686f4f2e945ab537b18089f7f71a12c0a38be58fffed0f8f8b81102406dbd165

Analysis

user interaction
yes
max time kernel
1048s
max time network
1014s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 12:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mlp.html
Size 517KB
Sample260804-pwcd4aba88
SHA256 686f4f2e945ab537b18089f7f71a12c0a38be58fffed0f8f8b81102406dbd165
MD5 57bd30bc478204e737f69abb43e1364b
SHA1 67c825cfdad246be757f061a1b50b3bfcb9f13c0
SHA512 efac0cab62b0374a2dfa4386d6dd26256d543c0d256f25e93dbf0c006ec0a9553b8fe47fa3b6b70ed1a46de3d4377dbf734774969787adf836cce71753727c06
SSDEEP 6144:NBDf8LhZuSCuf1m8Ws4Gv8j0EZWNf66Mv8sua0I/0UJo:bD+hbCASj0js0HL
TLSH
T11EB45A96F5A03073127361B9E1BF660962728123F5458880F69D9AD42FB4BCE4E33F6D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4856	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303208346082406"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EA6A76F7-C5F8-49F1-A8BE-AB8AAD5F90A0}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2368	msedge.exe
2368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3644 wrote to memory of 432	3644	msedge.exe	85
PID 3644 wrote to memory of 4856	3644	msedge.exe	86
PID 3644 wrote to memory of 4416	3644	msedge.exe	87
PID 3644 wrote to memory of 4420	3644	msedge.exe	88
PID 3644 wrote to memory of 4416	3644	msedge.exe	87
PID 3644 wrote to memory of 4416	3644	msedge.exe	87
PID 3644 wrote to memory of 4420	3644	msedge.exe	88
PID 3644 wrote to memory of 2920	3644	msedge.exe	89
PID 3644 wrote to memory of 2920	3644	msedge.exe	89
PID 3644 wrote to memory of 2920	3644	msedge.exe	89
PID 3644 wrote to memory of 2368	3644	msedge.exe	90
PID 3644 wrote to memory of 2368	3644	msedge.exe	90
PID 3644 wrote to memory of 2368	3644	msedge.exe	90
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 4384	3644	msedge.exe	91
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 5064	3644	msedge.exe	92
PID 3644 wrote to memory of 4772	3644	msedge.exe	97
PID 3644 wrote to memory of 548	3644	msedge.exe	98
PID 3644 wrote to memory of 4772	3644	msedge.exe	97
PID 3644 wrote to memory of 548	3644	msedge.exe	98
PID 3644 wrote to memory of 4956	3644	msedge.exe	99
PID 3644 wrote to memory of 4956	3644	msedge.exe	99
PID 3644 wrote to memory of 4956	3644	msedge.exe	99
PID 3644 wrote to memory of 3080	3644	msedge.exe	102
PID 3644 wrote to memory of 5508	3644	msedge.exe	117
PID 3644 wrote to memory of 5508	3644	msedge.exe	117
PID 3644 wrote to memory of 5508	3644	msedge.exe	117
PID 3644 wrote to memory of 5672	3644	msedge.exe	118
PID 3644 wrote to memory of 5672	3644	msedge.exe	118
PID 3644 wrote to memory of 5672	3644	msedge.exe	118
PID 3644 wrote to memory of 5288	3644	msedge.exe	119
PID 3644 wrote to memory of 5288	3644	msedge.exe	119
PID 3644 wrote to memory of 5288	3644	msedge.exe	119
PID 3644 wrote to memory of 5216	3644	msedge.exe	120
PID 3644 wrote to memory of 5216	3644	msedge.exe	120
PID 3644 wrote to memory of 5216	3644	msedge.exe	120
PID 3644 wrote to memory of 5632	3644	msedge.exe	123
