hxxp://heylink[.]me/Sleeppi

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
899s
max time network
733s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://heylink.me/Sleeppi
Sample260817-st3eaacb69

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4756	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314539823216792"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{20FE527E-CBF1-4CB9-A7C1-86E7B0250943}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe
3308	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 2968	3308	msedge.exe	88
PID 3308 wrote to memory of 4756	3308	msedge.exe	90
PID 3308 wrote to memory of 4072	3308	msedge.exe	92
PID 3308 wrote to memory of 5872	3308	msedge.exe	91
PID 3308 wrote to memory of 4072	3308	msedge.exe	92
PID 3308 wrote to memory of 5872	3308	msedge.exe	91
PID 3308 wrote to memory of 5872	3308	msedge.exe	91
PID 3308 wrote to memory of 2392	3308	msedge.exe	95
PID 3308 wrote to memory of 2592	3308	msedge.exe	94
PID 3308 wrote to memory of 2392	3308	msedge.exe	95
PID 3308 wrote to memory of 2392	3308	msedge.exe	95
PID 3308 wrote to memory of 2592	3308	msedge.exe	94
PID 3308 wrote to memory of 2592	3308	msedge.exe	94
PID 3308 wrote to memory of 5692	3308	msedge.exe	96
PID 3308 wrote to memory of 5692	3308	msedge.exe	96
PID 3308 wrote to memory of 5692	3308	msedge.exe	96
PID 3308 wrote to memory of 5688	3308	msedge.exe	97
PID 3308 wrote to memory of 5688	3308	msedge.exe	97
PID 3308 wrote to memory of 5688	3308	msedge.exe	97
PID 3308 wrote to memory of 4260	3308	msedge.exe	99
PID 3308 wrote to memory of 4260	3308	msedge.exe	99
PID 3308 wrote to memory of 4260	3308	msedge.exe	99
PID 3308 wrote to memory of 1056	3308	msedge.exe	101
PID 3308 wrote to memory of 1056	3308	msedge.exe	101
PID 3308 wrote to memory of 2620	3308	msedge.exe	102
PID 3308 wrote to memory of 2620	3308	msedge.exe	102
PID 3308 wrote to memory of 3212	3308	msedge.exe	103
PID 3308 wrote to memory of 3212	3308	msedge.exe	103
PID 3308 wrote to memory of 3212	3308	msedge.exe	103
PID 3308 wrote to memory of 4364	3308	msedge.exe	104
PID 3308 wrote to memory of 2344	3308	msedge.exe	105
PID 3308 wrote to memory of 2344	3308	msedge.exe	105
PID 3308 wrote to memory of 2344	3308	msedge.exe	105
PID 3308 wrote to memory of 5076	3308	msedge.exe	109
PID 3308 wrote to memory of 3912	3308	msedge.exe	110
PID 3308 wrote to memory of 584	3308	msedge.exe	111
PID 3308 wrote to memory of 2688	3308	msedge.exe	112
PID 3308 wrote to memory of 2688	3308	msedge.exe	112
PID 3308 wrote to memory of 2688	3308	msedge.exe	112
PID 3308 wrote to memory of 1368	3308	msedge.exe	113
PID 3308 wrote to memory of 1368	3308	msedge.exe	113
PID 3308 wrote to memory of 1368	3308	msedge.exe	113
PID 3308 wrote to memory of 3848	3308	msedge.exe	114
PID 3308 wrote to memory of 3848	3308	msedge.exe	114
PID 3308 wrote to memory of 3848	3308	msedge.exe	114
PID 3308 wrote to memory of 3612	3308	msedge.exe	115
PID 3308 wrote to memory of 3612	3308	msedge.exe	115
PID 3308 wrote to memory of 3612	3308	msedge.exe	115
PID 3308 wrote to memory of 5640	3308	msedge.exe	116
PID 3308 wrote to memory of 5640	3308	msedge.exe	116
PID 3308 wrote to memory of 3952	3308	msedge.exe	118
PID 3308 wrote to memory of 5380	3308	msedge.exe	119
PID 3308 wrote to memory of 5380	3308	msedge.exe	119
PID 3308 wrote to memory of 3588	3308	msedge.exe	120
PID 3308 wrote to memory of 3588	3308	msedge.exe	120
PID 3308 wrote to memory of 3544	3308	msedge.exe	121
PID 3308 wrote to memory of 3544	3308	msedge.exe	121
PID 3308 wrote to memory of 1748	3308	msedge.exe	122
PID 3308 wrote to memory of 1748	3308	msedge.exe	122
