hxxp://keymelt[.]com

Analysis

user interaction
yes
max time kernel
898s
max time network
759s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://keymelt.com
Sample260820-264bsaxbkc

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
45	ipapi.co
46	ipapi.co
53	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317411844864049"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{4D000888-FDB5-488A-B983-E604B815EAE3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3132	msedge.exe
3132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3340	2228	msedge.exe	85
PID 2228 wrote to memory of 4028	2228	msedge.exe	86
PID 2228 wrote to memory of 1992	2228	msedge.exe	87
PID 2228 wrote to memory of 1992	2228	msedge.exe	87
PID 2228 wrote to memory of 1992	2228	msedge.exe	87
PID 2228 wrote to memory of 3240	2228	msedge.exe	88
PID 2228 wrote to memory of 3240	2228	msedge.exe	88
PID 2228 wrote to memory of 2576	2228	msedge.exe	89
PID 2228 wrote to memory of 2700	2228	msedge.exe	90
PID 2228 wrote to memory of 2576	2228	msedge.exe	89
PID 2228 wrote to memory of 2576	2228	msedge.exe	89
PID 2228 wrote to memory of 2700	2228	msedge.exe	90
PID 2228 wrote to memory of 2700	2228	msedge.exe	90
PID 2228 wrote to memory of 4464	2228	msedge.exe	92
PID 2228 wrote to memory of 4752	2228	msedge.exe	93
PID 2228 wrote to memory of 4464	2228	msedge.exe	92
PID 2228 wrote to memory of 4464	2228	msedge.exe	92
PID 2228 wrote to memory of 4752	2228	msedge.exe	93
PID 2228 wrote to memory of 4752	2228	msedge.exe	93
PID 2228 wrote to memory of 4508	2228	msedge.exe	97
PID 2228 wrote to memory of 4508	2228	msedge.exe	97
PID 2228 wrote to memory of 4508	2228	msedge.exe	97
PID 2228 wrote to memory of 3564	2228	msedge.exe	100
PID 2228 wrote to memory of 2728	2228	msedge.exe	99
PID 2228 wrote to memory of 3564	2228	msedge.exe	100
PID 2228 wrote to memory of 2728	2228	msedge.exe	99
PID 2228 wrote to memory of 4548	2228	msedge.exe	101
PID 2228 wrote to memory of 4548	2228	msedge.exe	101
PID 2228 wrote to memory of 5084	2228	msedge.exe	104
PID 2228 wrote to memory of 4680	2228	msedge.exe	105
PID 2228 wrote to memory of 2632	2228	msedge.exe	106
PID 2228 wrote to memory of 3868	2228	msedge.exe	107
PID 2228 wrote to memory of 892	2228	msedge.exe	113
PID 2228 wrote to memory of 892	2228	msedge.exe	113
PID 2228 wrote to memory of 3132	2228	msedge.exe	118
PID 2228 wrote to memory of 1820	2228	msedge.exe	119
PID 2228 wrote to memory of 1820	2228	msedge.exe	119
PID 2228 wrote to memory of 1336	2228	msedge.exe	120
PID 2228 wrote to memory of 1336	2228	msedge.exe	120
PID 2228 wrote to memory of 3468	2228	msedge.exe	121
PID 2228 wrote to memory of 3468	2228	msedge.exe	121
PID 2228 wrote to memory of 2340	2228	msedge.exe	124
PID 2228 wrote to memory of 2340	2228	msedge.exe	124
PID 2228 wrote to memory of 1808	2228	msedge.exe	125
PID 2228 wrote to memory of 1808	2228	msedge.exe	125
PID 2228 wrote to memory of 2864	2228	msedge.exe	126
PID 2228 wrote to memory of 2864	2228	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://keymelt.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa85a4c188,0x7ffa85a4c194,0x7ffa85a4c1a0
