hxxps://azuremods[.]net/download/get/?id=32

Analysis

user interaction
yes
max time kernel
449s
max time network
444s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 08:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://azuremods.net/download/get/?id=32
Sample260808-kkd2bstara

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	30	https://azuremods.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a27d35e32acd886d	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306519686184838"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{B170ABB0-8D45-413A-9EF2-9F0A3A6430D5}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 51 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 820	1968	msedge.exe	85
PID 1968 wrote to memory of 4748	1968	msedge.exe	86
PID 1968 wrote to memory of 4992	1968	msedge.exe	87
PID 1968 wrote to memory of 4992	1968	msedge.exe	87
PID 1968 wrote to memory of 4992	1968	msedge.exe	87
PID 1968 wrote to memory of 848	1968	msedge.exe	89
PID 1968 wrote to memory of 848	1968	msedge.exe	89
PID 1968 wrote to memory of 2896	1968	msedge.exe	90
PID 1968 wrote to memory of 1648	1968	msedge.exe	91
PID 1968 wrote to memory of 2896	1968	msedge.exe	90
PID 1968 wrote to memory of 2896	1968	msedge.exe	90
PID 1968 wrote to memory of 1648	1968	msedge.exe	91
PID 1968 wrote to memory of 1648	1968	msedge.exe	91
PID 1968 wrote to memory of 2632	1968	msedge.exe	92
PID 1968 wrote to memory of 2632	1968	msedge.exe	92
PID 1968 wrote to memory of 2632	1968	msedge.exe	92
PID 1968 wrote to memory of 4600	1968	msedge.exe	93
PID 1968 wrote to memory of 4600	1968	msedge.exe	93
PID 1968 wrote to memory of 4600	1968	msedge.exe	93
PID 1968 wrote to memory of 1240	1968	msedge.exe	96
PID 1968 wrote to memory of 1240	1968	msedge.exe	96
PID 1968 wrote to memory of 1240	1968	msedge.exe	96
PID 1968 wrote to memory of 3804	1968	msedge.exe	98
PID 1968 wrote to memory of 3804	1968	msedge.exe	98
PID 1968 wrote to memory of 3804	1968	msedge.exe	98
PID 1968 wrote to memory of 2172	1968	msedge.exe	99
PID 1968 wrote to memory of 2172	1968	msedge.exe	99
PID 1968 wrote to memory of 2172	1968	msedge.exe	99
PID 1968 wrote to memory of 3944	1968	msedge.exe	100
PID 1968 wrote to memory of 3944	1968	msedge.exe	100
PID 1968 wrote to memory of 4740	1968	msedge.exe	101
PID 1968 wrote to memory of 4740	1968	msedge.exe	101
PID 1968 wrote to memory of 4968	1968	msedge.exe	103
PID 1968 wrote to memory of 392	1968	msedge.exe	106
PID 1968 wrote to memory of 392	1968	msedge.exe	106
PID 1968 wrote to memory of 392	1968	msedge.exe	106
PID 1968 wrote to memory of 3184	1968	msedge.exe	107
PID 1968 wrote to memory of 4152	1968	msedge.exe	108
PID 1968 wrote to memory of 3184	1968	msedge.exe	107
PID 1968 wrote to memory of 4152	1968	msedge.exe	108
PID 1968 wrote to memory of 4152	1968	msedge.exe	108
PID 1968 wrote to memory of 964	1968	msedge.exe	109
PID 1968 wrote to memory of 2024	1968	msedge.exe	110
PID 1968 wrote to memory of 1436	1968	msedge.exe	111
PID 1968 wrote to memory of 1760	1968	msedge.exe	114
PID 1968 wrote to memory of 1808	1968	msedge.exe	118
PID 1968 wrote to memory of 1808	1968	msedge.exe	118
PID 1968 wrote to memory of 1808	1968	msedge.exe	118
PID 1968 wrote to memory of 1928	1968	msedge.exe	122
PID 1968 wrote to memory of 1928	1968	msedge.exe	122
PID 1968 wrote to memory of 3888	1968	msedge.exe	124
PID 1968 wrote to memory of 3888	1968	msedge.exe	124
PID 1968 wrote to memory of 2520	1968	msedge.exe	125
PID 1968 wrote to memory of 1532	1968	msedge.exe	129
PID 1968 wrote to memory of 1532	1968	msedge.exe	129
PID 1968 wrote to memory of 4852	1968	msedge.exe	130
