hxxps://velocityexe[.]com/

Analysis

user interaction
yes
max time kernel
389s
max time network
391s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://velocityexe.com/
Sample260820-pypr7sdd84

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4024	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317034781844620"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{48F408C6-ED0B-4048-85B1-1B6987081F9D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 4668	2444	msedge.exe	85
PID 2444 wrote to memory of 4024	2444	msedge.exe	87
PID 2444 wrote to memory of 4276	2444	msedge.exe	88
PID 2444 wrote to memory of 4276	2444	msedge.exe	88
PID 2444 wrote to memory of 4276	2444	msedge.exe	88
PID 2444 wrote to memory of 3848	2444	msedge.exe	89
PID 2444 wrote to memory of 3848	2444	msedge.exe	89
PID 2444 wrote to memory of 560	2444	msedge.exe	90
PID 2444 wrote to memory of 560	2444	msedge.exe	90
PID 2444 wrote to memory of 560	2444	msedge.exe	90
PID 2444 wrote to memory of 3152	2444	msedge.exe	91
PID 2444 wrote to memory of 3152	2444	msedge.exe	91
PID 2444 wrote to memory of 3152	2444	msedge.exe	91
PID 2444 wrote to memory of 1204	2444	msedge.exe	92
PID 2444 wrote to memory of 4748	2444	msedge.exe	93
PID 2444 wrote to memory of 1204	2444	msedge.exe	92
PID 2444 wrote to memory of 1204	2444	msedge.exe	92
PID 2444 wrote to memory of 4748	2444	msedge.exe	93
PID 2444 wrote to memory of 4748	2444	msedge.exe	93
PID 2444 wrote to memory of 3244	2444	msedge.exe	97
PID 2444 wrote to memory of 3244	2444	msedge.exe	97
PID 2444 wrote to memory of 4236	2444	msedge.exe	98
PID 2444 wrote to memory of 4236	2444	msedge.exe	98
PID 2444 wrote to memory of 3892	2444	msedge.exe	100
PID 2444 wrote to memory of 5052	2444	msedge.exe	105
PID 2444 wrote to memory of 5052	2444	msedge.exe	105
PID 2444 wrote to memory of 5052	2444	msedge.exe	105
PID 2444 wrote to memory of 5080	2444	msedge.exe	108
PID 2444 wrote to memory of 2176	2444	msedge.exe	109
PID 2444 wrote to memory of 564	2444	msedge.exe	110
PID 2444 wrote to memory of 4200	2444	msedge.exe	112
PID 2444 wrote to memory of 2900	2444	msedge.exe	113
PID 2444 wrote to memory of 2900	2444	msedge.exe	113
PID 2444 wrote to memory of 4240	2444	msedge.exe	114
PID 2444 wrote to memory of 4240	2444	msedge.exe	114
PID 2444 wrote to memory of 4240	2444	msedge.exe	114
PID 2444 wrote to memory of 4476	2444	msedge.exe	119
PID 2444 wrote to memory of 4476	2444	msedge.exe	119
PID 2444 wrote to memory of 4476	2444	msedge.exe	119
PID 2444 wrote to memory of 2792	2444	msedge.exe	122
PID 2444 wrote to memory of 2792	2444	msedge.exe	122
PID 2444 wrote to memory of 2792	2444	msedge.exe	122
PID 2444 wrote to memory of 1820	2444	msedge.exe	123
PID 2444 wrote to memory of 1820	2444	msedge.exe	123
PID 2444 wrote to memory of 1944	2444	msedge.exe	130
PID 2444 wrote to memory of 1944	2444	msedge.exe	130
PID 2444 wrote to memory of 1944	2444	msedge.exe	130
PID 2444 wrote to memory of 3020	2444	msedge.exe	133
PID 2444 wrote to memory of 3188	2444	msedge.exe	137
PID 2444 wrote to memory of 3188	2444	msedge.exe	137
PID 2444 wrote to memory of 2064	2444	msedge.exe	138
PID 2444 wrote to memory of 2064	2444	msedge.exe	138
PID 2444 wrote to memory of 3668	2444	msedge.exe	139
PID 2444 wrote to memory of 3668	2444	msedge.exe	139
