hxxps://www[.]dbs[.]com[.]sg/iwov-resources/flp/fonts/opensans/OpenSans-SemiBoldItalic[.]woff2

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.dbs.com.sg/iwov-resources/flp/fonts/opensans/OpenSans-SemiBoldItalic.woff2
Sample260804-kdmpwsvgle

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4876	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303057767586055"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D9DFA5D0-8C2C-4FC3-9E11-1B83C360C5A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5056	msedge.exe
5056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe
2004	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 1936	2004	msedge.exe	86
PID 2004 wrote to memory of 2308	2004	msedge.exe	87
PID 2004 wrote to memory of 4876	2004	msedge.exe	88
PID 2004 wrote to memory of 2308	2004	msedge.exe	87
PID 2004 wrote to memory of 2308	2004	msedge.exe	87
PID 2004 wrote to memory of 3820	2004	msedge.exe	89
PID 2004 wrote to memory of 3820	2004	msedge.exe	89
PID 2004 wrote to memory of 876	2004	msedge.exe	90
PID 2004 wrote to memory of 876	2004	msedge.exe	90
PID 2004 wrote to memory of 3364	2004	msedge.exe	91
PID 2004 wrote to memory of 876	2004	msedge.exe	90
PID 2004 wrote to memory of 3364	2004	msedge.exe	91
PID 2004 wrote to memory of 3364	2004	msedge.exe	91
PID 2004 wrote to memory of 2220	2004	msedge.exe	93
PID 2004 wrote to memory of 1520	2004	msedge.exe	94
PID 2004 wrote to memory of 2220	2004	msedge.exe	93
PID 2004 wrote to memory of 2220	2004	msedge.exe	93
PID 2004 wrote to memory of 1520	2004	msedge.exe	94
PID 2004 wrote to memory of 1520	2004	msedge.exe	94
PID 2004 wrote to memory of 656	2004	msedge.exe	97
PID 2004 wrote to memory of 4616	2004	msedge.exe	98
PID 2004 wrote to memory of 656	2004	msedge.exe	97
PID 2004 wrote to memory of 4616	2004	msedge.exe	98
PID 2004 wrote to memory of 3720	2004	msedge.exe	99
PID 2004 wrote to memory of 3720	2004	msedge.exe	99
PID 2004 wrote to memory of 2336	2004	msedge.exe	100
PID 2004 wrote to memory of 2336	2004	msedge.exe	100
PID 2004 wrote to memory of 2336	2004	msedge.exe	100
PID 2004 wrote to memory of 2612	2004	msedge.exe	101
PID 2004 wrote to memory of 4852	2004	msedge.exe	104
PID 2004 wrote to memory of 4244	2004	msedge.exe	116
PID 2004 wrote to memory of 4800	2004	msedge.exe	117
PID 2004 wrote to memory of 4924	2004	msedge.exe	118
PID 2004 wrote to memory of 5028	2004	msedge.exe	120
PID 2004 wrote to memory of 5028	2004	msedge.exe	120
PID 2004 wrote to memory of 2448	2004	msedge.exe	122
PID 2004 wrote to memory of 2448	2004	msedge.exe	122
PID 2004 wrote to memory of 5056	2004	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.dbs.com.sg/iwov-resources/flp/fonts/opensans/OpenSans-SemiBoldItalic.woff2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa394dc188,0x7ffa394dc194,0x7ffa394dc1a0
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,1095151779501793795,12402338258279184849,262144 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,5075477417517532514,14765689906999958371,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2252,i,8984973486977442879,1997176679522669384,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,15653888701481400476,16583796636535169257,2097152 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9773193812251415199,6879359496481027126,2097152 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,8922967907792401659,1470271984698144681,2097152 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,5073925828498962536,3149928144332690549,2097152 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,503017710807373121,194802109853085516,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,12227720585228912224,11858666603807474590,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,7415846586775971831,7760241341595311049,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5724,i,5370465962188151342,17378490128437061653,2097152 