hxxps://thuytrang-shopeee[.]muahang[.]pro/tra-cuu-don/ffc6ed40a5ffc27ee80afeb875c10d6b

Analysis

user interaction
yes
max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://thuytrang-shopeee.muahang.pro/tra-cuu-don/ffc6ed40a5ffc27ee80afeb875c10d6b
Sample260810-e2g7esvygt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2384	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308095762152428"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{6C00A7A0-9718-47F3-9E2F-895CF45C6021}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
672	msedge.exe
672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe
3584	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 4140	3584	msedge.exe	85
PID 3584 wrote to memory of 2384	3584	msedge.exe	86
PID 3584 wrote to memory of 8	3584	msedge.exe	87
PID 3584 wrote to memory of 8	3584	msedge.exe	87
PID 3584 wrote to memory of 8	3584	msedge.exe	87
PID 3584 wrote to memory of 4284	3584	msedge.exe	88
PID 3584 wrote to memory of 4284	3584	msedge.exe	88
PID 3584 wrote to memory of 1028	3584	msedge.exe	90
PID 3584 wrote to memory of 4684	3584	msedge.exe	89
PID 3584 wrote to memory of 1028	3584	msedge.exe	90
PID 3584 wrote to memory of 1028	3584	msedge.exe	90
PID 3584 wrote to memory of 4684	3584	msedge.exe	89
PID 3584 wrote to memory of 4684	3584	msedge.exe	89
PID 3584 wrote to memory of 4424	3584	msedge.exe	92
PID 3584 wrote to memory of 4424	3584	msedge.exe	92
PID 3584 wrote to memory of 4424	3584	msedge.exe	92
PID 3584 wrote to memory of 1452	3584	msedge.exe	93
PID 3584 wrote to memory of 1452	3584	msedge.exe	93
PID 3584 wrote to memory of 1452	3584	msedge.exe	93
PID 3584 wrote to memory of 3700	3584	msedge.exe	98
PID 3584 wrote to memory of 4340	3584	msedge.exe	99
PID 3584 wrote to memory of 4340	3584	msedge.exe	99
PID 3584 wrote to memory of 3700	3584	msedge.exe	98
PID 3584 wrote to memory of 2008	3584	msedge.exe	101
PID 3584 wrote to memory of 4684	3584	msedge.exe	104
PID 3584 wrote to memory of 2472	3584	msedge.exe	105
PID 3584 wrote to memory of 1120	3584	msedge.exe	106
PID 3584 wrote to memory of 4984	3584	msedge.exe	113
PID 3584 wrote to memory of 4984	3584	msedge.exe	113
PID 3584 wrote to memory of 672	3584	msedge.exe	114
PID 3584 wrote to memory of 2800	3584	msedge.exe	116
PID 3584 wrote to memory of 2800	3584	msedge.exe	116
PID 3584 wrote to memory of 2864	3584	msedge.exe	117
PID 3584 wrote to memory of 2864	3584	msedge.exe	117
PID 3584 wrote to memory of 1504	3584	msedge.exe	118
PID 3584 wrote to memory of 1504	3584	msedge.exe	118
PID 3584 wrote to memory of 2056	3584	msedge.exe	119
PID 3584 wrote to memory of 2056	3584	msedge.exe	119
PID 3584 wrote to memory of 4944	3584	msedge.exe	120
PID 3584 wrote to memory of 4944	3584	msedge.exe	120
PID 3584 wrote to memory of 4508	3584	msedge.exe	121
PID 3584 wrote to memory of 4508	3584	msedge.exe	121
PID 3584 wrote to memory of 2816	3584	msedge.exe	128
