hxxp://help[.]evilginx[.]com

Resubmissions

07/08/2026, 08:50

260807-krpreaeh463

07/08/2026, 08:47

260807-kp44ba1ckc3

Analysis

user interaction
yes
max time kernel
450s
max time network
446s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://help.evilginx.com
Sample260807-krpreaeh46

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3900	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305662248318886"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{105136AD-E9B7-41DD-85FC-7B1781FFEE63}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
468	msedge.exe
468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe
2984	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2984	msedge.exe
2984	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 4220	2984	msedge.exe	85
PID 2984 wrote to memory of 864	2984	msedge.exe	87
PID 2984 wrote to memory of 3900	2984	msedge.exe	88
PID 2984 wrote to memory of 864	2984	msedge.exe	87
PID 2984 wrote to memory of 864	2984	msedge.exe	87
PID 2984 wrote to memory of 4828	2984	msedge.exe	89
PID 2984 wrote to memory of 4828	2984	msedge.exe	89
PID 2984 wrote to memory of 3532	2984	msedge.exe	90
PID 2984 wrote to memory of 3532	2984	msedge.exe	90
PID 2984 wrote to memory of 1532	2984	msedge.exe	91
PID 2984 wrote to memory of 3532	2984	msedge.exe	90
PID 2984 wrote to memory of 1532	2984	msedge.exe	91
PID 2984 wrote to memory of 1532	2984	msedge.exe	91
PID 2984 wrote to memory of 3848	2984	msedge.exe	92
PID 2984 wrote to memory of 3848	2984	msedge.exe	92
PID 2984 wrote to memory of 3848	2984	msedge.exe	92
PID 2984 wrote to memory of 4284	2984	msedge.exe	93
PID 2984 wrote to memory of 4284	2984	msedge.exe	93
PID 2984 wrote to memory of 4284	2984	msedge.exe	93
PID 2984 wrote to memory of 2932	2984	msedge.exe	96
PID 2984 wrote to memory of 2932	2984	msedge.exe	96
PID 2984 wrote to memory of 2932	2984	msedge.exe	96
PID 2984 wrote to memory of 924	2984	msedge.exe	98
PID 2984 wrote to memory of 4116	2984	msedge.exe	99
PID 2984 wrote to memory of 924	2984	msedge.exe	98
PID 2984 wrote to memory of 4116	2984	msedge.exe	99
PID 2984 wrote to memory of 1268	2984	msedge.exe	101
PID 2984 wrote to memory of 4012	2984	msedge.exe	105
PID 2984 wrote to memory of 3804	2984	msedge.exe	106
PID 2984 wrote to memory of 1752	2984	msedge.exe	107
PID 2984 wrote to memory of 3348	2984	msedge.exe	108
PID 2984 wrote to memory of 3348	2984	msedge.exe	108
PID 2984 wrote to memory of 468	2984	msedge.exe	116
PID 2984 wrote to memory of 3296	2984	msedge.exe	117
PID 2984 wrote to memory of 3296	2984	msedge.exe	117
PID 2984 wrote to memory of 4376	2984	msedge.exe	118
PID 2984 wrote to memory of 4376	2984	msedge.exe	118
PID 2984 wrote to memory of 4376	2984	msedge.exe	118
PID 2984 wrote to memory of 4456	2984	msedge.exe	119
PID 2984 wrote to memory of 4044	2984	msedge.exe	120
PID 2984 wrote to memory of 4044	2984	msedge.exe	120
PID 2984 wrote to memory of 4456	2984	msedge.exe	119
PID 2984 wrote to memory of 3620	2984	msedge.exe	121
PID 2984 wrote to memory of 3620	2984	msedge.exe	121
PID 2984 wrote to memory of 3496	2984	msedge.exe	122
PID 2984 wrote to memory of 3496	2984	msedge.exe	122