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,16535521444540693739,18387673435867908941,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,10081937486450826979,2461825446048297716,262144 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1310042955492914672,11254979494594633777,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10185558096435961607,13554541487109801551,2097152 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,8473050350033196608,6377299609003375921,2097152 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,17727697368805434083,4838370667165859637,2097152 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5346252779745657124,9598652359569783382,2097152 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,6898335333615347062,12596680078921210313,2097152 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,13751792297027273095,1779184206630169698,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,17994956137007142689,16246609922876188186,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,4914932908323624534,12327665805571467970,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7794268482705666036,3279581164027390391,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,7794268482705666036,3279581164027390391,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,7053615691864834446,13112379658529552672,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,7549262799205559527,253559708121168114,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,18233433593261877454,6671234465200819437,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,4157161408279377978,9895764881227919105,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,6172035711778773987,6738555913095954309,262144 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16381028419313481517,9992184059018299470,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,14995019223961081545,10864866745335366696,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3952,i,6380960448765325684,366665780000792963,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,11290610513385136784,9591334838137955816,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5467717965151838452,1283655450703754206,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,4238395913188301687,11364297334775088208,524288 --field-trial-handle=2228,i,2195155466423240167,7170519324976890498,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:2864

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 efb9563e637ef0b52257a2946716a2327669e92cd9832dc8aaf642a331c8cd1c
MD5 752570689273fbb2cc26e8c92e1c8c1a
SHA1 5dab09f0ebee93042a1e03c54287c59a326d82f8
SHA512 a6361b9cdfcd6497b40c8e18c85f88b94d3fe6111f02c21b324dcc93b3a1b53f190dc30e44963a982666e6bfd3a87344b98fd9c646cdd6de417661bfae8a64d2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7k:fwUQC5VwBIiElEd2K57P7k
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 73d5e0c9e315e27d4e5a51f3a6334d848f5ea151636f2862041a843cfe413bc1
MD5 d72cfd8517b302c996899fbd901a6b07
SHA1 010ff84f3d9edb5c89d81e858a60cc6c5bde2d8f
SHA512 af01a31ad24f72da7c3819d4658b15fdd85ee44760148c5b9a9daff7794f0a70d24dc4b9f10a8a6f3a32e7385527cffb59036a5f07b5316a4638c302188e2d6f
