hxxps://rluxsends[.]com/

Analysis

user interaction
yes
max time kernel
598s
max time network
536s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rluxsends.com/
Sample260804-ccg41sbb49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302821979097991"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{DCC0EF98-18AE-4D57-8E41-510D742FEA76}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2480	4720	msedge.exe	89
PID 4720 wrote to memory of 4352	4720	msedge.exe	90
PID 4720 wrote to memory of 2636	4720	msedge.exe	91
PID 4720 wrote to memory of 2636	4720	msedge.exe	91
PID 4720 wrote to memory of 2660	4720	msedge.exe	92
PID 4720 wrote to memory of 2660	4720	msedge.exe	92
PID 4720 wrote to memory of 2660	4720	msedge.exe	92
PID 4720 wrote to memory of 5484	4720	msedge.exe	94
PID 4720 wrote to memory of 5484	4720	msedge.exe	94
PID 4720 wrote to memory of 5248	4720	msedge.exe	95
PID 4720 wrote to memory of 5484	4720	msedge.exe	94
PID 4720 wrote to memory of 5248	4720	msedge.exe	95
PID 4720 wrote to memory of 5248	4720	msedge.exe	95
PID 4720 wrote to memory of 4240	4720	msedge.exe	96
PID 4720 wrote to memory of 3020	4720	msedge.exe	97
PID 4720 wrote to memory of 4240	4720	msedge.exe	96
PID 4720 wrote to memory of 4240	4720	msedge.exe	96
PID 4720 wrote to memory of 3020	4720	msedge.exe	97
PID 4720 wrote to memory of 3020	4720	msedge.exe	97
PID 4720 wrote to memory of 5200	4720	msedge.exe	99
PID 4720 wrote to memory of 5200	4720	msedge.exe	99
PID 4720 wrote to memory of 4848	4720	msedge.exe	100
PID 4720 wrote to memory of 4848	4720	msedge.exe	100
PID 4720 wrote to memory of 1104	4720	msedge.exe	102
PID 4720 wrote to memory of 4780	4720	msedge.exe	105
PID 4720 wrote to memory of 4780	4720	msedge.exe	105
PID 4720 wrote to memory of 4780	4720	msedge.exe	105
PID 4720 wrote to memory of 1484	4720	msedge.exe	106
PID 4720 wrote to memory of 1484	4720	msedge.exe	106
PID 4720 wrote to memory of 1484	4720	msedge.exe	106
PID 4720 wrote to memory of 5552	4720	msedge.exe	108
PID 4720 wrote to memory of 5932	4720	msedge.exe	109
PID 4720 wrote to memory of 5616	4720	msedge.exe	110
PID 4720 wrote to memory of 2276	4720	msedge.exe	111
PID 4720 wrote to memory of 2276	4720	msedge.exe	111
PID 4720 wrote to memory of 468	4720	msedge.exe	112
PID 4720 wrote to memory of 468	4720	msedge.exe	112
PID 4720 wrote to memory of 3816	4720	msedge.exe	114
PID 4720 wrote to memory of 3816	4720	msedge.exe	114
PID 4720 wrote to memory of 3816	4720	msedge.exe	114
PID 4720 wrote to memory of 1992	4720	msedge.exe	115
PID 4720 wrote to memory of 1992	4720	msedge.exe	115
PID 4720 wrote to memory of 1992	4720	msedge.exe	115
PID 4720 wrote to memory of 5800	4720	msedge.exe	116
PID 4720 wrote to memory of 5800	4720	msedge.exe	116
PID 4720 wrote to memory of 5800	4720	msedge.exe	116
PID 4720 wrote to memory of 3108	4720	msedge.exe	117
PID 4720 wrote to memory of 3108	4720	msedge.exe	117
PID 4720 wrote to memory of 3108	4720	msedge.exe	117
PID 4720 wrote to memory of 1508	4720	msedge.exe	118
PID 4720 wrote to memory of 1508	4720	msedge.exe	118
PID 4720 wrote to memory of 1508	4720	msedge.exe	118
PID 4720 wrote to memory of 1092	4720	msedge.exe	119
PID 4720 wrote to memory of 1092	4720	msedge.exe	119
PID 4720 wrote to memory of 708	4720	msedge.exe	120
PID 4720 wrote to memory of 708	4720	msedge.exe	120
PID 4720 wrote to memory of 708	4720	msedge.exe	120
PID 4720 wrote to memory of 5900	4720	msedge.exe	121