PID 3308 wrote to memory of 4332	3308	msedge.exe	124
PID 3308 wrote to memory of 4332	3308	msedge.exe	124
PID 3308 wrote to memory of 628	3308	msedge.exe	125
PID 3308 wrote to memory of 628	3308	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://heylink.me/Sleeppi
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffd3775c188,0x7ffd3775c194,0x7ffd3775c1a0
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,11350838528456673603,6568540607852132784,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8503235253708526611,11510393171798329515,262144 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:2
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,4982599866945896435,1241324110971002566,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:13
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,3339346240945465384,2206511856287134444,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,12518195314694396392,5172076217694346464,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,15653572191226816111,17756531251601342652,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:9
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,10001761500125568514,15604468877097170566,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3480,i,3120931569998892690,7042856011462571951,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9747513987916171501,2411570164298303018,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,10286614975098695278,14659598716018772558,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:14
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,5515999758474193740,5523760146624571584,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:14
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5552,i,940516836537223736,14409673196442843655,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9747513987916171501,2411570164298303018,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5452,i,7955841565614883555,611586527432036971,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,17469924914442120440,12721614666696855824,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,4619244888878187552,18087446477045344152,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4920,i,11281204416780297844,15261025176796970690,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=7276 /prefetch:14
  2⤵
  PID:584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6352,i,18375922802551409579,14212057342354979702,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5540,i,16211986918389696352,10614474548541321715,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5736,i,16704633443626509840,11144785427997828234,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=6908 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4964,i,14334942243699785274,5000825095087667509,2097152 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,16678200997461854419,2216630153316224183,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,18252968462278748472,9870591198103799983,262144 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,11867392869517979690,8426209537088231848,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,11624185347716116588,8179141440184482495,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,13350118285333868292,7799388621283722852,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:14
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,14360342223528171681,16282457480564642010,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:14