TLSH
T180E026B514DCC2BE9609A58B92688B0C828C3B4FD2C8B90E27008D9CB401041B39BD95
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 328B
SHA256 e91ddd8df0abfdbde0a8061a2cb4645b3da7ffb71c9a6147c3d81e39b246c731
MD5 bc6ea80948c1fc0d556df51ab6dd5504
SHA1 bcaf412412794bd6a82ae2eed3011879256e315c
SHA512 bfe058ba6fe2cb61e2fe771fb4a9ba4356067b792cd2acf3711aaeb5053d378cf06c72c2f77791ff93a37d224d7f5edc6edc38bb572667be090756d0d9e69319
TLSH
T1A2E026A409C8C22E9614A5C79378870EC7803A0FD6C8A90E2700988C3001558A78B9E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 cc7ef935d37bde5fb641c9c62d73feda1a0616062286ded8cc9287e8cdfb5c3d
MD5 3529d55f540be0dc30c7506e0a234700
SHA1 f0f51198ab924550561ec53a7580ac330db488e7
SHA512 5bc987bae93a4b51799f2b43e4625c789cd27475a156402172ef3ee59dfc689e06be45bb06d56338e0bfae2c5afef86f7a980206facc60d7b8a1775e569ee7e2
TLSH
T1EAE02064B2F0C67FC900EEC7DC66E755C15C710FD94CD95D3205719D24604024B5CE8C
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d918ffb79106fcd912e2d8b43b054360a7b11d384e4d2aa1462bb3bc528d1aa4
MD5 21b931ad24375e56de5ef873ed7761eb
SHA1 21da5a85a5844473c94b9b68fb58ff37bf70498f
SHA512 fff929748bf5fba1edac9fda14db8225534c4cb6f09831e76202df3f2fe81b11415b8d83a4c6942da0b9037877841afefc2d15cae5bf7be9cc25b9eed92adabf
TLSH
T13F819404016D08A2F7B21F71D9D15A52F4358B792F239DD733FAE83CB90EF2A611908A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592b9a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592b9a.TMP
Size 3KB
SHA256 aec4d9644a63256606e9c87a23b12e1459e4ba4c54eda988589e9d0f28c977b8
MD5 d7bbff64a9af1aad921f62df1b760fe5
SHA1 c73fb7c3723be53ac48a0aed1cd7d37d3dbefe55
SHA512 260e9cb33b899e3132fc48ac0f469343879abf571962cb9a6bc4771578dd6ab5f097b0724254af6f9917e3c4957fa1e8789809dc7f59c29e865f5d5def90b222
TLSH
T17871B40402AE05B2F7A20F72E9D00651B47183796E775DE732F6E87DF91EF13512948A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 64dc6242165b05ff23dd32f800a0beb31dcbe23cfbe0fa5a7836539f9a9859e0
MD5 8fb4241dfc9a2db9c5f7c490bd575c88
SHA1 89f1fe111da55077f1f029f1b6a9e985d6738e23
SHA512 8b3fdb0a42723affdd0cc16485a0ef7162d31be17eab99a02d040357eafaacf1989172d9a7f18a4c0be4cdd0225f4e414a4cd519866f242763aa8a1dff971871
TLSH
T1F951CDFB83F486ADDD0251F4AE146E2FCE2D0425472C3D368AD4AF1797E2071E25164B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1924e14dc1d789f27de3a608fb343c01acd1d9d4779e7f90a966a6e56150f7b9
MD5 09ef44a5df686a0764cbfc6091797c10
SHA1 99ec4264040736450703e5b9e27a3a1cbaf5a9c7
SHA512 1d7439c23c274fed763a1972a1a5758b2b6e6459cbc5826189e8c4133bd5eb2d6082ab9c4f2b6981a2f798c0811df2739a430ac4897902127d9f3b0d19609813
TLSH
T18D61A9F783E486ADCC0212F46B142E2ECE2D1926472C3D2689D4AF1B97E2471E25164F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0680cea7059a4b58202827b7c717cce2c533f495ff51b4ebcb85e18f53ce10fc
MD5 be8dfc9cfdf8e8d763775e26937fc8d3
SHA1 2c96db7643e46ea4945cfde070fc2bbf4f0e9155
SHA512 f07f1c981116ec68db5449cb76ce5d6f2dd208df49eaff3d902f0ba5c0350e4cf71410819639e42032b4eee6fe8afa623a838e1d75f35939f2c039175b19d5cc
SSDEEP 192:sxZRRZyM/jK1Ml8Mkr/fCs1XGEdptM/HW6+WNqd6/YLcMrIgrJ:sxZRbMr/fCs1XZUHbl/49
TLSH
