hxxp://linro[.]com[.]au

Analysis

user interaction
yes
max time kernel
898s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 10:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://linro.com.au
Sample260805-l2ejvsvcpc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1860	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303976957668083"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{CDB46A04-9395-443F-B0AA-9A0DC693DBE3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4296	4632	msedge.exe	88
PID 4632 wrote to memory of 1860	4632	msedge.exe	89
PID 4632 wrote to memory of 1696	4632	msedge.exe	90
PID 4632 wrote to memory of 1248	4632	msedge.exe	91
PID 4632 wrote to memory of 1696	4632	msedge.exe	90
PID 4632 wrote to memory of 1696	4632	msedge.exe	90
PID 4632 wrote to memory of 1248	4632	msedge.exe	91
PID 4632 wrote to memory of 5112	4632	msedge.exe	92
PID 4632 wrote to memory of 4952	4632	msedge.exe	93
PID 4632 wrote to memory of 5112	4632	msedge.exe	92
PID 4632 wrote to memory of 5112	4632	msedge.exe	92
PID 4632 wrote to memory of 4952	4632	msedge.exe	93
PID 4632 wrote to memory of 4952	4632	msedge.exe	93
PID 4632 wrote to memory of 2472	4632	msedge.exe	95
PID 4632 wrote to memory of 1372	4632	msedge.exe	96
PID 4632 wrote to memory of 2472	4632	msedge.exe	95
PID 4632 wrote to memory of 2472	4632	msedge.exe	95
PID 4632 wrote to memory of 1372	4632	msedge.exe	96
PID 4632 wrote to memory of 1372	4632	msedge.exe	96
PID 4632 wrote to memory of 3824	4632	msedge.exe	99
PID 4632 wrote to memory of 4176	4632	msedge.exe	100
PID 4632 wrote to memory of 3824	4632	msedge.exe	99
PID 4632 wrote to memory of 4176	4632	msedge.exe	100
PID 4632 wrote to memory of 2012	4632	msedge.exe	102
PID 4632 wrote to memory of 4640	4632	msedge.exe	105
PID 4632 wrote to memory of 4640	4632	msedge.exe	105
PID 4632 wrote to memory of 4640	4632	msedge.exe	105
PID 4632 wrote to memory of 1464	4632	msedge.exe	106
PID 4632 wrote to memory of 1464	4632	msedge.exe	106
PID 4632 wrote to memory of 1464	4632	msedge.exe	106
PID 4632 wrote to memory of 4716	4632	msedge.exe	109
PID 4632 wrote to memory of 3604	4632	msedge.exe	110
PID 4632 wrote to memory of 3784	4632	msedge.exe	111
PID 4632 wrote to memory of 4140	4632	msedge.exe	121
PID 4632 wrote to memory of 4140	4632	msedge.exe	121
PID 4632 wrote to memory of 3796	4632	msedge.exe	126
PID 4632 wrote to memory of 3796	4632	msedge.exe	126
PID 4632 wrote to memory of 1716	4632	msedge.exe	127
PID 4632 wrote to memory of 3180	4632	msedge.exe	133
PID 4632 wrote to memory of 3180	4632	msedge.exe	133
PID 4632 wrote to memory of 1164	4632	msedge.exe	134
PID 4632 wrote to memory of 1164	4632	msedge.exe	134
PID 4632 wrote to memory of 3008	4632	msedge.exe	135
PID 4632 wrote to memory of 3008	4632	msedge.exe	135
PID 4632 wrote to memory of 3476	4632	msedge.exe	138
PID 4632 wrote to memory of 3476	4632	msedge.exe	138
PID 4632 wrote to memory of 1300	4632	msedge.exe	139
PID 4632 wrote to memory of 1300	4632	msedge.exe	139
PID 4632 wrote to memory of 1884	4632	msedge.exe	142
PID 4632 wrote to memory of 1884	4632	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://linro.com.au
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffaf81dc188,0x7ffaf81dc194,0x7ffaf81dc1a0