PID 4720 wrote to memory of 5900	4720	msedge.exe	121
PID 4720 wrote to memory of 5900	4720	msedge.exe	121
PID 4720 wrote to memory of 252	4720	msedge.exe	122
PID 4720 wrote to memory of 252	4720	msedge.exe	122
PID 4720 wrote to memory of 252	4720	msedge.exe	122
PID 4720 wrote to memory of 1996	4720	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rluxsends.com/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff9cabac188,0x7ff9cabac194,0x7ff9cabac1a0
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1752,i,9546392795478363160,8713739600873533319,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,17962331536892737100,3914841515989440732,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=2892 /prefetch:13
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,4306408311793461629,1108220359295074456,262144 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3656,i,3009762807906316353,4973843152842297857,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,13565804228070668930,16787681518362071756,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11404766270879992773,5072638724508212133,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4368,i,2957126120947434332,15896957493624759716,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:9
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,14812373115849736013,4574835537047136272,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2192,i,15624873899802496251,18148690008283775238,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17431407980775041282,14901225026556667521,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,17431407980775041282,14901225026556667521,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5068,i,6477472386793554122,7320888804793343786,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3752,i,18398558354399087072,14684852377248737917,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,4644283574148145361,7975499551503205504,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,9415264715316402836,13525445245677976167,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,13430857505600007113,15301634788740100729,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2072,i,16870629281317234851,13584536932520252970,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:12
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,13547765791577523068,9289671446534753301,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6672,i,8358765927353034563,11296596602320974045,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7064,i,17863505736805423643,8139185132605862126,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5660,i,16819245795292100615,8396813286788622618,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=3788 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7052,i,8518304606892273278,14625534398049275936,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6044,i,8588691576365836292,1151360592485399157,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,16240581882356421196,15143294051516269650,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6072,i,5537551619251783536,3059376839781391331,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6612,i,4758334747720128562,4517998053820669720,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=7032 /prefetch:1
  2⤵