PID 3644 wrote to memory of 5544	3644	msedge.exe	124
PID 3644 wrote to memory of 540	3644	msedge.exe	125
PID 3644 wrote to memory of 5756	3644	msedge.exe	128
PID 3644 wrote to memory of 5756	3644	msedge.exe	128
PID 3644 wrote to memory of 5904	3644	msedge.exe	129
PID 3644 wrote to memory of 5904	3644	msedge.exe	129
PID 3644 wrote to memory of 2368	3644	msedge.exe	131
PID 3644 wrote to memory of 4536	3644	msedge.exe	132
PID 3644 wrote to memory of 3060	3644	msedge.exe	133
PID 3644 wrote to memory of 4536	3644	msedge.exe	132
PID 3644 wrote to memory of 3060	3644	msedge.exe	133
PID 3644 wrote to memory of 4248	3644	msedge.exe	134
PID 3644 wrote to memory of 4248	3644	msedge.exe	134
PID 3644 wrote to memory of 5452	3644	msedge.exe	137
PID 3644 wrote to memory of 5452	3644	msedge.exe	137
PID 3644 wrote to memory of 3504	3644	msedge.exe	138
PID 3644 wrote to memory of 3504	3644	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\mlp.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcf538c188,0x7ffcf538c194,0x7ffcf538c1a0
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,9826876420274779401,12085815010256986440,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,3719616294429521479,2375762058789754445,262144 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,3213623945331738684,5696727601608047611,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,1448717375977453157,1978447607101989256,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,15430689206558080889,15168153988063733292,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,648446495270065572,4120203515891331401,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,17577902943462282154,14307547837681503066,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,1286675239771288474,13011928800668950133,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,1443698634271395159,13338778269766237299,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5848,i,16248671864229858475,15015335479654739463,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7251862217352712362,1034609696585660561,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,7251862217352712362,1034609696585660561,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6624,i,1807456962319148349,6904515533276955760,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4184,i,17244455144638925174,2062396375979858025,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6312,i,1610932673180444285,13455781354453816372,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5784,i,7400377763254471551,14269717584789692634,2097152 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,14040953681580183029,9210979275912776687,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,13862303695579791887,8090967639592874459,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,6674431002589705013,10199913106592222713,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,16413219457195822234,14288488711036737677,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,14412318226100194833,11482071703753213672,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5984,i,14603161642363259427,15124679207726863406,262144 