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,9107094196191133647,4490356739041654226,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7826721586392500171,10809936770455297311,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,7826721586392500171,10809936770455297311,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4776,i,5250129272269659617,16979894581826577784,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4760,i,8084250873744802699,14638585428963397788,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4764,i,1155828928882374438,18318040068994400717,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,9534279407623119770,9484895049482662724,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,17033330708184654223,3535259614450023536,524288 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6768,i,12953175226802941426,11186214220449406320,262144 --field-trial-handle=2676,i,9256565597431378503,14485324736805152391,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c7537c2d364d30bde32bbdc7374054c7c7f14bb0d98309d7abf594d0c10888e2
MD5 927bdd8f4d534e7d8a861c98896fbad2
SHA1 fd217ac93fd23179a4b0f62711aaf9127f09955d
SHA512 a491711e07c73264a22d36d1ab3420ab5ffd4af03bdc420c3241a00a25c67a904157d5d99d97562590637609e67eca5365fe1441533e808a78dd77dab4d89b28
TLSH
T198714E3701C940C2D786013A54F26284F8BD82EAF53FDF5110F7AABE4B93711815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b002.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b002.TMP
Size 3KB
SHA256 23aa895de1206e6eaeda20e63cdd1310ca970ed12cbbe8ac3f659404c8c8cb7e
MD5 f298f3fea41dfb3af5f87614aae51e78
SHA1 27861a41044f3bc630091c2c3d8b4e057ba58d07
SHA512 41cb9cbb786f6984d16fb5c741783def59c65a44b23db33f9fa71b0f65031d495caaed4f4bdbfe84abe8047545ec99f0118809d6feb54a8594aead111d9a84c2
TLSH
T1A4714D3701C940C2D782013A54F16284F8BD82EAF53FDF5110F76A7E4B93715815A17B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bf360cf1a96b14f97062c94fd9074db644e91e80f19d9bb99ecbc960c3ed5d2c
MD5 33d3c39b0fc720abe7e68b023c2fc0bf
SHA1 8008e157c76e2813df5a5e17f96c6f5e45878ea1
SHA512 c8ff414c8140c6d48e3e6ffa7a170e7c4339743901cc61a6aae14cbad1101b6d952449dcb7117548ca5e285fb1800dc0ea03537de944175b8a8ee4880ca348f2
TLSH
T1A21189F783E5866E8A0157F0AA28EE2BCE1D0505832C7C29C9D4FF2B97E3075E10195B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 38a417016acbe458d9ed79b72f616b610b5e3b3b32837caf7d1487fb0afda556
MD5 b5d5254d9c34d05951a78a68c84284a9
SHA1 9ab94e0f8b4f1844e36c14cc8c7b825a2c8c85f7
SHA512 6b22e497201a5460f20e6757d7a6f22e3ae3d606a26eab3b82ade601e5966276443c932ec3c0d34f9fe6435584dd8377cded631f9ebc7b1ce72ea4796776715b
SSDEEP 192:sxZqRvyM/jK1Ml8UQM97/fIsn2PqIdpLHW6+WNGYz+jk+4Ig5lJ:sxZqbqK7/fIsn2rLHbGA/V
TLSH
T18852F8566A349977CCCBD20DFA457F63D6F9547292900E44A9FCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3ce0a05376979100a191a5969dbac0d8b557270af2d143b99942e47715085e5b
MD5 149fd40476cf0785c284d148cd5dc757
SHA1 e3b5b5eb08cd10b11b4281f65035094794e7c25c
SHA512 708ccc6cdb7930efbfdd223d7f96499a6085b482d7b0245aaf8b8aa82c459c346fd4a0e620e68941531cbafc23afe2121dbd684a2e54ed9ea991f6923df3e58e
SSDEEP 192:sxZqRvyM/jK1Ml8M97/fIsSFPqIdpJHW6+WNGYzcYk+4IgrJ:sxZqb17/fIsSFrJHbGt/9
TLSH
T13B42F7526A34A977CCCBD209FA457F63D6F9547392900E44AAFCDA1C04E6BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9598ca3246896d4b061e18960dfa1b01669e6a49d48867e733164eca1f4db33e
MD5 f8f8c8182a56ecca63dffc7b626822b2
SHA1 fe8aed521fc82102cd39740e3568b56acddea8c5
SHA512 a3769bc5eb0034524a364613aef791d96845b26d6cd7165823c1fcafd0dc895a22f65360369a0f021321c7756b632336437641ed6740054630069bdd722fd0be