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4532262633413145508,18373613764273199532,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5886898170758945456,5539783036320503047,262144 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,9478560347933225509,1633778785280934826,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,13766404442658656781,93983397766397629,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3356,i,11820652235012577638,9737618019033883815,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,3973217130812688484,2425630424360091834,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,17206878544090639051,16611710268831177975,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7396454172531386658,13876800690947740316,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,18316112247448732562,17173577408642466641,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17509698468642585427,1466197315737483470,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,17509698468642585427,1466197315737483470,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4240,i,15229611552287985786,7760541258068982513,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5044,i,823821065552166910,5801449073988231032,2097152 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,1369831938537740495,2680872859568432694,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,801801729440767805,5773523846242125963,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,3338078012153573646,13935417056284085025,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,11571302911574428415,11819475863170336008,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,17854066207952345801,16481866579838937542,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5820,i,15232722242731051055,2127958894747740707,262144 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,4141568871228061818,9491109706406360006,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,16519848262584439309,11594584321864438869,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,7119412611960743615,5729312394532994157,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,6082466103384461842,319453538978861623,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,13158305840387677309,2818835614935288612,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,8294408416213642900,10436169703446971795,524288 --field-trial-handle=2500,i,5128545884894000637,4088633777341644613,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:1884

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f1f27d0a6d8a536ddaab15b83cf94952862761ad1e0debd8d4927d0924f8c2fd
MD5 1df927a0cd7a88c1b355aa8576be95e5
SHA1 6c70ef6796956867911622211384e9ac754291c3
SHA512 9d943c591bc3fce9413dc0c6db327a17a44146429cb2da80ef45340f320fe5560f881aa4b0a90765e6bc6f6779b9e29256600be11bae409a5bf79a486e67e7a6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T126B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

8a69ba59-4735-404f-a4a6-40aa83e7560e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8a69ba59-4735-404f-a4a6-40aa83e7560e.tmp
Size 12KB
SHA256 39d287d57f8bbd1951ccaf87cfa16fa7262ea1df500facf02f97de1f4ce89748
MD5 771c731a8f7e654e0ba6ba5ab935cd67
SHA1 1653fa2f9fe59f281186355a70343f7957b45cac
SHA512 5ac033dba4285a533fc5902d529a80f9efa6ba9e75eaf6de56c77ae9ab54a4834b1c9fddd33aee5be6692ee6a034639ca00141fb2325df83eab6ce67af2b71fe
SSDEEP 192:sxZ7RnyM/jK1Ml8Mkb/fysR2VIdpJHJNF6+WNGYLljo+IgrJ:sxZ7TMb/fysR2mJH2Gi9
TLSH
T1284209116A38A977CCDBD209FA45BF53D6F91473E2900D44A9FCD91C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 07bcb25bc6f48967f34f1b653eec8828262fb6948365dd3903779a39da34b170
