hxxps://www[.]xiaohongshu[.]com/discovery/item/6a5a1cba000000000f031da7?app_platform=ios&app_version=9[.]40[.]1&share_from_user_hidden=true&xsec_source=app_share&type=normal&xsec_token=CBi3YANkcQwV1mLLIj-bfdR_kNMKmgVv9S_qu5XVJIiSM=&author_share=1&xhsshare=WeixinSession&shareRedId=NzpGODc8Oks4TDZGQjs2PD47Oj48PD4_&apptime=1785919995&share_id=097a7f7d1cc242148ea3eacb5b355d83&code=6Y0mHciFrsM

Analysis

user interaction
yes
max time kernel
899s
max time network
894s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/08/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xiaohongshu.com/discovery/item/6a5a1cba000000000f031da7?app_platform=ios&app_version=9.40.1&share_from_user_hidden=true&xsec_source=app_share&type=normal&xsec_token=CBi3YANkcQwV1mLLIj-bfdR_kNMKmgVv9S_qu5XVJIiSM=&author_share=1&xhsshare=WeixinSession&shareRedId=NzpGODc8Oks4TDZGQjs2PD47Oj48PD4_&apptime=1785919995&share_id=097a7f7d1cc242148ea3eacb5b355d83&code=6Y0mHciFrsM
Sample260806-ezzcxsdl7x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1612	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304638126696374"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{BBFE3097-FD89-40F3-AE4E-18874F0B9902}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{91728F2C-1F62-411C-9A4D-02A1CE7A56E0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3228	msedge.exe
3228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe
3696	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 4656	3696	msedge.exe	87
PID 3696 wrote to memory of 1612	3696	msedge.exe	88
PID 3696 wrote to memory of 1668	3696	msedge.exe	89
PID 3696 wrote to memory of 4920	3696	msedge.exe	90
PID 3696 wrote to memory of 1668	3696	msedge.exe	89
PID 3696 wrote to memory of 1668	3696	msedge.exe	89
PID 3696 wrote to memory of 4920	3696	msedge.exe	90
PID 3696 wrote to memory of 3840	3696	msedge.exe	91
PID 3696 wrote to memory of 2644	3696	msedge.exe	92
PID 3696 wrote to memory of 3840	3696	msedge.exe	91
PID 3696 wrote to memory of 3840	3696	msedge.exe	91
PID 3696 wrote to memory of 2644	3696	msedge.exe	92
PID 3696 wrote to memory of 2644	3696	msedge.exe	92
PID 3696 wrote to memory of 3636	3696	msedge.exe	94
PID 3696 wrote to memory of 4576	3696	msedge.exe	95
PID 3696 wrote to memory of 3636	3696	msedge.exe	94
PID 3696 wrote to memory of 3636	3696	msedge.exe	94
PID 3696 wrote to memory of 4576	3696	msedge.exe	95
PID 3696 wrote to memory of 4576	3696	msedge.exe	95
PID 3696 wrote to memory of 644	3696	msedge.exe	99
PID 3696 wrote to memory of 1876	3696	msedge.exe	100
PID 3696 wrote to memory of 644	3696	msedge.exe	99
PID 3696 wrote to memory of 1876	3696	msedge.exe	100
PID 3696 wrote to memory of 5056	3696	msedge.exe	102
PID 3696 wrote to memory of 4300	3696	msedge.exe	103
PID 3696 wrote to memory of 1284	3696	msedge.exe	104
PID 3696 wrote to memory of 4300	3696	msedge.exe	103
PID 3696 wrote to memory of 5072	3696	msedge.exe	110
PID 3696 wrote to memory of 4512	3696	msedge.exe	111
PID 3696 wrote to memory of 1784	3696	msedge.exe	112
PID 3696 wrote to memory of 1736	3696	msedge.exe	113
PID 3696 wrote to memory of 1736	3696	msedge.exe	113
PID 3696 wrote to memory of 2412	3696	msedge.exe	115
PID 3696 wrote to memory of 2412	3696	msedge.exe	115
