Analysis

  • user interaction
    yes
  • max time kernel
    598s
  • max time network
    601s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-fr
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-frlocale:fr-fros:windows11-ltsc_2024-x64systemwindows
  • submitted
    17/08/2026, 12:09

General

  • Target
    http://winklerweine.ch
  • Sample260817-pbt4eaar21
Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 20 IoCs
  • Suspicious use of WriteProcessMemory 61 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://winklerweine.ch
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2428
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb6ac3c188,0x7ffb6ac3c194,0x7ffb6ac3c1a0
      2⤵
        PID:2432
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1520,i,11454664884295770644,10981595013714316688,262144 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:2
        2⤵
          PID:4152
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=fr --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1796,i,1425949855651444458,9101720158098961363,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:11
          2⤵
          • System Time Discovery
          PID:4924
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=fr --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,445349808544851486,6028781934397071306,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=1392 /prefetch:13
          2⤵
            PID:1692
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,1599410423107983761,4289398864205533149,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
            2⤵
              PID:4324
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,13426592965016015459,8601249204399449724,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
              2⤵
                PID:3944
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,7851944247032841173,10178271196302419052,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:9
                2⤵
                  PID:5720
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,8807262311941875115,622285386119701565,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=4912 /prefetch:1
                  2⤵
                    PID:4700
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5424,i,11984387960882777704,880889900551404299,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
                    2⤵
                      PID:4176
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,13900044866148141314,8659530224677455145,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
                      2⤵
                        PID:3868
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=fr --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,14863954261308050587,17662341786800407045,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
                        2⤵
                          PID:5004
                        • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10044119780139401927,11099118258022976994,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
                          2⤵
                            PID:5956
                          • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=fr --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,10044119780139401927,11099118258022976994,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:14
                            2⤵
                              PID:4188
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,420222153933718933,10097805160165612984,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:14
                              2⤵
                                PID:2372
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,18382757318813259716,8424675001460505913,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:14
                                2⤵
                                  PID:4944
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,6177731019511434566,11789737177133713778,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
                                  2⤵
                                    PID:2772
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=fr --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,7559336890250220173,12504914528160113099,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:14
                                    2⤵
                                      PID:2444
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=fr --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,12312469216850213119,8721190616845998474,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
                                      2⤵
                                        PID:2908
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5052,i,8377011218592042031,7985624764387678227,262144 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:10
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:4640
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,1433075980572079792,7542149008686901208,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:14
                                        2⤵
                                          PID:4364
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4932,i,805745911180138896,2154306718448186897,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
                                          2⤵
                                            PID:4620
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,12282563005226543187,15100294856189939285,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:14
                                            2⤵
                                              PID:2700
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12610117296750866940,8786794870127783824,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:14
                                              2⤵
                                                PID:2296
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=fr --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,9446662070209887212,549455133404730339,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:14
                                                2⤵
                                                  PID:940
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,15213668534877727050,13563315286005123575,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=7180 /prefetch:14
                                                  2⤵
                                                    PID:5628
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=fr --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,5795578275218390084,13605973488888209890,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
                                                    2⤵
                                                      PID:3376
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5724,i,9567262985247827999,12259367854980182859,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
                                                      2⤵
                                                        PID:2020
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3836,i,7118863155653709775,18047488958563250594,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:14
                                                        2⤵
                                                          PID:5016
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=fr --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,12059419173978859602,5555305250233902616,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
                                                          2⤵
                                                            PID:1984
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=fr --js-flags=--ms-user-locale=fr_FR --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=6216,i,18143956380162693920,1973746095436242774,2097152 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
                                                            2⤵
                                                              PID:4892
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=fr --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,1121084317778812835,6965747775292903603,524288 --field-trial-handle=2832,i,15260835777174354766,5780091216354522719,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:14
                                                              2⤵
                                                                PID:4904
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                              1⤵
                                                                PID:5472
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
                                                                1⤵
                                                                  PID:1232
                                                                • C:\Windows\system32\svchost.exe
                                                                  C:\Windows\system32\svchost.exe -k GPSvcGroup
                                                                  1⤵
                                                                    PID:564

                                                                  Network

                                                                        MITRE ATT&CK Enterprise v16

                                                                        Replay Monitor

                                                                        Loading Replay Monitor...