PID 3584 wrote to memory of 2816	3584	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://thuytrang-shopeee.muahang.pro/tra-cuu-don/ffc6ed40a5ffc27ee80afeb875c10d6b
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x210,0x23c,0x240,0x238,0x25c,0x7ffc0125c188,0x7ffc0125c194,0x7ffc0125c1a0
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,13836888647420148579,6098422783516473628,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,18126741002459554384,2262298042662809150,262144 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,16600943075291672538,2565213208048462421,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14367459897673859834,3216884694489514221,2097152 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,16470721999139069392,2901431651174094528,2097152 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14564632867202432029,9681108349432144683,2097152 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,7842102130457170548,17910594147075372292,2097152 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11033118892910675827,10017965072414178036,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12437749644018761966,3106059767965835457,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9316187031066259883,11806258249079836506,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,9316187031066259883,11806258249079836506,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,978115049960482674,11539886339506013363,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,5274095415587123841,11072132700299201992,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,2254420034928745649,15705520818158640192,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11042107018499740817,16174924661225240389,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6088,i,2091358396303773296,12747217133749072650,262144 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5652,i,11260333115454517266,6471396049159618233,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4048 /prefetch:8
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,407113351977223184,2488368853209368961,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,17004514965030585933,13886606070664643305,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,12507549319174304762,7745941012877753096,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,13866244078604334008,17998701151731716485,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,9791842700676784437,4085147593068886077,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5172,i,6227134475089125860,9612514472099047612,524288 --field-trial-handle=2308,i,4163686537157698211,3876149966986842906,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2816

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 70ec916fbc4bdc762d303a32b425b3e0261fdf5d4861f31961987ba096c316ad
MD5 996e8e432c1af85dbbc9617643df9f45
SHA1 d0195d75db411ad1a86b9c76c84c53d5dbfa292c