  PID:5900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6588,i,8227320249569737892,15981387159913951261,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7132,i,3942573598671488760,16942490409715234782,262144 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6524,i,288071260078926523,16306277156688875218,2097152 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1733282571448305412,6495654416235076692,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,1733282571448305412,6495654416235076692,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,10454150269366405001,14499892739541184252,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,13442992595539722463,15300227776922320209,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8897250209490962950,13323892845556691101,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:14
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,1441339662033157157,4941487298856284889,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:14
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,12516801957587004780,16431424775445245101,524288 --field-trial-handle=2296,i,9702395093187968645,4442137543835230133,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  PID:1840

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1732

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4088

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 e895c713b499f7261f324b5fdd87824521729acef59d0f511383df5da893930e
MD5 855cd69f46ca80eb69346c8a580ca6b8
SHA1 edabd216a3773be95b50c047ece50793ca1b0403
SHA512 3eba5699e57eb3f6a05ab94cd60ae66b60f73621303363a5393ea34f2b8a556e243a128d41829e64f21b76f4c24cd5978cf832f4255309101adc2b7bbcb1babd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P76:fwUQC5VwBIiElEd2K57P76
TLSH
T18AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 b7ea02b5049bb9e27f61355e637fb2c6ccda23282426c0383e58f26b1ed95df5
MD5 ad3c3e71ad951caf86526cd57a37deb4
SHA1 82a033768bae0642e11e0e01d38f64cf30f16654
SHA512 707ca8a45fc2433d8da6d35c0f4ab573eff75ae4d07573654d89354306343ae47f4a13dd18564ab3ecb341286c4d990c2e60b19f7b5991238958bb1be9541d59
TLSH
T1FDE04F9F7BC8E1A71A159787A15C935889F0710FAE8CDD9E261C688C6442446C3659EC
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 b704bba9ce9c134e5040db4f442a92b06760a5d0318c70b61f686532e817c817
MD5 d99c8d9440d955444c2cf1c2a9724277
SHA1 83aff119632e6feeb99721101b364f44442fca0c
SHA512 dffc5e5db8adee127ac3b4cee531af6faa36e1a4c65c2e6be2538397830993d53aaad5275188eb1a1e648f26ac83823424eda0dcf7639e3a0976381a5c769d79
TLSH
T1BFC0809CBD4C845DD2D1197F5717F01007646651941796170750BDD031409B01E29130
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 48188106fc86c6aa0b8271db559f41bbea111ba12cb93b3db62ad39e7bbd829f
MD5 371d182a90394d0fc04a90277dda6729
SHA1 0f92126efc4916c738f5efef62133715aa1da0fc
SHA512 6caff8c28a018edb3ba028faca6c7f054ad0b4b0c42abcb9da8df5e955d1c8e88aba1305702761b82076cebf6dc8418e0031dee81ec16cbf06d2899e701f7732
TLSH
T18341F85413B61ACEFBA4D6F36FD27E9932B8D8F9080F2F9048D1A2F17E453241152761
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 8675b60d32bee5d262823f796a0a8b6438d090c54484164ea687fd8723dbcbaa
MD5 bdcd618b4c21e203bbb286d77957c0a6
SHA1 d3b070aa1532e822afaf137df0bdcaf1f7c53b9a
SHA512 9f0cde03239d57f8c760d238c778cc8d8b655fef002712bb09af52193bbd434ba562fe2f1641d071df1cfc15c1ebcc6cde314981ef710512bd2fd9e573d5d308
TLSH
T1F241F85813B60ACEF7A4D9F32FD27E9532B898F9140F2F8048C1A2F43E053241162761
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59cda7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59cda7.TMP