PID 3696 wrote to memory of 3228	3696	msedge.exe	116
PID 3696 wrote to memory of 5052	3696	msedge.exe	124
PID 3696 wrote to memory of 5052	3696	msedge.exe	124
PID 3696 wrote to memory of 2336	3696	msedge.exe	125
PID 3696 wrote to memory of 2336	3696	msedge.exe	125
PID 3696 wrote to memory of 3840	3696	msedge.exe	126
PID 3696 wrote to memory of 3840	3696	msedge.exe	126
PID 3696 wrote to memory of 2984	3696	msedge.exe	127
PID 3696 wrote to memory of 2984	3696	msedge.exe	127
PID 3696 wrote to memory of 744	3696	msedge.exe	128
PID 3696 wrote to memory of 744	3696	msedge.exe	128
PID 3696 wrote to memory of 5068	3696	msedge.exe	131
PID 3696 wrote to memory of 5068	3696	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xiaohongshu.com/discovery/item/6a5a1cba000000000f031da7?app_platform=ios&app_version=9.40.1&share_from_user_hidden=true&xsec_source=app_share&type=normal&xsec_token=CBi3YANkcQwV1mLLIj-bfdR_kNMKmgVv9S_qu5XVJIiSM=&author_share=1&xhsshare=WeixinSession&shareRedId=NzpGODc8Oks4TDZGQjs2PD47Oj48PD4_&apptime=1785919995&share_id=097a7f7d1cc242148ea3eacb5b355d83&code=6Y0mHciFrsM
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7fffe1c8c188,0x7fffe1c8c194,0x7fffe1c8c1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,4608695452571945650,5685100796752736316,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8881658397451693717,4020831561400618239,262144 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:2
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,6064352151811873016,9872772508248265721,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,2688011285722501616,535113135877728065,2097152 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,14335221930013638475,16952591690736231266,2097152 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,16041480173172800909,2341016889556296088,2097152 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,15792810414635426726,9377889655962454614,2097152 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,4460230612891037571,1353989034773575865,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2737515293449156916,669456863489927078,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15498298665794299328,8350892226483390235,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,15498298665794299328,8350892226483390235,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1680498289134415069,14834703640243857985,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,5038279390030602145,4668922565332844792,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,8651520480740258415,7961684003684542378,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10454171828693260273,1761115464967010696,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,11716385069723971579,17221944123158501267,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,16482989825550565174,6009194988345196326,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,8004447782288777552,3822722726987802004,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5144,i,6322100803296730914,10056710334185455602,262144 