T1B342E8116A346977CCCBE20DFA45BB53D6F50472A2954E44AEFC8A1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d851ceb9e10911cff60a21f4fa13f080b0fd8a2d7faf6b67c950ee09b8f1231a
MD5 00a9d2ac3a50cfda3532d1d2bec3c9ff
SHA1 66e778d2819da2a564fde7112d64dff41c7a62fa
SHA512 47045e94499720c080aaea882509391deac8d6e96f096045924227f709e08d1352cd6aabdd6f01385b96b318dbddb55c8276ba37e161c20e262d60b4d58d7c70
SSDEEP 192:sxZRRZyM/jK1Ml8UQ8kr/fCsa+GIdpHM/HW6+WNqNTbYLxdVrIg5PJ:sxZRbqHr/fCsa+nuHbcbqv
TLSH
T12052D8516A346977CCDBE20DB945BB53E6F5047292914E44AEFCCA1C00EBBEE221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 10396ba45e63c5d1c46904c2cd8b55d993dfc32545d96b74b333a2c131a380e8
MD5 55453e0a6369d25e2b2e8dc81c3b5a8b
SHA1 240889e22e4ae1c16d08ae53cac7ed6635f5119c
SHA512 03a7f65f458bfb4c5534edef9bf76b14bb0fdd95cef3aa4b9eb69bbc4d9951729c57dd478bb9ace567d705a054cac050826bd14533604f86a6d36ac56c472867
SSDEEP 768:ygs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNxrot7:ygs6pD1WvxzWju1jahILIsNKt7
TLSH
T19CD2EA3B680CCB7E4F841E5CEC2AAF967DD801CBAB58899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 a4d111dff1b568a52e2fca8e905dd06c8ab99f1726c7fda1e7fb88c89222e307
MD5 856dd56f6fc8695fe5f42996f450642d
SHA1 40714da8a74b36e8a651768dddf120478fa3ae0f
SHA512 b450c548878321bff98e8780921d54dc3e0957926033bac15e3536c20cc22fa1ed0c53160cd47fabd09db4116b3e1691517b11a978fe074e610dba0f64018b41
TLSH
T18931424D9EA189CFF8A041B21476F1A0737198DD4B15B3135C2C32327E2335A26579DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce40e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5ce40e.TMP
Size 1KB
SHA256 736f165aa61f444e012212c59a377510a73ae5342358d774ab653594a3e60c84
MD5 efa7b82787d9cffa3a2e2872b9631464
SHA1 48147716725c91c772c50f320530210ca37fe5e5
SHA512 048b60a7bd8adff738b6d901e5455859ab68ccd779b06660337867a0fc918356d22373101d12967e489ba5fda74406ec58e2ccaad64ded45a143529ebc00e787
TLSH
T1D931254E8AD15D0FF884507B1D73B4F8733588408315B393A87C62399D21B8E2A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da9e141f17356a1f570500ee2d6a416c8acc00183bd4acb4556244553e07ef32
MD5 a182a8513622347f8d28a6b49f1a2f40
SHA1 37b7c7ac709922b4dcd69d9fa05d46b41d92d8bc
SHA512 1fa8b97b9313af0a8a200f6a3af6a0aacdb44caf9242dd7ebb9055023ffaa0aeb3df72438533e4b1770bdcf445bfc2a1fbe4b4008474e38602a6d19e86bc1387
TLSH
T1F5E0DFBB6EA76820EDABE3E7287194B50641382CC805BC4F686AA6C390B13567846C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7573046dea3ddc0d32b60cc14c129caff860477\62d8639f-2102-4ad4-b81d-050a577ef0ce\index-dir\the-real-index
Size 192B
SHA256 830448503a681e1f6dc7690cb7be3c48f4d1f9e90948e67214c4e387f8ca357e
MD5 cf6b1c566254d063e45b716c4c7f64fa
SHA1 92a0c4fe3931805ff2392e76f91cae46e24b8218
SHA512 c95fda37d6db063f6a1ccf1db37b4ef3ccab97551afbeec57c7e55857fb02c7b99fd41ef1cd5cb5bd64afc7471cd2609c5167501e86214aac0f1c370f151e437
TLSH
T1B7C02B7C6F380900CCD840B55049450CE3380D9D5640054753C8E4F8CC833EC050E850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aaa3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7573046dea3ddc0d32b60cc14c129caff860477\62d8639f-2102-4ad4-b81d-050a577ef0ce\index-dir\the-real-index~RFe58aaa3.TMP
Size 48B
SHA256 cb3653d8e32d7a9eea982eb9072e19a63716d54478c0af1774cafe3bbac961b2