Size 2KB
SHA256 01803893eebf5f6459d8c3d32ff0817be429d751776dd9209847787b7c172bc2
MD5 0611ed5370fcaee7d03462ba4c2a0bad
SHA1 24dbed34af32f26c270598fff2e46c313060fc73
SHA512 395901c0a0f6296682e829fb5020a7f41b548574ba86cf60c84bf3923c687b2c1926334b560731c95e630662acb498a2e1b21d3b39954e2d1424eedb586bee9e
TLSH
T1A541F85413B60ACDFBA4D5F36FE27E9932B8D8F9080F2F9048D5A2F13E053241552361
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 5e6c6b3c2b830bc8eb4b19e60fdb9518b74eedd5dc27d20e5786cc8f5f990171
MD5 d6411cfb0f84b04769b56e4359fe29f5
SHA1 daac1b16bb2bdbba925bc7cc6bb0e5a91b3f0df0
SHA512 81e26ab329bf4c5b357ac3a05e318a8b40a510dac2a8835c87a7c2d5f3b0e88c1730724500d8b883ff2c8f900cda0c3385d085300fd4766e12621c5dfc404c5a
SSDEEP 96:D+HdkwwbaDeivVAbGBibcijwB1vDzjGj4/3:D+HdkwwbaDeivVAbeibcijk1vDzjGj4v
TLSH
T1AFA1BBF783E5966ED8115AF4AA047E1BCE1D0914832C3D6A88E4BF5B93E3471E241B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 b2e9325685c755b7e88aaee8d060a793e239b0c517db4407cf9e28e633bb3283
MD5 d9a4d1d0af8053664815c4fc2721fb2e
SHA1 ca8079c3328396971d351378020d8cde1bd5fdae
SHA512 f86c8f56446d97ea53ab1bcdf8ee1351e2ec6f1d1c10233c8129e865ccc8c60da708b1ae046fa0ebf3c231a87d9f524bc81a51faf2fdca17656aa45b7ef96d97
SSDEEP 48:YALljrPjKjyP4YVEPoxVxsJqaAsJvRfoKsJZFgmgCZsdpSzsdBTsdTYgGBibT4ig:D/umkwJaDeivfsbGBibcijwl1vc9zY
TLSH
T1EAA1BAF3C3E5866E981156F4AA157E1BCE1D0914832C3C6A88E4BF4B93E3471E241B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 22a1bd023c880d3dee56756bb70a1f3c6cba76ae18f913b70f3bb3bf7a8df4aa
MD5 679829ac18a0bead5b2e12aa30146337
SHA1 d0215641ea958278bb6aeb11aa5cd852d91dc06e
SHA512 1a983583585c942d2dbd5c6256a3d95c01efcc2ff4206a8a9821f10de074596a9099c7645a87a696fbedc98aab546bd87c36c411ea31c35669da029dbc9f3275
TLSH
T1EB71BDF3C3E5966E981156F4A6157E1BCE5D0914832C3C6AC8E4BF5B93E3432E241A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f940675d3cca886ca0482be6a32602cd49ce83ecbbf31b0874b51590b01a18bf
MD5 30c7c679830eacc60df46cde1c329a4b
SHA1 947c1b6978107617e39e10811f5e7d67d065f95d
SHA512 887ce498cb6092f9278dd0924d0b3e1eed98b963077c69e5e64c380fcc79b87f1f860187bb4a1c6376b868b80998eb190a08dc5f84421c3265de55947d24f8a0
SSDEEP 192:sxRNr/yM/jK1Ml8wbR/fisyzGYCbqzoA8pDZ/g6+WNLFC/YEqBeGahIgDXJ:sxRNr7lR/fisyzGPnV/5c/aAt
TLSH
T1CD62E805A924AD7BCCDBD209FA557F93D6F81573A1541E04AAFC9A0C04E77ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 1560dc50b7077fc3b94633844ff15c224d3684167284fd74d625e5f4848d6bfd
MD5 394f5a805bc439b0b3c593fd53af865e
SHA1 00f8769235c1d5e6b5a03723734ecac848008582
SHA512 c30821f64113fc3a71b6b765b376e81f3bf44bd072d10df4e0a55c14b0cd0e9de64cccae430a1f4119ec684c9d8143d5b9890abc83420beef338d540edbd5d21
SSDEEP 192:sxRNr/yMojK1Ml8wOR/fisyzGYCbqzoA8pP1TCsX3Y/g6+WNL1zDtcAu/YEXBeG8:sxRNrOIR/fisyzGPnlY/51DtC/FAt
TLSH
T12D62E706A5749A7B8DDBD21CF951BF53D6F81073A2941E54AAFC8A0C04E7BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6a8c87a80225306d24cfdb70ec5a4ba8c44357aa5b00e000a43e68afa0c337f0
MD5 ed09b8b97a8731b7e49fe1e1d03404fb
SHA1 c1d9c3bd97b7284954799c65cce3ad6c3734c675
SHA512 38eef56ee3ac8ebc6ba80b374c9c13ba36cb62512d0bba0c5314657fa1c77e06d6c8d43436e86efd1ed5f30323e692fa8850358bc6e58ff5068b6d1ff7f14b77
SSDEEP 192:sxRNr/yMojK1Ml8UQvOR/fisyzGYCb3zoA8pPdTRBsX3Y/g6+WNLflttcAu/YEMU:sxRNrOq2R/fisyzGPeaY/55ttC/wAt
TLSH
T1FC72E806A5349A778DDBD21DF991BF63D2F80473A2941E54AAFCCA0C00E76ED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dfe8dc7858b573dd8710db33da75af77e64c861d460de1d235733f9a473af222