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15492795556314905072,5636024692580701260,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,5047523114578041844,2349060918794740069,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,18148849529463249675,3298159135430278783,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,7729437678463448677,13804724084033889449,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,3373720890810977303,17462277317663243987,524288 --field-trial-handle=2380,i,15800581499345845990,13976917487939785508,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:3504

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a2e00bbd11a04b4324fb5a2bc77294ca5ba08d8cb094ba6c285b1e9a025188ef
MD5 c8f712fa798115fff5cffcbca23797cd
SHA1 a58c0654d45bdeb65791fc617724ae08d3fc5b2a
SHA512 346e6245325b1adad9f7efeb9f6ebef5e50131e687c911e0a8f29b8121a52b16ec47d2b0f70495dd5131197bc328025842e05dadedea01887a60cf34180705b6
TLSH
T192E0268645C8C3BEB601A44B726E675C82C2370F9EC8EE9E2B04C8C47146244A382EA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3a56802dd2bd331f24dcafafbb8170c07c69fa5ef654b3ef4f0c12bbcc571e1d
MD5 1c17bfe01309efdf805331917000d111
SHA1 cf6c9710b4ada3bc04e56be991e9ecd9a52f19d7
SHA512 95b658734b7671eba846ba3de70023d79ab52b7442c692b010c6512a8eed1a32a9ba665eb3b9f55db2d3f39a1cd5cd08f9041e96f19146d7528f12a89423b8c5
TLSH
T13BE0268944E8C2BEF704A4C7B2B8776C82C0370E9EC8FD8E1B008C847047440ABC6BA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d6
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d7
Size 405KB
SHA256 bb90ac8097da7c793676be5885f5cf00b9e5a27e30a878296c59d1b4ba27bb62
MD5 0af3640643657932c2b1de637482ecba
SHA1 363c3fce3a60b5a7149203ef63197f6abfafa9cb
SHA512 cae198a924008b8171580f9753b9c89e629875359b354ce62707e97429dbbdc00121af35aa083c14944cf274b60c1d103a123df475b8c5914834e1067ab5273b
SSDEEP 12288:ube26/DCSTYo5pgiLGQ8ktPC5SRP8l3xri6gXc:uK26/eSVx31t65Sp8rVMc
TLSH
T1AA9423D595D7CAD1DD9B04E6CAFFCCC1983072360E0CA1EE1B12B9AD493F96469B2309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d8
Size 67KB
SHA256 25b05fb02fedfc6cce6cbb542030d8ab4e66c10b4d7ed8f3f309e7fea4ac9963
MD5 c6d0f9252d7d9a57f18b99cbdf8083f6
SHA1 fd0c5ebfb986e45d9fbc2ee61a563803e6dd4066
SHA512 745f28a5222771f269e95f323e4161fe2b9cefa2eb31675dd2b23cd33508734cff9c4d4290f57f1221d9ff953d834e2a008abb31df662d3720e23f35f2872662
SSDEEP 1536:QH5HZyBokKeTWIgCgEP+MuMtoVJDuUEMNIbU6eVKwuWvz:Q9Z1eiIgCgEluLfIbU6qfuWvz
TLSH
T13A630218A5EBE63A4B1405E4476A804F37154FBC20AE2E6F88CD760D18F17F59EB8C5D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cad6fbc920ff78fb416d9cb148c315d94fba32317201e51caa203b0ffb40b885
MD5 47f6c3d70c1bf1a171ab3a2818a3ce2d
SHA1 c9de32e59f4f13219f18e1e670c15cd131414829
SHA512 27007095941006402de7def7aec1f9f56fdb6670568ece9498c9394881b0704193ba9f013b789cbfe17d890f51192e575608c1527418ac5e16a9060a722510ae