SHA512 e3b70f66cf03c6c9999788962930b9cabd2ecfa0b384ab514e85ba204c430600ab36e315c9acc46dffdc31af52289db2f445b572d3c1a4cf9868b5e4604b5b6b
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7m:fwUQC5VwBIiElEd2K57P7m
TLSH
T1B8B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 53c644d2513db01d05056d86513bac7466113ecfbbe2a0bdbc6864860d841ff2
MD5 298e9f5ffb41c632e7669a739a05b87d
SHA1 709f44ddd5345a3cabad8e76d4d66d68969ab277
SHA512 955cf07abb0e6cc1c7c214d95be1a17e59606c12698c0d33be82ddc17c7a8d5b61392a092a4d7b68191d54ac29487bd7bd1db18e3d2267aac5f34ac010c183bb
TLSH
T1DCE026E488CEC32EFA50F64B916C4B0CC2813B4ED3C8F9DA1740C8C83489050EBC3591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 ab4a6a30de4d35759309e7f6cc62b5e9a1ec8d0fad259ebafd6c6f0bcb2f4e37
MD5 670991e41a84e5c76a52fe38e6b63e6a
SHA1 ba6b2d10c75b62e486b99316836711461a57c6bb
SHA512 64af1edddff28dc9a2e77edfdaa5fc43cff83fed4a67f1f49d20e4207a32e0a82a7f9d34c8ea9ce0372aa510ab8fb052c2c11883ac65d028bf59455c819dba68
TLSH
T1F8E0D8B81ACDC5A58E859687E8A4523FA81071859E9CE4DD27C4F08C2C4C0329AC6884
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 641KB
SHA256 aa93ecff5e30c7e300874955e01a32939026067cb0a5aaeeb0cefc5533711bbe
MD5 f52b39c696d02035c303b087fd242b6f
SHA1 e6c9c214aa96530f88264dbf7dba48c8bc693adf
SHA512 b33028260560080ff9854c1becd702656925e59857b3e78d6a1deeb0fe9e7f5300f8a6178ca4086f975d41d13173a020c24ae2fdbc2e269c8f4c254d2c4241e2
SSDEEP 12288:gutF9ZBghFx+5BwD5HvDj8eG2JrsKn88qWu2OUlIzoozCABj18lFgBGGGsTOCXN2:n9ZBgLCB4rG/p8qWu2JloCAPQ+E
TLSH
T1C6D423DAE38273B064C17276732040EB5DAAF8B9545AB90215ABF1FCCBD87D711D6AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9f1ab954e9618a395a9102c3f467212b95ee1a6fced5aea2dd7519ef5a1ff265
MD5 eac6326ed754487bf3f67994867565b0
SHA1 6ae2811e0ea8740088de0eb96295c25bac9357d1
SHA512 ff0bc6d9c3ad91bccbb5de43f12ab6b75aed158fbbd1b35f0326bc52724b200bcab5666e2053204c75493d88d5899a8684808a8ac4b5310c23bbf463f26ee13d
TLSH
T1CC715CB04DDB0563FB61803168E333667731B7FAFC175EA902E24B3527A5762F46A024
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5886a0.TMP
Size 3KB
SHA256 594fd3ce3e8eea12306f07dfb83c1c8b2fc46b56de5b285dae9ef8b8ae8e9b01
MD5 17f6141f1f0d8d0ce45cb96816b5711b
SHA1 0be9473724af85dfb67bf0b01ac3177f6b7093e8
SHA512 960397a5c9ca300d7a9c1f4ce8f85980af7feb51f004554e0d7d260945bf39bc8cb40190a659c89876612dfa155442ea2a7028f78f6e248ebd0584de63ddd6f1
TLSH
T1ED715DB04EDB0563FB60803168E333667731B7FAFC175E9902E24B302795761F45A024
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7aae45ea2d92582f819615be371ea0358ed4000ee76f678a4984aab5baa6d8c8
MD5 df2fe992df324bdf8745d57978567cb8
SHA1 be3973af0ab306c73f3b9f2b82f862f6f4c9eaaf
SHA512 24ed7638252cf67acf443c3325346c7dd502253658e871d67bb543ec69d77b33dae8ee9d5e9232990c875e2d3444ca9e70d06bf6d419f9040494c7ea4e3be3a6
TLSH
T153519CB6C3A0825DDD0156F49A14BE2FCE1D0415473C3D398AEAEE57D3E2171E202B9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 839cf8fff2faae8b812c4543722f940e187380a3b19159d352b75dc8e60f6e5d
MD5 a1713e2d834de3e67582cfbc1bbc80a4