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,12803754988868550360,10153926202997545606,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7060,i,9570037000409520751,12229089836558138695,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,9734213180347626696,5917314268372066086,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3452,i,17300497227538866318,14546449532639503412,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,16686569127268915271,14746000586127012982,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,6549104503507882648,551155490485903085,524288 --field-trial-handle=2504,i,17926555280114770715,7928621391896012206,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5bc7bc5ae35dac39e3def74937cc3465ae842cf33329ba88cd0957e02d2f3b23
MD5 c73997c66f62454744a9c8eede26d1a4
SHA1 f05ce0e678ce8ae4b17427dcb6d0394e2dcaf086
SHA512 1a4d540d05ebf9d4565decc4b7d32e532d68bc9d8018220cc22c7ad50aff887240530366444af9c7e7d376fe566ffa6cd0376b09d1c3f5430de4a0bb92f29ad8
TLSH
T19CE086D49DCAC26EF615A48BD3A8574C82D07F0B9AC8B9DE1704D988B342594E3D2DE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 087957e9b13f2124431e7aeea66a75a76db57ee66a3087ccfa83ba7d108a4b12
MD5 469144f81ec3edbd047a8fe727983bb0
SHA1 1be6804245b19f6b3644433ab9cee5e93f0a41ed
SHA512 20109acffb24289553bebad5e074989babce4c0850815e26e61ede5df6c934651bd2c7c34b54d0f7878af8c174bd9e9b8e806187ccbeb2646242c6965d02b1fb
TLSH
T104E020A519C6C21DB70164879354430C43D0374A96D4A94F3700C8CA7186060E3D7DB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b96336066f91c925d39166701042e62ea17696e6d0365c57c975879cd3c6af07
MD5 cddfcca997746fa06aeb1a563e61e06b
SHA1 fda3f9c11f7c4620319dcd46b56c86b7a3de4364
SHA512 1d542bd60b521912c562571cf411f1f3cc18fe6335a31002c6d5d5b2642a3e1e2883bf4670eba4cc8aa1ad9215ffdabc043371e9c3724c7d88325873045a0d85
TLSH
T174E0209818C5C25FF604698B9368430C41C0774A96C4A94D6704C488704507463C2D60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 40KB
SHA256 70a159582e7d3ce5f3374945687be85da9b9e596bf4b0e6ae884884a0afdd456
MD5 9ce530fa019118d0276fb7a904394f9b
SHA1 7a21d89e17f384110e008dc28f473f294ac9fb87
SHA512 f14c697d90b9086fc33e03ef09140bd1f4e52da58d2d51ae412aae07b29c4408eb3b35399e10d3ee2a3cd797ee42eb24c852d7ebdb2ce70a45f77b11fe51471f
SSDEEP 768:xLqLmGfS9cGyFYqSQwBaoFZ+lKG3PtbicdOcybkRdkvdorXPNwhvSUd:xxZfu1K1OlKRcLIYdSdCAa2
TLSH
T1EF13F182A4643C9C03CD79143EAD3EEB875AC4686086128EBED4F1251DD3F6C7623885
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 db69b46539824a91792568dc43fbb4657cb2a0ad11ee593afa7cee142d118c8a
MD5 00683cc7c9eaa1e298629a7d20bc06a5
SHA1 5acc281a992732051a65d2d8e1c9656a4744561f
SHA512 995cc17de957b14178522bea0f2b0f7b3d7c8cd6950f2b630a5dd44a4b79c9106ecd63b07586377fd31d618db8397c9ecf4d18af4f706d7715bcefa85c348171
SSDEEP 48:qRbLGntWWX28vR/lQlxdupdy/N2bPBePGxtY7osVdta9W7Ih9mifDqnoXkq:q1LGnjX28vfMduHSN2bPAefHL9mif+k
TLSH
T13591D73E4F8609A4FB5107705BD1C611747D9AD3FC13DE42CBA048F0A7FB7528A9868A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e54a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e54a.TMP
Size 3KB
SHA256 0624c7f008bd9bd76ac0749c55659ec9b8401c7831d66c643c7a4fa63c8e5278
MD5 e09c2f72ccc28f4b3475fe45195688ed
SHA1 75041f18d3fc7f09cf67c5ff33aa7fe07c32019d
SHA512 a9733ed9c29ff490bef8fb7d3daa3b9e17a00e587f2dd5807ed70025a97ac87f270be7e0989400389e0a9c635a3cfede6af0d274f93dce087b0605be58cbf5ff
