exe	113
PID 3264 wrote to memory of 2100	3264	msedge.exe	114
PID 3264 wrote to memory of 2100	3264	msedge.exe	114
PID 3264 wrote to memory of 2100	3264	msedge.exe	114
PID 3264 wrote to memory of 1580	3264	msedge.exe	121
PID 3264 wrote to memory of 1580	3264	msedge.exe	121
PID 3264 wrote to memory of 1580	3264	msedge.exe	121
PID 3264 wrote to memory of 2148	3264	msedge.exe	122
PID 3264 wrote to memory of 2148	3264	msedge.exe	122
PID 3264 wrote to memory of 2148	3264	msedge.exe	122
PID 3264 wrote to memory of 1096	3264	msedge.exe	123
PID 3264 wrote to memory of 1096	3264	msedge.exe	123
PID 3264 wrote to memory of 4400	3264	msedge.exe	124
PID 3264 wrote to memory of 3540	3264	msedge.exe	125
PID 3264 wrote to memory of 956	3264	msedge.exe	126
PID 3264 wrote to memory of 956	3264	msedge.exe	126
PID 3264 wrote to memory of 956	3264	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sub2unlock.io/kUpEw
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcd763c188,0x7ffcd763c194,0x7ffcd763c1a0
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,13455427030601350829,10233071663339398342,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6741692515604916886,9698095026816201790,262144 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,13701210334721906638,8270084713796569744,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,10863187062285379396,11723522698818040051,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,12706345505289147975,11604882247692083877,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,4664930315082625328,9535496422604756504,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,12317040956713206609,8683794006629373020,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,10141848531835852200,13113209695544274528,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,11892633070979773367,7921442420004295753,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7337947643516469275,9819591851254616975,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,7337947643516469275,9819591851254616975,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4456,i,2594270775304320740,15754400672848723453,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4444,i,11797386306637595645,5631760107864135624,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,15108268826690219286,9043386975863240590,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,17795770441594177150,15636445255432305728,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,17043631380600686870,2773241246752297034,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=2904,i,14606462194778694875,14498985070506328687,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5196,i,16198022576037872991,16450090563750286636,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,12416147508814718585,6828380604981839150,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3592,i,5360032662077579645,1903260870761823497,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6852,i,2601891715768478154,13916667992012841505,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5336,i,8073550861275738335,6437495331162678590,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,7418585288873006286,5802223373359259320,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6904 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6960,i,3481148004970035029,17610416345756570209,262144 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6996,i,7078839498014894296,4626765041978473036,524288 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  - Modifies registry class