SSDEEP 768:8zW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjfroIUijiYJ:8zW7kf0Wvqidau1jaa5LA3jMAJ
TLSH
T1A3D2FA3B680CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594da9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594da9.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 584205b2caa9cc60fc7d31b4a81eddf69bbd2481acff29b6015440c3d01e5ae1
MD5 2eb6ca34e651ec43be54d2d3d25a4b5f
SHA1 05fa769f3117213bfe2a5f38bc0bbadd2a73574b
SHA512 db9e0b8b79e52bf0ff0aa57e78759fecc218be0b589a5449be9d4cffec6b412f342446226a7286db35c7b4bf0930e59cf40eda669c9f5a0c819401f4fd392a0b
SSDEEP 192:urLsNQU8QPjBb6hQmiU1dFi4aGBPK7hCI9jlEHdNmBqrU8:esNQU8w9bAFNbM2HmmU8
TLSH
T1EF323C766CB89C3A5DA2A280F44A37135FB5512BE6C46F54E2DD3B1C01EB39C131B91B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1e30e3bacf565d61a05be051b78b98690cbf6513c9533d51bb7aa96cb7b8c216
MD5 cb6a306d350e57902b9258d346faa16c
SHA1 5ee393aa1dd88e8f26d3987cbd631e555d8edec1
SHA512 2e48a04b3457d87ac8659624d0f1a2255f47828747c8672d016d5ae959cc1f32299ebb24884c389b41110a80284ddde05530eea724d167db0d1305c40558fedd
SSDEEP 384:HiFiZcI2zsNx8TUNTUlIltw9bAFNbM2UmmBeRs9JKgqijUqUQn:CFQGAwgU9w1zUmmTjKgqmUS
TLSH
T11EA28E735CA49A3FAEB6AA81F58933138FF55067D6C0AEA4B3DD7A1C019718C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e900c565dbf3be74450f93f9c4889cec479768f5590fce3953ad78ac68470229
MD5 b29393feb0b25e3d1ec5919247321419
SHA1 5cab83a29deab0e0673500d5c653d3b277bd3ef4
SHA512 b035bc319e6a1b5302baa7c1a067795331402cbaeca7de4141b66e2f9e53dcdcc0b588fa1ede5eb60fcdd1a5f1623ef64f98794d48a9bb9feb9fc396c6f12d36
SSDEEP 384:fZcIhsNQUtw9bAFNbM2HmmBeRs9JKgqijUqUQn:3hZ9w1zHmmTjKgqmUS
TLSH
T1EC92AEB15C755E3A9DB2F181F48937135FF8802BE6C05F94A2ED7B1D02AB588131B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8960f2ee88420848552ad933bda1264c4a437c63cc9caed2e62c1ccd178164d3
MD5 2d8fb623c3fd2db231e98048c1a04eee
SHA1 6d00e5882a6904aa821fcfc54d85e073ecbdd9f5
SHA512 cbaab31fbfd26cba5d48247751aff3eaf3d415ee3092857471f0fbd8e3f0c4576ddb3c7bba2922c2db40feb2f26313a1f335f83e57e509999c95aa9406ccb989
SSDEEP 192:MONo64BAQmiUyl1kW5GBPK7hCI9waDmtXU6:MONo6eA6mWQM5mNU6
TLSH
T100020A396C796C7B9EB2AE44F48637176FE8117BF5845B44E6E82B1C01D764C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48171eef8c1de60db0f8249026616a6e0f815341062c4718b0af7e09d5c7ccba
MD5 c0b58493fc27fa6ca77a504b4db3c955
SHA1 33eee37f95922609ee5ade4b0b8f46e177b5fdef
SHA512 35ceead320b15a8165ee96b919d77e9bd614bbff2e92c52c33d6d0bd2e47490b859fdac3798f64fda209b66930a77c852926694bced6dc91ee4e99b62eeda5ae
SSDEEP 192:GONa64BmQmiUy8kP5GBPK7hCI9jlE6WwmBqrU6:GONa6eC2PQM24mmU6
TLSH
T135122C766CB8AC3B5DA2B580F48A37135FA5512BF6846F50E6DC3A1C02EF65C230B517
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 db5d216ed2513f310971eceebed9e4ab99a412eb70bdb35ec74723bfcf7bbccc
MD5 0b59d13df5881d7c059aea027afed62a
SHA1 b6ccdeb655206cd5cad6371117e839c36ae78656
SHA512 f322bf0bbb76dcd0ded66610498e533c18ee21bc9b8837347f1a85eec334fde2b55fe489acfc1474290102549b4748440f80ffb6d9f67cce88cc7ab0af1d63d4
TLSH
T133413B58A6F91144F3B76F5AABF6A87D487B79732E0B945E10010D4E0A22B40CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download

OpenSans-SemiBoldItalic.woff2.crdownload

Path C:\Users\Admin\Downloads\OpenSans-SemiBoldItalic.woff2.crdownload
Size 57KB
SHA256 2ae4362c10194e2a94d9a2b5b1983da99f359f25fd2421d847738b77913a83ee
MD5 4838762613130ab62a2879f5b5c89081
SHA1 ac223520a33a5458856e87be5e3fc5305a85e03d
SHA512 6bdf24a87c71a0ef2db2ec355355229f7c377c6f1630e7cce5ad1b74b519ec187e10b867dd5ae5c362608ad4cc88a27ccd979a2502457890a9de8be2747f1c29
SSDEEP 1536:bGGb+TXP/RmHLyoTFulFLQI2+cZiAekOtrfgQtiseOp5toiO+7JIxA:SRTfJmH+KFW9vb+s9fgQAVy5toiNT
TLSH
T1CE4301528542D14AD049E47E48F53FD00DBC1BF5F2455DD09A23EAECC8B79A820ED6EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download