MD5 cef103787a95af046960810dd2bfac6b
SHA1 609ab4e4b978715240b07516ca999514802ec8eb
SHA512 a4d9d9e4dc346e2ebc0e3a3c921d682840f6e198eaba6207e94ef5b45e53486db10033cec09804bee9abd6163b8580b623f216ec220b23fa6441b74a19495864
SSDEEP 192:Sjc+u+++++++++++++++++++++++++++++MVLO:Sjc+u++++++++++++++++++++++++++2
TLSH
T1CDE1314642D8CB5E9F2660C789B0635C51B0770BEBDCD518179C8ED9304E89EA4AEEF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 bf25cf1a7a196ce46e42159e79c949652c9fa9de39dc25b34eb4d451997faf58
MD5 3b2784f37ac48122bc9044870f95c9aa
SHA1 d55964339706c1cd090c3e94a7b501bdafa9075d
SHA512 b5507b9b3e49b4418af3e538d1a60f38743ead773827971cd107a5bd8e5369436612a0c29232b32f7f7756ec2affc8a003586dba8b5fed308ed562fa028805e1
SSDEEP 192:gjQiS///////////////////MMMMMMMMMMMwLO:gjQiS///////////////////MMMMMMMh
TLSH
T1CBE1620642D5C79F8F0620DBC9A0A3AD11B13709EBDCD9080B5C99D9308E5DEF5B9EB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 61b38bbd798753e75bdd659ac807be730bb2ae7bc7c389c15dfe844974da0754
MD5 ed8d699a12a11b47e6959991a88df4b7
SHA1 1753d09c6280d6e893a8040b053eb0f6e7b402d8
SHA512 0793423f197ecac7dd4a6cc8f8df4f1ad1b0767464bfaf9fb9ba220a34a19cdd960a60e48881e1df85ce3fe38ed93ebf716085cb1e3074ee19783e3855a5669f
SSDEEP 192:BjLwBOBbEbEcrrUllbqhhgVwYNRRA3L9WK3M7M0LO:BjLwBOBbEbEcrrUllbqhhgVwYXRA3L9v
TLSH
T150E1584686D5CB9ADF0510CB89A0A35C51B03B0FEFDCE508479C8ED9304E89EF5A9FA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4a2cb1e2fe84b8da9230e4a8c7d1fd43848be1515406ac6672842d20390648c8
MD5 86394cde0975324d5e126d5d39d16095
SHA1 d6bfac23010cd8c28d5f426f901fb11701d75964
SHA512 d6fc8b67cfefed90ae19d0ab816883ea85340e8c177b9023d1707ba7a49c4b640d60bf1e56d40bbb0a2a6c19f5ef912bcf697cf691e28d31bff06ddac156ee87
TLSH
T19F81C589C24E1C91E76A1DF9EDF1B13130B145C80963CEC6919086FF2B0ABE94C5F407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3909408684b66edc611dab6c901c584e3bbbac50fecb6864ff631511ec67ca3e
MD5 8c227739b9b0911c2b79a0988f85df93
SHA1 3d2761daba441f6fd75091159b878a30b501162c
SHA512 8b56c2a5de75b9ef710271a47ac47e9fd85192ab840470397bd4afc9327f16309f5c7726078657dc1ca426cbeaa3162e96cdec417589226c2c306d198ebe0def
TLSH
T1B5717059C65D5C91E7601CF9EEF2B27130B284C40993CED5951045FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58532c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58532c.TMP
Size 3KB
SHA256 62b7d3642419632be61e1a0c268f2a78d883e42983e576924ffdfae71ba99c2f
MD5 180d23919970be14f3fb640f8a931f46
SHA1 752e7f8fb5b8c79faf6a411d35f14b5735da4630
SHA512 a3dde6dd9d628889f26cd528c8197a80bf9105ee23e51f6ddb034226eb921d9c46e526c00e0045f1aaa24c928c53a26b2783b9bfd81f5d84b7aa13fe7ca77789
TLSH
T139717059C64D0C91E7601CF9EEF1B27130B284C809A3CED5951445FF670ABE98C6F447
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5d0db49771aa951bdb6bc4e84ebe44a30189bb3479dfd119d97f373c3e09d0e2
MD5 b589f3551b8425f635a77e5792b3dcc7
SHA1 b9131d6caee32a983320bbd0ca3d2932d87450e5
SHA512 d3832de69c05df7350af3f6bf3620ce9859e8db0ec1e4bd7bf89819427542fa56d2cf96e0293abfefadda260f40cfcfb84f63abb40599eee21d60691174f207f
TLSH
T16831F0F783E0C2ADDD1296F0AA14AE2BCE1D0915432C3D3AC9D4EF5793E2471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e4b560fe44be300d4160f1c1e386b0022970ac9b955563eca746c8bcc4d32b95
MD5 fc9030c0692d706a3329e363b5c805f1
SHA1 3ea320ba46316878625c47b78319eb3f4b656e1f