PID 2984 wrote to memory of 2556	2984	msedge.exe	123
PID 2984 wrote to memory of 2556	2984	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://help.evilginx.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb8646c188,0x7ffb8646c194,0x7ffb8646c1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1768,i,14880768394704265813,9643625861806196962,262144 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,2628991428663333536,13686999925256728816,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,7482622112113865088,757180004841186894,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2071291061593859232,14988140701753083677,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,6203307497868781343,14129387241183652867,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,834460339415822920,11889946303971183706,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,4394099439279050241,16007993640732620456,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3452,i,311640328670165658,9381388128673754419,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,7747085818454207863,11965992412468099333,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,2838179610372424613,4573544735884341903,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,7712116485836097578,7843420744276898199,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,7712116485836097578,7843420744276898199,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,3429907025533476780,1268772683000528014,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,11912665808820992306,4316037138633588791,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,9476122293402644653,980688472138739969,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4608,i,809480083592756117,7337498952592218029,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5988,i,18369717065168742696,14914476734088725383,262144 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,15558627935877249008,3287585531361406586,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5628,i,17782448146927155911,3683486721010089841,2097152 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,13916760196042102229,4976367885862513339,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,12585200081456644229,10641000025416796016,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,16115364065009202432,14200066511256238287,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,12716881497650442804,15619163399916186019,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,773848343092152603,11177865431845468830,524288 --field-trial-handle=2464,i,14812599092089186639,4759027971302963117,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:2556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0c6401b939427f34d7f80315962834d6f39368ee90ecdd2ab80165873dde3ca5
MD5 066ce696b70ad0be3991695bde95a530
SHA1 c572ff09b6d9daa4b374206ab203a4013ec61ca7
SHA512 c06778d8d515322b1c71d7949f23251758204b5e1fec9764b0e86a00861d849956d111501fb20e0e54a2f08796e7fee01f6a6551739dc49453a641e7bdbb139f
TLSH
