hxxps://redirect[.]zalo[.]me/v3/verifyv2/pc?token=OcFxnjroNGLW2VhEsnfQQcS8-h_O7bfgP0lvlp4tCm&continue=https%3A%2F%2Fthuytrang-shopeee[.]muahang[.]pro%2Ftra-cuu-don%2Fffc6ed40a5ffc27ee80afeb875c10d6b

Analysis

user interaction
yes
max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://redirect.zalo.me/v3/verifyv2/pc?token=OcFxnjroNGLW2VhEsnfQQcS8-h_O7bfgP0lvlp4tCm&continue=https%3A%2F%2Fthuytrang-shopeee.muahang.pro%2Ftra-cuu-don%2Fffc6ed40a5ffc27ee80afeb875c10d6b
Sample260810-exnteaar2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2280	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308091715177194"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{35F7E7F3-0AE3-45C7-8D76-49F4AE776AC0}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe
3736	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3736 wrote to memory of 1172	3736	msedge.exe	85
PID 3736 wrote to memory of 4152	3736	msedge.exe	86
PID 3736 wrote to memory of 2280	3736	msedge.exe	87
PID 3736 wrote to memory of 4152	3736	msedge.exe	86
PID 3736 wrote to memory of 4152	3736	msedge.exe	86
PID 3736 wrote to memory of 3228	3736	msedge.exe	88
PID 3736 wrote to memory of 3228	3736	msedge.exe	88
PID 3736 wrote to memory of 2388	3736	msedge.exe	89
PID 3736 wrote to memory of 2388	3736	msedge.exe	89
PID 3736 wrote to memory of 2388	3736	msedge.exe	89
PID 3736 wrote to memory of 4472	3736	msedge.exe	90
PID 3736 wrote to memory of 4472	3736	msedge.exe	90
PID 3736 wrote to memory of 4472	3736	msedge.exe	90
PID 3736 wrote to memory of 4560	3736	msedge.exe	91
PID 3736 wrote to memory of 4560	3736	msedge.exe	91
PID 3736 wrote to memory of 4560	3736	msedge.exe	91
PID 3736 wrote to memory of 2180	3736	msedge.exe	92
PID 3736 wrote to memory of 2180	3736	msedge.exe	92
PID 3736 wrote to memory of 2180	3736	msedge.exe	92
PID 3736 wrote to memory of 4680	3736	msedge.exe	97
PID 3736 wrote to memory of 4680	3736	msedge.exe	97
PID 3736 wrote to memory of 4680	3736	msedge.exe	97
PID 3736 wrote to memory of 2884	3736	msedge.exe	98
PID 3736 wrote to memory of 2884	3736	msedge.exe	98
PID 3736 wrote to memory of 3784	3736	msedge.exe	99
PID 3736 wrote to memory of 3784	3736	msedge.exe	99
PID 3736 wrote to memory of 4708	3736	msedge.exe	103
PID 3736 wrote to memory of 3664	3736	msedge.exe	111
PID 3736 wrote to memory of 1868	3736	msedge.exe	112
PID 3736 wrote to memory of 892	3736	msedge.exe	113
PID 3736 wrote to memory of 2572	3736	msedge.exe	115
PID 3736 wrote to memory of 2572	3736	msedge.exe	115
PID 3736 wrote to memory of 1444	3736	msedge.exe	116
PID 3736 wrote to memory of 4728	3736	msedge.exe	117
PID 3736 wrote to memory of 4728	3736	msedge.exe	117
PID 3736 wrote to memory of 2344	3736	msedge.exe	118
PID 3736 wrote to memory of 2344	3736	msedge.exe	118
PID 3736 wrote to memory of 4164	3736	msedge.exe	119
PID 3736 wrote to memory of 4164	3736	msedge.exe	119
PID 3736 wrote to memory of 1124	3736	msedge.exe	120
PID 3736 wrote to memory of 1124	3736	msedge.exe	120
PID 3736 wrote to memory of 2748	3736	msedge.exe	121
PID 3736 wrote to memory of 2748	3736	msedge.exe	121
PID 3736 wrote to memory of 1460	3736	msedge.exe	127
PID 3736 wrote to memory of 1460	3736	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://redirect.zalo.me/v3/verifyv2/pc?token=OcFxnjroNGLW2VhEsnfQQcS8-h_O7bfgP0lvlp4tCm&continue=https%3A%2F%2Fthuytrang-shopeee.muahang.pro%2Ftra-cuu-don%2Fffc6ed40a5ffc27ee80afeb875c10d6b