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3876,i,11182641453642212023,9513390427029953132,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,17680860004766342019,11496857414727413527,524288 --field-trial-handle=2116,i,13850464001836311792,11164702050161961105,262144 --variations-seed-version --mojo-platform-channel-handle=6044 /prefetch:14
  2⤵
  PID:628

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1056

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

95b8cb8b-080f-49ed-a22b-16a6aca15003.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95b8cb8b-080f-49ed-a22b-16a6aca15003.tmp
Size 38KB
SHA256 5368e30cf0cba67448ab5302e4c7e6e99f2df7a5d2e6d2a2beb237f874dbd04f
MD5 fceccb5e2f49871a542efcb2caeb3f69
SHA1 66b13b2ada8d70c3f09457c678a440031715d611
SHA512 606ca440364963769aea6880521e5ace6f077448d300274ca3f8b8c2be1966510072d0b4d1f8dbda8c79c70957783d1c5973bc3fb927ebe5c987bdfa2be3a5ab
SSDEEP 768:6rv+4UNbds3OeDZIO0bxNzc4ReyIsX1eVH1S5D:6bsbS3otc44bsFEH1Y
TLSH
T14C03CF32E8788937ECF6A686B14776537EF8512BC2981E94C5DE6F0C4A4B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 67f9d88a7a7f5e7f5d06d10ddde1cdcf13b15231c15d0f48c6225591456eb65a
MD5 59e5e191ff5a288e105a38979bc06b8b
SHA1 24e733da47193140101e4f2a224f108a6462f4a4
SHA512 b20c3b9291278552e7c81d0ee69df3b1e67ff5f2608d187526b8d4e0dba8b2416490778a4a3c5ad3f2103beabb0a187cb2fe1df243c41b842ab72c287cccd406
TLSH
T1EAE078C808C9C25D6A4C65875374574D81D1360AD2D4BA5537408544F703841FECF960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8a0c24027fbd81cc5fb7160e86f212bbb573f460f1ef204b8c2db7f6e5438b46
MD5 14dff88d9c1caaaf04f57ff3e065f294
SHA1 59458057663b417a93082253c4ac619b0db6e9a0
SHA512 91f85e90762db191f7409df719f8c3ce185ef60f48dd3d9f62fc013ba0c0bbbf6359800593aa8916d124191c2803c7d8392a82b0b12703d98cd543ee36d3420a
TLSH
T110E026D85ACDE22FFB50654B517C570D8380374AD2F8FADA2704E8857607840F2876A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e27c888ba6f37ca95875f11237b4fb98d8d3ff69b9ca2fa4258e0fef3f6ed9a6
MD5 a0eac53ff42aa65d93c236ee0c6e6113
SHA1 f3cad6c7bf75b4dc3dc842cddd0715d90a863cb8
SHA512 cea655175f152b010005fa828b2bf04bb3331d8e9312734c847b1e19c67757315d1a2bbf0798ee05ba910f270d4976b27771eeaef022ac346e110a6abbe5185b
TLSH
T18781838627553AE0EB3904F347D958D4B7F5A7BA0C1B9EE6A3492C3E684EF4C50C901B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3748749ed35b0ec3824161c8aa3954d669df04356daf9d0c20740a81860f054c
MD5 9dc98fad38a4bb442720bec26cdf55d0
SHA1 5edb13ee531cc45e593bc64701c0d716d19d2d01
SHA512 ce65e2f2a3fb3738aec7b2507a52b7113bde1eac9915f102f3416793a0464c173f4e4c0c61bda12b934937d44b073c8823113a6c959ee5d8584a583098d62677
TLSH
T1E261B68617193AD1F73548F757E954D4B7F0BB69090FAEE2224C2C3A981EF1810CA01F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598004.TMP
Size 3KB
SHA256 f66608057c5f1d9e0f65f363edea99712c2d48a22070d8e81b584376c3119386
MD5 e334af3b3160785189db46b74e0a1c9a
SHA1 265fd61a32dc4f678c834b12101240b971e7ba35
SHA512 4ac1acd9d16782f92b6adb36432d631a6dab4051fce432eca8a2883db9ed36e4f7af45cfc85ef8c3899738740713406786d12f6954be7520a2e9868dc2799416
TLSH
T101618696171A3AD1E73449F757E954D4B7F0BB69480F9EE222582C3A581EF0850C902F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 fcd090e813bc199e9a0290aa96f81a4eb136f0927653e182e89f7bbb01184a5e
MD5 8ee3feb0122a4bbdc3ac1bcb6d258492
SHA1 76ee4cb1d9cdefdf8e77cecf393a0a9baf802625
SHA512 dbe23ed5b421b36b80e7d5bace5104596b3982f1b782f4e7c15a7c9cd52ac5a74c0ea68a379bf7a9defd85aae11856edcd0320d797023dce02239d9f945a02a0
SSDEEP 192:DyR8Re0xvBSbeYe5nDyZXVaaiGCdGC30IF7vUbUED4fqUc1novt40VeE6ib60qvv:DyR8Re0xvBSbeYe5nDyZXVaaiGCdGC3y
TLSH