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=4352,i,356872110937807307,13053952334579430027,2097152 --field-trial-handle=2248,i,6527954032237458006,17315819406698655720,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:956

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e71b968c09cf84ce586a967ab0afb4189ab726e49489deac19dbaeea1ac15d1a
MD5 12fc4a4156284201a1a79692642cad1a
SHA1 aa32f5c4a7a0a81bfd207cb184182d6465cf6610
SHA512 a6eea3c012e6d4f7fdc873278d555372160ea0bb08b79c333a6e6e81c2378e232affa7293f0c2a691c33b180c12c15c53cc7e3707ddf63a93b96f22926419d40
TLSH
T10B714D7F0293307ED7612231CDDE1A05F9B5CC8549FF9D0AF146B57C86A375285EA818
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 bf67f30425ccb0f7137825ae321b76270cd7b3d0e585c065e0258fdfdfeb9ac7
MD5 0a96db452c521279d3bbda46c5d2ae00
SHA1 e8a18f50e1d172e7fee0cc48f9398408597974eb
SHA512 3440edf4ffc1e61f579b02fed3d79f0b8affde491c73298cb05a4d45a03d4acb95c6eb0924ae95ad3115a9faaf2fbb2ad7540a2a78c247728e8b7d2e9d05571f
SSDEEP 48:033RvAaLS9LcyudOnyylGn3CHBd/Ng+ycdkYgWjbco1DfCrvfW4kHaUNPb94sFIP:03Bd2G3WNMeVRUvt03yM/V6MaVFRR9Kk
TLSH
T10D91C47F018330FDDBA15231CAED0A21F8B1CC484AEB5E0AF165B93C42AB39145D5834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1857d26a4c4036e15da79bc4084863de7c7a2c9da0ed1ac29f6831bb52fb87d2
MD5 db98d53c12cff3892cd9fb313fe81ff3
SHA1 68858770a83f08f414f822d73c3b63df0a4f2eca
SHA512 3ddca43da962c82b07a57be43de728e8167f2b6146982f65270cbbfd8352a558cc8ab0af9c02f701a8c327bacec57f951f4306c86174fc48a554bb76192cfe42
TLSH
T12B81607F059330BDD7901231CEDD0A15F8B4CC9449FF9D0AE296B97C869379285EA828
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58998c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58998c.TMP
Size 3KB
SHA256 47633a3abb835ebab168e3f5a082988f44520ab41c2cef958d54e0c0696c6a1e
MD5 cd37532942b9f4b05e60062794df235b
SHA1 7ab670af6ed5715eb7ffed9f75322ca7b8ffd19e
SHA512 8d3b958d3a9dbfee975c20c3bf492811c5ed4a46c1c4de6404684085f84c6be92cf47aa796d5731b2f4735fa19833fb339db2d6d58c95b97362e0f96d3d223bd
TLSH
T1B4713D7F0293307EE7612231CDDD1A05F9B5CC8549FF9D0AF146B57C86A375285EA818
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 169KB
SHA256 0d3bc55722c8b734faa134c9f2ae170808504683896a43d7b85090c163ad5a40
MD5 8c59bb68d9d6cbbed769d7fece324102
SHA1 33904444bf028e8f073bb7bbe5c9342a3ba1160f
SHA512 865efe67af6e7e1259a37e35a1d6a7e81992750d96e69c8da6a25dd409f276d55725553301c0aca2a8289b60a9795cae2af79924127468207a231a5f4aca768f
SSDEEP 1536:7TktnkhV2lUqGQUix7ykTMhh0Zr7cg9r6RztJq8ykTMhhLZJqI:7TktnkhrQUix7W0Zr7cdtJq8WLZJqI
TLSH
T13804C525A22AA3D6B07E432707139D06D3359BC8A6497412AFB33B5D3AF7F053E58319
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 bf48abad91a2f3ec21b7c996b28401a0b3ae0ea167e7e6130f07545fbd712897
MD5 7d3c5931d06dc3a9fa7c9d022491f2a1
SHA1 b94dbd18de5a32cd84af3579a81b90e06806393a