                                                                        Downloads

                                                                        settings.dat

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        settings.dat

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                        • Size 280B
                                                                        • SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        LOG.old

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                        • Size 331B
                                                                        • SHA256 cf604756c2ff986f00ada01c5c1929234acdeb6a25bc63704ec28ec89021cd0f
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        LOG.old

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                        • Size 331B
                                                                        • SHA256 9078c55bea626040e79ffeedb8f80eae44213799d71b98d96cf5e4c7c76a4b45
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        f_000059

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000059
                                                                        • Size 17KB
                                                                        • SHA256 1327dd0ea14681cca5337d2a0574467cde7fc45064be3ab21fdc495966140e23
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00006c

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
                                                                        • Size 18KB
                                                                        • SHA256 238d538c8a004ccb954d17345be54a1805c33e009cd9e383c14c1c52c9ecf7d3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00006e

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
                                                                        • Size 96KB
                                                                        • SHA256 514d213f2cd22f930551cbaf08ed4b52205fccb6120f606dd073dedb94ffa343
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000071

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
                                                                        • Size 20KB
                                                                        • SHA256 1e63848f6d88fa57cf6877272303c2ee89051b92112ad66a9934681b3641d048
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000073

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
                                                                        • Size 47KB
                                                                        • SHA256 6dbe3af7e9a35b69a2ff0c99c1b7c9b73e84a71389637769523ec0ce63017d83
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000081

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
                                                                        • Size 121KB
                                                                        • SHA256 8d0a8e903e2c3ad22d09965e6acab0993b7979ac703affeea9af4be525ee76b4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000085

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
                                                                        • Size 196KB
                                                                        • SHA256 014fe39923570648dc8feacba743dcb7c3df6ae68ceaf5ca9ea14137e0b7d3e8
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00008c

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
                                                                        • Size 37KB
                                                                        • SHA256 7a31f93aa3318da403018d5fa39643c610ea146f4b1d373cd68a27ebeed2dc41
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00008d

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
                                                                        • Size 70KB
                                                                        • SHA256 b2d170063f1e2beb4014e5b6402c9d47766a886221a38d9c424cea0cb58437af
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00008e

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
                                                                        • Size 29KB
                                                                        • SHA256 57cfa8952df0b67da5e35db138d5e9139a34e45af7996080ede3d28ca8870c16
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00008f

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
                                                                        • Size 29KB
                                                                        • SHA256 2403e1a1abbaa8f911da32a55052a95352a23250d3caf33cfd9246e4084fcac2
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000090

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
                                                                        • Size 24KB
                                                                        • SHA256 4a6fcf78683ad84255ffd65caac4f46f133a7ab088d0b5b5c918aa4f693713ec
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000091

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                        • Size 40KB
                                                                        • SHA256 783e5c770525803973e7c2cc37a7778cbe7efadcedcfb11050072cbdc4e7191d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000092

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                        • Size 93KB
                                                                        • SHA256 fa2d9f0806fd5043c790e9d4559bac2561640e30cfb025482a204f685e8a4cb3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000095

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
                                                                        • Size 73KB
                                                                        • SHA256 92562e870d8a7f8007b856eda1f22382f6ba500838e0e6a23c51ada17e09c7dc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000096

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
                                                                        • Size 21KB
                                                                        • SHA256 6871c79216c700bf68d0519e6a36b726067612ab68f8fe5c3d8f942ae322437a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000097

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
                                                                        • Size 94KB
                                                                        • SHA256 123b84f024edf110a0dac8da95f52b00cedaddfd3c6572d3bb70392333645c3c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_000098

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
                                                                        • Size 390KB
                                                                        • SHA256 86af9905d0ae6f2b77be040ac812e7c912ab918e2023242c12ffa7910b7ba538
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00009c

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                                        • Size 29KB
                                                                        • SHA256 ea644bd5be2f9c59d7d28d1389e72939fcad26b9212d1df535990195c5c84e7f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_00009d

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
                                                                        • Size 37KB
                                                                        • SHA256 4d088148b66b122fb63802fb65f44ceb2ac3446269a9d228b38a4058b128a073
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000a0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
                                                                        • Size 149KB
                                                                        • SHA256 50895ef8648f98974058183a11cf3d1644674933d27f0e856549bca80445a137
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000a1