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,8512958503702186577,7422076826058482248,262144 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,18419475892531835251,5203073879371747676,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,17938379273079415582,3817285545941088951,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=1844 /prefetch:8
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,3229969628061181818,4849202706258137339,2097152 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,9934535940499302136,5953576555801139310,2097152 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,1438507318622446561,3553575746209094948,2097152 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4092945161655636351,6532420925259666716,2097152 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5036,i,10979069904898238528,3914800475034475799,2097152 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,12315167229374619041,13853131941138764511,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,13829143738569137554,12685543776157255815,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5517874605503865713,7042979041327187500,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,5517874605503865713,7042979041327187500,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,17757122877369663680,16167740929584301047,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,7193517670031154855,11848622886885752709,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,9243761833537298435,1687380208585160472,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,12349222511587104111,8996154128138886021,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3656,i,15435139145645238062,573105917570684820,262144 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,11500814018243945441,7618119547709489184,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2046147067729767601,6000891910821568154,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5336,i,3896352041984291325,5110457654102782325,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3332,i,13348132497370310866,7244859530530760925,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,16409575462015987858,5512033388059438891,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,18278671847031455419,7452745216762019877,524288 --field-trial-handle=2252,i,16752515276094905050,13059539705469571243,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:1460

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77ce46c7-0ada-42ba-9092-e64c1c8c99ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77ce46c7-0ada-42ba-9092-e64c1c8c99ee.tmp
Size 8KB
SHA256 5d82733389c24678cc1089a25f1c31b8d2cff4d4129460dbb18d81b60e0cd8b6
MD5 f30893a0aae3e30f8b037e5185f83021
SHA1 dab91832b9e8734a63a900dd9768724a04b6dc5f
SHA512 1f012df1ec04fa15e6216ca04c102cad7a1b742487d94d0e8b4cc5dafc6e337de0615e7f36f27c8ff01e8380f273b4aae58edf9bc4b3b10eecd899be2a35094d
SSDEEP 192:wONx61qWQmiUyDqtGX5Obd+juOFm0bedjJAqIU6:wONx6XFtGX5od+KOruSU6
TLSH
T1BA12EA32A468BC779EE3A554F44731139FA55167EA457FC0D2EC2B2C01DB69C231BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f32186789ee213531ec433fa1c5cad713becba6a5aa80fa79a3f92353346366a
MD5 a33e0f980e52b6a95a4305365dae3acd
SHA1 71e87ca2a27596079965077beadbd02e4909156d
SHA512 b693c97cb43dd6f64b27f799a07b487cbd1977bf758b2b9b2032c5035a5b2b4972caa7f937242b35349de8ab8db6c77aec1d0001b6d9d804ead4b5b77ce2f460
