hxxps://getsolara[.]gg/download

Resubmissions

10/08/2026, 04:38

260810-e9efha1elf

10/08/2026, 04:14

10/08/2026, 04:13

10/08/2026, 04:12

10/08/2026, 04:08

10/08/2026, 03:57

Analysis

user interaction
yes
max time kernel
209s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.gg/download
Sample260810-eqebdsea44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308085116803757"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F473241B-2D79-49F4-87E2-07003E08EEE6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{D44CCEFC-9EEB-4F5C-877F-E32EDD60BCD9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 1936	4648	msedge.exe	86
PID 4648 wrote to memory of 3844	4648	msedge.exe	87
PID 4648 wrote to memory of 1924	4648	msedge.exe	88
PID 4648 wrote to memory of 1924	4648	msedge.exe	88
PID 4648 wrote to memory of 1924	4648	msedge.exe	88
PID 4648 wrote to memory of 4972	4648	msedge.exe	89
PID 4648 wrote to memory of 4972	4648	msedge.exe	89
PID 4648 wrote to memory of 3332	4648	msedge.exe	91
PID 4648 wrote to memory of 3332	4648	msedge.exe	91
PID 4648 wrote to memory of 3332	4648	msedge.exe	91
PID 4648 wrote to memory of 4692	4648	msedge.exe	92
PID 4648 wrote to memory of 4692	4648	msedge.exe	92
PID 4648 wrote to memory of 4692	4648	msedge.exe	92
PID 4648 wrote to memory of 668	4648	msedge.exe	93
PID 4648 wrote to memory of 536	4648	msedge.exe	94
PID 4648 wrote to memory of 668	4648	msedge.exe	93
PID 4648 wrote to memory of 668	4648	msedge.exe	93
PID 4648 wrote to memory of 536	4648	msedge.exe	94
PID 4648 wrote to memory of 536	4648	msedge.exe	94
PID 4648 wrote to memory of 1944	4648	msedge.exe	98
PID 4648 wrote to memory of 1984	4648	msedge.exe	99
PID 4648 wrote to memory of 1944	4648	msedge.exe	98
PID 4648 wrote to memory of 1984	4648	msedge.exe	99
PID 4648 wrote to memory of 4928	4648	msedge.exe	101
PID 4648 wrote to memory of 3020	4648	msedge.exe	113
PID 4648 wrote to memory of 1588	4648	msedge.exe	114
PID 4648 wrote to memory of 5076	4648	msedge.exe	115
PID 4648 wrote to memory of 4836	4648	msedge.exe	117
PID 4648 wrote to memory of 4836	4648	msedge.exe	117
PID 4648 wrote to memory of 1776	4648	msedge.exe	124
PID 4648 wrote to memory of 1776	4648	msedge.exe	124
PID 4648 wrote to memory of 1508	4648	msedge.exe	126
PID 4648 wrote to memory of 4036	4648	msedge.exe	127
PID 4648 wrote to memory of 4036	4648	msedge.exe	127
PID 4648 wrote to memory of 4036	4648	msedge.exe	127
PID 4648 wrote to memory of 3464	4648	msedge.exe	128
PID 4648 wrote to memory of 3464	4648	msedge.exe	128
PID 4648 wrote to memory of 3464	4648	msedge.exe	128
PID 4648 wrote to memory of 2988	4648	msedge.exe	129
PID 4648 wrote to memory of 2988	4648	msedge.exe	129
PID 4648 wrote to memory of 2988	4648	msedge.exe	129
PID 4648 wrote to memory of 2240	4648	msedge.exe	130
PID 4648 wrote to memory of 2120	4648	msedge.exe	131
PID 4648 wrote to memory of 2240	4648	msedge.exe	130
PID 4648 wrote to memory of 1736	4648	msedge.exe	132
PID 4648 wrote to memory of 1736	4648	msedge.exe	132
PID 4648 wrote to memory of 1736	4648	msedge.exe	132
PID 4648 wrote to memory of 4524	4648	msedge.exe	133
PID 4648 wrote to memory of 4524	4648	msedge.exe	133
PID 4648 wrote to memory of 4524	4648	msedge.exe	133
PID 4648 wrote to memory of 2136	4648	msedge.exe	134
PID 4648 wrote to memory of 2136	4648	msedge.exe	134
PID 4648 wrote to memory of 2136	4648	msedge.exe	134
PID 4648 wrote to memory of 4360	4648	msedge.exe	135