SHA512 e56ae244c1bc14c59a942fdfca655534435fb32639c1908108898f3d62910a4bf1cee7a1fe662205f48318851f244a3785c6a4e3d2b812f19fe4610dc8a047dd
TLSH
T1B9E0D83888D9C16F512464E72534BB0F9697750EDBCCFE494E04E8187046548957EA61
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 591485f0f6bf2f78e19ecc52b7532cb9dabcdc865037cf8310e05b75a2afafb0
MD5 6ccb97133fa4a4e10c55f8d2c55b0551
SHA1 662daab6fedbb87f08687d748c746bfe583e289d
SHA512 185cf92fef3af59a7c024d0e4e71660e652a3139bdfa4fb47faf942cd8b5e599db4b79dbf917c19f679e91c487e11227a2a38d62cacfabb8c6eea850e41b5b0a
SSDEEP 384:DKMF3Bxienf+1J6GJx6Jh+z08eKjWugQVm92kZJtJxWVOdWJPL7mqecahqGH6hvy:CxFcWFAjr
TLSH
T12E428FE7C7D8C62ED85256F4A7143E2BCE1D0A6C43283C1AC9D5BF4B53E60B0E241A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 506f988e546f0290564e5d6b9e1f488d6a2f368042c0f53e0ecccee16aaa32ed
MD5 aa2defe3f9c0ee68005ea2b760f3fed3
SHA1 4a81698dcb06f406acb1f2a6f93e49481f47c4fa
SHA512 6d3801fb71f8ade811ebb63b6e446db91df99f530eae1b3c199958e0c46562604c2ed2889cca49c50b75d1106f17c21c97ecbd821d02ec26b137afbc01bf5fd6
SSDEEP 192:DKMF3BxienxJ2J1J6GeeCF3EKT71FVm92kZJPlVvjxWVO0AWPx0OL7mPQ9d:DKMF3Bxienf+1J6GlW3Eg7DVm92kZJt0
TLSH
T156F179E7C7D8CA6EC85256F4A7147E2ACE1D0A1D43283D1A88D9BE4B93E60F0E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 58355a54d7fea1eefc03d98839f99422cab6ade88f7f98b602ca3af764b0d382
MD5 b22349c913f3854a3def0d1acc9972b4
SHA1 dab115a78b9c7fe9bf5e65623e7d5094d8f20a6f
SHA512 7eb6044aa0aeaa9343fb822dc863cf02e5d860c1593bcd3aa08cb4aa4b6bb412ee88df963804ac8ef077d082722ae733a074213853cb052592e899b1e061a2b7
SSDEEP 192:sxZ0RNyM/jK1Ml8Mk2/fwsXzJIdpJHW6+WNGYw85XAZIgrJ:sxZ0JM2/fwsXzCJHbGr9
TLSH
T1A742E711AB34A977CCCBD209FA55BF43D6F9557292900E48A9FCDA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3db52cd53adfd47c45ee4cc284ab2e2db3d2e2af6632b551c28cf001396c5c9a
MD5 c42bce3f2fc32fbf0a6dd184245fadaf
SHA1 51ce22221bbfbd395ae785153760eb4b30633456
SHA512 9973b1ce99630973c757ce227756f0e849f6b956cb50267749e8e9300eb25f67894cb2a09a2340ef7923f3b316591e0be13adf0f66e4151af8675819a5edbd44
SSDEEP 192:sxZ0RNyM/jK1Ml8UQEwk2/fws3tJIdpiGhxsLIShHW6+WNjJWZo3+R2/YwPaXAZE:sxZ0rq82/fws3tCQHbQa//lE
TLSH
T16762F852A6309E778DD7D218F950BB57E6FA547291900E94AAFCDE1C00E7BED2203C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 705d4fbf36ca27275fabac41da36f6a7525ef34234d537c0fc0d21fc3090f7d5
MD5 14ceab27fcb60e573e9d65a1c1ff1fab
SHA1 3987faa098ca9342e5455afce75e6e1bf2409eac
SHA512 5a0b8a3401e5e41e3ab284de2821cd094e7b8a2ddcb7bd070eb48f80857b9cd06b85241f10edb7cc8fdbfdcac624232a7c92db1d05968f80b8fc9a8ed251d723
SSDEEP 192:sxZ0RNyM/jK1Ml8Mk2/fws3tqIdpqzIcHW6+WNyaR2/YwBlXAZIg5+J:sxZ0rM2/fws3tjQHb6/YE
TLSH
T15052D612AA349D77CCDBD219FA41BB53D6F9517292900E54AAFCDA1C00E6BED2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6a35dfd827b82e02d1a5d5325e36ffc6fb8f5b20d770f36d464e1733d00e936c
MD5 e73d22aa79a79bbc970bbc02dc157653
SHA1 691209b12400af705170dbaf2a5f4a24ea55091f
SHA512 226af255277284215812205be6e4ced15a0adeea73a5c78c66e17ef1c4858b059318153a82d03246254a2b39f32bb9ba56381bf0af7561d9c27c339db69139b6
SSDEEP 768:Id4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dHrohEc2a/U:Id4jeXmWvmKLEu1jacPLZQdUV2
TLSH