TLSH
T1B981B7380E6F00B1F3B11FF2B3D14B44347E82EBF993BD9A62806A70780A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6daddd15ef8ebd7c738c3f3c231ce5a920e7ce51dc9d835aea3cd180efa1c58c
MD5 e10ed14fa8bb829561e8d2b04c9a495a
SHA1 80468bb2aac6f6b58dac0c479de0aa76eece979c
SHA512 3b2f8ee8e062b1045a5cd4e655eae9100dfcfffeae663eed2cc6c08b13e312e7dfac1ec22564bdd0252598e07bd78f5b2a533957adb7f1f190c4103c0c30096f
SSDEEP 96:OS6ZlbVIf6XlXChrCyWesHDWMgDqip9KKyb1nBR6pc:IZlbvlCXWe1p4Kyb1BR/
TLSH
T115E10F385AAA0673FB7C0BF163D24F543B7A51EAF8477F8712445AB0790B2D262DA0C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589e9c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589e9c.TMP
Size 3KB
SHA256 64403cdf32ac951d3fe49d14d22b76e06d5809e70cc4ea4f4a73f37b502b0958
MD5 62cc0f3d7f8002ff9e0f2dedd206cf77
SHA1 010d6770909ba23f7c01e6bf69afbfbd656be5ef
SHA512 976eb04cacaaf6b7c0728878e7c96ab4f37b979a4b6a180f85af3b93d63fc20fe22cb2fec941498e40125dc3f67984c86eba6cb9568ee7a5c3d3e5fca9db99cc
TLSH
T16B81A6380E6F00B5F3B11FF2B7D14B44347E82EBF993BD9A62816A70790A761B2C9404
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c1df759-8e73-4aa8-8249-9b85586b78e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6c1df759-8e73-4aa8-8249-9b85586b78e6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 23690af28be928897e876df5e3d69115373b53052ad61e38f0a41588101068ff
MD5 811415e91bd6a0cf34a43b5a8ccc336d
SHA1 572f7920890e821f0290bbc4ecfbdb470b69c146
SHA512 3b66839b37c5a98f332dc4cbc4b6a4ec6066682e4194debe04cf156c92e0ef277ae56aef382daf7a87e3d7372cb48aef1b7bbc62add5ec3daea5e5a3650db7ca
SSDEEP 96:DXOZLwlyzBhiIWcZc5GORbZGZ/twO1bzO:D+ZLwly1hiIWcZc57xZGltjbzO
TLSH
T10A91DCF2C3E5826DD91156F0AA187F1BCE1C0956436C3C5A89E4AF4BA3F24B1E151B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 fa2c838f8618a581f1c7a7494baff77ca1bf98ed9fc61873af57095d1157f2de
MD5 b8777cb465748861db07a18c88b020f8
SHA1 f55e455ff02144806ca02957636a4f2798847c66
SHA512 4be9c5a64c3c28fbc22058f76eb4c732556e2bfb607a12727553a8767394907710efcde5be4bca19c096d83e30a74016affe3b3b2560d9070f0dfbda9b1ab649
SSDEEP 192:sxZ5QUnZRxsyM/jK1Ml8UQvWO5/f+s43YaJWAVbCJdp4MvHW6+WNBo1XYzyBvvIN:sxZxnZcqeO5/f+s43yHtfHbeXpV2m0x
TLSH
T14A82E612A624987BCCC7D518FA317F62EAF91463DD504E5CAAFCC91C04EA6FD121382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cb2360c8c5b073900c003d048b1b82221dad57a2bf80a4ded87a1255ed6b3f5a
MD5 6211b7ac0c51b61968886ab00aea42d8
SHA1 8364ef213c8e793865de88a21fb6fea07e7995b4
SHA512 11c1e8cc50aa8c25031ec9c130c7e758314580c5df5fdc6a53d71db7d5849a41055817bde4db74a17e1cbc107f07b0465cd4f4f0bc18685aed51fcf5f35b4ed3
SSDEEP 192:sxZ6RxsyM/jK1Ml8Mk5/f+s4VYIIdpdvHW6+WNGYzQSvvIg5tEJ:sxZ6cM5/f+s4VelHbGKTI
TLSH
T13042E811AA34A97BCCCBD209FA55BF53D6F5147292900E44A9FCDA1C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4c92360642b12194891c4c92e486c5c672cd5e8b17776a0db11c39dbb6c8a829
MD5 d9546312966af8780f498dda609cae8c
SHA1 2854f8ed129eca066dc34ac8f56c3d940e76e35b