MD5 ff8433b8ba2fee2d3e355ef79bf46822
SHA1 9ed76649475a2d47e0ef94974a4a6f6a6af8dcc8
SHA512 7577a8db5408c33192d1c60849f5d784d564f0ee88f8c44694919ae5fc969d0292116f19a72848ebcd84984bf704b638a4a5f0707e23d1df4abdaf9b212eb7ed
SSDEEP 192:sxRNE/yM/jK1Ml8wbR/fis7tYCbfzoA8pi/g6+WNIYEBBeGahIgIJ:sxRNE5lR/fis7tP2i/5IDAs
TLSH
T1FD52E9056A24997BCCDBD31DFA557F93D6F81573A1941E04AAFC9A0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5e1892a998e2682558a406882fbca698add4cb82b82f25def76699f7229d9ee7
MD5 0ccd63ab13deeb7746d4b09076dce8cd
SHA1 dd606bc1588df7b10bc97186cc665efb9f1f02fd
SHA512 2940a822c9e37384588a56fcf867c9c1f62a57927405930d6c196b2fd0c9d6700d8c93f2cf7c13d7c360757acd25b895e09594f699ea0c0d6cbcbb7830cd4601
SSDEEP 192:sxRNr/yM/jK1Ml8wbR/fisytYCbfzoA8pi/g6+WNIYEBBeGahIgDBJ:sxRNr5lR/fisytP2i/5IDA/
TLSH
T17C52E905AA24997BCCDBD30DFA557F93D6F81573A1941E04AAFC9A0C00E76ED621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b5d0f85fc2bf9426ebf46a726b2f48fe8ea911a1988ad109ce504cb68f1fb256
MD5 0c95e112765bf9900106fa6bb7ec61d6
SHA1 860ea12c2d58e1050188ce6bd4ef00397ebd3583
SHA512 3e0133ad8cf9e9d383ba5dc08c9c3b4bb73dd33e0474a5b5b59b7254d09d24e80a8609837fee3337ffc92421587921a032ff3718dcb35b733fb1d6a0143b6315
SSDEEP 192:sxRNr/yMojK1Ml8wbR/fisyzGYCbqzoA8pDZ/g6+WNLFiZYEmBeGahIgDXJ:sxRNrOlR/fisyzGPnV/5YZWAt
TLSH
T1EF62E805AA24AD7BDCDBD209FA557F93D6F81573A1541E04AAFC9A0C00E77ED620382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 93d134f8b8c96dd277a8e68c862c67b621d017a29aae756b60c7aa21ff3e215c
MD5 a305dd72d164172f3b82770c3d7da69e
SHA1 cace52866eb72011416df85499f7e1bb9c9ad797
SHA512 639956634ee5dbf7c026c8d92794c1384705ee7a136b1d787ef8429bb7a169ec03cf90cb76c649a684e717ce77e6f739de8d9f63e2053a73eb5c60a86d6c79e4
SSDEEP 768:40D76DrQD8f0DbWgQ6DjfPQDF8F1+UoAYDCx9Tuqh0VfUC9xbog/OVw0DjGQDL6t:40D76DrQD8f0DbWgQ6DjfPQDFu1jaj0+
TLSH
T1E2C21B2F540CCB7E4F804EADAC29AED66DD801CB97984D9447EA890C03C77EF521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 1a678462fccfad467422a958c398d6bcca128f20d355e1cb0ae61052dbdb4dca
MD5 157bd88e36a42dff43539a6c72cc495d
SHA1 9dedf0ab483679f805e13ecf7c82ea506a7b32d5
SHA512 cbd6f785fd3a1e979fb6d3adf21fc5bf4d45ea65edd58d8c89b32e78cceb93ac5a46f144f93b020eb5089128ad42067e874f8d410ab1f1fbbe1635ea350c4fbc
TLSH
T176E0C0FB2DE71C18EC7F83C22571C6710101B838D148EC4E111692C340B5369984AD32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be1ae9cd3c074b7a36bb2f900d782628f23e74fe13b3937975521808cf0dc841
MD5 66f5368783b9e5c9a44db5c062ede819
SHA1 4020ac68acb1a60af136aa61c75dad82c00ba0ee
SHA512 5d919a700845fa32db97cacecfa679dfb56ec8c736ca5af076ca820f0ff5fda5fe59cb606ec8e2a337df6ef4ab1cb37ab773f0f1fd31f25e012b5c35fc3f6c71
SSDEEP 96:KRWLa2Q44eWIdFgWeK4rgEec+W10m/HFSr/VPTXWbAOgHXK42gZXc9lYrWyIKXqH:CWLa2Q445IdGWWrgEN+W10m/HFSr/VPA
TLSH
T1BC917484327B4680397E699C9178C52F52C2B563350CA93B77B801A24FABF164DFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5016e0044ad02e18debe0b323fb134d9db72b233f0b505fb6482f9492559b856
MD5 163c89d9e02cccf69510b4aa9259f3c7
SHA1 21fe9c30a2e19ccb99adf4d490d197c969d96ee1
SHA512 af3e5ab1e3e98d4958b6fde066aa17f0a00b9edec7b1388d50567b80d1bfa133ebeb224c461c78a7f3408ad884351f922bc343565ab5a5e0619f42eaaa60daa3
SSDEEP 768:7i31e7gDTd+ZN21fveX6+qTko0u229a4vsTGojKgqmUlhOGn:7i31QIxuvVTVKa4bfgRUl8Gn
TLSH