PID 2444 wrote to memory of 3172	2444	msedge.exe	144
PID 2444 wrote to memory of 3172	2444	msedge.exe	144
PID 2444 wrote to memory of 4512	2444	msedge.exe	147
PID 2444 wrote to memory of 4512	2444	msedge.exe	147

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://velocityexe.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8e9d2c188,0x7ff8e9d2c194,0x7ff8e9d2c1a0
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,15606902373963242224,5522773214632113390,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,14314143710148128542,1973411833580108143,262144 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,15149658102743186840,11452184490400814419,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=2600 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8262365024946100967,4692824088683001535,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,10575952992288314757,10088560407403574122,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,6482317398045800775,1681477344854092356,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,1005526660610981332,1032394240722071636,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,17493068684913760569,2375614413569476408,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,17141721651191309987,886103013872437470,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15818898042817526211,10433218870226488718,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15818898042817526211,10433218870226488718,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6248,i,2871357904474184142,1638523317334293500,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,17652183378120138524,3931932642681301150,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6344,i,15942849846411635151,11054160231466163834,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8383402396288658397,10099179793185114477,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,7824748405063349101,5995018818121846238,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3028,i,7824748405063349101,5995018818121846238,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,12092921987182190993,17604137016922282419,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4536,i,11587909476172648134,3085009714110953098,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3600,i,2772376758939757707,6946458880056813385,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6672,i,5499711733478444212,5955296796882530887,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,1044940600863366903,1469202639241743543,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6200,i,4447457531350838464,11693392232093484914,2097152 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4328,i,3902198062735075972,8999584751812240553,262144 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,4814180234450116429,2495573041751100908,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,13278803300080083929,9692807743601894050,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,6158289304154540472,14467526630123478192,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3256,i,3717497775697638765,544453537024517935,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,17567733534532792604,1291848475759069395,524288 --field-trial-handle=2336,i,10797698132815137201,3299457493854903794,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3419437915e3347ddd9a1d566cf0e01add95c4b9029c0f0acc820fc21f6832e9