T191D2093B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90d565eb-ac24-4949-bd00-94dd7ff76276\index-dir\the-real-index
Size 288B
SHA256 9f9df4781d5528397de83d9a9b48223fb998e71d9f5bfb0aa384275833d6f790
MD5 a689332a3853cf0a18b4c733fc4859e0
SHA1 5a7824f1e7b2110b405d9546c3077d187dc3847f
SHA512 a70fdc2928eb2c59f9fc4d3f422238870f9c51cbf40ecdb2c3ed07d7280a00632fc201664bf5b2e060d8a5ede1898ab6e8ccf8a9d423654599fbad6d353a747c
TLSH
T193D0124DE9201258E4355DFE4DC21B1511B26E24FC8C1B8A4094B276F4E65DA824FEFD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a783e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\90d565eb-ac24-4949-bd00-94dd7ff76276\index-dir\the-real-index~RFe5a783e.TMP
Size 48B
SHA256 02729ec519d93dc944f26a50617dd23413c718f022df9c32e4a8a73c1eae1110
MD5 957355edeadc6a3ec08fd7a3c80b3d34
SHA1 bf4770e0be77650fe02d0f06a9e2ea5496becdba
SHA512 776c0e93275cac84c469b53bff5b958549194d2a7064e3ad6fc667aa14701f7c545bd2a40e755ac8d1348369e3b4895a33b0fb1322585caf42f4fe235d42c171
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f668baa0-b711-4c2a-9515-dacc05e91497\index-dir\the-real-index
Size 576B
SHA256 cf49df1a5821c5d6d9ca05907e24655bf1890edd16edef00b07ac55791d6fa69
MD5 6cffefe44e72238cdf511839e3f788ac
SHA1 0c68edfb1146b5c7b19f1a9d12adca84be81e50f
SHA512 7b74bea420e634dc030e5a86ca3b739c685ffae2a7ac9577d5c3b31ea18564257277fc7882679c6e96a47552be95c1514725e4dbf02b9921ef72297624be4671
TLSH
T1EAF0ABE599A82E27DE268B7474B20C540E3682BD07AA9A97EB8CF00AC5A73510D82200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7550.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\f668baa0-b711-4c2a-9515-dacc05e91497\index-dir\the-real-index~RFe5a7550.TMP
Size 48B
SHA256 d17d0e1ff2788848cdd3ca9b114c6d82fb37b7e9aa3247b03245b51e31a5c774
MD5 07d7bd0af4c2d2a2288bcde5d7dcc85e
SHA1 f56b5d98da6d8c4d789e02cc36765d81bfc493d0
SHA512 25ac197d66ab5c81bc949ccf56acbe28885491d1ac89a98e0985001d7dc6ed2ce7e2c405cd37014839efd18e0d8be5a5eb24cc5d90a6e5552ae35188258fb915
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 560f0bd70f740655d87daadd6d24fcca94b020f8e68bc4610c7ab12c4ffda4c8
MD5 712015c79b1df47479efc103dd60f92d
SHA1 90ddf480af8983d34a235febb64ea1a66b274410
SHA512 28b2c32ebf2abcc30b5ee986fd186c3cf39be8422c7495a14abf5635446d4d5effe9a3dec7f7bc4c64439d3d55d62bd067a214014869c32759033927384ea3d4
TLSH
T1B6C09BF35510859A0EB0EEDD1C74976D951F414C89C4CCF4901D50473838E138411D3D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 241B
SHA256 b565e66a0fbf44fe4ec739165d99c2ec4866e3e79f8c6fbe5d917a5fc7398a50
MD5 da229b87df146d4154c82c98eac6ab4d
SHA1 c3c7bf9f24be7c17b2d1c87f4ae3ebefd70616ec
SHA512 0500d208b387851fc091fb3587b6c0ee011c85fc39fa8b2d5ae05a192ceaf5bd3862b478553c2f656b804b9c596873c07f07bd6155338e66709c5d3caf0e4649
TLSH
T190D0A7E3669140860AB55EE92C74A2AD821FAE8C8F89CCB84158714A3534E03C825F39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 21783f4e3ea8c8b60eac6f214a95f529e9820a2311a3b00491a1eb3a9f194b7d
MD5 cf27a159881c5fa5470c13b9c24dda6e
SHA1 2bb24f0b2853fd23f0a8255b16b276f005e5c03d
SHA512 1400e286110ee3abc1268376cd131365fa313f45a2d24374e99625ab22912140bc07f8496ab9cf5293a8da84c32e15fb9ebbbdcd04ca76f3741b1f899801559d
TLSH
