hxxps://www[.]itees[.]com[.]sg/

Analysis

user interaction
yes
max time kernel
899s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/08/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.itees.com.sg/
Sample260819-drywrawanf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2128	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134315829218208196"	msedge.exe

Modifies registry class 16 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{FE2B6F0D-8DF9-456D-971C-9E98748DA850}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-2904698490-2540843659-2047741361-1583039222-628509060-1343416660-4183458959\Moniker = "cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.xrf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 44 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 42 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 3896	1308	msedge.exe	84
PID 1308 wrote to memory of 1520	1308	msedge.exe	86
PID 1308 wrote to memory of 2128	1308	msedge.exe	87
PID 1308 wrote to memory of 1520	1308	msedge.exe	86
PID 1308 wrote to memory of 1520	1308	msedge.exe	86
PID 1308 wrote to memory of 2116	1308	msedge.exe	88
PID 1308 wrote to memory of 2116	1308	msedge.exe	88
PID 1308 wrote to memory of 4608	1308	msedge.exe	90
PID 1308 wrote to memory of 4608	1308	msedge.exe	90
PID 1308 wrote to memory of 4608	1308	msedge.exe	90
PID 1308 wrote to memory of 4948	1308	msedge.exe	89
PID 1308 wrote to memory of 4948	1308	msedge.exe	89
PID 1308 wrote to memory of 4948	1308	msedge.exe	89
PID 1308 wrote to memory of 1452	1308	msedge.exe	91
PID 1308 wrote to memory of 1452	1308	msedge.exe	91
PID 1308 wrote to memory of 1452	1308	msedge.exe	91
PID 1308 wrote to memory of 4284	1308	msedge.exe	92
PID 1308 wrote to memory of 4284	1308	msedge.exe	92
PID 1308 wrote to memory of 4284	1308	msedge.exe	92
PID 1308 wrote to memory of 1492	1308	msedge.exe	96
PID 1308 wrote to memory of 1492	1308	msedge.exe	96
PID 1308 wrote to memory of 3312	1308	msedge.exe	97
PID 1308 wrote to memory of 3312	1308	msedge.exe	97
PID 1308 wrote to memory of 4636	1308	msedge.exe	99
PID 1308 wrote to memory of 3636	1308	msedge.exe	103
PID 1308 wrote to memory of 3636	1308	msedge.exe	103
PID 1308 wrote to memory of 3636	1308	msedge.exe	103
PID 1308 wrote to memory of 3336	1308	msedge.exe	104
PID 1308 wrote to memory of 3336	1308	msedge.exe	104
PID 1308 wrote to memory of 1544	1308	msedge.exe	113
PID 1308 wrote to memory of 4992	1308	msedge.exe	114
PID 1308 wrote to memory of 2508	1308	msedge.exe	115
PID 1308 wrote to memory of 3628	1308	msedge.exe	119
PID 1308 wrote to memory of 3628	1308	msedge.exe	119
PID 1308 wrote to memory of 8	1308	msedge.exe	121
PID 1308 wrote to memory of 2000	1308	msedge.exe	122
PID 1308 wrote to memory of 4264	1308	msedge.exe	123
PID 1308 wrote to memory of 2000	1308	msedge.exe	122
PID 1308 wrote to memory of 4264	1308	msedge.exe	123
PID 1308 wrote to memory of 1168	1308	msedge.exe	124
PID 1308 wrote to memory of 1168	1308	msedge.exe	124
PID 1308 wrote to memory of 2068	1308	msedge.exe	126
PID 1308 wrote to memory of 2068	1308	msedge.exe	126
PID 1308 wrote to memory of 1760	1308	msedge.exe	128
PID 1308 wrote to memory of 1760	1308	msedge.exe	128
PID 1308 wrote to memory of 4952	1308	msedge.exe	130
PID 1308 wrote to memory of 4952	1308	msedge.exe	130
PID 1308 wrote to memory of 3332	1308	msedge.exe	136
PID 1308 wrote to memory of 3332	1308	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.itees.com.sg/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x2a8,0x7ff93af1c188,0x7ff93af1c194,0x7ff93af1c1a0