PID 1968 wrote to memory of 4852	1968	msedge.exe	130
PID 1968 wrote to memory of 4672	1968	msedge.exe	131
PID 1968 wrote to memory of 4672	1968	msedge.exe	131
PID 1968 wrote to memory of 640	1968	msedge.exe	134
PID 1968 wrote to memory of 640	1968	msedge.exe	134
PID 1968 wrote to memory of 844	1968	msedge.exe	135
PID 1968 wrote to memory of 844	1968	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://azuremods.net/download/get/?id=32
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffcbbb9c188,0x7ffcbbb9c194,0x7ffcbbb9c1a0
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,7638311215443908860,3832976060169896519,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,12893814542311906496,6092734273725463870,262144 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,9049029214682678467,15270309570345034118,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,14314857171736842412,5586059545079076088,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,5093394502814611343,16869142942126801236,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,3107986979889630426,13898063083961053472,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,17590974859871893651,12226788459988337338,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5048,i,2073303660992259302,10895186504903447344,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5320,i,13261070800590450168,9665718792066275697,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5412,i,13734356701257877904,12479925599073847270,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,6793586513545079935,15817076373918079496,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,683317158834873162,9826900162537011971,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3906402262861082318,5757051276244266788,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,3906402262861082318,5757051276244266788,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6836,i,11074383544738093705,12786475353479286696,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,7586269190834347305,6045196837944939564,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3444,i,15352010626609640216,17189448717374445964,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,3597846232113838831,13178623275732167749,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,2051339907149270098,18296039845681716435,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,1256481863001381389,12060692914393665725,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,699214603548609993,7358891933237850467,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6884 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6876,i,3287690132641430836,9662123489423017713,2097152 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9768645476600678434,13223694514456898655,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,4963522524099627014,6039005141326775672,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6992,i,1766850727072949741,12843216928530740097,262144 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,11846578640893338276,3953283808374883896,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,7761335043012981569,6906124250443738221,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8484514150713780287,14270412550555562808,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,16504029760922812820,8226108382336087191,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3932,i,5325525638859342706,12310766669845677615,524288 --field-trial-handle=2316,i,17551225776146988983,11319024511518950951,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2432