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
TLSH
T199B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 546a4fe7626b38b460bcca41c95ed0fa8770e87c992317bc06b811e21754e76a
MD5 400874313988c6f648182d8f6336f6a5
SHA1 867535eebc08a22c25c8c9fa3ba1a95678bca4f7
SHA512 a466cf5aa03df90bb8930469550e57b519b48e560964e1e8296fd9b516d4000a1df753abdaf58bd8f74a880e4eccef01fe9113e7f9d2f42ee237bf17bf172b6f
SSDEEP 192:pjkP6SBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBSBI:pjkP6S4444444444444444444444444p
TLSH
T126E1421785D8C79ADF46208B4AA0625C04707B4AEBECE50843DCC9DD344D4AAFCF27B5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 4d65ea32d394440631829bfcdf321813130612897fd7982c92ba94218e81cc8c
MD5 bfdc1d78baa091ae97080b1873e1a854
SHA1 7914aba780691cdd145179e6d85cae45dd694512
SHA512 755f9449751b4ca5d4970233fbd3438b83b59d559183ea17d302d5b403f69c21b136856d398642ff978c72516f0df4c5a3fec88b6d37bf3496d96c1d54731945
SSDEEP 192:rjba6PO5vud00jjiiBBooHHttE4zyyccOOPM5LO:rjba6PO5vud00jjiiBBooHHttE4zyyca
TLSH
T179E1475787D9CB9ADF05208B49A0526C5371374BEBDCE90803CC8EDD304F8AAF9E6694
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 641KB
SHA256 aa93ecff5e30c7e300874955e01a32939026067cb0a5aaeeb0cefc5533711bbe
MD5 f52b39c696d02035c303b087fd242b6f
SHA1 e6c9c214aa96530f88264dbf7dba48c8bc693adf
SHA512 b33028260560080ff9854c1becd702656925e59857b3e78d6a1deeb0fe9e7f5300f8a6178ca4086f975d41d13173a020c24ae2fdbc2e269c8f4c254d2c4241e2
SSDEEP 12288:gutF9ZBghFx+5BwD5HvDj8eG2JrsKn88qWu2OUlIzoozCABj18lFgBGGGsTOCXN2:n9ZBgLCB4rG/p8qWu2JloCAPQ+E
TLSH
T1C6D423DAE38273B064C17276732040EB5DAAF8B9545AB90215ABF1FCCBD87D711D6AC0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9a799a31a5e9e01b1bcc5cd6bf7f362fb2641d1ef90a7a1d4d60e9c9e53799c
MD5 d1e340426b6aa97118531438fb000654
SHA1 9816fc48bcc5c8fff966d68b13fec2f9c1d060fc
SHA512 6e897c7fa13629832817dba4e32c24b2a488c83e78535f5680597a482fe2634f7a2c105250bc2962300ba30329691e6cf8355beffad33e78cc5719940122cdf6
TLSH
T1A3716EF902AB30A1D7618230D4D306FCB57B4495DB637E51C250ADBCA9C6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589c6a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589c6a.TMP
Size 3KB
SHA256 b6900648162dd631559cfd87b07ba63520ee5e7e636e95486bf4e59f5fc3be9c
MD5 4e2eed4fb0064405035c1a4d65769d8a
SHA1 4f67b15a336c17197c63e54d6ed43ff3ee900d0d
SHA512 90edd43445f48967eca3af6c092aae99d27d21084509749978fd6c1daf2d5187d2523f1868998a0c77deb486d5aca2a2dd992f65a02022850e4b1ad408a73dc0
TLSH
T158714DF912AB34A1D7248230E4D306FDB47B4095DB237E51C1409DBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4753519341a3394b1931ed4add0f4e0080a0a0f730f367e621d52a9837090d6c
MD5 da7f0c09182ab445b3578845321a0727
SHA1 bf651510edca7d00a13ca56f5b1aaff40704ff54
SHA512 392227cd62615ec762972b35ff57968afcedf450619c777dbed56c13a7160e9feaba5157dab6e19280aa067632934446aa83bc6b2803a103a1613f4e48ea1e6a
TLSH
T1E6517DB6C3E4866D880116F46A147E1BCE1D091943383C39CAEAEF4BD3E2171E24664F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 81a0d8d53cd58b8cc622bb467350513310a22586078960c574cb33ad70a863f0
MD5 4ae9ae18f15aca27385df03ccb9a12b9
SHA1 fdc1b8f5f0f678ac2339c9d884ef8d2517a1bba7
SHA512 4ab7bb74e2891a4011184fb09e74b1c59d31954dde444d9b38300208943f185c88189d7e593559a2d4411afb5a4ff79e12fc84ec8219b71c35b66c47dba007e1
TLSH
T1B2519CB6C3A0825EDD0156F49A14AE2FCE1D0419437C3C798AEAFE57D3E2171E202B5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 41355e2ec14db2de3fc75ab014730218f00d01cb7fc653a1d3f298c3393bfa8f