T139E0208509D5C31D954067479358430CC2C0760F96CCFD062704C8C97542855EAA19F4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9060f956b576c6a082bc54ad929a809c2892786fa911113fec762e0d75c41e7e
MD5 5d2bfadcc89ca7776f3837fa59c0da2c
SHA1 3aa526738fdfa5e5ecf2214401787549beb3b5e9
SHA512 214fe5792587504835d9c0077208b6eb96e7cf3ef5e0964fd9fb44c23a314bd2f70bf58221172941ab64706d34b5b3571d274a618d70e0a09c1c6cbef3d185a0
TLSH
T142712B8403890991EF9AD6F3FAE95015F673C6492C4BFD66228068FD1C16760592ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c536fea6e289503d4ffa11b23328f727a616bdf12ced1cd4b7865708337c75b5
MD5 163dcd7d3094494d5d3b1ebfd4291599
SHA1 8e0d78a6d895f6668a9e9905320fc17cc6072778
SHA512 200289e4131695d8557146f4437e8e934c2dc86cdf0995409c5da69e516c13c5d6d7c6b8691510b0f6650b38302c7226e216f6dac87ae945dad1a8d5e929845b
TLSH
T127712A4403890981EF9ED6F3FAE94015F673D6892C4BFD62228068FD1C16760992ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 877a70821139f2d3ad1c7b4ccd5aa79a8f40a7e2471abdbfd4b72c0081298bde
MD5 1008b79233162060ab972ee1a183de63
SHA1 6e3a72fb4ebdde93eff0e6e4e9bf2938e2bf1749
SHA512 e436c6813c8ef1684ffcae9524536a2df3ace5a2168f542c3fa59ba4441ef99c0ece4e7fb0a0e5d11a802a16a2157cacfa9fbc13bf1c3f4888d46f889b1f1092
TLSH
T149712B8403990881EF9AD6F3FEE94015F673D6492C4BFC66228068FD1C16760992ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fd29e25e3f720445d7e3bff965d64e042c70129660c6598b6e1998b6cf52b004
MD5 50b3461ca51bcdc182a08ec190d96842
SHA1 781972442e14192f1285400fddc12db37fbef84e
SHA512 d7e8d89f93b3beacaa46f53736f296b7f0519964bdb1f5c8eea538777d55a864b7850d2ee6c9437317ed27392093d7cfdbc4e7c6a354437da2469ed6610a7d3e
TLSH
T1E4813C8403890991EF9AD6F3FEE95015F673C6492C4BFC66228068FD0C16760552ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587923.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587923.TMP
Size 3KB
SHA256 3cc115168680ed1a578b8a4609a556e297c640264f00c52b6c9130989a244ea6
MD5 a7b299c158b02e3178146e865832a983
SHA1 255273965f69a80e7efe7a657b09a1d5a4c163fb
SHA512 41cae96deb3aab01974060c9d4e15fbfe3ca9dcd294d2c401fc0811fd655e74bdfbd5c1936eb682a0446f85362c294e703c8ac721d873020b19bfb3513cc5e19
TLSH
T10B71E90503954991EFAED2F3FEE91105F563D6892D0BFD65228068FC1C16760A92ECFB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2441148ec772aea5101f046f133b8ef4a5bb0cf8f6b5e0fa85b3e86f48412258
MD5 eab030119b9f614852be72b3c7eedb5f
SHA1 ab75ff7e2c6efb9c46203269edf84dc579ca83ab
SHA512 60a064205cd35e045084fb57631d27451f634af841c05b9b23cce97f97fdee206de9a9dd5f919587d709653f1b7c8c44958b6e2e6b73f893e7cee1682211dceb
TLSH
T1EB41CEB683E4966DDD1152F0AA246E2BCE1D0929431C3D2A89D4EF5793E3070D101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5a51df1c5e4658ce4642ce067a084e5c65ee2c005ad98614b5e447dc6d46da45
MD5 1a753823a4902dbce7d5755c2764ca6e
SHA1 35003d23dadd372201db0efffb877da1089d74ea
SHA512 ef5b1abdaa4edc260c95eb9e8333733370d6adc51a9225c58b3f226530ecc7390d1b582072ac690cf40598ab3ab5d1cbc1a5b96f8057e38eeebcfcd1893fb967
TLSH
T15D11BDF3C3D5856E890116F05A24AE1BCE2D0605821C3C15C9D4FF2B93F3075E00195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 721c83a7a7a608dcd51a983e86df108eaea8738175d10dd1609f6f838aad5742
MD5 b3e3e5dea4984d635642c95c30adb002