SHA512 bc5f2a39bbe11c74a4eee59e54f756d26f21c7cbd9071cd442391c35871606323bd7ac715d01a094fa9113ac446e3cec7a2b6c17d420e5539c7e6eac2b6f80a1
SSDEEP 192:sxZURxsyM/jK1Ml8Mk5/f+saV8IIdpd9HW6+WNGYzQSvvIgrJ:sxZUcM5/f+saVKvHbGK9
TLSH
T12C42E811AA34A97BCCCBD309FA557F53D6F9147292900E54A9FCDA1C01E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 04804e10f134667ee3951008a6ea66d776d64561aec9d8bb0a3c68bcffc8df12
MD5 77b261685add6f4352bc28ba74fc8f62
SHA1 9edeed850d3bd1e86ff4362156537471e5a8e202
SHA512 8e540a66426d735804b4bd61344f56e9e25ec1a3ba09d1914c8a184a1ffcfaddf8aeb0c4d1d85c6bde42802f4e96ca812ccbc428565c76b6b87c73ae36b211a1
SSDEEP 192:sxZ5QUnZRxsyM/jK1Ml8MWO5/f+s43YaJWAVbCJdpmMvHW6+WNBUa4/Yzg2vvIgp:sxZxnZcuO5/f+s43yHtZHbh4/4Vb
TLSH
T186720902A624697BDCDBD218FA017F63EAF91463D5944E58A9FCDE0C04E6BDD2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a8eba61dd8336337f1d61fce9c00ca8cc4d35de4c4e7bbca58bd1e79091a568e
MD5 53549d3546b787ffa44a9c6e5d9d6210
SHA1 918f0e17557bab224409c1ead9bdbe95b1282958
SHA512 06ef283ac925c3e83a25d1a309013b9e98984d9607596cf0903998eb407c7995a64db78e36c3bb3ad2be4c2cee65e067c4fe55aff64f9b4d771b88cad75f21ce
SSDEEP 768:H+W7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjAroIJ0DYh:H+W7kf0Wvqinau1jaa5LA3jL4h
TLSH
T146E20B3B680CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 864B
SHA256 76084d1772fd6216fc60385a60e4f8484cbe8d5d1b7282ec569ee622d4ccd830
MD5 9aa44387547b4d8d38d3a62ccabb4bfd
SHA1 fab8da3773623b2dd41c33916370b5db913002cb
SHA512 3e5c545c836a6ec57264f9a9e48d23b754b1c8a986275c02f7a6eabee32d1e809f1e8296168b70c46b87308e45b3c4fbe5978d59d70a37a0bea021bf8acf647f
TLSH
T17E11D3560EA18D2FD95901B718FAE0E4B33159DD9321E5679C1C1A762C6734968071CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 b742b5565f2655debcdd5f165aebcc2da880049bd5de58ba82d223280966f02b
MD5 02eeecd8655bc5b4ba1e9b4e0444d41f
SHA1 c437e054a086fab151f8c55a5f2b042521482c29
SHA512 f641cc6fcbeb029d4aed16bfc70342d29ddf3bdbacf232650c9caa32f05350ed2a894062dd870492592c9fe6cbeee48981c71a4e8fe1a0adc860db6f936f6f9c
TLSH
T1E951F84E8C8B1DAED9AD04B26CFB1046337A58EE4649DA0F669DA0303CC33692E54105
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a2a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe58a2a4.TMP
Size 864B
SHA256 ac9b16d57e8fbdd71021cf279be337fd76c54add36b030d829622e29b002be4c
MD5 225517a8f3e583e62ce9b5fb6a4beea8
SHA1 2617ce38e47ff3568dbf19b38b69aef063b5041d
SHA512 daa55021f3da45dee7bb8be3a5790b26d5744409eae82c1e788bfa44be97745eb2a35ecd2fe1008c37d66bbb3cfa29dec4f4b3ae9c70e857bfc2843e5f919bc4
TLSH
T13611025A4B924E2FE884517B1D95E0B8F3310C009312F7A3A42D193A5C7A7C959070CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 bb949aeac2278f0c4d1cf87b52d7f681f47573101a3d8f4966a819f36a282c48
MD5 4c796927e2d2b7a39a61729af3bce15b
SHA1 716e40bcad45ad48ada0d74f2039b4a432596ff0
SHA512 80c421ae07ff8a2be76a236500a51756ca4a212e49b5821c9393cd09d7f44ac59730b9f1f00016d31c0e58de5e9b74b4b5725c7b6276d25c7db520f25c8fae4f
TLSH
T141A002118BC0821AD01B51F2165317511304C8902100574740D15084CC544918E4510C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc577b94-5e5d-41ae-97a8-afa364edec75\index-dir\the-real-index