TLSH
T1046170380F8605A4FBA2037197D1C252B47D86E7FC93DE56E3B009F44BF57228A5974A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 94d7c5d2e94ba0cadf5a158764c97dd3d1118e9958d7f409a5dd9c38b174216f
MD5 96a0001edc2f2bbb87d8830c222a78be
SHA1 f6da75af3e9d0ff91aace9b2726854fdbcd1ad44
SHA512 0be380a869d4367fe6cc9f9d42d7298f4839039d41fb32632504ab499030f43a349698793d2c52274ecc49111956f948cf4798e38443cd64d8872385545ae167
TLSH
T1C6618EB343B6896E8E115DF0FA08FD1BCE5D0228471C789E85D86F039793476E101A4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4990737bbc62893dd600cec8e82c53e1fe2a374ecc21cf8f5ef82edc9711871e
MD5 d41ff9822417139f69c0eca79810407b
SHA1 771943d147b921a6814bb7d5796a46a78ee606a2
SHA512 f176308d5249f06af5d7eafb1faa48a8fc47ef839754ba95e7885740a31f6fa953bb99b53348fd0192a95989c773e95dff47da841fa3f63491f89cee6a50c03d
TLSH
T19F614EB74776899ECE119DF0FE08FD2B8E5D0228871C79AE86D46F139793472E101A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 fd0b513e8ea7619e0ffd6e5b292d261450ffa4d92c9f91640e5a3acfc55e9f8a
MD5 bea4c1857c43a1ab799abb0d682078d8
SHA1 360de0e5960c61eed6491c894efc7b35eb9cd371
SHA512 a881142df83915af45f7c3524808d7a84488e0d62c47ffaf2b5d652b384b07950fa1ebf7760a4e5c8942c5dc6b8043dfc1d92da38a165bedbd525bee6b010682
SSDEEP 192:sxZ7RfyM/jK1Ml8MkH/f3XsB2lg2IdpsMaHW6+WN319/YzZFlhIg/mFJ:sxZ7xMH/fnsB2lA6HbD/mOv
TLSH
T1A152D9126A34997BCCDBD20DBA51BF53D6F50572D2940E54AAFC9A1C04F3AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 af478ec7dfae56fa08b838de7e826a9b9ce8ccdc799809d0e0aa22e51699bb31
MD5 abce170f87390725607cf587fb0f3408
SHA1 1ad208ab08cb16096e8f3361284a3594b9e7bff9
SHA512 cace27d42789e4fcd1c9853a3f77e843f7b7a888e44d986ba97dc8ba4cc00dbf0e2f4766c705b6f4bc480a0aacd8160089148644d353e3dab2ebb4730873c852
SSDEEP 192:sxZ7RfyM/jK1Ml8UQdckH/f3Xs02Fg2Idp2MaHW6+WN3H1XYzAAlhIg5FmFJ:sxZ7xqJH/fns02FA8HblXQuv
TLSH
T15262E8126A34997BDCDBD20DBA41BF93D6F5157292900E54AAFC9A2C00F3BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d8148fda88dc8dc6a7260901f5a2ef142aa351b0fc4bf1e536678b63b23e07a5
MD5 531b84aa0bb3f9a5f19f10fea7879df4
SHA1 dd352a951b77cfe4996ecec5129fc324c715ae1b
SHA512 b83f5708cc64470b977dceae2d64296b2d1c414da500fa14b6243adc2f38f57dd6043bd50ffef27aec5ed2c709e4954bbcf959ea2301b93d305a3394ae71694d
SSDEEP 768:ZgW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjuroIDm0mYr:ZgW7kf0Wvqinau1jaa5LA3jl0r
TLSH
T166E2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D544BFA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 912B
SHA256 b9b5eb0606f0efe7389300795c6565249f6642ade153577d457ac318c07d5886
MD5 276ed9e39b9f024ceb8d5894159181f0
SHA1 280f529a24d8c1da5ba075f16b31d19f508880b3
SHA512 d53face06d6568204a160bccd3e80a902208e6b3435a50413149916cba32f3bf67bd3dae5942efb0766fa3afc5ef9ac643dcd93e73cb439f5c3bb20062bb85e0
TLSH
T15711F4464E95D92FD9A845F314BB70F43331CADC2321D267842C25361C27349680B098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce5e3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5ce5e3.TMP
Size 912B
SHA256 50f45321babcadf609f890c9f2986e31b90bfaf631331ff00be2600154918d58
MD5 ae815315782fec9183b254f88e86e589
SHA1 ed1d974a62913ad27aa69a770185e5fc654dd295