T137137CF194E75937C8AE9783633D2D421EBCD123B6881A50B7DD6A0CCD0657FD30A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 000a7a15b45869f7807559c7d2549377c84fa4791f32f26fc45d290423dfc0ca
MD5 25be6c3430bb03afcef8d9952be2ff08
SHA1 b87c4bb09a9cf050ead21717a34f6893a0c28f2c
SHA512 b57975fe9d79b321b547613093a32e9ad4509f340a8ea56a7813c031697fec2067d59a1da1a8f8da52046640383a7a58d447d8afefd08883cccd8ed671bdf928
SSDEEP 768:Yrv+4UNbdf3se2gDTd+ZN21fgeX6+qTko0u229a4vsTG6:Ybsbp3sdIxPvVTVKa4b6
TLSH
T10F03BE32F8689D778DF6D685B11B31436F7811638BC80B9499DE6B0C064B5AD270FE27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 653cc5996632b7a77298a9cedb34ce50491796a34748508c1ac04ddae7f3f487
MD5 34b39bc3e3336b70eaaac76261490779
SHA1 43cb5d34f6084afc1d4d14b3acb10a023d0f37cd
SHA512 a49c4fbef24029b0760ad17052a15c237e13d7fe2c8463fd06e5c56321bcb883fc2bd71674b2facaf581b25d8a58c15b97e09b7c376ed9934efe61b653e14e7b
SSDEEP 768:UU31eIgDTd+ZN21fgeX6+qTko0u229a4vsTGojKgqmUlhOGn:UU315IxPvVTVKa4bfgRUl8Gn
TLSH
T1CCF2BF31E8669D778DF6E7C0B21A32475EB45123D7C82F50AAEDBE0D024B66C170F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 464269b61dfd5e16532fee18ad0fa4d4cd375979ac5a1cf7946a860b5167feb6
MD5 bffbb75a88953b725d63db054b2a8d6a
SHA1 f8982e4eaa390ad72bebadfcccf618663374c8c1
SHA512 df02a8055ed1fc39cd941046789650f51a5c51abbef890c3d91c4804ab5cf3415f97d1d50d599640d417a3ebc825b2b324d8f844d5ca4b9489ab761c89910649
SSDEEP 768:prv+4UNbdG3Qz8DTd+ZN2reX6+qTko0u229a4vsD4eVH1SdW:pbsbU30IavVTVKa4ZEH1h
TLSH
T18203BE32E8B589778DE69788724B71472EB95163C7C80B90D9ED6B0D068B5AC230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fe02455aff483c7a56f4a560a67858e3a62e7628970020224ff068d8f1ee7a88
MD5 9f625834249fbc2229e91b33ba147562
SHA1 f3bd2a53903437d6264add7d136b6a2821a7a46e
SHA512 3c85ed1e3e721949066bc4460dd8d6ecd3e2c3f9e0577181ce7445112ed29f18ce1dbd30591afa47a493fce3ce9ea0f40919ed40d4979969ca8aee92986b4e34
TLSH
T13EE00204A3C1022BC42C073800D71F51FBF4D04057B30307476001791C623042E25E84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1a915a922036e14e17eaf176d4845491350f34b3f390fb5e2cd2385f59b24eed
MD5 d3ddc7417357bcb09c0bd89ae20e4ce1
SHA1 14e1421344edd1bbbf141338cf27d062ac1eecd6
SHA512 f29c2e5b4f24261dda753e32975d29025456c489f75d2969f13b14a082d8805d5699cdcf7af3610f10ec934eb861ab7892c67a4c649c698fbdad33200ce9818c
TLSH
T103E00105A781026BC4280B3800D71F51BBB5D05057A303074B6002791C623442E25A84
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4520494c3803469cb014867e2e2dd62587f6bbad8ec0908f0d8f924ec148be4e
MD5 96d8737a698e8d00edbb8bd92a1a9646
SHA1 6607436ead8a9e97f62a07d52804cfb0b4656980
SHA512 f7b7983673f99f0c4eccda6585af06c3c7433b11ec216dd8b75f94bd9d92e250ea21bf95831f452cbfb79bde8e6c48a0a2737c1fb207934baff2529516dd8f5a
TLSH
T149E0020462C1022BC428073800C71B5177F4D04003B30306456001750C633042925E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b52a1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b52a1.TMP
Size 392B
SHA256 17a30fabb47fcd17ff023c3bc2398e1fae92a698f66bceb0fd54b4f64ccdbb26
MD5 f356a843c2a002a3a6fa4ef7a76a3d51
SHA1 e0c7ca4e55cfc17e0d08e52d957d14d35be010a5
SHA512 1ca777563d5dee7158eb159655c237f746979ab380867c1e445a92ff334e7c337be23eec49abd8d0278a0942212518caeb727defd6b76f26bd16c88985134529
TLSH
T125E0040473C10315C41407340047175177D4D04001710307445001550C533041D15D40
MD5 SHA1 SHA512 TLSH

Submit Download

b453797a-886c-4c81-a6d7-16356aab34f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b453797a-886c-4c81-a6d7-16356aab34f4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download