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,12892315544936352295,6324079639048216225,262144 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,16420631125965889805,11943944057195333937,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,669430242293815011,3198599859551653889,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3380,i,7267054318209880859,16801854593492554500,2097152 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3384,i,14167825832445762932,2780587388958855073,2097152 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,16215574943399217276,14125545735615322986,2097152 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,16844749743860422667,17006941362273176381,2097152 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10674709822860623965,3211660931223063656,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,7362749425360112108,4655031676010703739,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13213455419605483950,15745022202048784870,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,13213455419605483950,15745022202048784870,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6220,i,13439579920736092561,865982693320816588,2097152 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=device.mojom.XRDeviceService --lang=en-US --service-sandbox-type=xr_compositing --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,15109015349009836646,2127105245829794902,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,490608949436337074,14113786569957307277,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4200,i,12285939964924864840,16718874621066177517,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,17482099581735274692,12249519435683386313,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,9256476452910206889,6399144000483196003,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6652,i,3324151303713848843,10398900878653861089,262144 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,12308859850513374663,14176781703555152138,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,10950616583366089906,13280061580023854612,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15596704210849601821,8541368675300730841,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,6098390382151142890,1337065716154680896,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,11758072389129040214,16087107971275922440,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,12005700839879388545,1983189152664088987,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,7748950940108622312,11222157274609424797,524288 --field-trial-handle=2340,i,8854015783203309142,13177473157875145649,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:3332

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 eeef9ebd751ac57340bddd0e184828679bd2b816030f7e8b32163599491a69e1
MD5 75f9bdf898c979780e853d0520c179b0
SHA1 7ea4309e3aa64fecfa0848d070185f00d3e5592c
SHA512 bc6b63352eca063a6e3f48ae40e7119a1de3c15c186aff756cc2b1ddb3df939c7f35586f6ce0eafbb936b73d151a51d75d5b09ed777d97c520df5e98d7216945
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T173B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 7913e1017f34fe9483e6181eaf011c62deb23acb2b4ef1ff9b265bc1d950aab1
MD5 2b84ffbc75fe91c3ff6d72dca6e285ad
SHA1 2ff41b2f2984fa27e87bd15d30a86f1b2b3383e7
SHA512 43486a8f4e7351bcbecd0cbd579ec7a2f674c19489a0d9860241b641a51d3697aeb18759b43494ad54ee39a94636f9ce70a307e5d0658114bf1fcac39356cfeb
TLSH
T19FE0DF9E138CCAB58FC0B68FE6785218C110BD8EA68DE46A3AC8F59D7420080939B080