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 fde5025ef66eed55fd88d8ade54159c6896f668960612cdc8ac646f38c6df2db
MD5 92fd10844698a944de0d2c25a0e93afa
SHA1 1449b369c4e6fcd8a01e721c49cb1ff8abbf0718
SHA512 6db7c50c102e0f642aa312115f988b94bf36359d77515a4972a61ddbac533d9fb04756ac734eb4054291d3cc6f89ad0157b4047c9a055152fdd82eff17da3b5d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 156ac7a3e58b4dbfd4209ac1224b1111be0f4c80ab2e08f9b18d4a9dae1e1935
MD5 ff9f222124b9bbd74aa999cb9391bd7d
SHA1 cd965783a530d0a1f8e6e681b6a8f9072193eeac
SHA512 e43c5c0ef508de633bab8b58a376bf6aa45c9612a9be8cdcda83d635b2eba2bfec98cefcbc750651771564700c3896f246f82fad46f6bc1cec9ea00bae6b75b1
TLSH
T11BE026553388C1E76A80B68FEA9E439CC1A27207DE8EEC5B761C608E264280082B4CA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fd3a7ba56c7418bb602136d5a2ff07cc03580be7a9013a587bb274ad4df976a3
MD5 de37ceee953e3d320fc8722f1c1cb37d
SHA1 4fac5fb986e55197f2bf31faa9b28a7f2c309bc7
SHA512 aac0a310cd5c515f8ddf7a42e2b8dfb54fd14286c87fff5f8fa5bb3810153230386e18293d0d81d9a9bfb0dd33a0a47b1a3aac54fc630c261c04bf6b0ae8cd1c
TLSH
T11DE0268526C8C23FD710A54F626C830CD2C2360F9ACAAD1BA7188889F201240E6E2DA0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6586cd2bf363113de92f58935425edce70e05a8f0ca5ad30487e18cc12a53dec
MD5 98c623c47b8f2c2aeac6585061c988f5
SHA1 a81623a8caa9728ce3b1db387aaa028c28fcabfd
SHA512 897c5312b12defcaea63714d477c51457f871b2e7ed0b9bcd19636bf9ecf8d67a5bb314d2a8ab9986866a1786a192bad950fc0a063d56a892973d596579bb778
TLSH
T17D71292552FE039DF3262232F1DA4A1834F3679B4E977D5E12AC8F7C2525B349DE6408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589de1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589de1.TMP
Size 3KB
SHA256 7186dd69b66d9fe40be0a4dcb10ffeac0f73c7d139bbd78d6d0f22640f16f6f5
MD5 9d33a00cea10138b841157a6d837f09e
SHA1 f55777c6133557195b4a76a02e97cf00597ec134
SHA512 be0f1b4d022df5ea7b3bed75062e2e6d9e9bebcda3be3e63c5a2087a536ae4bbe9cdaeec7c1513b9ebbc48bafb7e225009587677f722c4d121db7cdbf4a3c9fa
TLSH
T147712C2952FE075DF3262232F1D95A1834F3679B0E937D4E10A88F7C2536B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8aa790f49fedc8d6a4bfeef2076ca25ec476ae952433a108c3ac132e0d6cf836
MD5 96c70ab98207f204f4e9f2b65a5adc6d
SHA1 5070af43afc9775fd34dba2a86ed1726da795eab
SHA512 7b11dec6757a21a8fa7eaf0b4a447b38530c841e9ee437a44132eba680a49641dcf6ed8fcdd26e120d6ecb0e60936918d6f9155c434341637d3cada849c1f0d4
TLSH
T1AD71ABB3C7D9D66EC81642F45714AE2ACE1C091D42683C2BCEE5EF8F97E2471E14164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 dde1af89de7505c7b1cbcf237b4f668d7f1c9851041258253f968d2928e06b70
MD5 fab6ebb8665361e9da4a3bfc3d3aeabb
SHA1 c42de5b0fa47717850602a5a9858ba45aac79ee5
SHA512 4db754c9fca5c52dd619ac3cc9130f3c1a44ec876bfec6b1e9f8d450089fe7670fa2358f23c11a37e2d2d2cb16d9e4a05bde322984ab313f6d752b461ab5659e
TLSH
T153519CB387A1D6ADD81296F45B04EE2FCE1C181942687C36CEE1EE9B97E2472D04174A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f1cf9eafb3500176966a97c097713dbfdb9f008d4e6694db401a09ac4b5cf31c
MD5 b0fe933541828e8de214fd93bef3d72f
SHA1 38aab957957bda7c0ec4552672081b52d37fc6bd
SHA512 9ee8b27e2c2bf7413e57902c78b6935590be71106efe000f1df066c7ef6bba2c0ba5908ed9b0ef6696efb1debb39a45301a84f1a1d7a8e00a3a7163a47fbf3d1
SSDEEP 192:sxZRRyyM/jK1Ml8MkS/fosjwkXIdpg2YHW6+WNPRh/Y4pv19IgrJ:sxZRMMS/fosjl4iHbD/j9
TLSH
T1FE52E7116A346A77CCDBD20DF951BB53D6F80572A2900D54A9FCDA1C08E6AEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 4dee3d382dc6953ab1865bc720a50e036b835f252de3ecc1abcc55c408c36760
MD5 fc49a33a1d49dcaab0808854ff6894ad
SHA1 93f7b1affe98a34f5738942e834d6b0ea8034eca