MD5 c322073305e39a205a17ed9a838e0da0
SHA1 df94cc297a3bb3ce20130d64cfcb3cff796fdb6a
SHA512 18b5b7bbbcb8fb2c852a29762a67bfb2ab4acde52c7818f21e10452d78379b0b0448802529d08988733869470e1194ba955717013c6303b1a6be0b15afcf6390
SSDEEP 192:sxZcRmyM/jK1Ml8Mks/f/syBqIdpRvglqHW6+WNasb/YHpo+sIgU6J:sxZcwMs/f/syBjhHb9/1U2
TLSH
T17652D915B6349A7BCDCBD309B955BB53D6F90472D2500E44AAFC991C04E2BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9e334dd1a3440faa0845caed7ce964b431dc9f71cfd2d1825e13b5d7d53ac8ec
MD5 c2db30486d749606ab848f6af8252d20
SHA1 0d84d7f5d4d852b728bfdb3915f800ab709a4831
SHA512 00dd46451448d13a955d85f61c1d36d3276802f24e084af389ba2446fa247d0cfc54b4f4d191c07b6273fb3518e8ba343f7943f41a94fc746b31cd727bd50cd9
SSDEEP 192:sxZcRmyM/jK1Ml8UQyks/f/sEKqIdpfvglqHW6+WNasb/YHp/XsIg5z6J:sxZcwqxs/f/sEKjXHb9/j92
TLSH
T1C362E815B6349A77CDDBD21DB941BF53D6F90472A2500E44AAFCDA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4cc43e612a68ad2e280a22d30b0e434a0e2d79280aa116fd5441d20a4e08a4a1
MD5 c07983def392b1bef3354db249439f5f
SHA1 724190770379fa7c09fbf31ca55e18c2d14966ec
SHA512 94711945becdb8284a092c82cc6b312b917a9d45de32672d2dc9d46f025da1a059d22a9776ef00ecf89bbebe6695b9889b6a3846653615dbda7f0c3884171b8b
SSDEEP 768:mpUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R5roVb07:mpUZYTMWvg0Pou1ja7eLZmRyW7
TLSH
T157D20A3B680CCB7E4F844E9DEC266F967DD801CB5A584D5447EA884C03CB2EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 2550d89c0b9135bb34e2770b4a3f9d0578d4394dbee9d5c89ebe4695011ac724
MD5 d8a26a0c8e18c848d8ed9e343956c052
SHA1 b584983b808a32af00462e2096271158198e9360
SHA512 7b815012bf4b7516461a5728e73bfa6d8e4633d48c7396c972035b820a5093114a9cd306191aecfd817b14d9fc5d30da7b4dc82bc0af3b6350643c85e6cbf883
TLSH
T1F821EF4D9EA08A8FF96481B61576B5A0B37098CD4F12A2139C3C31326E26359365B5DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdebf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cdebf.TMP
Size 1KB
SHA256 cae3b6b9c481bb96cb6c37235cac0abb50323b5041ad8a7c932c95ed313aaff0
MD5 872665676f16b802f010f5007f0cbe40
SHA1 99542029693c6427e12bacdad64117330213cfd5
SHA512 feba163c1d2d60b968f74285890f3e03ba73acb0fc627a7a02065609a564159f8c96b365e64eca6eff0c79706fb8b465ca0478c66f81657dc8229a20d15ca4c2
TLSH
T10C21148A4AD18E0BF98450BB0D67B8F8737488009721B393A93C62795D25B8D1B4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da05141a02521e555874779b1c2116f5870f04efd830e5d08dcf3f8f55e3e0e2
MD5 e9b18c92201fbb5a26effbb9a2c9848c
SHA1 f3cf2140039e154495593b04790507c7d982b65b
SHA512 4465a30e2e263820204df087f6dac185753f33c5855a3fc9c8a7114e0e1cf3ad6979abb447a20aa5cf71f661c7bbf8378ada1517d05d273ef8c6b3caeef02b9e
TLSH
T1B1E068F32DFB1810AD6BC3D65471A4A4410138A8C64CAD8E00AAA2A310B23002806C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6a97076e6a18d4d3556e3c4fcfe09b9f8c467ad9bd66039c07d9374e4ebd0367
MD5 e0221ff85fd5797ef34e3d00ea3b284e
SHA1 7c527755d4a518275ca35765153286679b6047a6
SHA512 c4b863b4f90f4d4541a9d141d8bd40cf69784c6ea4f52d7edfa3a0120d943be7af605e1de055bb007e94795bdb46d65e5ddb2c404a8334900979b61161d64111
TLSH
T1B6A0022711940067CC5407719C7101F6675059AC0E03171285B50454CCD61444227C4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589b03.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe589b03.TMP
Size 48B
SHA256 a6bb8ea1ea4eb015c3543784ebf2a6fd907bbc61c01394835207495734af0c72
MD5 e0bee4c981007569c5c4bc8653fab9de