SHA1 6cdc6ddeff4c3d0721b09e60e05826e14651d88b
SHA512 b6ad880a40f42ad472d4437da3b665f0bdd2e820c444437559bc44a6c85fac27d416059c44e8ce53745762c16925b294cb916559d321e14a085a07faf2ed173a
TLSH
T120515CA6C3E4866D980116F467147E1FCE1D091843383D26CAEAEF5BD3E2171E212A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4d786bfa3072d44d22b500d5bd4029477782525d67a47fe6a96fad9deffc2301
MD5 d34f6b3f4e670776871f58c6d837ea9f
SHA1 9be70f9a60d864a2c956c45c6bbcd40abdba56c2
SHA512 e5126f16e9d34a17b58e61d0e44c459b5603865b4d1b6033b0d849bcfcd7793359fc0e367db779527b8f54ae34efa2effb9df26ff62132196613920eaf62a44d
SSDEEP 192:sxZ4RQyM/jK1Ml8Mku/fNsemKIdpRqgl5HW6+WNa65/YICpX3IgU6J:sxZ46Mu/fNsemDFHbx/uU2
TLSH
T1B852D8117B34697BCCCBD209F955BF53D6F94462A2900E54AAFC9A1C04E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7f19e630ac3aa4915e9469a3ac2654962022577d7d11e49df2515ce651b71877
MD5 81f2e682d656fe11068f71b2a09a9ee9
SHA1 cf93894469c474e1d452b21069e4e0c059ad700a
SHA512 5d867146c1a3319efb001e2cf3ad8aec313ab2ab9a3b486a881b928b7a5ab1dac13f2723affbcdc1dc0685ec95d13553e14eabab9595a30c0c6b8eca5735526a
SSDEEP 192:sxZ4RQyM/jK1Ml8UQP1ku/fNs/uKIdpfqgl5HW6+WNa65/YIAA43Ig556J:sxZ46qP+u/fNs/uDPHbx/Gj2
TLSH
T19452E811AA346977CCDBD219B955BF53D6F9447392900E44AAFCDA1C00E6BEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 18a9faa62e31c7e0ea2f4b710c90852a15555f7a7598ccf31e5e8df66a4267e7
MD5 814409950e4c929399a9983ec90f3323
SHA1 296122510f482f553ff4e3b9700354082fa5cb23
SHA512 5dcb2ec06e7ebb1c1e5ba847c20c417750b3be9547f7e26b0af9e984d57c73b4ea54be7b5ed7c8693cd4324aec3318b99423c46480637ffc5caf006f50918d12
SSDEEP 192:sxZnRQyM/jK1Ml8UQP19u/fNs/uKIdpfqgl5HW6+WNa1qdYIBA43Ig558J:sxZn6qPfu/fNs/uDPHbpdZjg
TLSH
T18962E8116A34697BCCCBD21EFA55BF53D2F9447391901E44AAFC9A1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 cf88c9c5751792b28de595c79977f136a61a2aaf871b6d28d9de3823126eed5f
MD5 02731414f57e2f5e992e447613122c66
SHA1 f8e500c735ebdf86624edae575f1137378d94d69
SHA512 9757cc9dd08e1fc8a1faded83bdd0b58dd5919cb14b76b359b187deb55158c420ee579083d7202574de57ad17781e3321181c480858b2543650fe9e48c593887
SSDEEP 192:sxZ4RQyM/jK1Ml8UQP19u/fNs/uKIdpfqgl5HW6+WNahfXYIFA43Ig556J:sxZ46qPfu/fNs/uDPHbkX5j2
TLSH
T1EE52E721AA346977CCDBD20DB945BF53D6F9447392900E44AAFCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4edffcfa73dbd1d54409016648fc48dff5c4feb91960e6450daae6f969f2dc51
MD5 1849bed9f830689b076906c7a70b6231
SHA1 9a057833402ba9471bbf9f60c36d60fac6634d00
SHA512 c2a225696a42f55ab678f517f9efa1dd011b78bd2b1e369ac36dfece1f675cd7c56a27c26e5d8dc806793595150640bf8918ac3f0df829e76a33741fdf0abde6
SSDEEP 768:AmsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9jro4hh:AmsqxXlWvJD6Tu1ja54LAs9Q47
TLSH
T1D8D21B3B694CC77E4F840E5DEC266FD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 e6346af673bd38c090a6e8f44ab7d1256477ac7ef742dbb1be63fb68bc843050
MD5 ba4ac12e4ec21106eed204d697df56ee
SHA1 4889f0fc66fcc06f77da195c61be72e141ef40d7