T17AD022F2593188865FB0AAD96C3D429E441B9C08EA88CCE5A849B04F38BCA03C006A3D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 239B
SHA256 e98cfba20496f04ef077674bb087fe054edb79a863f59532c2e56e55e649908a
MD5 bd97baa1f377048a572243246e7235f8
SHA1 f619f994e3e211c8cbb744b581be51bb9c4e5b8e
SHA512 e64ef263f78461dd3a7602d8707c7b259c2a81fc8e117d6a28a7360d2e9470b89a2e33bed20795619c2c81423558d731bead5ebc45f8127784137128faddd724
TLSH
T19FD0A7E35A92448609759EE93C64B3BD920F518C8E81DCB45658524E3674E07C864F39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1946.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe5a1946.TMP
Size 137B
SHA256 12bd475fd0387471adb61e60538ac0651329d42d37bb5ae38807d36ca560bf94
MD5 6f8d15b0ea317724094efd723c340fb0
SHA1 3e29c3c708f100a3675744736ef9ee21be58a70b
SHA512 d79543049f956d2664108341a8f1e15b6b75ca3b021067d137b392d8712adae31d14db0fcd9b508e38ac1501db7c59adee8602e746fc5426fbcd2dcef8b1f1e2
TLSH
T146C04CA3451045960B61A9995874966D951B4D588980C8E4901A70463438A138411969
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 e500622083d95e4834a0ee08a0fb8261a0070af9454da78f351667ae7f2f5bf9
MD5 d0123f37150dd6e64a29fc65112e6956
SHA1 d04f959962c7d463c6a7991121cd034f3554263d
SHA512 a66a72ec6d8e4c97b79a2b754fdefd4820fb7793571ce626448f42d507de2f59bacf0915758799f4bb4e06d0f12e5bc84ba92ff472c260978869084b2bafae38
TLSH
T1AEB0029A1D3EA0D7CC6C8BFCD08705E8313C7C225F173612C0F841B4C96B681C626099
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a6979.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a6979.TMP
Size 48B
SHA256 25623a0f4cb635739a8394a34a3f08abfea3ae6075af9f02e9ce76c333da1e76
MD5 742174a9f937edbbf3ef1d2ec3c757d8
SHA1 18f7650364e5ec76dae208f0c6fa4258d1199e6d
SHA512 a2a2bf77ba49b3feece57e30d0b56a38b6ddb74f9f632d1ec41dc5bc35d7c28e7065b09d9c0ead79baffba51db0e446363431c4eababc8581f931bb04b1fa1e3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 a8e48f61e96057b994f6051bba4985ec0c64dc4b2699a4a74bdc41313a44c161
MD5 d5f9489f9d3f72501b6977cfe6d1acfd
SHA1 fcbce47c970ad9b6ac875363f7e861ea10429d5f
SHA512 8a2498c74262fcee8ddfd0237b96453d07316dc9fd68232aa60c2c5bf680d78aad2eb96599093c2d295c49640015c846baacd8e8fc04da8a0d047ff086b247b7
TLSH
T100A002B801662E66F8016A7150A901402211CC15E123864643D00444F8D1A41B91A500
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a31ba22da839ffd2ca44d2e8846f22903ad3218ec394c6da39ac16bcb936683e
MD5 ca77f24e0f6f581cb5a03b4d92dc5548
SHA1 4ee0f647e9d8f1a292e0e39168c76bfdf3b2cf71
SHA512 de2bfc0d5c15ce4cdaae973c256ffa6d93a4b8c0d8f4959055b8ff6fb74d18c74b36dd8da71abbd31b2ded7df74bf7540811ccd0947d985d80e6ec383fbb79dd
SSDEEP 48:KQLIhK0IMnyNbI1Kc048NItKG4wHyBsIW:KQLeK0I22bSKc03NSKG4qSsp
TLSH
T191A1120575BF12023C7E282C96E19B37168271733428A52F7BAD50620EA7E694EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9390ee5419beeee35a4db3a22ba86b1edcaf699979b58a54615958e60bef3d78
MD5 1a11cc662da28154d315898f87e64a63
SHA1 72e0063716b10b23eba51047413f00496302142d
SHA512 13649993df404cd7da8be76ce661981a85d1e9e5b9665f815dad95b88482a9db60475a54457e2caff760b6141fed172f3dadf4155aa53cf9df57cad996db8e40
SSDEEP 384:MZcIhsNXJKyA5+5of+5OMYHo5mFnBeRs9JKgqijUYb:ahvR4wkOPo5YnTjKgqmUYb
TLSH
T17B927C319838AD7799E6B685F48736134FF99127EAC06FD4E1EC7B0C009A59C131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5fac1730f1e945fc4dedc4f737fe79ab102c2293660d8cd1d89eb36f9c0e20ff