PID 4648 wrote to memory of 4360	4648	msedge.exe	135
PID 4648 wrote to memory of 4360	4648	msedge.exe	135
PID 4648 wrote to memory of 3620	4648	msedge.exe	136
PID 4648 wrote to memory of 3620	4648	msedge.exe	136
PID 4648 wrote to memory of 3680	4648	msedge.exe	137
PID 4648 wrote to memory of 3680	4648	msedge.exe	137
PID 4648 wrote to memory of 3044	4648	msedge.exe	138
PID 4648 wrote to memory of 3044	4648	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.gg/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x20c,0x260,0x7ffb8e8cc188,0x7ffb8e8cc194,0x7ffb8e8cc1a0
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,13228466720226173092,11481695134952982274,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1808,i,13759626661575447007,8693437588265395786,262144 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,3322458814009780430,16715018304712099031,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,4749243199425435849,3278244337620906716,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,12941618972417258143,8900023955654359555,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14159949811255832524,5701550374161484302,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5912321234646646728,16360405748614639077,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:2
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,2677900509297956344,4122397872739044755,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,18300898903735270318,543528288597353063,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18246709551329894315,4561212439383417610,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18246709551329894315,4561212439383417610,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,13467765666574158980,10434202115708363837,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,612813442706395860,711623257219108039,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=4772 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,2847271671421365200,17960067551947228764,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,13767238402580080534,5710986888026990168,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=752,i,2080159086609074239,17402816327607255172,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5828,i,16917771436707848413,4559489764416936865,262144 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6452,i,5358772773395081482,1582410018250896794,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5412,i,2246596087774092704,14499048633948495604,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6448,i,7453019068734283499,11513005061160591547,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6688,i,1299467899939452717,17409585533408036964,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,10031179079528252844,5037024054411785366,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4748,i,6183930430755542343,1871027536479228319,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6756,i,9551132010956594043,4720564505374666932,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6992,i,15445901460325358691,15672158877412155928,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5484,i,11877674977720743060,18249110740081748078,2097152 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=1288 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,6726217356565902859,7807177215825805076,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7448,i,4189164264074690211,2566597550732402296,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7276,i,6319069341352860446,4822403482305634159,524288 --field-trial-handle=2280,i,16449262223059881097,3722649694947732252,262144 --variations-seed-version --mojo-platform-channel-handle=7568 /prefetch:8