MD5 3aeef1419ec694f26f72a89a9ffc23d2
SHA1 17161e561e532041a14ddb5c35819f2763df2f95
SHA512 6fa2398fc92d5c631503b48fe7dc70b550f35d499fae51bd837db168b46ed57c62df008653a0de988b11622a786e39e9bc0a24fc4f30b6d568bed93eb9a48198
TLSH
T1F6E026C804EDC2BFEA20A49792BC631C8280360BA2C8ED0E17008A887082858B693ED0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a2b615e01b0473263da178b8df17765985ce738cb106ad1d7a63cd86906ea6f6
MD5 d2a448df6d814ffa8cfc11849609e84c
SHA1 a41ed136db7fa2e5824abb271074db23d75bd90b
SHA512 e73105cd3a4eb4ab671cfce8d20265f2ba22a9833f3fb99bb6fd2da9f0c595fa1b1e2a7998803b5209b6e921bdf1fb941fce41c6a297e53b8a877ee4c8c2f0e9
TLSH
T18E613F380B9E0482E36516B1B0E20105717183F9FF9FDE4EEF149DF55A32329C98299B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4d79c113908f0effc28450dcae9d217839df701b461f923cb957107293b6f45b
MD5 71d30ad447f90f175d3509822ff16ff7
SHA1 7fbff190d394241b97eb07564ddceb8d1bd6dfc8
SHA512 aa3865c8733ffa59cd2541ea59be3fcec447a21a173d64afe55b3ba7b408c0ebeebb3a8cbb8523f9f2320a8494d2ed89d1e58e212a10cd95d8c953acd1382074
TLSH
T13D611B380B5E0482E3A156B1B4E20105717182F9FB9FDE4DEF149DF55A3632AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb2d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb2d.TMP
Size 3KB
SHA256 b065a37059ab891bc7ed77da2ad98089270678db6566a6dd4195172d5305ac7d
MD5 357a490c6863b47d028a297a1151ae07
SHA1 2c193d464485e85a9e4f8a516097940d9c0c454c
SHA512 b1ca0dc9636765ff09bc81593873452eff12b3b560866be74d4a28aa359bb500a5b26c9738b3c510e3ee5f3c58959b2e809febb54242f567a52313574ae05a12
TLSH
T19D613B380B5E0482E3A116B1B4E20104707082F9FB8FDE4EEF148DF55A3232AC99249B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 dea3a306bfcf5d196ee0d5c06aa72e7f1810cc6c01f04d6e1279e7c8c27f5ec1
MD5 5291521a6f6160aa4c53aaa2e124b7e4
SHA1 76bf2ed348d875e23b2ae56f3603946a68e547cb
SHA512 0bccd9cc582cd8e05e2de6483b9ec6e8ad3f7a2ec2b00a8618b403805c77d5b4bc6a3c26dbbff5ea308d95b6baace3835ac415ba76a82ac5d8bcafc12478b814
SSDEEP 96:D/OlU9TuCwp+LtflgTHzBOA6U9oudJpWo96powB6IMfGj4/5i:DWlU9TuCwALtflgTH1OA6U9oudJko96H
TLSH
T151A1A9F793A0875DD91162F4AA14AE1B9E3D0524436C386AC5D8EFABD3F2071E28174B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 035b9529137cea05299ca798e364e79fb22d012fcc70ef4858566935c08af4f6
MD5 7bc000dc8db11801d3c9a1488e08e95d
SHA1 1888509a9310cad50d22b0cc8d5f84a4cbe75849
SHA512 f434aeae4e170fbb42d992000544733ddbb222b10e7efe442cbd17f284709c208136e906351b9802fee0365c6775b7f629b64451da8a3a730570fda168101b36
SSDEEP 96:DPOtU9huMapgQ/RwVzGGOqIU9owTuUBpWin166T6Abf:DmtU9huMaqQ/RwVqGOqIU9oSuUBkin1h
TLSH
T1CDC18BB3C7E5872DC85116F46A147E1ACE3E095453283C1AC8D9EF9FA3F2071E24164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6143f05e3ff74449624e0b917067b859c5328df9e5e80d61d77c77424f81da23
MD5 1db5d38aba7cf5f22045d6456b58159c
SHA1 ef50bbab5106a7394ee7398c29cab83d0d433807
SHA512 7227390a7969f1d35d0db5d04c1fac858fe6f601c3653e0b75b4811cb5abdd5a9422e065b1b69f7efd3f8219f3c193cc9673d754ba5cefa54f2b3a4b8e33222a
SSDEEP 192:sxZzRjyM/jK1Ml8MkS/fUsnyPEIdpFDHW6+WNqc0/Y9I00TQIgrJ:sxZzzMS/fUsnyVJHb6/S9
TLSH
T17D42E8166A34997BCCDBD209F945BF53D6F51472A2904E44AAFC8A1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 36512741dea2594a54556885a885332c489e68245f36851fe4e9665e4eaeeee0