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
                                                                        • Size 232KB
                                                                        • SHA256 13e83db1306bd2519e4f235b9c83597415290f8a2347a640d4ff0da2cd3dd39f
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000b9

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b9
                                                                        • Size 99KB
                                                                        • SHA256 65e73530c92143b0dd64b79946f14e4a57d152bfcf130be0846c780e003c83e4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000bf

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000bf
                                                                        • Size 25KB
                                                                        • SHA256 293dc24bb7fd4c61b2be168c4d0dcbcad79c9b07ab759b767057f78ea95e7558
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000c0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
                                                                        • Size 20KB
                                                                        • SHA256 3773a0983800eea4ee2fd745e5060cc23479d31cebd844d8cff2a59cf19348b8
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000c4

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
                                                                        • Size 25KB
                                                                        • SHA256 b9b2e239bdc2b8983a8b8e21898dfa82be2eaad8cc075a645122f9f84a40fab4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000cb

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
                                                                        • Size 33KB
                                                                        • SHA256 d15d69ac640b0e68c2f161a55abf919416ed5ac6e5e981f4b49a676a6c41ee45
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000d4

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d4
                                                                        • Size 33KB
                                                                        • SHA256 307c9466a68d8b8e165deca97bde62fcded24a2fc0778a9f61459608b9955313
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000e3

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e3
                                                                        • Size 243KB
                                                                        • SHA256 108d3d1314b63ae114220f3dd4b2a4f3349f1549015fb47b186f8fcf71073c73
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        f_0000e4

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e4
                                                                        • Size 30KB
                                                                        • SHA256 ae919a7c9f25f0fd97fc18e398ae8e453fcaae487e4a4cb4f896e7fecde4a780
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        15b2be7c4a8377e3_0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\15b2be7c4a8377e3_0
                                                                        • Size 251KB
                                                                        • SHA256 602034d7032a01be6b7954cf6192f0db32eae755e4132178f52a934b258dabb4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        356924481ca36fcb_0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\356924481ca36fcb_0
                                                                        • Size 271B
                                                                        • SHA256 bb8791d5a5eecaa9dac052ffd55243c8d8c7a3e93511f9a4f3121e6a725c9187
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        a34887e8483bfcdc_0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\a34887e8483bfcdc_0
                                                                        • Size 273B
                                                                        • SHA256 e4fb9f8214f2bd53075759b528acfb6cb012ad01a0e3a7cbbd24185a926d146b
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        cb0d0fe4a15d2466_0

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\cb0d0fe4a15d2466_0
                                                                        • Size 313KB
                                                                        • SHA256 37f7bf5b4d680a595dd10a9fa0bf577dfc16a5b3ead224fd2f211f9509f2ed0e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        temp-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                        • Size 5KB
                                                                        • SHA256 72469d49631c49a80f6bb143f248298c49e2d5655d3c16bc995feb09d32a08f9
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 caa40953d158e344813f33d11868c22d19eca68266adcdfd792b0ee0d82bddc3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 4KB
                                                                        • SHA256 589072e4c21d70e3e5c9d0b2d6c0a8809c5d2bf743ce68e6253c10cce7607905
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 f00fb52ad35a23aa20427c86e180bb8f38d2607e1aa3ac203c8c917ef0432abe
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 fc109c2b2ec464f0f77d84bd86e4663d51b6b058d18beac231747972d4677e84
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 f669757c89b56ffb4b5b9b47cddca4dd255ae1b8d4d97f86c2cb11b1ec1999e3
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                        • Size 5KB
                                                                        • SHA256 230f7dc69665cc9346c7e56be0f9821ec9c075274944243a0cccf165836c3182
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index~RFe5b1029.TMP

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b1029.TMP
                                                                        • Size 2KB
                                                                        • SHA256 aaee37d37809ffd82586cf8150e1bf455c72474e0e0afae8c0ea983e349e35be
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        SiteList-Enterprise.json

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                        • Size 2B
                                                                        • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                        • MD5 SHA1 SHA512