SHA512 14da5b13df6197923d21fcb54ce81c55bbd7954f40a482b3dde16b4a1d8434f1b75509e22cd1f0577e81e63abaa53cc054eb0b8d38bd2b7aabfb1a66ef8a327b
TLSH
T1C331518E8E5099DFE8A449B2047261B43670C9CC6B01D7134C7C61373D2736A2A1B1EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cc23e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5cc23e.TMP
Size 1KB
SHA256 3116e05cb4d14c0ece1ae8323c7a4c50e47e7bb7114c3d37ab26699921a3ab72
MD5 1be2f7f0162fff2cc27f8932841eead5
SHA1 aa8e1884ee406bd2ced245b0eb6ac5c1b95c5c37
SHA512 9d38bb2ea34798e2a56e1821929f419955341ec24a89264886eac5238bd7bba475b129b940e31418bc74068bbc669f6b8f9454f5ddb2f1df8008b265fb4a9211
TLSH
T1DA31938A8A418A0FE8D410720997A4B8337AC940531277C7987C6239BC763BE1E5F0D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ad1f100d3f727e853d31de14b61a3fb71760905af2bb2aa67ef122a888a6d427
MD5 592a1c6e703ba7848d9988a7b1e9d357
SHA1 55c0c7b05e1cff2a5c759379f1cdd26c3f45acd5
SHA512 1acec13ced9a13eadf2230c4d1cf15f6d4d09c5d0c60dc3f2271b3260fcd1b8bdc8a53670c2198e7ac795e6ae4d3500f1dbe5eabc611ec5d4b34c6186f737536
TLSH
T1D6E068762AE70814A8ABC3DA087244964514F428CC51EC4F0129928310622602832C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7270e2616be2ec9d152f8b161d61e6c67fffcb52b33d0af2c990e90499f02803
MD5 d804922dad6de0c64d3c870eb532f584
SHA1 621470bf4326d6809e2450c3ce17f1e8033a24cc
SHA512 49a75d7cf209bb576ddd9274d07911c9bcf10af960be817ab212bd82835e51f56b6ff23a8e0c56ff68f0d5cfe708fd653ed8741819bdba04ce3fd2861330199f
TLSH
T14AA0022B01650091CC902671AC7213A462194C986E115321C1A55A65DCD12C0411250D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587ceb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587ceb.TMP
Size 48B
SHA256 b1f7699c2343af26eb4449f0f0520d503f1bf6202a4ba19e62c875df4dc2b861
MD5 89c2a35d43003146e46fe5b808276683
SHA1 4274f685f895dfe3d38f51812976a18c68e3515c
SHA512 1eaa3a6dff3740a00bb1e6b4367abf26fba37a7537b088df518677de27cc9b3650c89270538bb55f9aff52a754973d4c27437945584046d3552de58452a15f50
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 2f8cc581e86b562ac73e483dfcdf1a0b96790b678915c77e8e847532b239f5fc
MD5 3ea6c4553eacff334b91d76b72be532e
SHA1 404e183043c1dc5706f7acb161a5722c62c4e337
SHA512 abc45f04d010114b68c8a6eeecbccbe79cd99e8d55b491e9f4004fae1a0827a80dc6b863cebff279ea289526c03896b7da2e23d3712010dccbd2b6914ed14d18
SSDEEP 96:KYbaKYIK+P6Ko8uutGKuIRJKKqQaCMwKZ2y68K/KGg:ExZBdPxzSzg
TLSH
T1F3F19A52313B82023CBE690CA67AD5378E8372A73518A56F7F7860724E66E124DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2f87c348e7db6348134fef51ca08777e36bc87c39bfaef72398b8fce023e707c
MD5 a1d227239836587c5b5009730bcdb6ec
SHA1 7507c47b03571d3773e3696b6b57b0927911321a
SHA512 1acd68030948f88a636fe9626ec58aa92fc292593f93813db587c8e316f2db2ca4981940349d2fc2b01c17dda500c241d465f9fa45e8545e6dd6d9291a0bd40c
SSDEEP 384:6ZcIhsNI4q1nbwKsVRNVOK+t9FWZ6HlytEDq1i:4hVCHVOKs9cZoy6Dqs
TLSH
T175928D3159741C375EFBA505F84B36138EF85027AAC86BD4D1ED9F2C01DE599131A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5346555164584b1c83a70c7eb00198051682ffd95b7030a9eef46e61ede0f4d9