SHA512 eda7bfccd041317fdf1d163f25092223e5146b18a58d14d0a513efc68fdbab14207b5dec0ec26d3f3e2a50429e348ee3af6fdb45ebf683c7e584a1a4a395e2e2
SSDEEP 192:sxZRRyyM/jK1Ml8UQH9S/fosVKkUIdp+2XHW6+WNPH9dY4v2ov9Ig55J:sxZRMqdS/fosVzNXHbFdlh
TLSH
T1C352E6116A34AA77CCDBD20DB951BF53D6F4457292900E44A9FCDA1C08E6BED6207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bbd7f5ecc11e361538c69c203409fc42caa9900ff260831ee1f9b1fc1f3edee7
MD5 97deb8d1df38c80dd3d441bb5870a31a
SHA1 a351ce7f00c66939094edcdc14468e9e9d7a4e02
SHA512 41c2ec88dafd5a774bba0c48deb67dde6fc4d0fa07fe89446b865c1e537d16f91079367b31fd37f5a7a4de494ab9f6f46c05fae4c63476b0e76f0af0236bcf7d
SSDEEP 192:sxZRRyyM/jK1Ml8M9S/fosVwkUIdpg2XHW6+WNPyyXY4Wv19Ig5bJ:sxZRM1S/fosVlNVHbfXaf
TLSH
T1B952E7016A34AA778CDBD20DF951BF53D6F9453292900E54A9FCDA1C08E6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ce609907425d28936e3e753c52402e0f00b1759e40f5e62efc72383dfd0e67f0
MD5 47f0ddf4b0d1be81f8ad99af0f2b458c
SHA1 20e7151abfc2ad4f99d3a41e49491e96e3045fff
SHA512 f48750c21abf75afcbdc4768b6174816e4d50c3cbcce36c95355838f07693c68c288cf883c51f684c4f40f7d7e28dbdb551e28396a043929b54ffbe55085517b
SSDEEP 768:KI8iJPNWvx78r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdprohkO8Uni:KI8iJPNWvx78ru1jahALocdCcUi
TLSH
T147E2EA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EA512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 a668c8e9318213e53f34d8b76b8e8b1c21c43a5642a669ce4cb42fb0553a8ddd
MD5 d8520735cef2ceeb1be4c1498f93752c
SHA1 10e230b9aefb7769750c6b977b1db55e940313f4
SHA512 43867408558ab75456fcbca18247162c6fa09bcb2cd0f18ecc8ffb07ff8332be6baf5aef677c369cf5c3d429e3d96616912b041f1411a864f50d5cf5f4e7eb7b
TLSH
T1723165494DE5CEAFECA4427116B25478337494DC1765A653983C3130BD2737A2A4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cb2cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5cb2cd.TMP
Size 1KB
SHA256 166af85054e191d3502fcb7f08e75fdcb5aa9c45fc265feeddf0cbeb18ec0184
MD5 b838105ead672b41b4aa9fb4ec12b45c
SHA1 1db717044f334f46f34a9ba505642fcd038aa546
SHA512 ef0bafecb4bdaf5aeb5a13c9a8f831684d369a88b3a1c5ab49b926194a28765aabed8f668fc0c355314b0842e2933c7cc98f62d95b10c130e9d6898deaf256ba
TLSH
T12931A74A4EC48E1AECC4407B0EA3A4B8733999408316B783947C5138BD61BBE1E4E0E8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 8644c1b456e74ccf6fec7dc770073c032ae8d983fabbe22283d674d7fc546de5
MD5 eef5f9da792e8283a5e75568e30bb35f
SHA1 28b95150786974d747d887fc5c91286a36ffc425
SHA512 79a4a8983f052c29b52310f29bcac84abf00f8aeb7ea46c038a1b9e0d17c8161da624cc97d597b588197d8a3402c4e7783d22f0ae1d1466a0b3a20aa13c432d2
TLSH
T17AE0C0F72EE72880FEBF63E1187198B00241B459D584BC8F2416FB9324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5e5b28d1f933d066ac10258e088ff1427ff69e4d9fcee360bbf7dc8e053d4bcf
MD5 570535e459cd641a5f8a7e4f20db50fe
SHA1 1e78a03b7022b30459e7be737022af5141629fc4
SHA512 713914064f2da6c838596d3afda2028f6d8a65248204499716ae992f8536f7c45b46755a4bb76b8e1b1b585f22ef4e6d7c4b033d67249f01bdd083bb076d61c1
SSDEEP 24:KdXfu1Mapdddt45V+AIjptKiahant1E/9SmHMC89WyXYtfo7Sa3df7z4Lv+CIjnT:K0YIjKlqcbyRyIfKnqon1IVKOgwHyO
TLSH
T16191120730BB12513D3F291C9A929A169B8276633118F43BB7B840B11E6BE240CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590594.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590594.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 48d3972addbc70d3bd67f00886aaa98cb6965ca34a34ba82e35d83e27e750506
MD5 2603a666316a32c3f4b292d2919496ac
SHA1 6ccf7c3452a8c6e088c49c15eb33f4f8a95a4e10
SHA512 67da20d96be8fecbe38eb14f47d3b7b912b801be736eff1b9d2a6312ad0bf6f009c3dafe179946d15a3bcb6489052ac6efdbcc3ff33901da350d088c331905df
SSDEEP 384:ciFiZcIkFsNU8TUNTUlIlD1u2v4GkywmfyrnTKwBODNZOCFWk:HFQKxwgDc2XyrnewBKZOAWk
TLSH