SHA1 41556a7366b043d3993f166e9df0a654a7254f84
SHA512 5fea03a840d945a0553b2e7df00d30e79bd0f2f861609730faae033a427b1fe8766490eefa5c05df166382877333f9535c9368b157c1a4d4ebd02dbd2901422b
TLSH
T12041B0F7C3E4966DCD1112F06A296E1BDE1D092983183D2AC9D4EF5B93F2470D101A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f2fb4c7f7ca1cda0512c09ee6eb929848106e87ea148552518a5ff78ae5b297
MD5 d84b71c7a60a1b51b7a48adc0f15e594
SHA1 a16ea728ad36d67350ee95cd98679525dbbda642
SHA512 3dbd48490edbd7bcf9fcc319435279d525833eae9f3f5443ec63b475b0e06d4bac2e438fc83eb319e453580dca6da1d6a5b14c93998af1a02735e7f652ce4eae
SSDEEP 192:sxZ0RNyM/jK1Ml8MWq/f4sKOIdpclHW6+WNMqC/YLXyNLIgrJ:sxZ0zuq/f4sKfsHbU/b9
TLSH
T1C24209556A34AE77CCDBD208B955BF53D6F94472D2900E44AAFCDA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6e4dd25951fd1a0f472baf56d88e2164b30d45e52755d6c7ae9db939b6881358
MD5 6c6d103c165e803fbc8a696ce0168728
SHA1 a86d2ceeabb97fe86b7b584381c13d1bd4809ca8
SHA512 af8dfe3244e3d3e6dd62099119a7a24ff091170f77d540214b21fbfa972d9fe0a230de98f4cf64402acaaf0667af58e980455e80f626a104a48fc2aa11217327
SSDEEP 192:sxZ0RNyM/jK1Ml8Mkq/f4st9OIdpclHW6+WNMqC/YLXyNLIg5fJ:sxZ0zMq/f4st9fsHbU/bb
TLSH
T1E85219556A34AD77CCDBC209BA55BF53D6F94472D2900E449AFC9A1C04E6BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 f7384536e5089c6c45b574b3520d4e567c49c573711ece59234714edab84a7db
MD5 e02bac0af59cb21b5b4d1346f31c9846
SHA1 22557869f1e6ffcbd3809ebbfb460bce19910b64
SHA512 cc3aa95c0301aa07ccf89d0198d71ad1795b99640edf0eae0222ac1148fc7ba0a6de171c252ce126167aaa240d15b1fd5c3c76c6460c1b1cef76693b7428e8ca
SSDEEP 192:sxZ0RNyM/jK1Ml8UQNEFq/f4stKRIdpu4HW6+WN73XnFKxYLti4LIg59J:sxZ0zqoq/f4stKaPHbb8xgd
TLSH
T1B852F7516A34AD77CCDBD20DBA55BB53E6F54473D2900E84AAFC9A1C00F6AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 df384820609013795a63ee860a4eb4c8f91cc1b1bcb4a0e86e721c40b648c276
MD5 18739e585fd493fad2f2edfe9fd7b8dd
SHA1 b5e53cd8b679db7cb7da4829aa1e54d810c93058
SHA512 0e7dc79cee749f1e5fe021593d9317973c67f7a28c66e849f6ec2cd7c9108f903ea47aab2eed79ef666fd57fc88f8c4e8dd958d10745bd88fdd8326ec43e293e
SSDEEP 192:sxZ0RNyM/jK1Ml8UQQEFq/f4stKRIdpu4HW6+WN73XnFKxYLti4LIg59J:sxZ0zqBq/f4stKaPHbb8xgd
TLSH
T13152F8516A34AD77CCDBD20DBA55BB53E6F54473D2900E84AAFC9A1C00F2AED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd4cbb84c2751e42a2756ecf00b9ba9e30e756fe851ecfbefd6d00e09726a74b
MD5 8a464eb2a37fceb786b8b25f24a4e16e
SHA1 289211bf86379540c0bd596334498358cca7f67f
SHA512 b59fd63535f4b27be7ec81b0504ab960957e3cd552874fe15477916d186386bb37233ebdc2b9fabdb94f01a4c207e00ad5e47b0de9fcbf30d2fed0683ee381f0
SSDEEP 192:sxZ0RNyM/jK1Ml8UQQ9q/f4stKOIdpulHW6+WNMGrdYLMB4LIg59J:sxZ0zqmq/f4stKfSHb9dad
TLSH
T1EF5207526A346D77CCDBD209BA55BF53E6F54472D2900E44AAFCDA1C00E2BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 72abbf54b541637cd28f1f277b56536825a770dfe02729df0c8d7ec05eef972d
MD5 240a10f0898b4a949a28512db1f75e0b
SHA1 d97ab377762120fbfa74016e1cd2d6e831f8cab4
SHA512 bf63041282d6db2f2fadc7364dee0eb5bed2a5a998f935306aa974f80c565964f8554218a01066a930053352390b47146f7d35b7ac2b92aa3ef8c101b17fac83
SSDEEP 192:sxZ0RNyM/jK1Ml8UQQE/q/f4stKRIdpu4HW6+WNMFKxYL3B4LIg59J:sxZ0zq7q/f4stKaPHbtxxd