                                                                        Edge Profile.ico

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                        • Size 70KB
                                                                        • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Network Persistent State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                        • Size 1KB
                                                                        • SHA256 9c9ed9aaa6fc84fdb073e2aae83cba6a3dc0879af3b988bc6106b3ab5f5340ea
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        Network Persistent State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                        • Size 2KB
                                                                        • SHA256 c284b5c95d19fb5747ab4150733f7f97c49cc27576da5ecb1d432dac5892122d
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        Network Persistent State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                        • Size 2KB
                                                                        • SHA256 16f996ea73c3b3d3e9fb4750b4ba532587856349ff273d035e3e49dbbb42be2e
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        Network Persistent State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                        • Size 2KB
                                                                        • SHA256 d94a31177b4b91fa9410db906329a46811fa1fecd35c526f2f17d4c2c65ee854
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        Network Persistent State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                        • Size 5KB
                                                                        • SHA256 9d7e55c11e63f3c0d8b6ddc29651849d75335180d0ad1243004dd32d79b588fc
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        SCT Auditing Pending Reports

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                        • Size 2B
                                                                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                        • MD5 SHA1 SHA512

                                                                        Sdch Dictionaries

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                        • Size 211B
                                                                        • SHA256 0a0b807f0ef0cfde409bb2fc4c6f488702011c02c3bcd6a627af7587d35eae22
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        Sdch Dictionaries

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                        • Size 40B
                                                                        • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                        • MD5 SHA1 SHA512

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 4ffee9b467f39ff09a96e7a6190d627368da6b4fa30cc849608dcb7ba49e2443
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 26KB
                                                                        • SHA256 1a3b54785672776e1c6a97240ed04c71f565addc7466fdcaa624251d453d17fa
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 11KB
                                                                        • SHA256 34500ac9a290e5fab11764ae90a2154a5aebef284e194b1c225f37086de74188
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 1f76deffb2a5e2e247b23a927a0befbd5ffecb6c30e97af930ecef1cb4380c9d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 11KB
                                                                        • SHA256 ee256e321e61edbee6edbc49d4bfcfa57eed052f8d0a73a3e4ead26482f62f0d
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 a650b0e68b2e2bd22d5be119936f2ed8b765997cae840c7822373781dc81d777
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 12KB
                                                                        • SHA256 d3f20c2df13dde05bcfff10579f2c7c8f29f860cefec6405afc6287b89bdc74b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 26KB
                                                                        • SHA256 1e1077968fb8504e72b0bfde2ea9118ff7d18c6227bfb3ad0d3eb403d1224633
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                        • Size 26KB
                                                                        • SHA256 e6b01583c3470235636ba7917fd90fbe7ddfb0e9bfba3028ecbb6d45f3efa77a
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Secure Preferences

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                        • Size 23KB
                                                                        • SHA256 2c7d83d4af8f8159f2018ae6cb714f0f20f963a3de5f736d5511e1756accfbfa
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        the-real-index

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bde0919f-1314-47d4-b158-02f622429967\index-dir\the-real-index
                                                                        • Size 360B
                                                                        • SHA256 5bf7c0db36d50d897f319a60714b7cf5520bf4ad80e2468621cef5abb1f5ee21
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        the-real-index~RFe5de189.TMP

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bde0919f-1314-47d4-b158-02f622429967\index-dir\the-real-index~RFe5de189.TMP
                                                                        • Size 360B
                                                                        • SHA256 33899e158571416d04fd55a8a1ae33187ef0261da2c601dc8b7f42251b8caf48
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        index.txt

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                        • Size 371B
                                                                        • SHA256 447414bf1e2f362c185dee4cdd2bd1cc3b67391484c97e9f4bfa0a4aacc449d2
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        sync_diagnostic.log

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                        • Size 2KB
                                                                        • SHA256 fee184f9c6d1d2bdf0dbe8509e081dbdefa91deb8750ecaa6892cd3988a170a4
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        CURRENT

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
                                                                        • Size 16B
                                                                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                        • MD5 SHA1 SHA512

                                                                        MANIFEST-000001

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
                                                                        • Size 41B
                                                                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                                                                        • MD5 SHA1 SHA512

                                                                        index.txt

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
                                                                        • Size 155B
                                                                        • SHA256 3a2e610375ae1780d7e15f5dfe0e233c1eb5ea9ab702b3b16dee0571e37682c5
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        index.txt~RFe61b286.TMP

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe61b286.TMP
                                                                        • Size 162B
                                                                        • SHA256 87d72f233fea5382e80407c8a09d476412c39181a9274942313cc4f4ae73e5d4
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        291f0121-259f-4282-96b5-3d469236de16.tmp