  2⤵
  PID:3044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6bbe63d16f75104009a1f6c4deb586e25f16d8cbe5db41d456bc3a6a4e83a0c2
MD5 335dbb88a1448c597f43b78eb215c8d1
SHA1 782fb1264e2a7f413c24071ab80027e2e8785f0c
SHA512 0fde3d7a71a2e76fa38e3466de17faaeda10ce8f74a9dbc53f3713cf60f6b730f280694cc46196535175d0e724a94ee5c91f4250cfe53063c58cf8afa80be1f8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7f:fwUQC5VwBIiElEd2K57P7f
TLSH
T186B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 0cbec82d0f09903c551a041cc419ca82b97bfb29e72727c06d97c8ff43f86552
MD5 2e88faf23a022f4c7e5188ab881cb23b
SHA1 e2b50ad5b3b5b52f5faead1ef019431b725e83b4
SHA512 138bb8debf561ea9150d84aab3d13079a3905bbf839ae18713999e62219a5fc571feb610b9bee4927092c0955c24f4ac2c78351522a9d692ba59d400fdc90b37
TLSH
T118E0D8A61FC8C5959F4B9647A0484737596C72C7D54DF65923C4A64E5C8B410EA8B480
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 36c31cb53cda79d3d18e1669c525dcf3ea448c9dde8296c413e18fe1d3973eb4
MD5 b3200ebce0097fa6d9b9c923aab7e28d
SHA1 e08998d38106b46cf26bf8b66a8308e569ef2bc1
SHA512 7892bd6abfd9110ab95a2140a40e8015747b3b6205443e8540575d54bb4cd911231e915e2a30a1e4c7316933c553a7e1ce2755a131254684cccf5fafe03b8974
SSDEEP 48:FmUI0b/7v5vTftXCMEx4xIcFioHJHpw9iwOESDrD0w1XaCVbFWaBxo2jwfNDScq:LI0bDvFT5CrKIipHpww3/VjwVGcq
TLSH
T145A1ECB81153A29CC77C52341DD23EBC367786FAF4279F5A5288CE31EE0A751C239585
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f1b0242406a6c439a4f1e994d3ae0fd2289f48a7061f821b5ae1c26b7854e56a
MD5 0921dd9c339b07245557145760c54db4
SHA1 b8a6473916d7dd251220889ef6a9e864b8e96ce2
SHA512 36633e05d3d32c7113215f33f01c0f013bf85c44e8d088a91bbdc4365b2b15ded4d29e6c3aa664c02582a9f1cdd46100843a1d61d12b6da1fc32c6ea62ad354c
TLSH
T19F811AB42263A3ACC36C42315DD22E3C34B786F8F4079F8B5198DA30EE52712C33A995
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c2b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589c2b.TMP
Size 3KB
SHA256 6d02e595792488949397d8daa788b34192803cfec6a0fa685a72844f564e6254
MD5 6b37d022d797df2d10a82c4ebd141e93
SHA1 b9847d10c60ef61369d418679bbb44f0f082ece8
SHA512 4b5d1bd9bb036675e919651667f94807174f0a6af73079f0726f0b734f527171452759302290522487c662fae484f1597e4d6917d35c12c3c87b663746706e37
TLSH
T1F9810AB42263A3ACC36C42315DD22E3C34B786F9F4079F9B5198DA31EE56712C33A995
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7c4445f7c0583ea1e107575d7e8a41747227fb9a7e617e6a1a2106de6c47a1fe
MD5 b6305c204c1504cc7ed260c0629f853e
SHA1 f05d730b4ec5e78b309a6ad170016b9d00689587
SHA512 d4be0bffdb676c04a73c5f472cd4dcf4b5ead68fb9457b167441ad1ed5d28cca5a34bb6cffbf8d25e87e0b16fe5e2aa5124c093420dddc29ac8aa0a7ff769b5b
TLSH
T195218AB3C7E5996E8A1116F05B24AE2BCE1C090642183E29CDD4FF1F93E3479E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 66d160515f3de67aa3bb804f8561fe08af180957419eb63446f29cd162872af3
MD5 b962eee4b0a16e26459cfeda5718f5d7
SHA1 af18f304f10ccf445f10ce31e6a59252b6b390b4
SHA512 045047e15d5407d2dc8af59235102e36f45422f040f6f2e5ab414043275ec5c3a84b870f4c366b6f7d9cf99fd2f5d88c455aba6faba877fc04da052a520b1fe1