TLSH
T1C052F7516A346D77CCDBD20DBA55BF53E6F54473D2900E84AAFC9A1C00E2AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4ec7971e1d0d00f1066623a1ea848eab58c812c14610e316f98a0bf9e706ef2b
MD5 2526f192dd4bb7e1cfe2f1bbfc189447
SHA1 a35546616ce385105f10853c7c1e8532bf1da745
SHA512 8a0f621eaba3c563e7083dda6850a4de542aa2615fe1540f7e85a383b4fcd316c0c24f06b72c37e15ced8a5705c389f611637f85ff6371a11d416bd77d1350ca
SSDEEP 768:TXs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNYro0G:TXs6pD1WvxzWju1jahILIsNj0G
TLSH
T15CD2FA3B680CCB7E4F841E5CEC2AAF966DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 ff3b78f663714cb470ff45874aee7b9d1237da81793a5d845ba9ab9cfbc4e1a4
MD5 60c2f427a97e5fb134980174f26b87ed
SHA1 2fb82460d4c957fbe53f3729592159613f4b4eac
SHA512 192eb46507110209987f89a9ce98c65748f5142edeee7a1535aee01f49b47d5e577057b43a41cac9646dfe905e0cd7bce916775dbffcdb088c94fb3216d68abb
TLSH
T1B651E68D4D528B5FE8BC41B204B294A43374BCDC0A695A236CBC2235B94772D2E5F7EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca9d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5ca9d4.TMP
Size 2KB
SHA256 8b00a43f8e60732d396ddbf9a07006f406011b879df2c5e6216f24710649c0ba
MD5 8aae0885428bfb48fe7eaba4431d62fc
SHA1 b6e5c364fbf38f261adc635ac5012e18b1f183a6
SHA512 4aefa0ed8a85643bf24696397aec6598d0b91c8b4634440f0abc85ec30fc05d359091734805a037884de22335c8dabd1712a643becc8dcc9fafd8779c835cad5
TLSH
T1BF51874A4D418629D9C441770AE3A4B4333A690086157F5374FC9636ED927AE3E0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 073ad7bd141795b58e1ad0d6898d9650db06a94c869b56655af1bcd34b422729
MD5 ad83546d4321f532947fc9ee2b999ab7
SHA1 37295c4a2901af725632f982821bb9f750396b19
SHA512 48f58365280a8b2f8bb0e70425e3d8ee71d3a27493bab64017b9e26449565a0e0d20c88c4985b3675012e8796e4936a91de1d5e76722bc65c6fd0dd23576088d
TLSH
T164E0DFBB6EA76820EDABE3E7287094B54282786CC805BC4F686EA6C350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d9982cdf322577ff20b7e174cdc1f24995b5ab7bf5d52aba1fd9cd8183670a63
MD5 96680fd22d7156a3a616a548c96e84be
SHA1 a36bf0e46e828edce8238aa61f24dbaf5925ff93
SHA512 abbb3a31376aa6d799e123ed120e25d081ffcfebdfaed717c43887842f72449f477e5e3cbf822dffa235025d31ed2f4dd16a47c834ad57e416a5efc2c814b9b9
SSDEEP 96:KUAAKtePevCKoUOKhCKqkRgIKZumioQKV+t:iihpFpPzG
TLSH
T1A2E1C22276BB03512C7E2B0C92D5C7278A43B553741DA42B7BDE40B58DA6D204DBCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9041436484f9ef6801e912f80ced5f03ec70f3504bbbf604b55738acf960a637
MD5 8611b2d6b73c5a97c2c6e1c6d72a8d91
SHA1 91692c47a131531ce6f78001fb8e70a0094d1142
SHA512 527ba6e22da93aedfab29eb871cf6ad55f850793c0825b4b9f6dd052e9ce98d71b0f72a64e9813ed9a0706c6888ffc6a8c400e7d2a92122de7af889a97f4f407
SSDEEP 192:upLsN3yQd27+3vxyQmiU1wFE4atb0qO2bo8P+CLM7fqftblYyXj4XAd:msN3yc0y7a9HON8P+76xss
TLSH
T1EC422A3668389C739EF2A144F9873613DEB88167DA852F94D6EC5F0D01EF6AC2307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 34f11a3943e5736e39efe0eb11013481ef07c4f2bfcf63ee653b4bcd3b373175
MD5 d22e6b827a822e852a8c72a48c956270
SHA1 9294bd05b72d34907f2ebaa56a194a18e4fe300c
SHA512 f5827ff3394e55de754b8b4f34399c9ca64ad829d262e8af0f32b9daf5a483b58a9100b391d0331c0c43933f370f8ddd8d7315a9520592d61341dec46dea98f3