Size 72B
SHA256 b7b1f09fb4815192a041bcce63e4ff3d89681b67dcf20dbf968abd26eb1d4da5
MD5 50fb8498c9b7204b45bd7e7f1d769159
SHA1 a733faf5930f52c7a690d09a2220c44b69fa006f
SHA512 a9b34492a9f331a54581d7aa824be5bcfdda5eee158512fc1c179b7418a895f3a77458e50d92ed86fdc6092e5c1603564274227b40347741876be966a19177e1
TLSH
T18DA0025452C8C702C11312B426A6C24932D14A101601578DB1D00454C8555D9896544D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a58297d73c47dc91fd6b9bbd43727d05b7dd64c9cb376b8961b6e5155afd3838
MD5 b045c7939056a9a4302c9e6a2429900c
SHA1 fdc4ef0f74479b24b001448edbc9382f444ba384
SHA512 6577c8a01d1db0241f0a8d24750a56a91f40cd04586af990e07673ee613b71c0f95724b6a4958a97769e6b85d512c5f651218c82656314d6dbe22e14bbf7b668
TLSH
T185E068BB2DFB1824AC6F87D138B168A0818538188500EC4E3027A28730F2352280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 255f9aabefae81c942e385b6cb24e840178d0f64e9a5a5887bac3ce73fd73007
MD5 0026bd16e078b1940a95116ad1370b80
SHA1 fdc4aaa6bb2fa36c70c1bb537172f67c8fda4a1d
SHA512 42552d584fafc566f66123cec2a011f534c24c581dc06057c865d590e72ac178cb897cf469dc41f6ddb2828b72dc291450c4393adc50457bd03b88df7cc496ec
TLSH
T137A00235CA958082C00022709A6302C8EAA08CF8461623258AAD0454996C5814996148
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f940.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58f940.TMP
Size 48B
SHA256 4f9b303c721637a203eaabfa9376eab9aacae6d5dbae8ae92265caf0e036c814
MD5 2935f8865ebb7db56505069d14d5a220
SHA1 bb294f2e3d6e55e5aad37613571da9ba19e93695
SHA512 feb279e293a535cb7d68be6f07903bcc003d2812a3d9ec57cb7c7ade016379437fee3f4b2773a17c4eb39c75fa5310e727a39396704e76b703b6159bfd8852a2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3b016cbf140874821fa9e95abe3a7f259c1ca0b396d01d23df6bcdb5917fa63a
MD5 064e2ab032712ee4f3bab3f4a0c97047
SHA1 faa81270607ebc80f88cc7cfdbfbf0d610c4dc10
SHA512 6357d60e704070c3415a3d120ab40cbe590fc38b6e7f0d94f3d679690883feae412c11442c70123520fd2bd12916622ec22bfbca22ac703f35d6f7a3af329826
SSDEEP 96:KIbCKc061e6UccuKMf10auKsb0IuQCa34qv+XeKEcXBa1hLTD2JTk9Dh2KbTDV:sCFpGBa1hLTDQTkhhxTDV
TLSH
T1DD916706703F060139BE2808A675CA365E4272673515A8FFBBB950631E67E114EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e52eb585-7a3a-4341-bfd2-994a58416514.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e52eb585-7a3a-4341-bfd2-994a58416514.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 48669923bdd9e3f297ec037bfd2c42a824971887be2d73cc8ef368a52204b9ab
MD5 38a42bad58eb1f60bc0b41bf3609f669
SHA1 f860871c1a2dd6e21a0dc49b1e78917ca6bfd971
SHA512 e4de6e24726fe29d0ed68911b8446abac79878219def23e559235df954ddc9618b5f303eb4e2029b4894ed09afd1dd54c97c31b1157be84800f3160a0ee8a1e9
SSDEEP 192:MON664BAQmiUyK1lW5GBPKXo+FdGJaraDAAhLU6:MON66eA9DWTdEaQAeLU6
TLSH
T1EF02E935AC786C7B9EB2AE45F48737175FE8113BA6C52B44EAE85B1C019764C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 fd76afe8c1f674841325943a690f28c0579ba9b3e174c6873f25592db91cca8b