SSDEEP 192:sxZ/RdyM/jK1Ml8Mkp/fhst7UIdpJHW6+WNGYCIo/a4IgrJ:sxZ/hMp/fhst7NJHbGJd9
TLSH
T1E842E8116A3499B7CCDBD309FA45BF43D6F90472A2940D58A9FCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a635c2f9eedb9adead66ad00f4f6714fe6482bcdcff14e4f929899423fb22b57
MD5 261d40a457125ecff74a19cf95b842c6
SHA1 dc5308768fc9406a4cda937f748be04f97994c12
SHA512 068214f31e4d1d71de2fb504b9defaf3ba50a4324c6d3ed0e200ca6a88a2a858649d750845e0cab16911cf5da797f4b8a7174c8abcdaf6c8211682aa04cf7850
SSDEEP 192:sxZ/RdyM/jK1Ml8Mkp/fhsPoqFIdpPXHW6+WNEnV/YCy7+/a4Ig5wJ:sxZ/TMp/fhsPoq2fHbc/Wyde
TLSH
T1EA52E9116A3499B7CCDBD30DB941BF53D6F9047292940E58AAFCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c909ec895741a5e0b5267fb1dd7794798ed8c2b733122c5a9e9bd83a94f0aa1c
MD5 d361b69bff24b2bd730dbee37be3a2f3
SHA1 9aa97d16308b06a4803cfa2fcd6b9ba4336c2d70
SHA512 f34c72343863e4a845aba6217be3fc8f9507448be6ca4f321363b2fb0ef59909fb3d3c7df8c2156b20f018738c2d045745fe8276ceff9de5062c7fd8b26d6e0b
SSDEEP 192:sxZ/RdyM/jK1Ml8UQPkp/fhsPoqFIdplXHW6+WNEgxXYC0xKa4Ig5wJ:sxZ/Tq8p/fhsPoq2lHbtX7de
TLSH
T1A352E8116A3499B7CCDBD209B941BF53D6F80472A2901E48A9FCDA1C04E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8b5fc753b3ee9706a68b85430d0442a55fddf99cf482378a6a4f3f5a9d70f54c
MD5 34daa54e01f9587d445d6f6191606fcc
SHA1 469655384690c3a34fcfbde199db2943ccd2b048
SHA512 96f6dac839176b29538d1d4cf5b76331e203ec3e70c1e222b69c7123d0688f65c9855cf1b18ee1b0d572248273499017dc5a20e46f5a4ab51b6c889a3093412e
SSDEEP 768:9m8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVmroqV:9m8bqn+WvSCt6u1jaCZLbWVdqV
TLSH
T179D20A3B280CCB7E4F845E5DED26AF962DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1d9c783f3889cd57df26aaf9fb74e13c0db39d596d00606e81fc8682755de086
MD5 84a2e8ea6393de2437c6410511f68558
SHA1 755085b055da4c568aa5a76413a41c5e9ed72d2f
SHA512 d7606a1a2fd565994e744fdf66270bfce6690ddf6090fa66e4806b791aa64a028bcea9680b39d8a86b52d88df1f2b3ec4e32bfa8c27b1c48d45a7ed9168e0280
SSDEEP 48:KeDQ3jVNNeD9KFI0DeKNrF5ehbOiyJz/yNlI5KOs0byVdIVKWYwN4VUY2d:KskQKhSSulmKOsi+d+KWYq
TLSH
T1EF914701307F028238BE381D92A686368E45FA573918A8FF7BB940A55E66E115CFCDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\77ff1476-2df6-4bca-bf08-9d461f964617\index-dir\the-real-index
Size 168B
SHA256 f94f3f858fabe07992c31bd30e7db201d8ee5a5590d129edfd422f05dc8bb194
MD5 b406fdf5b3305b458361acc8db521d28
SHA1 3919eb35f99baf2a4b269fc31de594b1361cba51
SHA512 314258912b57fb1ba8a04b6168fb5b544d781428242045302a67d99d8434157799462491229743b5b74589abb5a2013648cdd5094a81e6e1105654ef5bbcf0b6
TLSH
T173C0921CC5781205C02A0BFD299222F53A381E59BA2A032390D43696B18A2EA4A7A4F8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b3c3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\77ff1476-2df6-4bca-bf08-9d461f964617\index-dir\the-real-index~RFe5b3c3a.TMP
Size 48B
SHA256 2edff6500549bca00d796d27e8f601e060432a967d2aa75714c2dc6e1fae18e2
MD5 f7694645ab2889124b20995a7ff6723c
SHA1 c298b0e5186c638720566ebefa2dfa1b8b3f9b8e
SHA512 37332d4c1118057b9542b4e29ec34db0a8dfd9ee4a845226e53ddbe6c558c9dac7a1aafac98b7ac1a16a392d2e4499609cdf6996f38e5a4abdeb886e0072f770
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 162B
SHA256 37e50c6ad0f6048727d51a107a05681b23c1e7543338780c99a477368265a43f
MD5 a8353dd949539237372abee2cd26e25b
SHA1 e8bf75fa03e1de03c38a02cb48716cddf305a98f
SHA512 34980578d79eeeb0b194dc6b6b49741a7ec599f134aa8584ea4d7ccdb33b4526d632c9dde3236b8c5f964506ddc3aa4e5b5cdd7c13b17f775a1f02c386c05b79