MD5 4233c0538ed2f44ae634b6193ab39004
SHA1 a018b6a375983cf3e842e338f0da3528efe7ebc7
SHA512 cff525905f35b6da56add1f5209e7cfbe6b15a62d19f2440667135aabcd6de7815ada71226d6a83bfdf340832d6824bf4ef4b00da27f1ab275b412c9e74a9017
SSDEEP 192:sxZzRjyM/jK1Ml8UQJ9S/fUs5Z3EIdp0EuDHW6+WNg5mrJW3XY9IA/TQIg5SJ:sxZz9qrS/fUs5ZNsHb/+XDs
TLSH
T1BF52E756A634997BCCDBE209F941BF53D6F5547292905E84AEFC8A1C00E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5ed048e4257924fdfa71f0ec504866ca3b7d40a0309a345d17b9116c1307d98d
MD5 11eddd7d524dc73f80465f1104199279
SHA1 83ec8d1afb645029eec7a31305d78b25ef64f381
SHA512 be7580fa87c79619c45e3521cee8441df68590680051aad53e71a532f38c6c1acd11a8a958b7d2ae3ee1cc2c8f7bfaa83d43fdcc71d889eb7d71fecc5b6dfa13
SSDEEP 192:sxZzRjyM/jK1Ml8M9S/fUs5ZqEIdpFDHW6+WNqW3XY9IsQTQIg5SJ:sxZz91S/fUs5ZGJHbvXMs
TLSH
T18252E915AA34997BCCDBE209F945BF53D6F5547292901E84AAFCCA1C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bffcc165ec51e7f0a39de25956a99ecb8ec6115d5a8f7f115d4d52fa28624c08
MD5 dee281443480b97e9f0297f23a3da7d2
SHA1 a05ef3aafef5218f55a5f20658232b483d94fd3e
SHA512 a88c825613cf0073ea99bfcd3f88296b8dbb61e231315c58c144ea68c6bb993ba4716f714baea45f834e54148e0460be5a458537bf0edb77e310709717314707
SSDEEP 192:sxZzRjyM/jK1Ml8MkS/fUs5ZqEIdpFDHW6+WNqW3XY9IsQTQIg5SJ:sxZz9MS/fUs5ZGJHbvXMs
TLSH
T14952E816AA34997BCCDBD209F941BF53D6F5147292901E84AAFCCA1C00E7BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 300232c5f150137455e12b80c4710994433de1a617b71ce892556f6e194b29a7
MD5 e4b863939b3c131a8419652191c53cda
SHA1 dd88d02f7cca47690bee931e1d1c2ffd66d61c5f
SHA512 d714bff59b95d4ba8be14a6be957993130944347d9741322b3125837e78fde4fb2350fbc0286111b1f8d160d8107013f545587fa756bb59c7e7f3fecdd6342b5
SSDEEP 768:TYcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNAroOg6c:TYcv21wWvu+Z+u1jaeFLeRNLOs
TLSH
T151D21B2B280CCB7E4F841E9CED2A6F866ED801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b732fa46-5e14-497d-9a97-e0b4d2c2bd37\index-dir\the-real-index
Size 144B
SHA256 ced469293e25a0d47bb194b5348b14e5a3714bc004a4a64a1c0f913c494df19e
MD5 4e23cb2a352bce0dec0ee0d526c4dddd
SHA1 e8b478eda26ae4fd81bac17e12b43c2982d15704
SHA512 6bfac11e0353abf77902bd30b1441257914f98481b1e7e939958acafc3d86f3f0f7f1b865f90de4a5281b832f6a231db617a59a64493874286378159fdb05fca
TLSH
T12AC092154CE28819C690827620B36865A2305AB8AE159F4EB8AC08F8682201E9212549
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5bde.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b732fa46-5e14-497d-9a97-e0b4d2c2bd37\index-dir\the-real-index~RFe5d5bde.TMP
Size 144B
SHA256 e9fb0da4a431855b670e62398e025d8509a0fd4d756d82ec4092486382646b53
MD5 e61d8ea4ac143ba03dcc20e496cf93ed
SHA1 bad30ffaad7433495e94c2c51c327a08a5894d83
SHA512 e6857cba67b785a31dce165571dced58bf29140f079bbce7b721fece05e774dc2b037a74be662d52cd1ab182e80ab3a573097f8cff33e28200d7c7f9895ad4a2
TLSH
T163C0124993A08E25CA00877634C3B565A7204E306D19FBCF35CD10F87C3144DDE2260F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 3e001f731750918a7c99a65f67218bc19eb5bafa21a71f3247993f7b29d14dda
MD5 7f2d20ad3fef9ac649534c6698e1703c
SHA1 35934c3192e9dabfc75ec363d39e117580abd110
SHA512 51d903db5613b889513b1c76316d6e33cd02852bfc5a15d74715d8c905f81e1cbbf1185046fc9d401bb152dfa184fff6048f3cc52c6455241fcc5d1820451d06