MD5 2d10b568ab03ff935470370c75730875
SHA1 c2798832f67e8b78a48ae35cbed65d67279ff54e
SHA512 e1a8952a292adfe3af002f4a50b353b28de20dc8f24dcc1b42bc0bd436e8d4015175fde7837283c3771f85fbef7231bf3c8ae6b89902341e1b835ffdc729c4a4
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7573046dea3ddc0d32b60cc14c129caff860477\index.txt
Size 133B
SHA256 bd9c51db5c00a278c6a03b4aff725663f7de26998195b6b3153afe166845a24e
MD5 a5be29fdc9aa878e44a510ce19c358ba
SHA1 87054b8432851c05e48135e899c46fdee1a51650
SHA512 c9b0657887fc0bf7d5ce2b7bad4b37389719e9c8a65261088576270e67a7b6387112e678d2526518f171eb2eb2f13558176fb3d69a82b7f011dfcd75d2088a84
TLSH
T127C09BF7568515245F01538D3E0032795B4797DE94DC94CB4309743055485B76006D5C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58aad1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\c7573046dea3ddc0d32b60cc14c129caff860477\index.txt~RFe58aad1.TMP
Size 138B
SHA256 5c1638c646fd00fa5839fdc609e4cc8e6da1402c7218a61f40848b1e9f4e0174
MD5 f527fed1998890c368ffacd820da69cc
SHA1 96f59ede8c55b9154db9ffa2ba4c349290a67bea
SHA512 ae0fdf63d45af0510541dd3523db614a2f235c5315782d3a77f732c4f3499ac7fe37e8af4fdae53e23d4051b85339b7d003e593c6713393b83ef91764859a609
TLSH
T182C09BF7128515245F01528F7E1032696F479FDA48DC94CF534A743055785B76006D58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 99864bfff783d8874295208dc6f44167f55b066ab40d452d5ed2f9fb5b86578d
MD5 48d25b0b6e79a66643d23b8dd0bea20c
SHA1 7d864541cfe0ce1f42bf08509a57566938b82914
SHA512 4cc0043845e8b68b9206ee24ff26ff8b8c72eb71eac7ce43299638a87d361b1a78244e4f593dab5a47d334c8ecf5ad9c6aef51190db2c77fb18e91a042ec0a52
TLSH
T115A00227825CA953C8F81670954E09D4A65059650101327240F855B9E8D51705552405
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a989.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a989.TMP
Size 48B
SHA256 372191edccacf6b011c3fe4f9317b8afe1ae329810475fcd5daa86f524015612
MD5 804724339ad2e21c617c50c47580fccf
SHA1 71f14d3ef561155e773ecf8d5b8cb87de846527c
SHA512 7c7907fe349fa625f2a3d3cba26c5a8c4c21e53425d584cc9ec5807bdde4b81cfba4a5378768a3877b79c01247445ca7d2f12bab6ae9e16444c20619a52072eb
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 103583c4b6e8c7d04e1f9f5d6349a58471aa36816294240f69c8d2568f9657b9
MD5 2d2f9be15100d22c63930fdc2b0ef70d
SHA1 a45f9ebda835409963f88b1e79ccbe3e91c26f35
SHA512 dc8361aa9b9111cc788e2cc70f65940b7399136ebe211e720356e398222ad3f09c8fc37802a4691cfe8b3c7d07b1bb947296d4e2c7c93e6adc90b2115ad683cb
SSDEEP 96:KUAAKtePOrqKgAXe12KeASBCBuC0UEC2MzxgyCKYngICcSabgt:iitMlh9u
TLSH
T197C1050271BB02223D3E291CA29997664F4276633819F42B37AD04B55DA7F344DFC9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7248c1d-3fb2-44e0-84e8-b74e6f29f7d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e7248c1d-3fb2-44e0-84e8-b74e6f29f7d4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 0d155e811daf53975ee5a6e9f658941cad42facb72e83d32a4825a87eaed8035
MD5 01ec52939bb22f60801152e4726ecd89
SHA1 69a62ed5d4b7aed6d8616d6a2da22233c6d0d3ab
SHA512 03d9739b545ebaa0479a0f037afe1114c34b2ad144044ed716d95109653b94dd9ac782d9c1f3d47b6dc2925e7c19fdfe695b69abc378b8d16b1369fa9dc4af12
SSDEEP 192:uLsNEHQmimD/POq7+3vsKQmiU1I3sZatb0zO2bHTQ+26cMhqF19YyXj/d:ksNEHlPOBn6Oa9yO+TQ+22C5B