TLSH
T143C08CF30810C64B873178E9522033CCC17B8E5C4CC4ECF4E20E300231B47238002A69
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 81B
SHA256 1346fe6efa190f0bfd656ae87f4621c5f9ac83b3e0d65e0dda9ac48685098cbe
MD5 c385063fc199cbc436392e97a084c336
SHA1 c6ebaf81899d9771edc963455a4f5de54bdf82c7
SHA512 0eaf31572fdab1d86ddb8dd550b62ebb5aa7928bfcd9a46e26aa489b99cb2787289ea0367519fbd4168e9b33fa99ee1c5897c39bdff1cefa564b76832ddbd15c
TLSH
T13DA001F74C04C4AA4A71B8E86125B35DE15B829C8CC4EDF1D40880422138B774016A54
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 156B
SHA256 8300d75ff8c2fa15735c9b192e501eb47dc397e0c692c837de88dfa47c78df0f
MD5 08646180ee154321fb4a4b8663502ab5
SHA1 fab7a6080e65aa452fd3f18c9c54e45dc34d5685
SHA512 d8f62876194d0fee84a9c980a624b431f802ea45f788e2840bc45541f645320f931173be05a19c79f3180c98cf0d2d7071c1eca188c685fb3f55c2102e3d3f79
TLSH
T170C08CF30800C64B8B31B9E8111033CDC16B815C4CC4ECF4E20C000231F47234003A69
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5ae929.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5ae929.TMP
Size 165B
SHA256 42864a286ddaaa9f52f9f9b9e4756068ebf8e8db95deb3018b681e310a5a84bc
MD5 a3af5a3e7d53c31502741d7d0a348f02
SHA1 b88aa2029f5e59c0368b6474b5867fbbb367ff90
SHA512 4a1baeaafd78f42db08944b71500880f316b7d9bdc00fcad6b7def1c4335dfc898fe71db4b756fd427d091bd8f887db7263f634a6492bd876b86ed0bdcb0837c
TLSH
T12AC08CA78A71D1691724A8E2A038A28CC257AD8E5CCAECF88814F082247C323C109A61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\a07c4e5e-9f93-4161-aae5-5d9096fe951c\index-dir\the-real-index
Size 72B
SHA256 2cc3a043b62b4ae0be8122f58b08bf73ddee3c0f2d1c2acb6e80ec2d2b62f7ff
MD5 6837a0b73029d7d73d878c08637d0dc5
SHA1 3f99233610c8686bed5a8f17497b4c2114f1a9e7
SHA512 3fb494981191467b0f330be490a66a1c42048b494f3cdc1e500339323af6e479dd42c3bb01020dcd05b62509bb2621023fa1101af23d625378375940f405ebf0
TLSH
T1A4A0023043C66083D11012B451561BE67314D9581655170344A4238E9CA06C49911096
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b487f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\a07c4e5e-9f93-4161-aae5-5d9096fe951c\index-dir\the-real-index~RFe5b487f.TMP
Size 48B
SHA256 1fb3e6ade80602921083dc9e60509f5b21ede4a38c7cbe5f2a3570c54e59d445
MD5 70323a676b6fdcc9a6cef99f261ee8b9
SHA1 98f79cc4c113ff178007db76971b1f5aafd01667
SHA512 6aee60a9bf807460918cd44614b3e44c9ed6c3d0a15ad30bec05c7d991719353103314e5bc47639f17ce98dbf31a9d4656038a8f66e09563d4bb8c7220a453d3
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 95B
SHA256 3e46e8026ad32460ec56446df4496086a31d4936956371a206ab35ac6132d91f
MD5 93ac6ee0acc223b23db53ebb984062b4
SHA1 457be7fe40baf3613578d7b465d3a4c478adcabc
SHA512 c673b0488bfd4a0be96ebb6b625facb0471b21695e4398a5c4b81f747da3903218f25aabbf16cdabc401bd161518c780a22fbc50769c634c641cac6936bcc141
TLSH
T144B002FB4445D9D55E7138E7414533DDC57273DC5C85FE8DD4752059322057F5011E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5afa5f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5afa5f.TMP
Size 182B
SHA256 de9fe0b5b5385e9ff72fb5a001cdc5ac32d068fc4bab85d925763723681caa9d
MD5 5317317c3561e6bb1744e5b82597ceef
SHA1 a05fde770291bd18b17ea1ae69849e1139470eb5
SHA512 5d2a7b5b4c19791f9b37786f2f4ca053fbed1fcfea2d296e2f3b9b7fd13d13cd38c6385be10b8a4d86bc068ac1fc6164d378fff380913f42cde9fbdf2178d1d8
TLSH
T1FEC0127714A096A53A3638DA421532CCC5323FDD1C80BA4C44213045617086A0510A24
MD5 SHA1 SHA512 TLSH