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\291f0121-259f-4282-96b5-3d469236de16.tmp
                                                                        • Size 22KB
                                                                        • SHA256 41d7425579d647887df4b3dcad99792016f6693f9de05ce3a861a12fcfcbdde4
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 35KB
                                                                        • SHA256 a5fa3094e95f3d3d60321abc1a1654ddc142253bcd237fa7c436db20ec05bc2b
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 39KB
                                                                        • SHA256 68a468ac8e5b9211d797d7ff66c145eb2f0bc05f2eab5536787eee01515dd50e
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 38KB
                                                                        • SHA256 8002d6676476956822016313095e61e912950b9de7c51355bc64dc964c5a7270
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 42KB
                                                                        • SHA256 8686e6a30b8b8a9af1c85835e9eab57696c230044f67758dd09cdf55da436aa1
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 35KB
                                                                        • SHA256 33129bd0c269e63db37d83e4b3c78ae9b14eb11e594a35448f1711a12f43643c
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        Local State

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                        • Size 38KB
                                                                        • SHA256 ec6f68fa5da8a35c136bfed1d6a3f5694c87493e5c99c2799ea072dcf4d16d51
                                                                        • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 15dc321a16de0066c5c515c5868984d83eaef06fa9ca6ea19be6b0a92b7f0dc6
                                                                        • MD5 SHA1 SHA512

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 c7ed87f5a339f8a4d8ca396eb5ed6e92e474764bae3e1b392559e810973a32b9
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 0aa621b90b49a3d7b4f59d196ad89d96960625684d6cfbb1d1a1dd4cf2a6ba4e
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 fff09835d57ea0f451ee5f6233d0e881aa8d1ce6d5680d8215614d7b7bb9eb4c
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 7350e60cc080b20baa00a32ec35a0e47ca32b0057f9c2999d02abd02a7aeee1a
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 947e39fa7c87be1664821d77a19e73ff11ef4511b1309e1bd6df068a70de25ea
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 8515beed957e75828cb8ab9cf6bb74ee3204d9e0a1ca57d164d8d5e6a523692d
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 1ec271084fcd2335ec9ca931c12308a43b7f19a315df1ddedddee988d03c3c0e
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 9d5f418057dcfed999e47e188536cacdd8d7c845a1d872a59d2dad2cd86b6cbe
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 25b3696d890e900c4222a60716020c32089eb0c691aa6e89d52a3412458cfbb3
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 d8bfc5449233204420095e2d14759a7ed74f6e0f857e051d32fd1d2b4625ca1d
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 59a41dc119335e46b4ef7d17f27e773f06e1940a5180f56c9d21a4f40b33e3d8
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 a6e49488237c17a2f32c3663280bf61e176388709a9b6b0eb5d3f81d6f21436c
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 2280e509356b17fd491f3ee0eb84a52e0e96d7b0a0f2f93f01d2fbf845669fe1
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 4195b472389d1fcabb578c5fbd3c22cd7137b9e64387fb7fda14ee6a3f200694
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 80e7165e7056f91502cf573713d41d6337196597b65f7b1f6f82d7d07048602e
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 8e91f8fe3622e72c2188ffb054dbcd7076fcc9b8fc6e726650b9cbc4d03abd83
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 c71406e59dc8b0c725d89a9b076dfc809fb7b6008ebf8bddfd56ae105965d0f7
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                        • Size 392B
                                                                        • SHA256 ffd982f121e02946e046487a4924fdc885674616b27b70dc4bdae9a27bf2e179
                                                                        • MD5 SHA1 SHA512 TLSH

                                                                        RevisitationBloomfilter~RFe59be55.TMP

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59be55.TMP
                                                                        • Size 392B
                                                                        • SHA256 14151460f1c33e64fe1f507ddb4c176279f8ed1d65d8fd05ea3a4ac6051b2d5b
                                                                        • MD5 SHA1 SHA512

                                                                        44f72700-2481-4fe4-ae56-c88bf6391f3a.tmp

                                                                        • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\44f72700-2481-4fe4-ae56-c88bf6391f3a.tmp
                                                                        • Size 13B
                                                                        • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                        • MD5 SHA1 SHA512