MD5 1ce17c35365823e28d3752f2cdb7e8c1
SHA1 b9cc614c92177fa767018539447f5d5836b1055c
SHA512 b87f9d66fdd15c3a92b55290d06e16ab8ba51ad99fc7c087e609f64b8ab122fe659412e4f8b41ad3c1c0e7a8ae78c6c8fb42e630b5c5e13c768fc552055c0846
SSDEEP 192:uUm+xasuheOwQxMGsNxwTF27e/VBbulBfmiU1biJ8BaGBPKXo+FdGJaV6FC1SJrR:KZcIhsNxwThjbJsJ2IdEaACEJrlAC5
TLSH
T1E7728E719C74AC3B99E6B141F4823A138FF8903BA6C86E94A5EDEF1C01E66981317C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 eb99ac2cd5e6642dfc82349f72624599eea2abe057cdcd72212883a634959297
MD5 36a54425f76ac016ac0e58bd876b3ca3
SHA1 2bef3f9a3a6e55f14cf0c90482397e33490bc84d
SHA512 28b206f58fbf25b0f82dcfb5571517254c042be4d6bfec0e4f66758a9726e0a100db79e16a651f9489ce10605a764b42c7d7429489d3b644f8657bf700ee5ed8
SSDEEP 192:u8m+xasuheOwQxMGsNxwTF27e/VBbulBfmiU1OiJ8BaGBPKXo+FdGJaV6FC1SJrR:GZcIhsNxwThjbJrJ2IdEaACEJrlAC5
TLSH
T124728E719C74AC3B99E6B141F4823A138FF8903BA7C86E94A5EDFF1D01E66981317C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7cc2c8afce08da011d631cede0b88480b6173690cde29061ac6cc51e18f5e005
MD5 6d0cb26f5d2c0af7caf66f6e2699cd80
SHA1 b7565b973cde916d6cf65be5f19ba60d91f1b8ad
SHA512 4ef390167f133ee18f999aa3f271463124f2824f2ee395f92cbc2b8643891b6aa601ce7de156220bbebfa44519ad30e3ee20980bbc52c8af6b9209a97da8629e
SSDEEP 192:YONE64BPQmiUyplI5GBPKXo+FdGJaV6FC1SJr0WwAXqdU6:YONE6eRcITdEaACEJrKACU6
TLSH
T1A4122B359864AC3B5EA2B541F48736139EE4423BEAC57F84E6EC6B1C01EF65C2307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6c6e7480a42e7f26243812f414e87958c6605956f773f0fe971bca2714bc798d
MD5 320b10eca9a47ed5ba0479e64b474031
SHA1 10982dee3e29cbe68f5ba48f70b5e28ad747f18a
SHA512 a16c39ee1a0da7e6d386c36122c04b0679dd8dc9fae0cbe027414ba95e314a448d3215778113af344826b5a74492eeea5a9a51c290d923dbb9f90f1e0f9fd346
SSDEEP 192:uULsNxy3Q27e/VBbulBQmiU1ain4aGBPKXo+FdGJaV6FC1SJrpdNAXqd6PG:lsNxaYjbUP4IdEaACEJrlACJ
TLSH
T184424B359C389C3B9DA2B141F4473A139FF8916BA6C82E94E6EDAF1C01DB69C1317816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff2ea3df-e1c9-4a20-a8e1-98091bd7e9e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff2ea3df-e1c9-4a20-a8e1-98091bd7e9e0.tmp
Size 19KB
SHA256 aa01373d189e05e50122b6a32da97d1a26272a332917bae50870cd7e6577b827
MD5 dca0e438e48de0045277d55cc44e3996
SHA1 5c0a91ab64e9153fd274f277fb94af44a92621c2
SHA512 abf0174c10eeed1debf0cf00d863998f38f8e136b6542fbf201f93d788a6005fa27abe9ebefd914a70aa05c1093c97daa20745c9654c446ef596e71fd2a5de27
SSDEEP 384:diFiZcI0zsND8TUNTUlIlwThjbJWJ2IdEaACEJrgAC5:UFQIWwgw4JLyhgd5
TLSH
T157926C728CA4D93FEDF6AA41F98636138EF59077D6C4AA94F2DDAE1C01A719C0307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 22e2a94e730191688fcdc18621bab5d733f94be35ed3723227695552eb78329b
MD5 baf38a22ae58865c87ca24b10c507018
SHA1 afa078305b4b29f38b761a4395ec1a31038e18d3
SHA512 7e310ede2de9d60396dd9b141e88a7a87e5225498d2812356562adcc65518903d02eea1294b2c1915d0dc69923d2a0aa321273b36f88f79428ea7ceee7beee1a
TLSH
T190410558B6F91148B3B27E46ABF2687E447B79772F07D46E00110E4F4B23A41C9A2737
MD5 SHA1 SHA512 TLSH

Submit Download