SHA1 3fed27a842fa26c91615c32963f9eb7d6ba41be3
SHA512 694beabeb93616fc33515f7bc0a3850565fba0710267915f26280354be8a04e5f35f887b9f58ca8328f3d86feb92376896643dad757739309c9de64ef4290a76
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e7ef608ed4b8e26704f6eb34358ff20a7d2313365f4bc86ceaaed8a5d9847ad8
MD5 335ec242bd1e82c438fc49fce84926a7
SHA1 26e8cc1cdfca36402e4406f89df545366d39e333
SHA512 d657a9d68efb247984a5bc9748ab0078dfab7888e717081e20316e259fc5b17dbcfe7a11e16ac0b842e032d0aea2ec87cbb85e9d0d3038e0bc55238f3e3f046b
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQU:E0BFlp
TLSH
T17AB1360232B712033C3D2908A3AA973A4B45F1D33424A4AB7FA504B25D6BE754DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13d13717-328f-4fd4-aa7c-1641821eed55.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\13d13717-328f-4fd4-aa7c-1641821eed55.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9de77e92b340b882091f1df650c908340c130635db83c9f8b816e936d12df24a
MD5 6b043e3f945a0ac7303191a8355d5064
SHA1 6121c73f591fe9c5c9f348127c706ebc83fd8f72
SHA512 2ad1153018621fbc1012809f128101f6f3d8b992a69379959461cd62d1bb4a610acf3a1b752e5e97c310c909df2b2bfa1b28fa81bae2ea70ac84711aa0aecaf8
SSDEEP 384:BZcIhsNgO5F1xvzX5od+KOr4S6HlytEDq1OCUX:Jh8jOzOr4Soy6Dq4X
TLSH
T1C0927C3165B869339EEBB145F88A35134FF85027EBD46FC492EC6B2C00DA5E8131B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8e5fad50a69ab47b9a643b7ab11e17aa5fe709ff2e6906e5e967540fd4d9b2c2
MD5 545007eb7dcaa6e636f55cd59b463519
SHA1 059a64dd4cac405a75029dd9c4bf91894aa29c87
SHA512 2021c6446cab629151a3ca00b2db0b4ddea6b2edf5612ef94f32ef3fece4c695e87f5605eff486088d1267f718647d5d4e4d8624534cc0fc397083f153b19352
SSDEEP 384:7ZcIhsNgH5F1xvzX5od+KOr4S6HlytEDq1OCUX:jhXjOzOr4Soy6Dq4X
TLSH
T118927D31647469379EEBB145F88A35135FF85027EBD46FC492EC6B2C00DA5E8131B825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9dff00b87ed75c4fbe44b3d4ed1385aa79b42663074010110bc1c2ede2c59cfe
MD5 f263e8bd6547cf3fdd79d17da31bd832
SHA1 7aec69c954210b252c178507dca7fb86aa08f4ed
SHA512 6d2968981b4d5fee3f6f9ebd45227a9abc8fa16c6a6be188fcbd88a067cde1baf5c545c25c84449d74a99d9a390a1def90e37234b9d93b564f7572b43c4b65c8
SSDEEP 384:WiFiZcIbzsNg8TUNTUlIlH5F1qvzX5od+KOr+S6HlytEDq1OCUX:9FQPVwgajOzOr+Soy6Dq4X
TLSH
T13ED229F254E79536D9AEA747E77E2D034EBCC063B5846A84B3D85A1CCC961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9d99bb83f2713db4a58c487ce8705c57e8e9ed96e5eadeba0c46402e50901e45
MD5 fcf674d1d5b4e5682d491551c12b3fbe
SHA1 638167daab91a32474939eb84d0adfb9743e1235
SHA512 9dd25c5c59767757777d8360e635ec1e30670e284a1540cc5cb5134afab82c967902529ac77947a5124fb93e659058545e347ae7238b35bbc152c51fd8ea78dc
SSDEEP 192:yONc61VWQmiUy/qgGX5Obd+juOFmI/ao3s5U6:yONc6WbgGX5od+KO6D5U6
TLSH
T12502D73569687CB78EF3BE49F48737135FA8217BEA546F84D6E81B1C00D769C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e36ca81-1497-40f0-8255-297c1c727424.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0e36ca81-1497-40f0-8255-297c1c727424.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8ced9e8e04531526bbd7f9a731a8593a70e3892b5c0bcf31ac8a9183adc68cf2
MD5 b64a87eec16257dcc053d3b7ee74f54e
SHA1 6c3876392e83a0c7fad01b827e0117ae378352a8
SHA512 d10d516f14acdf09c369a8c0a6425219fc1e39f1ed8c5435f03c8c43d7de357ccdd31c826b57afbfab159a5c16583f67636118aa880798abc4ac718aa7798872
TLSH
T100417B59BAF91108F3B76F1A9BF6A86E487FBD771E06D05D10110E0F0A22A40DCA2737
MD5 SHA1 SHA512 TLSH

Submit Download