T12F2270F783E5866DD951D2F0DB24AE1BCE2C062943283C69CAD8AE4F93F1471E25174E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 52568cbaaf00718d0b0e16bd8a99136ee74f38c69ffdd7c0e34e2575b32f88cf
MD5 4b56acfc6726ad9c5188502bce6c43a8
SHA1 212b3a266c2ecb2c87a2349413d4aae994f1b599
SHA512 eee42422f0808fb69f3191d55402c8c16894492ce2ca20ba4c2682589d8f2c26ff19c414183aee7401b183ec9afd3eaaaf7bd816e5106df8c3b3d36c4d523ea6
SSDEEP 192:DWFJv3bUlbbEexe4wEINagVaaiZ1G30IF76Upa4fqUa1ioRt40VRhEbi0kdgapZy:DWFJv3bUlbbEexe4wEINagVaaiZ1G30A
TLSH
T18CF15AF743B5866DAD51D2F0DA14EE2FCE2C0625031C38798AD86E4B93F2472E19175B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bb1a05477eea897dcc4aafd77c29b813e7f67e253a52ed96683de046d329c3ba
MD5 9fcd6c6ac2ada9237eb7a00eb9930f84
SHA1 2b245d60377eb0deb623582a19adb3679f8e3427
SHA512 2aa4d4c8755cf8508afaf1d4e36809f2b7037b1453ff129e6ac0d0076f4968090387d3e750dacf9d32c7507bbd30596f280e9cc6ea522a22ce057a5795986e19
SSDEEP 192:sxRqRSbv/fTsYi4WprQ5AzoA8p2EL/g6+WN4G+/Yn0eBdh+GvIgDCJ:sxRqqv/fTsprc//5Q/BedZa
TLSH
T19C42B65669686D3B8CC7E21DBA55BF53E3F91132A0D12E44AAFC9A1C04F76CD620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 a4d7fc9a58e64a5ae892a3872e99e44bef9b29d67d9ca92363a315001661e2c9
MD5 e9c0e91832e166bf7abddaeab7e4c9c6
SHA1 56c156363fc7f34a5369b05368d2e7a6d3391581
SHA512 62464e8805143894532e475945fc832cb0e2144605c94afaf7ff368c591a8351a0c7c9c20962602bab9b1f146abf399f7ba9ff24d06088fecfe8180bb20e208e
SSDEEP 384:sxRqqv/fTspN66s8qMpRiYnazAW8pZS15posJWeT+Pjm/5fX2e8Za:sWqv/fkN4Mnc7WeT+Pq/5/2Bo
TLSH
T117C2F905A824D83B9EC36D1CA53D7E33DAEC505221C5DEDA5AECCA1C01AE1FDAB07817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4095e967c17a5fdfea71068ae00f39e00cc650ac7ce405b834c358472322b91b
MD5 b990c921102d9253516d5000528f37a5
SHA1 8804968a7e42df36e8df7b9a6ea914c33e72f9ee
SHA512 3a5d2a453e66299d97bdde2df03c8fe334cd9372dd4396614478df9dcafddf58a346f62bcf961a96812cf95ccfaab92c6c871b88408acd8296b5f739d6a2087b
SSDEEP 192:sxRZRSbv/fTsWi4WprQ5AzoA8p2EL/g6+WN4G+/Yn0UNh+GvIgIJ:sxRZqv/fTsPHc//5Q/BWZs
TLSH
T16632B7566968A93B8CC7E21DFA15BF53D3F91133A1D06E44BAFC9A1C04F66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63503f8fb29b2fe5652a54129d9f8ff5b2d628785b192d52f5ef0fe9d64605e4
MD5 213f47dd1fd23742e51c7da5f494c56a
SHA1 f6539e1d8b29fdd45629145a29209cccf00f5eff
SHA512 dc1c51a3e38d1e4ec03db8ef3d2e21d766959b9d4a8d2b4ce199b237a3823e9e5f6128374b98ba79b6bb86d879c49c7e420375d55b1c9523537972fbb8eb2211
SSDEEP 192:sxRqRSbv/fTsYi4WprQ5AzoA8p2EL/g6+WN4G+/Yn0UNh+GvIgDgJ:sxRqqv/fTspHc//5Q/BWZQ
TLSH
T1AF42B6566968A93B8CC7E21DFB55BF53D3F91032A1D02E44BAFC9A1C04F66CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 221fdff373a5215efe4c77aa753852603e30812074a49424f53b8abe647881ed
MD5 f1276cb6f3931eb309fca767ba4dca88
SHA1 a6d60fce0b1d05f5ae20d5073e7cb0efff83e354
SHA512 7313c131bf4b6ec68a100c7d93adc2453201ce688b6220561086925b2199591a8f4223a4152e47d65f929ea92d7bad4ec001629e558313a8206c117774abc69c
SSDEEP 384:wum8dzAfCtgoSFfmMKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPECroh5:wb8dz6WgoufmM8F1+UoAYDCx9Tuqh0VP
TLSH
T1A0B2DB3B604DCB7E5F800AADDC19AFDB6D9802C79A988D4447FE990C03C77EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 360B
SHA256 ade99381432901ef451d90501816abd516ddd902357e4c03c18595430e3ddcaf
MD5 033c5aa5e0e1fdca6b372395f3d8bdd1
SHA1 89ad626bf9b4521d5565acd79f8018cc104b8e49
SHA512 ebe24184bc8146e36c93eb26a39b2a3f19bca3e7ddff664f8ba6c1b44f6c27a3d73b87ebb570dd1427027f631a8b2d4bf23627f2b371bc40d9c8c979b7a1515a
TLSH
T15EE02BCACC934903C9263C370DB6251D333F1AFD2509AA2610FD401EDD5563D424170D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5da441.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5da441.TMP