Submit Download

06731261-04b4-4552-8666-a7c9a54de348.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\06731261-04b4-4552-8666-a7c9a54de348.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4304cf6748a2b4874003a8a7a508567aeece4854c8634892f3acdfff9f852330
MD5 3b40b215a19f13dbfd034bcc804dcf56
SHA1 fd72f7ba8d16467b6fd3e34aea99c54cae69767b
SHA512 c0307e4de5b490d04144c7f58245738d3f4880b9f9d703373bca5144329fb99b26017ee5ba66f977bd629471891daf7a2d804de652bf47e96b6594f30a2040ac
SSDEEP 384:VZcIhsNe3U8FYDEa+HIOnJa4+r6HlytEDq1TCUF:thu4agIOJa4+roy6Dq9F
TLSH
T1E1928D3159785D779EE7A545F88A3A039EF88067A7C96BC4E5DCAF1C00DA5E8030F825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d680178eb4d15c5b87d7354217ff8f7539f64a142ff7f08e9689df1edc7c7ece
MD5 fd9175cdad828b64377c2ccddffce429
SHA1 389848e18425978fb45264065c2f6bc888c5e5b4
SHA512 d24ef8810149598223e9e44f8cda06a925a74f803d66d70a02034489bfed5ab04afe32bbbe23cc532126a8adba81ca7fe550762b829217745c557efae7acf634
SSDEEP 384:jZcIhsNeOU8FYDEa+HIOnJa4+r6HlytEDq1TCUF:7hd4agIOJa4+roy6Dq9F
TLSH
T17A928D3159785C779EE7A545F88A36039EF88067A7C96BD4E5ECAF1C00DA5EC030F825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2652f6f46f7a1baba596fb847e14341307132351e931f2cd4470da0bab40be74
MD5 90fb3a00fedf8d57eb0fc9f4962379b7
SHA1 7544bdfbc251fa8750fbd6c2ea0a07ba2d331c48
SHA512 20bd8a77304db65ba96a635816dbab1eff0a7d784674a4297c900450708d6f4e6b42bbd27d17f87f0cc0daf0f1ca3ed8acdc8d009850e25ac6c4aa9d380b26e9
SSDEEP 192:vON56Db6QmiUysCHBa+jLIOmYtmpRgSoU6:vON56u8HBa+HIOnFjU6
TLSH
T14F02E83579786CB79EE26E49F88B37279FA4106BD9562F84DAD81F1C00D764C230A836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 98ce2025f73a9bec8dbdc2f3267e9f941488ccb5945b0486d3d1438f9a14bada
MD5 9e53ed6569723ea8bce32e25377a16c3
SHA1 6d458adc89a028669b1be89d32f14b107c2b2cc7
SHA512 71dc45f24f7b9bf1cac9ebb286769a762b9c12600e1ed15b2c97cb461d95e4955dc1dff44049c5d45f396e9bb7046e8ace3e2973e38f4e27acf2b021f23b2923
SSDEEP 384:PiFiZcIkzsNu8TUNTUlIlOU8FfDEa+HIOnJa4hr6HlytEDq1TCUF:aFQYPwgu4agIOJa4hroy6Dq9F
TLSH
T154D219F248E74976D9AE5747EB7D2D038EBCC063B5856A94B3C85A1CCC960BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 72ded1d0f5c41699c96bb86bacea2ac06dfc3266c62db55c8f3ad685003f7835
MD5 ce847b93dd8eaa03b81d4a5c53f7a79e
SHA1 a72932a642e02d74bf5da46e60494a06b256506e
SHA512 58bc7337a44ee2e4c05d7e10899d19507ebb790231fabf50a6dae777ce23b4b91cc81511ebabc1d52471f026297b879d608099e3955d7771797864742975cb0d
SSDEEP 192:tONv6DbeQmiUyECRBa+jLIOmYtmsa0e45sNzeq/U6:tONv6yaRBa+HIOnJa4srU6
TLSH
T1EF12093668785C7B5EE2A584F88736139EA84167DA8A7F90D5DC2F1C00EB99C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1afe6c1f-3953-4fc0-9e78-2d588543362a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1afe6c1f-3953-4fc0-9e78-2d588543362a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7ca81965b687c91d2a5de5df35aa12b44578753b9ef7e19cd27a0fcb3340c73a
MD5 6f79b96134987768359f97d312264446
SHA1 e4966cca2bdb0b21f7c8be01cc4b928a1aac4a1e
SHA512 5d01e71e67142680740be01d45c3bf6735f7bac161a3c611e669a94355fb72d8fd9a465df896c7edbebe51f73fa7ec63ad23cc9d618945d07426ad1800ff9385
TLSH
T15F41E958B6FA1144B3B36E469BF6A87D487BB8772E0AD55E10010D4F0672E44C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download