MD5 59b2df40d4b3c5a14f8f9b4f27932660
SHA1 8549bc783a68403b829f664f60eb1089f156f44b
SHA512 25da224b061404f284b0d036a1d7470fe06c05fb00c92424cdd52653b80227baa1bc1ba9678ea3357ccccc6ce11a7c87b482bdb0031e56f246bdb6e012e5f06d
SSDEEP 384:VqZcIBzsNXcKyA5+eof+5OMYHo5SFnBeRs9JKgqijUYb:uxARPwkOPo5knTjKgqmUYb
TLSH
T13FC228F154E75876C9ADA743A77E2E034EBCD017B6806A94B3D86B0CCC8657FD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 59a4937c195a6c725034350cd5dd4b867d9ae71d479e5a662947433a50543860
MD5 4d5b3fad95cfa99b2cfbff307a7a574e
SHA1 4dbbb045c7a06b30fe86105cec94ab16e09a87d2
SHA512 e9e2ec04c0d0d0052ab3834e55011dae2ec4e765aea57616e595d8acaf0d35afaf92faa2d55fc90c0754bd8c616a65ddfd3b7b3681d4fd9fe1e5a5bbff0c5594
SSDEEP 384:DZcIhsNXcKyA5+5of+5OMYHo5mFnBeRs9JKgqijUYb:bhAR4wkOPo5YnTjKgqmUYb
TLSH
T143928D319838AD7799E6B685F48736134FF89017E6C06FD4E1EC7B0C009A99C231BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7fe3c7a73494afb53897d66e57f8c97d43c33c6e87ec0a4c4028ac772e454634
MD5 e865723ad23e25c9ce7b5bc2cd716ef7
SHA1 272c2c8e469c2a7a0932caa985a7df7e3af89f4c
SHA512 33634b73ede0f49c41136a7a76a15c43f94216fd1716220f88d7a1de251b7ca3aa771de5d3fa18c7e3acd6dc10d1890420e000d1b37501e7c5887f3692dd0dca
SSDEEP 192:EONU6hZ0QmiUyeKpc/+jVnO1GYc5wOZwLU6:EONU6oUpu+5OMYj2GU6
TLSH
T1A102EA3568686C778EE2AE46F48737235FE5112BE9D56F84DAE82B1C00C769C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49fa25600b687c158b02dcf97d678703c8e5920c2380bdc1c381940e3d921bc0
MD5 0c151c015d9f2d22470ce713b09df268
SHA1 da636f44ced6daeda67fa1298499c85e99fbfc3a
SHA512 a5da8c2fe37211e77388d232739b3a5606cfe00c43938312fa0c6ffe6105a1bafbf740c7ce7fdc88b959c3599c4216907fafcbcebf8b8d3704d266918ec98b90
SSDEEP 192:IONy6hZRQmiUyGKYc/+jVnO1GYHLE5K5cOqzqYU6:IONy67qYu+5OMYHo5F9nU6
TLSH
T152120B316868AC375DE2AA45F48736135FE55227EA857FC4D6DC2B1C04DF66C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ff09dadf908c76bd7eb296636aae1f323979911b63743bf18e1a9bce2e01e8a2
MD5 6210c1bbb082f4ad3305c372892bec69
SHA1 c3418a852d472c6ad2369b11f14c8beb6be24b00
SHA512 655cf6283bf5e418387e886dddccf781fed1ade4abbef2727d3da6417dd3a1c11b59131c375b5525174c79508c5f91acc4b6e6b9d3e00ebfd0f4d8db2082a125
TLSH
T14BE00401D7000075C41C433000D3173017F1C4500151474F451101543C157041D30D40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a3058.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a3058.TMP
Size 392B
SHA256 6256c5c3f287fcb582cdcffe488a82d7eac62f2be359ae15c61ee66f2aa43493
MD5 9ca0db323a6eb4b3c377f752d0c07bed
SHA1 e7cde91ffa76fd6e6d701679f80b08daa2411ec6
SHA512 7a708d1f0b90aa75bc1d0f24fc1a51faf234e1c12059f6b104cedd41c1b38770f8f91f3627f966ebcd142a2992b168110882d55d5a4d6e8d94f3f2635f514941
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fca4577d053c48cbda5a7ae3f78b77c7feb939506790eea0e43406ead974c8c0
MD5 7bdac301289037426cc803b7c50fe6bd
SHA1 11f43ea5b8c1fd994fefdf6cdb19838723b5464e
SHA512 a2ccb0569c2f1b9da8b8605ff3900fee9561839afb5bac1eb811f395d96420ea3939ff83fae757f9e5807fc2747aff33c29fd5446ef8ebc50b276a3411a6409f
TLSH
T10B412A98A6E91148B3B76E5A9BF7A86D447BB8372E06D45E00010E4F0B67A40C961777
MD5 SHA1 SHA512 TLSH

Submit Download