SHA512 f716db311b94c26762260eb3f322faf9fd0fea6b5d7b971e722997e1a66e894109e12c5f76ce175e08863b7e8041ed31340195c24783ac4a62820b641faabd28
TLSH
T13531F0F783E1C2ADDD1296F0AA14AE2BCE1D0915432C3D3AC9D4EF5793E2471E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 916ded9623b3b95dc7b3d0b2233d56b0c76d07c3f78508c3fde441fa8e96df4f
MD5 7701d4778faebdae4086167aeab9f7ea
SHA1 cf111218db9f59c70984113697c7b5f923b7a4d4
SHA512 148b36814b532251f4f539c39a4287c4341c894870e3e270421d9e01315f76e822a6d61d597267011897060475385c6b570cfeab21eac7ddab8e87257b76de98
TLSH
T1D931DFF3C3E4C26ED91256F4AA24AE2BCD1D0A1543283D2AC8E4EF5B93E25B1E10154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 09ea663857a8b0cf9148c2a6ff1dc0400bfd2910bc05110b687d2746c817ace6
MD5 58bc5df57efd53dc589363f7af89c0b3
SHA1 5251d1e5a2f5dafae0a69d3c98f6680d9ddab833
SHA512 29cf751dee5ebc54b067c4d1270df0f48af480b39215731b57bbea0c9fb8efd3e93f7cf20ec4b6d59d70ba111b40bf04abdbeccbbdd260a350455fcd3d748d20
SSDEEP 192:sxZ7RnyM/jK1Ml8UQdkb/fysJWEIdpp/HJNt6+WNUvsXYLHO8+Ig5QJ:sxZ7dq2b/fysJWdJHOvXHC
TLSH
T12452F911AA349977CCDBD209B641BF63D6F5547392900E44AAFCDE1C00E2BED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6c014a21d022432e79538a073c9e360429d2deeff6d60239b8ab44d35d02a94d
MD5 2857e3b7f05532d970c820a0b91f2ea9
SHA1 82cc1c2788755897fb50c500ddaa1d320f376d77
SHA512 a775358b9250734e3c5dbfa0d44bcf8aabe23ff30f533544ff08594f80da6b02e542690cc7864a87188cebdc3f34f0a3b5a534eaca58072d3f4d80b3a9efa2bc
SSDEEP 192:sxZ7RnyM/jK1Ml8Mkb/fysJWEIdpz/HJNt6+WNUgf/YL5to+Ig5QJ:sxZ7dMb/fysJWdjHOD/GC
TLSH
T10B52F811AA34A977CCDFD209B641BF63D6F5147392900E44AAFCDA1C00E2BED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8a4d574da231a35afdd53ff34d109985d30fa6e0575d0c906670ee87127682ca
MD5 7ce11ce08f894bd9705d95634947980d
SHA1 f0e73f2fda9c29aaa5a470641ba0f31b71d2ab23
SHA512 20a63d4646a9131bd2dbb0d776bc92be83e9c23257ac544c9c2c4df26ad1ddd1b1831b7f62a805f024cd5704170082e3fdce5e8f069636d9922400861517ec36
SSDEEP 768:DDs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNcroV8g:DDs6pD1WvxzWju1jahILIsNHVr
TLSH
T1E8D2FA3B680CCB7E4F841E5CAC2A6F966DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\temp-index
Size 1KB
SHA256 90517d389118cb3186cbc50abdee90ddd59e4bff51e78a054797e87869ccedb6
MD5 3c0de9c71b8a4954891651967fd7ffb0
SHA1 00527f604bb62417f21ec2aec247d701a246617e
SHA512 fd7ea6f1b578412900f345993636424ba1fc5833a6d27e4316bbed0d46b144f23a000bc597c93794b4393c5e3350101b4ca7d1d9d10df8dc74e56e2500b32544
TLSH
T1E931634E9EA0CD9FE4A441B21572B5A47370D8DD0A22E7135C7C31327E237192A0B4DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1773.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5d1773.TMP
Size 1KB
SHA256 2e751faa36d4e248c5a2f035c5a483f5ce42a3ab83cc6a0bd9ef2de5068c1dd7
MD5 537056f2376e641034707dfc0eb03f74
SHA1 46fdb858e34b656a4ad7cbfbe7f603bfb4789bdb
SHA512 aa62a4dba0136ae3812c641ad52b2e6a1f83eb1840d2e4141643e3c15b035de1859f99f2a023b620fa60801d2e8524fe7ea22dd6a6ed8780430227942b61cd67
TLSH
T12E31424A4AC18D1AE8D450770E67B8B8733598404311B793997C62399E25B9E2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fec6470209be76b4bbd4f498e412cbd9f2af8364a87a9652bca73ffbb97422bc
MD5 fff33617ee9a906148f7eb16411b3401
SHA1 7c4def22941a7d5305e07d404da4cbe74f1d14e2
SHA512 96255d5f3b147b2a41e304bacf7821d7c6152814a6edf895beeb7006b233a5f8129e9b164619c342ee0db915f0a4a52be5b536d9014f1970f4024daea9b23a71
TLSH
T1B5E0DFBB6EA76830EDABE3E7287094B502823D2CC805BC4F686EA6C350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2a814901b7dcd879926c0fa1b2b2311e3626f2f94a24da71f2fc3fb11f4680ea