SSDEEP 192:upm+xasuheOwQxMGsN346Qd27+3vxyQmiU1wFE4atb0qO2bo8P+CLM7fqftbf5CS:TZcIhsN3tc0y7a9HON8P+76f5UrzZW5
TLSH
T181928D756C38AC766AF2D545F98732078FF88037E6C52B88D5ECAF1D01EA59C230780A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8d93397899a3bbca68d5b71ffcdc8e57212ab97aab76309959a72c0612c29146
MD5 c9bd8ade49d5797c7fb1e0bc99d6b972
SHA1 745ede577f36b06752023b5e3201c9a8b08a4845
SHA512 8d261950068fe734aa432d6c22828a6bd05ca81a2cea5978176aaef360eee6499a774378b7d7fcb487ea57223b206fa0d60145cd460d514ca18814ffd5e6df4a
SSDEEP 192:uUm+xasuheOwQxMGsN3LzQd27+3vxyQmiU1wFE4atb0qO2bo8P+CLM7fqftbf5CS:+ZcIhsN3Lzc0y7a9HON8P+76f5UrzZW5
TLSH
T1CF928E756C38AC766AF2E545F98732178FF88037D2C52B98D5ECAF1D01EA55C230781A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 209a5e1177e6c4b28f8c297bf027e6163e166643d3b8fa33bc6aaa3bad206f47
MD5 7b3c86def78b4a9cce3989848405ab5b
SHA1 3e57540b76c244ced365c9c9de9167e230463edd
SHA512 6f1ba4ad7a4a8109deb22dee6efab599b90ac305894fff0b766b3e86a09219eaf52d56de334e1e44448bc4f1099c6bc37f63b45ae7e32b1f2680ac3cc8f50423
SSDEEP 384:pZcIwUzsN3Lzc017a9HON8P+E6f5UrzZW5:hp8e9ON8Pd6SZW5
TLSH
T10CC22AF518E75C32DAAE9347A77E2E074EBCC023B1852A84B7D85A1CCC9A57FD306406
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b41cecc9951fe0627f1a53a52d07cc99785e40fafa4fde586389119d6ff3a9e1
MD5 0b8d8e412426d830ad5f285e78764ff7
SHA1 c3d793cc2cc1d506bf4c1654ffbaa0ef4ee572e8
SHA512 0051ac640ba72d8764562e0e3266d0b3569d6f27ea0e261d7e9285ecf13917803101dcc2665fdad1e5d5179d8d545a8da0513e4363761ec7c2f46c01ce0d4955
SSDEEP 192:qONF6O7+3hQmiUy2EGttb0qO2bo81gG7ASU6:qONF61qGt9HON8FLU6
TLSH
T1F502F9356C786CB79EF2AE49F98737179FA9103BE9922F40D6E85E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f2eb78170055716ead497d80b4c311c3ae3dfee2438a0d993e3f7a0ab1bbe75
MD5 1c3e6656dddf0c69564e59a7ba44f7fe
SHA1 a5d96d936347a68302095b215282112ba07318f4
SHA512 8c95bf0b10c3072f0655b82ce60318b18914aea47937c73a91375e775591ae8f8b6bca41cd7b132c4d7dfc3632f1e246393a681037728005ceaad946e4ac007c
SSDEEP 192:VONa6O7+39QmiUybEZttb0qO2bo8P+2cN7fqftbU6:VONa6NFZt9HON8P+X6U6
TLSH
T1AB121A357878AC775EF2A045F98736178EA9413BEA467F80D5DC6E0C01EF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 bdad480f2f8383f441513ca933586a63368c2ce833a664d622494cc9fa216652
MD5 253085be25eec0b752eec26a41c86528
SHA1 18dff0e3bfbd464d59e62ee0f2ae991a1cc672b2
SHA512 6a6169f1416d3a1e3b9be5e5955324c24a100312d5b3276c883e30511fe82bdec69d827b93254ed13996b6650b18ef7620af81c6103230b4e765a09418bf335c
SSDEEP 384:pZcIwU5sNiOzcWV8Ba9HON8P+k6f5UrzZW5:hjo8U9ON8Pz6SZW5
TLSH
T120C22AF518E75C32D9AE9343A77E2E074EBCC023B1852A84B7D85A1DCC9657FD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2df8185dc9efc34792f1eeb9d682a950c8fbc013d310de9b59d37a1e9aba5a1f
MD5 08b4cf94558ef0275c0e9234c31c06d8
SHA1 d010e6628e8beee68b4e25a31e3f35bd09d5f8d2
SHA512 fc99032c165f9e7a0ae1aa2caa4378f0d9240160ab69a7c622d3c05e16ff6c1673fdbf13a84147453ff00da40aadd57417399783a73b73dfd6063ddb3b204384
TLSH
T12341D659AAEA1144B3B76F56ABF7A86D487F7D372F06D49E10010E4F0A62B00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download