T156D22AF218E7587AD9AE5747A73E2D038EBCC163B5846A50B7D8561CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c73fbb3f97b709c00c502a0023ecf05fd785c0edf6bbecb54ac4c0aa300cbcd9
MD5 f542b7b5efe2684d49df6f560531fd93
SHA1 5f7153785001202a4572afb37c9b4fae0668a777
SHA512 d229a3158becce0a18a53e5eca8d78dd1e87d8a6fab6e050bc26a21a267285209841ac471cf583c120fb52840a3712a7fb4e5295fdb86424c92a899a55444c30
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5U5D2BhPwivh50xy0SFYKNAxOYou:gONw6kDfQmiUyGmZ903iow+Qib90oU6
TLSH
T13F02E83568786CBB8EA3AE49F44737275FA4117BEAC52F84DAE81B1C04D725C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 cb15bc59de17630eb617dfad9c89231339313ece827a1ef7586e70f839fbf9f8
MD5 faac059361c870e6bf10088ad634b010
SHA1 8943ddb0edc7fb4dc81e7add08b12c36d3ffa77c
SHA512 70593c931d7449a1bf84ab2aeaea7c70ccdc9b97d198adf1d0e3640f175b7bf9397c7452809b0bd326cf40aad945fed2a2adcac5298ed89d57f8fd43755b49a2
SSDEEP 384:uZcIhsNcD1u2MLGkywmfvrnTKwBODNZOCFWk:MhJ22XvrnewBKZOAWk
TLSH
T14A928D716C386C7A9DE3B54AF84732078EF89167E7C82FA4D9EDA71C05D52981307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c7dca9aca3055557c5c4e07e95d1eea99b397e09fc8fc19949eef8232c4a77f5
MD5 28b1a2a2aed99464d8b85e3dad69a57d
SHA1 136f9a40b3181717177fb377bbb7d52710cdbca7
SHA512 74e338edcbece130d9f11912874feda07a6e0683038e48f49e042fb792d567b774000c68498ccce97d3fc941463d26c76103e31d95305703a214ed062ee1a193
SSDEEP 384:uZcITsNcD1u2vLGkywmfvrnTKwBODNZOCFWk:MTJ/2XvrnewBKZOAWk
TLSH
T141928D716C386C7A9DE3A54AF84732078EF89167E7C82FA4D9EDB72C05D52981307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 038bdf1143af8df0affd8b757754ee70b16d555ae4dcbbdf6459473800152fa3
MD5 21482b8ddfcd584dc580927eb7bb63b6
SHA1 f7d905fe3b9ab8c0451090097c653b48d9ebaa37
SHA512 44e19180589a227d32cb31ee8636bdb14a8bc4b1ae86c9a7da450fe77d48d5d195160e1202afcccf45b36302b4ea6032792f61139ee31252b2b020f73f89d4f0
SSDEEP 384:IZcIhsNcE1u2MtGkywmfvrnTKwBODNZOCFWk:2hGE2XvrnewBKZOAWk
TLSH
T140928D716C386C7A9DE3A54AF84732078FF89167EBC82FA4D9ECA71C05D52981307D22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d652a5cdb141f8102aacbb55250828872bdd99f28c1b12c99b1cc6ade36c971a
MD5 ba9bae799c607579eebe703785e2a1bf
SHA1 892049ac1c2d57fb8f4a58ac9907cfd818cf934b
SHA512 1f62f90b26c8930052e4f640f96110d16f8511307c1538ea9a0821cb4ec5e08e0acc85d41817ddc4096863ff77f6fa2b668a8d735b737c2fba16130edbbb7dec
SSDEEP 192:IJON96kOQmiUycmS903iowmcEJrcRbrq8U6:OON963sS9ywmfGrU6
TLSH
T1DC122B316878AC7B9DE3A956F48736139FA48127DFC97F90D9E8261C05DB29C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 7cbc76de60bccaa8c0b59faef259f59f91b4d3d1c638c507feb98c6e92392e5b
MD5 d673488d3bcdb1e17551370ddff51594
SHA1 e7da6e5829f7f159bc3b4fa4f76adfc2dcdc421d
SHA512 08c5c40d8ec820a1f526d41dda7457db0e8442e77a8627626a49bad7eea94f3877abac9d364313740725f246903f4559039b98e4b2c917b58e278a5cb30c45bf
SSDEEP 384:ciFsZcIkCAsNE8TUNTUlIRncu2k4Gkywmf7rnTKwBODNZOCFWk:HF6XApwguB2X7rnewBKZOAWk
TLSH
T172D229F258EB987AD9AE5747A73E2D038EBCC163B5845A50B7D8661CCC921BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be08d22f-0478-4cb2-8f09-f29477fd310f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\be08d22f-0478-4cb2-8f09-f29477fd310f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 46d4fad0f86a715b066b8db59d9a08810144e23c5e9007f46168da1fceedf273
MD5 60076f5c152e93aa746598dc58836c62
SHA1 cf6871568fe3d05c96f4dc25f743710fb5f1e332
SHA512 9bb6e90299ce98b48540270a4823a626b61224cc1ca3f8c74ef36f34da410fb62a4e6608509c2167e86ee3620f4adc472025fa4a83a841c8fd72e0661b44d7fb
TLSH
T18141F85DA7E91148B3B77E1AABF6A86D48BE79262F0B845D00110E8F0662B00C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download