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fa66d18a3495e75b009951913aa39673f3a5876f559d04b71322d9a83e1e6bb9
MD5 5c7020dc640b727c26491ffcd2af334e
SHA1 ed2471de1c45ff70ea082de0113b480bfe5c0efd
SHA512 c01b60eea79e5761686750212cc604943b92da4c8427343ef8c99df0e6ce51b5c1c632693c5f2ce2f169e01addbd3fc1ac7e530daf6b91f0e3ac6480996d130f
TLSH
T17FE026E806CCCA6EEF40B6579278830CC2E03A4E96CCFA9B2740D48C30C1854A3D3AD0
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 39f53806d4021f3de82cdd0d79687a586e5591c423d7ec3ca922e50455d0e54f
MD5 c01661bac78dfeb274e9a28fdc4941d2
SHA1 82f15b34847e3e98d1e065b121d5523768876837
SHA512 1be51c70c419198fe687a73545b16a42c473b6eb414ef5f19b1afc214bf06827cc7bc9e4d5c2d59751a28ef26bdc90ee5ee691551632fcb521bbdd1251ead82d
SSDEEP 96:MfoF197uC0jdSqWUPnYsb4WC0adb8P863:MfO7hlqRPYs0W3+Av
TLSH
T11BB1FCF52B724060EB6001FE96F96E16353593DAFA07DF4A32847C30AC16BF10069D2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 934d2df313aa80332f7b7c96e55f76749a5fd544bb34694d80ff859d4dc326cc
MD5 2c6176db743292e40130bd4e9e856087
SHA1 c5f1ca9864b057e9888b3410611f0834a0f65398
SHA512 5e72c2dd23e5bb3b17432e90be6b03f73f13cc85b505aea78a5c8ad31d67352d36560a839bbe04e68f8753802980dcab99d4e9e2ad0e702d438a2f6f14f028c4
SSDEEP 48:LGcx9rrhZmeVk66ZtzmVSodS6cWFiUPnTFC0uiBb4DqpI0Q9gepb88C2JUV:LhFT7uajdSqiUPnx3b4WC0adb8l26V
TLSH
T1E4A1A8F42B7200A1EB1005FE96F96E16363697EAF607DF4A72847C74AD16BF10069C2D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b735.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b735.TMP
Size 3KB
SHA256 e31255608d4476a635dbb4ed1100f0b983a44980e41e140e77fab3e7dbba5970
MD5 3e963eeeed4ad923eac47815c18c5995
SHA1 5418e07d9ab00eb8ef39bec077d6ae94048a7a31
SHA512 3a1560b9c30bf1063837dc9554cd998c669bfd9115153cc01b09ade0a53662c143756c5b4361be07f353da3440d601e89d193521a1c7e214db45287b338531f5
TLSH
T15281C8F52A3200A0E720057D94F96E6A3A75A7EAFB0B5F5A31807C706D16BF10069D3C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 396b56d83d428b9d88e7c06f45abd9d59c10886e5765d58a1ef73ce5a4baba9a
MD5 ea0bb17bc3ff13c093e3ca29eca58acb
SHA1 1a0d4c99870937cdb7290882a5117a4446acb2af
SHA512 706ab8d193999f6dca9178f657e660e2fe904454f37109e5a4b1731e9cbddfeb55caa46bb5797c55f90f4b6113eef20272917e3891ad5a046b8353dc39cbe015
TLSH
T10F419AF7CBE8952ECD1192F05A246E2BCE2D0955422C3D2A89D8AF4B97E2431D50399F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4ce35a155ad9a721b621e1cc9fc4e37190a436838214a52b8dc2a8eb0e4caf18
MD5 af155441a3d6423997b4143647a45553
SHA1 2de80fa3473b583be4c749470e0b6f8795b3cf47
SHA512 6a9933c8b6fd35e10cd708fa287fe843d5c635d03a90e55674011a6ee30f28ecf877c285a45c22fa7a3c47545017203979b880395031f471f1264973126a136d
TLSH
T10C61BBF78BF4966DDD1152F05A146E1BCE2D0910433C3D6A89E4AF8B97E2031E502A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 decbdd6e548746f3f1677a3f44e875f0ffc39ab3fb1ac71cc151df04b23d9d45
MD5 098937c2d1153fe002331662cc305999
SHA1 d9cd641d186e07b253363498f1e5638be8673465
SHA512 c9ba09dc321b383ded9aee44f9e12621672fb9d1cb3e8e0eee9935eb5194a462a32e06119b09309e66cb9f71d62807f58f062bcd7a6923b68e03d1c4d08181dc
TLSH
T1BD51DBF78BF4966DDD1052F09A146E1BCE2D0910433C3D6A89D4AF4B97E2031E50299F
MD5 SHA1 SHA512 TLSH

Submit Download

cacec47a-e7d3-4952-b977-b240de34594f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cacec47a-e7d3-4952-b977-b240de34594f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 1b829caac05dd32a978464178e520f10905a22c957b4ccafbb018eb0a3e3135c
MD5 7431c55b45834c8bfc94330133cee328
SHA1 773a94f581d9f2090ce9456c95467654ea118688