MD5 142d1a618c3442bf9d822db14b8d5dae
SHA1 b2a2cbc37b2a6163f5ec433161079a3be85445bb
SHA512 e42294dea0487b4605eb73776db12546570c011cd583bf9b7b19bcdf3cb02ad3fbe37206d93963350c9b29db4a350a221284c14c50bc44564623673f6bbc945e
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wUz:KUAAKtePiwQKFWvC6EKfKuurmKA8bz
TLSH
T141C12C12717B0A033D7E1B0CA255872B97427263301CA92B7BED40764DAAE395DFC6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f141.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f141.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3bba9c56871ccd0cf6afc982305057913313897a58e0b20bd62e7552e54c84aa
MD5 1fd5811433f6c1d9d7cfbaba02cd039a
SHA1 751a8990f052b25f724acb9cf45d4685ef78194f
SHA512 b965df526114b000f7cec2c2ea674e475b4bb2f75ecc132f5bedf0a08ccaa0246d6fdf609fe98e00772c1130f8af1aae871204b3c3a7571cfebbfcddeefd9a0a
SSDEEP 384:XZcIhsNCcUbOrPa99d/VfnfBeRs9JKgqijUcN:fhpUCfznfTjKgqmUcN
TLSH
T1BA928D31687869779AF6F141F58636175FF88037E6D52F90E1EC9F0C009A9AC230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 da3a35dcefdd7b23cc112bedac175cfd301c314cc8f639f2b5f7738fc9b21c65
MD5 5a4c184760fb0ba07f4ee06b40a3e8d8
SHA1 a2e0f6dc40249426354e25c838efce2f29071049
SHA512 a3d0f735ccc2e815e155f2615a875138ce930a3f408bf4aa5dbe93a31923c22a3289023f1d73481d22a5bb4a94697977f2ffc3b57de8d77a19ed53f6db5ecab1
SSDEEP 384:0ZcIhsNCZUbOrPa99d/VfnfBeRs9JKgqijUcN:yhsUCfznfTjKgqmUcN
TLSH
T1DB928D30687869779AF6F141F58636175FF49037E6D52F90E1EC9F0D009A9AC230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 507a24983ddf5c974b2931c722220c05a9536f90e45aba962feb42a4ef5af748
MD5 cb9254b9c43ad8cb9e7b39a613a8cf6b
SHA1 851912999546de2f24730b23b80b933b59d62d36
SHA512 78ab27c585ce201e6f487fbc89e247d914c1923fdff3918f5b50bb918832dcae4417afcf8158c6cfdfd72316cf86a7bb4e5d4ed91c35954cf66942b6b57295cf
SSDEEP 192:qONt6O7+3hQmiUyhzGttb0j+Fd/9UgGr6W8rU6:qONt61+Gt99d/9art8rU6
TLSH
T18A02D6356C786CB78EB2AD49F58727235FA5117BE9A62F81D6E81E0C00D766C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b9795eefdd7033a3745cccefc46fad8d41802a41807089a9a1e3ba84a4b58323
MD5 e84fffe74f86393d65579ffd86a73984
SHA1 e2d5d8507390d5cd210b79c06a00b54b64be9311
SHA512 7603eb87d45c0a7e8ef6a06c45753e11cf6bfd9571e9887fe005920f239e80c3b296e334a747f8875948807a6a051e8c18446893bfe91928faad72342ce413ee
SSDEEP 192:RONT6O7+3NQmiUy4zNttb0j+Fd/cQzDRHcN1qWRU6:RONT6hNNt99d/VfafU6
TLSH
T1A81218357C6C6C6B4EA2A141F48736175FA5417BEA8A3F90E5EC5E0C00EFA6C2346C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5e570b2317e06f2085302885cccec062f5b0eb3e6287d122363e0d7cfec6c563
MD5 c7245078918bf097ed80254e7f862061
SHA1 11075ede3cc64e5021b1319193c55e22816c82f2
SHA512 7dd1d2484db3b8d7e338a2d54b22a00af7a8b29ee645b3c4fdc3eb75c329f50993598f42fe464009c7322a10a4b6aceb2af1db135646a57cd4fb8778abd76f3b
SSDEEP 384:iYiFiZcINzsNa8TUNTUlIlZUbOpPa99d/Vf2fBeRs9JKgqijUcN:uFQ1jwgAGCfz2fTjKgqmUcN
TLSH
T17ED229F208D79436D9AE9743A77D2E174EBCC063F5916A90B3D8990CCC564BFD30A912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e54296bbab00cceb9b8f4a08a020a3b24105575994d4fdb0f7d79e1a78f2aba4
MD5 d0952411fb5d73e0f71c8e2ee0212aa9
SHA1 75a717cb8a675a21d07307de3cf1c9dacf804318
SHA512 33c49fa6ffa53bc1b56328c3bc68c7030e7092e1dd18c5810a5294a5582e377cf5bb02b0a853902517bf59618135299370bddbaaaa9e61f175f4343835cac2f1
TLSH
T13841096CB6FA1148B3B76F1A9BF6A86D447F79671E06D45D10110E8E0A23B40D8A2737
MD5 SHA1 SHA512 TLSH

Submit Download