TLSH
T12AE068723EDB1C10F87B9BE5243008A040437C58C005FC4F4429E68700A23113C55C27
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3b353739bdb9dc538202027e54002603fec495c0969d39cb91bb3e3d203ab922
MD5 d69439618b66f5d4fbc9f2eddd671c67
SHA1 e77147c48a48dee0064619bb664ae25e5231d5bc
SHA512 dee884dcfb6e68b5768106c8731eeb011ddd23741c0b164c49852a270e5ac906c2d7a2ae08366f64a5d763c71c386fb218230a28f12ff2e114fd5fa5176fd4f8
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDWuy0Kvq+6GAKHKy:mTYT3r
TLSH
T1BC917242B1BE86412C3F680C92A5C53A7F4635633459A97F7BA800B24FABE141DFCDD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0094182b-f818-4433-a2a2-7633432ddec8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0094182b-f818-4433-a2a2-7633432ddec8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9c45d4e7425b43afa7709e6be49017c9ee2291e84bafb6bb8f7bb30918ee77cf
MD5 198653b35e3614fce46d994b8c580137
SHA1 709fbe77b4ead4797387c2b0372f341e8e410af2
SHA512 d0b53718b2614dc774162f03d072bfa423d1849e7cb2550196b1d30ba8f696d2003e62757ad00f97866f942285e9538f174850dc81583af4a556190d31a36fc7
SSDEEP 192:uyLsNHCOWQNR+YLeePQmiU1Js64e+CGD+FdeP9osNOeBQdJi0qUkIZ:7sNHCOziCsle+CBd0esFqjZ
TLSH
T1A7423A36A8741C7B9EE3A545F44736139FB881779AC53F90AAED6F0C01DF2AC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ccc9265baf81b35eeeb98c82f5bbe066a3b48f21305a067c790423ebe409da0b
MD5 3ec8c4e7a9f06c85aee64945d69634da
SHA1 dd3873850aff411770de1863efa74b92e344f1cd
SHA512 40f2a7d857853ce2730c013f8814b1bcd83700ada84d8ff4c0874ce323ff6a877f7dfec97e9f4b7a70b9ddde52758e33d299ec94317e558ce4ec9a0eef37f2d7
SSDEEP 384:6iFiZcI4sNv8TUNTUlIRnfzi4R5e+CBd0espqjYaoz:xFQ4iwgxxAJxspqjYaE
TLSH
T13CB208F248E7487AD9AE9747A77E2D034EBCC063B585AA50B7D85A0CCC971BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c1a3600a304050a06a225f5ed71c1b7c51a0011bb480bff25dc1a8615be1f3b5
MD5 b034a76cf2a9c2545b794169c3ef7197
SHA1 090a44cebac684ecaa617f5c3381671150500cd5
SHA512 c39135a5c6674cb2216d593f15627ebf5d2e29cab7eceb8c52e06427a62ae665d5a4c7945fcf1c37afd35f138778e6140df9510dc4e713d3f378589c883cd588
SSDEEP 192:uYLsNHtOWQNR+YLeePQmiU1EsO8Be+CGD+FdeP9osNOeBQdJi0qUkIO:1sNHHOziCPO2e+CBd0esFqjO
TLSH
T191523B36A8341C7B9EE3A545F44735139FB491779AC93F90AAED6F0C01DF6AC2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 e5509f93d1df12fed616721fd133244c5f0e4b3a543f6babc1d57f764ad21119
MD5 4f13ace40b8e933407a08690c07157d9
SHA1 33a25bcf64d3f785d496a21fa20f8ae6c7b0660a
SHA512 bc69a4fdfeb432a806f81ebde6ce40011c92a67de295e235dddda071a12553579d62badbb813a1aa775acac725c908925619186a014efbdd1354eabf299d24b6
SSDEEP 384:6iFMsNv8TUNTUlIRHfzi4R5e+CBd0espqjO:xFMiwgZxAJxspqjO
TLSH
T16BA2E6F648E7483AD9AE5743A77E2D038EBCC163B5816A50B7C85A0CCC9B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5cd8a793f080a324d013ea08bb2f690b8dd484ae4bea7d94018905aee641ac61
MD5 928dc6a72ac0629afc85e15349c4d8fd
SHA1 e8b3e3bf008a9e68068038549cd110692f47610b
SHA512 d05ebf774415127a914bc321dc9e1bcd49bba4dbd8ebe4ff22f4141ecbd54f210a8b196fa94ce616b5ebfb09c5e5a7daaef762751fcb35a419381d30fd221300
SSDEEP 384:6iFMsNq8TUNTUlIlHOzi4R5e+CBd0espqjO:xFMhwgoxAJxspqjO
TLSH
T1F192D6F658E7483AD9AE5743A77E2D038EBCC063B5856A50B7C85A0CCC9B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1adceb207ccabe6ca63e96ce02f43cd6cd13274f2fe1a6df4c668022f85fa9ab