SHA512 673da5d85bf344eca79cd0ffcba05317add9cd9c9fc4735093fd5dfbe63ce9df6e4a561b999a182ce9a533a80d8671a72f23efd90c49accdcf066399de0ea9fa
TLSH
T19D11DD8687A6992FE95455F6049A64F87370CD002366F7A3547A253A2C3638999470C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0b043dc0ec8e1223c9ea25cc727e56a59c61c64a6c36a0afb72eba944e7383ee
MD5 8d077dde3b883ec776adcda66d29a31a
SHA1 e0ea6a4e22b1b9faaeffacb034fb1309b60a979d
SHA512 2f09b20412c8eb969aaa880f2964baff934ccac233fd3a04444999ae1a60cc71ae126a193ed5d79ee4d94c423cf8a6700acb0017d354c74e08994f2ff85f1fed
TLSH
T14FE068BB2DFB1920AC6F97C138B064A081853818C900EC0E302BA28770F2361240AC31
MD5 SHA1 SHA512 TLSH

Submit Download

f1cdccba37924bda_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_0
Size 19KB
SHA256 c2cd676573a27b2790e7fa27a7cf5b3c7c9d5c9e3adfae89220e3097be3e5643
MD5 81a8d5a9a5fe47d8fad09b252f77186b
SHA1 4900d38b2d30270e4858aab0ea2992eeaa0b7253
SHA512 47fcc04f3d0a5cf4ee1f715c39605b75948915fc08f2b76f928f8254535749b1f2cb6437c2fb3dadb650f0c00c102c21429af364bcb9dd368ed48c67d4591404
SSDEEP 384:d0+wZcq+/198Z+y1adTu7sYXM7E60adtlwQ98FOEhrR+:Wcx1+ZhATnYXM7JltKR+
TLSH
T179923AAA9ED060665F035178678F950979346087225ECAD1FC6E8B592FC073842FEBCA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f1cdccba37924bda_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\f1cdccba37924bda_1
Size 9KB
SHA256 eb1702ec103ecd45c1ed8e3d80311334b38e7fdfabf27cbd88295d2499badbff
MD5 cf0374bef18926e1e2e0145a90fabffc
SHA1 18a6ec503137ea1ad34455339c5764f0d5f7f0af
SHA512 1419d853644861b843fb99f1620265e543b7ff374015063b034becbd152b6e15ac77f95e55dccd71e5dec2d085033b1f7a9e3adc41276f3d711dce88a5eb1f41
SSDEEP 192:/Z/3oRLuw9/6XDCmxH7rWLxxX9SXiNOWiX2j8BNA/J+Tsu:B/3Nw9/6TLxH7exxtoMOWNj8rA/Ja
TLSH
T12922280167615817CFAB93FAA493851B3336C1657F43CB2610E277382C213F398AF90A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 c57e1932b9debd45f145a14b075a38d48b883fdeafcf84389f1d9de98fbeaf5e
MD5 d3986e4fc024b766d94c30455d8ddcb1
SHA1 d29c26736ea24598cbd78e1f6acc3abbe41a7f38
SHA512 236ccab48a020c3798db7f5451196a579a9cf78e8ffc89a68be98654d809b4c5b1a90e4e200c76b3606fde677bf788e0a964bd468eff28041e3ea360bd03f83c
TLSH
T137A0022446FD2543D508167014D69593235088720182C311C4A492ED8CD129A6981145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a256.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a256.TMP
Size 48B
SHA256 a1a78dd1689fd96598627e517619ae23d13193cfdb3d38507ec97bbb82935694
MD5 1b1c1d6dff298026444eab8922f8b0e3
SHA1 85db89da166430b291e644c04eab850628c2b45a
SHA512 55690e9db7acab4798e786d3b13c7c277c38c76439592ed07acd3804d547a996c6290e5eb37e8f441c605149e0e9c2808d52446d0542ed60793e123669cea9c7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 3759371a40658e984ea3be15ff54da8be8d1f252c1ad2145422ec85d015885d0
MD5 22ecdea00ddb5ce0170a1c597a62b2bc
SHA1 9113997673831ea1a54303415b3e824b463d6a05
SHA512 a7f49e48fefc8bace54bc6ceedd0916bf8dc8037266eb2e830a6150955f22bcd203cdd8232bcf8f7947cc6b81fd2a54b9cf6739e52344e3d00b2e66658f0a664
SSDEEP 192:s2t/kh4fjRTnMv2zLJ2W1yZBOfX8L6xWqkIsPITOSuhWMfKqzkK:s2F6Jn
TLSH
T13FD1220A703A4601387D389DB29B89365F4676A3751CA4EF7FB900A60E67E210DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61cb29fa-192f-417a-8d75-119e38f1fb61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\61cb29fa-192f-417a-8d75-119e38f1fb61.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 5eb281ecb43a0b75ce30dd3308f7e4bb6ad7b66b34bcc446b772af312c91a044