TLSH
T133423A35AC689C735DF2B285F94B36139FB840679A8A6F84D5DC6F1D01CF6AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a63330dbe26db621ad4aa03a1607f72208a95d2b2de4246ab723554a3289280e
MD5 b7761690e4be222e516aa80f47136ff5
SHA1 da8ab36505d3a1a33c6a5159a969c8e7e72abffa
SHA512 e3f8dc78ab49f5542c3fa1baf33c0d40f404a11499d9e5f6630539d29baead76b629015a201c32b403e273955f3ffc56dc702e9553260b991ac635a8db45092d
SSDEEP 192:qONT6O7+3hQmiUyzLGttb0zO2bH3gGZxU6:qONT61MGt9yO+LnU6
TLSH
T19402E8356C686CB75FF2AE45FA8727275FA5103BE9961F80D6E81E0C00DB66C2347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 f1f5ed450a34c8753d010f44cd8c57dbd0142c8b402a9fa4d2f9816fc1505df0
MD5 b6a0df86f831970a39d6a795d9c75168
SHA1 08d2cde4dc94e5efe1c5cf2f623d0329aa997dd2
SHA512 c22706f1f265d21be6cb45d7524548d8166fa4dd413d3872b8b8ee63caed26c9b378fe67bd3a16b42ec10cdc975f03aa9e0df21efd90bec43362a3eec5ad1410
SSDEEP 384:HiFiZcI7sNM8TUNTUlIlPlPOBnwja9yO+TQ+20Civr3/OoB:CFQ7pwg72OGIOuQl0CiTvOW
TLSH
T119A27C325C98CC776DB6E780FA4A26178FB54067C9CAEE90E6CC9E1D00DB5AC2307C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8b43ea566d51f3d80f183f50249c01fe4101fd9c4c43dd9afbc96792be172f5e
MD5 a649d3c199c5f70847597a5335005843
SHA1 d0841950edb05845455c5ef4ad79ab67d79fc155
SHA512 b045527cbb96a06fa058821fa0de3b2d889b772b0fad67e1aca0208ccc32b3dccdae899323c6252b3c9dcf03cc9d0faed1605ea79190cbe086cdd6cf0d0cad03
SSDEEP 192:ubLsNEmQmimD/POq7+3vsKQmiU1I3s4atb0zO2bHTQ+26LMhqF19YyXj/d:AsNEmlPOBn6ja9yO+TQ+2DC5B
TLSH
T170423A35AC689C735DF2B281F94B36139FB840679AC66F84D5EC5F1D01CF6AC230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e5068096aeb7704e0413e6deb7fb8cdb909be8b9888ddaa97c691d39d097fdce
MD5 4b4c4b870f8a9f5d97a8744c04aa0edc
SHA1 6621a016b8bff6c7ad43e8888344ff0d3d0d948a
SHA512 8e86f892b8b0eeb28e90d1b29a0118a14306b4de70d4442be64e57e074fd3b122e5e9ec136452050172e4039063bdc3859e13126e9c2d730fb195cd01072e1b5
SSDEEP 192:MONV6O7+3hQmiUyZLxttb0zO2bHTQ+26cNhqF1U6:MONV6l0xt9yO+TQ+2jCU6
TLSH
T155121935A868AC771EE3B641F88736139FA50127EA876F80D5DC6E1C01DFA6C234AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 685a56c6fa9b4acb9702d98d7c05c53daf077279831defbe13b6e763c0793e1d
MD5 1536388dd31e5ac6464d62ac072051f7
SHA1 f662505ebe1a253fc9406e5206c3c856d16cb115
SHA512 bd98fb44852e0a9516d0fdd8da319fdb429b54a658fe9f8e263ef11d4ab5991acb6cdc335a3adee172395390623a948f4a2d42198645ac493305813fc9ca262e
SSDEEP 384:oZcIhsNEPlPOBn6ja9yO+TQ+2DCivr3/OoB:Whd2UGIOuQlDCiTvOW
TLSH
T128826D316C689C7319B6F281F94B2A175FB8402796CAAE84D4DC9F2D01DFAAD2307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7236b324-22b4-473d-9834-374584b90c91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7236b324-22b4-473d-9834-374584b90c91.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 108b1658b493ebf8b1ffeb85fcce66735cf91be6d55a56e30ec950a8e5d891a5
MD5 05cb2ef7679396fc5b9b7669be72f70f
SHA1 5fb4de1bea048fc742fc0d3ba42487581e1e9cdd
SHA512 a8b4f57d35fb374d1663b62812dc0aa2548cf51bfd4178b64dc1034bd00b2b9420b7e20530f5bfdf81dc9c37cf8b05be5f2f46c21faf5e2f6d7bc56f0c387bc5
TLSH
T1D6412A58B7EA114CB3B76F5A6BF6A87D447EBC372E0A945E10110D4F0A22B40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download