SHA512 3a5b87ee3d911c74ef4420114fdc2d4785ec41ff864797c4e67f07e94d8018a828621647fbae46496148c4d51ef12f54a7f48fe272147b68b18cc692ee596509
SSDEEP 192:sxZCR0yM/jK1Ml8MkZ/f2sKL2VbIdpWFsHW6+WNBMQ/Yvppj66IgrJ:sxZC6MZ/f2sKLpWSHbF/Cp9
TLSH
T1B042D612BA34697BCCDBE209F955BF53D6F9446292900E44ADFCCA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b4daaadd28e28f120be77416fc9c100960baf8d7bcb3c9b54dcaaad015e35fb4
MD5 34eaa03bd21e4f8b823d49a60c90238a
SHA1 2c20dfbcadb0a0152b33b417b3439224b569a8b2
SHA512 96a1415fc7ce00856f9675873714bfef75c754967b23960ad8af53e72c09fc12a5dd3991e960abc872823e5f660c0afe2b30705728734dc6d6508978b66455d7
SSDEEP 192:sxZCR0yM/jK1Ml8UQWkZ/f2s6U+2VbIdpAFsHW6+WNBedXYvi4j66Ig5pJ:sxZCyq9Z/f2s6ppASHbyXepN
TLSH
T15652D712BA346977CCDBE209F951BF53D6F5447292900E84AAFCCA1C00E7ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 42f805b8478e5bc83168573f9195f444568689b15aae3309bc0cfd1eabe90ee6
MD5 6b2c20f17eb982593466e906d4282901
SHA1 0fc8a181efaf8685fef9f82438e39871e160a9e3
SHA512 ef25f32a8e0f4bb0ed461d75ca29b5be8b3fd13ea545916e40afedbd13aa4f8f671a95e321998ecb4867a797d16249d0e6de97c94c9a7dacf6743e575839cabf
SSDEEP 192:sxZCR0yM/jK1Ml8MkZ/f2s6L2VbIdpWFsHW6+WNBMQ/Yvppj66Ig5LJ:sxZCyMZ/f2s6LpWSHbF/CpL
TLSH
T1B352D612BA346977CCDBE209F955BF53D6F9447292900E849DFC9A1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 3bf16c485bf8ffabb620ee60d32e432c9ed456742034aefcb462609bedb31501
MD5 0e7287831308a58fa6f5109a472320b2
SHA1 e496fd8c0f0ecf8f787e6bc1996e65e456751f2d
SHA512 0d84dcae885a5a3e36651c6707257ab7b14a105ecfed887831109af7c1a6ab1248d8eb75bb9b14e38e4f981d976a10538b546184cc7f0652a7b571edad306b89
SSDEEP 384:sxZCyqwZ/f2s6R66s8qMpRiYnazAW8pZS15posJWeT+hZANHbwQZWGN:sqdwZ/f0R4Mnc7WeT+hWNHbtWi
TLSH
T1E5D20A05A924C877CAC36D19B43D7E73DAEC50925285CEDA1AECCA1C019E5FDAB07827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f1b6df9dc54e537cb5ef3e6a267289880af2f59176f72a272b4853cd7c07b4ea
MD5 e2410eed3c05ebde84a7a86704640534
SHA1 6c88bc053f4f7b60fec252ccdaf0f023465135c4
SHA512 c4cf26df504770c519e8e3b20809c446d1a28f693d27ae5a95260e95bf93cff267ff1f48d0cf4228d235caeb573591571d12f982b3d469d78bc6691173ff95a2
SSDEEP 768:VZseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pparoFM:VZseJ3xWvhfynu1jaVcL88pRW
TLSH
T1FED20B2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 bedeeaa76cb2b46dff8f9af2c292ae36083de6e083c2c7533890116a17b885ee
MD5 b3940999ff5b4be512bb4f38185980f7
SHA1 8a0000386dda2e415fe15f7dbafae742120be61f
SHA512 7caf9bac416e3e9e22832bcc109acb8d6d18e9bcf6d820680d371051611c8f6b97c4f783caee0e346eb38a69124e53f3068aaa361b599bbb1753e8ad9227a6f4
TLSH
T1BA21A5488E90891FE468847B15B3B4F03370CDDC572163631C2C35751E2139D3A076DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce566.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5ce566.TMP
Size 1KB
SHA256 0089c650b493f596cc929a9068aea1ad257a5b1142357fafe5e087dfaa5ed7ea
MD5 ddf855c41a5a8829c4ffc118176b851f
SHA1 d0d42602b6134ab9938b722862badf49de174f41
SHA512 76c6657ea891dd00101c33fedbf70dc48b6a5c1f14c8d5f5ca507a8e80a3f02308eb10364cb3d3ab81fedfd1c21630f5a7f033d67b7055db32587345abed44ab
TLSH
T1FA2114854A914E1BF894917B1EA3A4F47330CC006323B7D3697C25795D35B8E5A0B1C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7b6a0cc4458b41882e57ef37e2547e8b2ef1fb799b00b5e906f77896ab2ec516
MD5 272d4e6b459f630a295445556acba455
SHA1 b66edc9b4223c57f4942793c745bcce777137a81
SHA512 ceddd599b1da573165443c4d20d5ce0a0f2c12f19c04f79c288b31136c768f5d0089ae606e97494871b87d426afbff64ee7d6adf2fcc2766c8ed39d55b65e847
TLSH
T196E0C0762DD72414BDAFC3D12030C490064A789CE901FC0E551BF6C3107231530DBC35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bc100b3f3f641a7ad5ff46c3b7534dd9c72ff04ba773af62c62aabc18485a5c