Size 360B
SHA256 be6d38b284da1dbd2bf4f7c390de88b0ab5d612083fc2de5a806bdeb6257fcc0
MD5 e839d771cd510687f565a7e1193d994e
SHA1 09a924850c252e9f532275b7d6177519f9e530dd
SHA512 eaf40cce0d5110e7d26e9aa8349e2d78a361434d653b3984e6bc2586746cc148792c7a926f0a0876f5443ad8ac5da489214f351c3957ad7c211c15310393e70d
TLSH
T194E095CF40D15D52CD276D371543A11E333F0C3C2519EA1B50DE945F59217BC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9e0c540edf61fc07e9b6849887f3d512e25e32b61adcacc21a912d3b9b3e452b
MD5 f77d28ab03a37e3562e8d8ba93c1ccc0
SHA1 527cd0018868df575f8badb12998e8dfde96fdb7
SHA512 2c872d8d835bce6637cf5376263eeb58eb85789a0c95b978513b6cedf1b30fd2077135704bafec0db302a7fc3b84b2c55e0c836bcd257a36c5e9794ba966ceaa
TLSH
T11BE020773EF72804ECFFD7DB1831649105507454884DBD4FA815E3D714B236434AAC61
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a00cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a00cc.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b51823c8166c2e96f52c2083b37c6ccbed2eb5da84551959ae5e8dfd2df98425
MD5 4c060ff42b48309c9072dea4cf26a646
SHA1 06cf83d73160e802ae68309af2ddc22628b8385f
SHA512 6b0243a7c060ad18529599a68d4f0c24d99a0ce8dec45d99cf61031454a27efe2161befcf5f6a10a437db46f1cd4bf3329213c7a941083942c66d5fe6adbd6b9
SSDEEP 768:K3Izhi3X/CKDZIO0bICNzc4ReyIsPCTX9m6yMtS2a:K3Ig36tc44bsaxm6Vfa
TLSH
T1D8F2BE76F8649967FCA56686F2073253FEF4412BC1D83E949ADE2F0C0A8B19D434B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 9340a7e551b67ef9bd8bfac0106524e60c8884ced38f83e1056005c631c42f35
MD5 408e551c1d1badf8c59187eaa3e3564e
SHA1 623ffa2a6c5c2e53648820a9582511dbba56ea08
SHA512 2092c9d797d90edb329b8cc60b43a9527c6c64cfc11f01061ed0cc0be2f2b2f58d4f7710a9fe847074f2869af467e2049b6b866a94d1e9b0f8db8e0cda3f5fe3
SSDEEP 768:6rv+4UNbdK3V/IKDZIO0bIJNzc4ReyIsPCTX9m6yMtS21:6bsbc3ttc44bsaxm6Vf1
TLSH
T1EB13CF32F8689A77ECF6A646F1077213BFF8416781C82A94D9DA2B0C064B5DD131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 0d3490031f09644e3c1d9f690d0632b98b21431be97afae854c318b10a0aba14
MD5 38bd59a4f1ac2a81a9c0ea0308e65e2d
SHA1 f1df000c1381e9b963332cc960f7fea82b6a8eac
SHA512 7e13d66b1f34161df6e218696389045b5a68d6d8cdde10350fe19d3814dd3b80eb6a07bb715d0d824831de82beada6e3754f555cba63ba6e61d65dd5523db850
SSDEEP 768:yOFZ3Izhz3Bwgx/eKDZIO0bIGNzc4ReyIsPCTX9m6yMtS2a:b3It3stc44bsaxm6Vfa
TLSH
T109134AF6A8D38576ECAD5743A73E3E12AEBCC117B0946954B7C95A0CCD461BFC30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 fd385a4bbab824e59c5892c30d94b88e1f94e6a88bdd46add5d9b411d47a43db
MD5 5e073e42cc44a76bd1dbbfc4527211aa
SHA1 eaf3890e4773a845345b267218292f9f5ee200de
SHA512 1f5852d9bbb24a561c6459b56d6b7e2af62e38e2e2d1d1318804acb672ff167bf352feb8ec7262500a5c53c1a859700c224ee00ed64ff8f63728b16c222eceea
SSDEEP 768:73Izhi3c/CKDZIO0bICNzc4ReyIsPCTX9m6yMtS2a:73Ig3Ptc44bsaxm6Vfa
TLSH
T13BF2BE76F8649967FCA56646F2073253FEF4412BC1D83E949ADE2F0C0A8B19D435B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 17f712b89ce1b42d7ac99d92b43e1e20d9fc7bcaeae45751a65ae48f95a4120f
MD5 e8a191a0e034d6225691418fa4a2531a
SHA1 d38d3c36ea36978d8d279f9d09cd766c61460778
SHA512 d0a4c81a1c54019467dfe9b8b395c9c68b3890972af05ca149d7860149d0369e829187ae8cfdbec2297641ee2730349841747c5518fa2ee6ad54b25c7a2e8df8
SSDEEP 768:Rrv+4UNbds3YUDZIO0bIgNzc4ReyIs2CeVH1S5D:RbsbS3Etc44bsREH1Y
TLSH
T15F03CF32E8689937ACF6A686F04776537EF8512BC2881E94C5DE6F0C4A4B5DD034F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa15bed7-7344-47c1-ba3d-f0db3a120d08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\fa15bed7-7344-47c1-ba3d-f0db3a120d08.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download