MD5 d11f0370a7bf25c4a39b0b4bd524416e
SHA1 9f3496bfb0858b6141d6526dcf7f20cc7046d62f
SHA512 83d5d3349e5249bab65c202b92bbf4ce6b5a0739ea623befce0a961507212b7e9ff115fd43091af316981cfafde16c17f27d1c9c20acc03ce3ec6d3db1cccd5f
SSDEEP 192:uYybsNvRQllq31BBb9AQmiU13k+4aGBPKlt+FdG8PohrGFC1SJrFdNSq0f88/:5MsNvRaUlfbWKh7dEh+CEJrpkf8Q
TLSH
T1F4423B346C759C37ADA2A241F48B36039FF841679BC46F94A7DDAB1C01EB69C2307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 29d5daccf656a4b6d22f1caf31d4fecf96c9d8f52c22b8c45bc1d4f752b693a1
MD5 979113e7a1c516253a8b6ffa02332c81
SHA1 1b6be1a447e860df53938fbab650982cea447a99
SHA512 d6504639190d262560a2e79b5d91d2af60f343e3a1d873350af01ec20a8fa64ee7dbdf4a48e4d283df37133180ff9247454be87f31df61ea8d2fe82fcc90ddd4
SSDEEP 384:qGiFiZcICjsNR8TUNTUlIlUaUlfbWbh7dEh+CEJrykf8nTKwBODNZOCdCg6:qtFQ24wgdUlfItWuhykknewBKZOi6
TLSH
T154D239F158E79836E9AD6743AB7D2D028EBCC163F5806654B3D8AA1CCC661BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 95b2cc507ca0eb0fb3a3c95ade4202b29a28c7e25efaabc54bae198aa2f8fe9f
MD5 952cb9e472cc334d624c6ec848e7eeab
SHA1 8f343aa6011e47aee18a80ec282a98ddabe2ffd0
SHA512 ee82ef43a5a960ee535e37bbdb4e36ce673fed6b88e3e83a0c9245d1793434c01381704f8fdd10e52689847f49fe3cd1ebe5b37e69f73e79f5a9cb26e866ab15
SSDEEP 384:yBZcIxsNvUaUlfbWKh7dEh+CEJrpkf8nTKwBODNZOCdCg6:yJxsUlfJtWuhpkknewBKZOi6
TLSH
T1A5928F706C395C376DA2B245F84636074EFC9177F6C42B94A7EDBB2C01BA6982307C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 331110a3d8b3f18e3e1192d200e6412cc7be97ffb55aec0643e58ef07c68eaca
MD5 7030c7a2ae4a09d2d9c28dc957b01048
SHA1 7a2dae8f3db13bcce78c690360852af438482c58
SHA512 cc56b01f6fa56520d9e20bcbd9b6971969b247fa2533ac250e474c6cebb61d42d8a4a8ef7732fd8be1739aa045e524e1ed782b956bad21a2e6f13c22f64b6e32
SSDEEP 192:MON/64BAQmiUyz1OW5GBPKlt+FdG8PohIaDyqU6:MON/6eAUIWAdEhxVU6
TLSH
T1E502EA346C796C6B9EB26E45F48637175FD8113BE6856B44EBE85B1C00A775C230342B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dad5f63671d99b056f2308df714989f2e589d41819ea50b6924a7995b490fea3
MD5 158da9799325379c10a77ec1f21b9b0d
SHA1 424324fc7d1e54104be8fece7545147c2fcda98c
SHA512 688886170c9f4ca480df7a79a3d002e0e1e6669e1994641f81e38454371a236b0d989e802e000276f38cd47b9c2d24183ef03a5d376f767b9aa0a9ad85a38494
SSDEEP 192:RONK64BSQmiUymOT5GBPKlt+FdG8PohrGFC1SJrmWwSq0f8U6:RONK6eOiTAdEh+CEJrEkf8U6
TLSH
T1B7120B356875AC2B5DA27591F4C736039EE84237EB856B50E7EC6B1C01FF76C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155c53b4-c351-4eeb-bfe3-8a1803f9e702.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\155c53b4-c351-4eeb-bfe3-8a1803f9e702.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 282d09575c3ea2de4a87d6bcca835ca590637574ee88f830aac397e966c6f6ef
MD5 ed8dd533224d41d37debf2f2da7010dd
SHA1 fd45b0c43aecbed4391e75654e78c348103566c2
SHA512 91b33ad643f02b9818d4c7ae436bb8df684d7245f0d4bfd7d02c88d4281d7df58cbc17e627fd7768be2770838a93a71bd7540767eac7a1391827229936d55ea6
TLSH
T1EB413659AAF90148B3B77F5AAFF6A86D487BB9733F06C45D00010E0E0A62A40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download