MD5 f9bcd12db6a9c57b6b0c7ac34e226d88
SHA1 b4eeed5ce0c6b090e8cd9df8b7cf94d651543974
SHA512 3cf8612c7ff7273157231441a3ab2160076d24d8fca7977f5d9c5f12ab6c94be8de48e69d290f1247104d08a9add0a58fc7cdfc17c1e58ca1cc632bda9ee4072
SSDEEP 384:6iFMsNZ8TUNTUlIlHOzi4LO2e+CBd0eseqjO:xFMMwgorOBJxseqjO
TLSH
T1E292D6F648E7483AD9AE5743A77E2D038EBDC063B5856A50B7C85A0CCC9B1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 bd5673313f561dfd2df4b54b483aa16338f2aa4c558273418decca0e4d22f50c
MD5 c572aa92d74c0f04c4b9b86074d36f3e
SHA1 8028220e6b3c301cbb4cb484a711311be13719f7
SHA512 1b146bdd2aff06c7fedbc5b2d519ad80dc35e5a8c4a2fd0f6bf46d7022c0ed4d4f5d87430b6d30dce78a355cbacd1241364ca758c31ba4edc559f3e3b7b87739
SSDEEP 192:uYGsNHtOWQNR+YLeexQmiU1EsO8Be+CGD+FdeP9osNOeBQdJi0qUkIO:ksNHHOziEPO2e+CBd0esFqjO
TLSH
T145524B35A8381C7B9EE3A545F44736139FB491779AC53F90AAED6F0C01DF2AC2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c1d1c6bd8ddf6c548b389d1160f2d6d8c733da2ee14c2079e911fd39b1cfd313
MD5 6efe338c4e8afbe3e59bf4558705319c
SHA1 a063c018c3a42ad53f41cd41d2536a84319a14a1
SHA512 ebdcb4a88f0460ccd926d841e57e0a712031ace5d355036259ae5c4f49fc854d069b51f657cc8f83b5ebaa39234085e414c10276503e211ebc31d8fd92568d2e
SSDEEP 192:JONa6v+YLNQmiUy5rZh+CGD+FdeP9ospusZ2AU6:JONa6vz/cZh+CBd0esJcAU6
TLSH
T12202E935AC381C6B9FF2AE45F4873A175FA82177EA912F85D9E81F0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3cd8c147b228fe895f164d7b2714c4bf6905e58b3257d1056691a0cd41c68a8
MD5 e45080b0a8d60b517d23bdc4a62d4dda
SHA1 d9cd56ab48db52acb18ab219f91c573136233c04
SHA512 f2fab786feacf3412461162647b2542c8172e35fa6f2eb2edc2ada221d177b1c273cfce6837c5bc983895b7f4e480f021872b2ef388f144f16e0414ae5c45205
SSDEEP 192:JONa6v+YLwQmiUylrXh+CGD+FdeP9osNOeBXCH0qUU6:JONa6vzMoXh+CBd0esGqU6
TLSH
T1EC122B35AC786C6B5EE2A545F48735135FA55137EAC67F80EAEC2F0C01EF69C2306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e662ca5a5b103f6a316a2184e28f31b1ac8ba7e31d363a940cc5fd1a0a125aff
MD5 7578a4d7156aa32b3dc97abb2c4ae26c
SHA1 9c1188c0640420e6ecc020e0fdb86dfe7a0f8ded
SHA512 c007fd597100c6eb470b8fb0c8a775b4e64c0c5871fd23feaf78eb2b8e764c7092375f03cde79e42bdd63ed136e74e4b3440361891729859b0e78b7782dc9c50
TLSH
T174E00101D704407BD028033101D7137137B4E05113EB038756100170BC423001B60A80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe599b5c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe599b5c.TMP
Size 392B
SHA256 878ce8c458c61493f7b7d3e7012a91bdca3d0f27c287084add6053e7169d0711
MD5 8c7ec8e929923b8e9491d877e30ea62d
SHA1 56171819431c6fba3c155107c59fee8a3563ab00
SHA512 4cc00e1e68b4e2480d0dd06afd3f0f3191b4e9d502bd8a80a9a8d4a4d00919bd97efa9ef89df4922941cde161ecf5c294008b30a542da14d603526ce819f80ba
MD5 SHA1 SHA512

Submit Download

1649e9ae-1ba1-4c2d-b1dd-8c53038960ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1649e9ae-1ba1-4c2d-b1dd-8c53038960ee.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 658784c47cec5c21d2abd5224168028501b7a7e68d09f373e5cacecfbd70356d
MD5 3263f918573b3b6e638f4035faf72c3e
SHA1 99f4f9403c4f93dd5e3cf37b3161758d887e21fa
SHA512 3869e36765afe4e4c4f532009703b7241108ad90dadd52f1dd408c112b4b3f6149c2acb507baab2dbe3d26d72993473b628ce7348182649a026230c5c7179eb7
TLSH
T1CD41195CA6EA1144B3B7BF5AABF7A4AD447F7C276E06D0AD00110D4E0A62E50C971B37
MD5 SHA1 SHA512 TLSH

Submit Download