MD5 96fb452192f486030948be7a63e6d35c
SHA1 5c6ad5d85d99a72a76242f384efdc7ffbee948bf
SHA512 a5a01a353b897a547d8cd4f10471a64da04d9aac51d7386a86ba3c4b89288cf0184bc27b6c03bd405864de280ce03e1d192ee1b4454d194200106d77c3a77ffa
SSDEEP 96:KYH+KggmSRkVBnTfkvTqP1ZkK9B1/kJhBKnh5eleKm0NX:49SRkVBnTfuTq9ZdB1/+hBKnh5ho
TLSH
T161A13542357F02022CBE244DA2E9AA768F4175A33558A4FF7BB844630E66E110EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591757.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c982def503e5a507dd70ef0da36ea020f79c9737905b8a6d92ce03cd4e23c819
MD5 7cf7a39b74c61ffb031002ea5f3d1b28
SHA1 fa4ff57996188d46c25c70b8767e4fd6d450dc36
SHA512 e8fea4176c1203df31c38ca720db726bcf0609540a52789913d97e4eb0277a00cf085545a7c53d930a80290ea36769dae32cc83d74b0ba14992853d64b8c0189
SSDEEP 192:uUGm+xasuheOwQxMGsNCyQUmWRLM7XcwQmiU13dG4MTq4+FdLkxdtSJrx8z1jq48:jZcIhsNCyT07swvJJd4xGJrWPTA
TLSH
T1CB626D71AC349C3B69A3B246F48A36138FF4D167E6C45B94F5EDAF1D01DA2A8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 65a13f90d97e4d60b09761bca91ef37cc85cf06e52352fe3538009bb891de795
MD5 534ca24e809ce402c844cf1dfa527bd3
SHA1 77a799e035533f130c7c06dc982a85813ac50c0c
SHA512 b588f3ed1a787c6d0f0fb84cd7fbfdf83f273be59765f90e5c7ea5700ff6e54eb3e87831b7946e0208618ef53524db8589e52785298c099cea77f15ad677a50f
SSDEEP 192:lON7Zh6vMtPQmiUy56ThTq4+FdLkxw847o64U/u:lON7D6UtRPTSd4xKeU/u
TLSH
T1BC020935AC786C7BAAA3AE46F48A37175FE4117FA5D01B54EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b9ded7cfaf8c787b84420cf718055f99246ead00e69035c800d365a70e042c10
MD5 84d451e51f92ccd89a1a03cde3d31600
SHA1 d565be3b09f4cc834fb466683a9c83aba18374af
SHA512 8831693fd2323692c0068c78adf9fd40faf40389f5aae30e9fc9b2c2af178dd6ccc899047b52832c61cd3301e68c6aa7043c4b312688c915965612072ab3c959
SSDEEP 192:uKGm+xasuheOwQxMGsNCvQUmWRLM7XcwQmiU13dG4MTq4+FdLkxdtSJrx8z1jq48:ZZcIhsNCvT07swvJJd4xGJrWPTA
TLSH
T181625D71AC349C3B69E3B246F48A36138FF4D167E6C45B94F5EDAF1D01DA2A8130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 b72f04647f1f3ba99555df5c8765a79bbe8f346cd7d8bf99995902d4629ad5a7
MD5 32e1e849774e94aaa2a030ec6b7687d3
SHA1 91ae6e778c9687aa79319f5e041779868de1986f
SHA512 0c6c9e966bba6316a4c4a7a868f2d0d8de2c12aee11a519b72a3a1150d6142e4034f55edf62152bf6ccab06d74a285fb21183c00265aeaf9ec0c2ac60f635e55
SSDEEP 192:jONT6vM6PQmiUyI6rhTq4+FdLkxdtSJrZ80Ijq4U/u:jONT6U6RerSd4xGJrOPU/u
TLSH
T1D9120C31A8649C2BAD93B556F08B36175EF0D16BDAC46B94F6DC3F1C01DF65C130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fdd7899c-0caa-4e35-a847-b4e771fb7f48.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fdd7899c-0caa-4e35-a847-b4e771fb7f48.tmp
Size 23KB
SHA256 516e3b77f155163afe5f672797feebbc7eebd7916b03d191a98586a57ff20bc4
MD5 edc05f7b701defb1afe98512b8371131
SHA1 f02c40685a3c17da9c691e2655ec2ec8a571b059
SHA512 b6433b79d5d94956f156fcfec83744034b6fd434a7aff6350380306eb9a7fbe3739ba4dfb96fde87ab30a38620cb901a67e10e1b1cdd1e620ad39b4bd80aef54
SSDEEP 384:wiFiZcIFsNa8TUNTUlIlvT07sw4JJd4xGJr2PTA:LFQFbwgSq7zh2PTA
TLSH
T150B209F258D7883AE9AE6743E77D2E138EBCC067B5849554B7985A0CCC961BFC30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76de084bed9c2337f88b77028f67a895af66bd811395dc63ffb8d4dd55875d76
MD5 28a5ca4d6f31143d10111eeaa910d0b7
SHA1 99b9b18ae75fc40353f8f5e7140601d1509b311c
SHA512 7a34cfedf78f5ca7b5d13e184dadd5637ff3ba84c9d098fcdc44999d3ab05945085c273648ad2eff7da8d9a3986804f60040b773bef91076de2a7df6a34db081
TLSH
T1A8413F5CB6EA1148B3B36E1A9BF7B87E447FB9771A06D56E10110D4F0A23B0088B1B37
MD5 SHA1 SHA512 TLSH

Submit Download