MD5 352232fe9b8b1f97d5bca7691fccc333
SHA1 601cc561e99dd7839b43c4ef620821ba962d04a2
SHA512 ede0ec340e1c57d15f9daf48ed254c5cc7e867ce86696a94bb78cf5db7c2442b850f0df030a7816183e5ee2d52a201801ba776db19aaa71beacc919086de0a9f
SSDEEP 384:4ZcIhsNIeq1nbwKsVRNVOK+t9FWZ6HlytEDq1i:GhXCHVOKs9cZoy6Dqs
TLSH
T148928D3169341C375EFBA505F84B36178EF85027AAC86FD4D1ED9F2C01DE599131B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5d3204f77ea0f57a621989c3302e82d802aa5f47f575edaebf897e10f85154bb
MD5 d6c3fc04dc13f412d233825946fc49f6
SHA1 1ab45e2c10624b72b8356e51b33878fbfe305140
SHA512 ffb6b977a794b9645e2f069fd07ff80ce6a545237f4b204ad7ff649b80b83c84acdbe5796d360de3f8a3df893dbd22c87efeac5cea222b701fc9b50b3ee66e05
SSDEEP 384:6ZcIFzsNIeq1nbwNsVRNVOK+t9FDZ6HlytEDq1i:490CHVOKs9pZoy6Dqs
TLSH
T1ADC218F058E70832D9AE6307A77E2D134EBCD027B6845A94B3D85A1CCDCA5BFD31A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9820ff789397f1f6a66845e5c98e17a2dcbf43bfc0337e536233a60a1c329efd
MD5 37e2b1b9d3f3db151cd9fe78a06cea6e
SHA1 223eeeb036894eb32ed6f3707f3b154988bab1b0
SHA512 f3f1bfcd97957f09e0ce36384aa068ce79f5853ae08c542ad1cf01bc9a2691eacadd20e65366df37c853a7950c768d2bea04682b5366083c01441e4e9bb8ae56
SSDEEP 192:tONc6JkRtQmiUyCCW+RNVOmSY+y9h3gReU6:tONc6UrMW+RNVOK+GpU6
TLSH
T1F002E8356D382C7B8EF26E0AB48B27175FA9203BB9856F80D6D81F1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d1f362293e04fa898d5633367400533bf13b01f3a0df20050863926e12364514
MD5 6a42bc4129700d6901079dbde6a1f3c7
SHA1 d41078c6a064654a3851aa79137189bd6fef7a31
SHA512 02ca75bba634522a5cf3c9f26c89f858a8bcb32bc37606e9fb534d4d31659daefc8e8637421898a5009addd44dc0603d959cae9bdc99efb0d11d05bd1c0e8e85
SSDEEP 192:mONR6JkRaQmiUydC8+RNVOmSY+y6l9nF4VcHqFkU6:mONR6UWj8+RNVOK+t9FPZU6
TLSH
T107121A35AC385C7B5EE36945F48736178FA95127EA896FD0D1DC2E1C02DFA9C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 fc7dbb1680488767c722ee8edc8bed5107a5451cc39a9930c2af4c0c40c36b86
MD5 d2055e9a6a4cc23b1dd5a553dfd2507e
SHA1 c064ed61c3aaf919a87e33e9a03de0d4e65954b7
SHA512 2fc2c939d2e0c86f2abf5d31ade61261bf22417082d4e8b0ca2b5a068e1b0e9132461d6c37f3da28ee8d5a59dab3a77cfa38df5495750ffbb19b9805c45bd83b
SSDEEP 384:6ZcIFCsNgef1nbZNsVRNVOK+t9FQZ6HlytEDq1i:4gaCHVOKs9uZoy6Dqs
TLSH
T1EEC217F058E71832D9AE6307A77E2D134EBCD027B6841A94B3D85A1CCDCA5BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67d24e9d-752f-4622-b8e7-9449ceff9ce9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\67d24e9d-752f-4622-b8e7-9449ceff9ce9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 209539532f4530a28f89a3d4a164d4e87a6bd8bf58485114e650a327e3da8f0c
MD5 e23a13adc67a28c3b56e44bc7e5040af
SHA1 9ff79a5f69c88c5443beffb63e033f9bb2b1ec57
SHA512 14e28d9b7ee6c6e9251ea5155904209b49c1089ccb5160ead64df780e6a811e9415001d08d48a72e983e2d7e3cc485a7c0b7112de36e3d44265815d2620d5605
TLSH
T19641456CBAE91148B7B36F5AABF6B86D447BB8772F06C09D10010E4F0623A80C871737
MD5 SHA1 SHA512 TLSH

Submit Download