hxxps://getsolara[.]dev/download

Analysis

user interaction
yes
max time kernel
128s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/08/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getsolara.dev/download
Sample260822-kfbqeaef25

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1304	msedge.exe

Checks processor information in registry 2 TTPs 5 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318611474698417"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{561337B0-D904-447F-802E-0D2688E6C2ED}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{95F12F08-AE3D-44DD-BDB9-FA3C6370D277}	msedge.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
6432	WINWORD.EXE
6432	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6264	msedge.exe
6264	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
6432	WINWORD.EXE
6432	WINWORD.EXE
6432	WINWORD.EXE
6432	WINWORD.EXE
6432	WINWORD.EXE
6432	WINWORD.EXE
6432	WINWORD.EXE

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1320	3244	msedge.exe	85
PID 3244 wrote to memory of 1304	3244	msedge.exe	86
PID 3244 wrote to memory of 888	3244	msedge.exe	87
PID 3244 wrote to memory of 888	3244	msedge.exe	87
PID 3244 wrote to memory of 888	3244	msedge.exe	87
PID 3244 wrote to memory of 2032	3244	msedge.exe	89
PID 3244 wrote to memory of 2032	3244	msedge.exe	89
PID 3244 wrote to memory of 1140	3244	msedge.exe	90
PID 3244 wrote to memory of 552	3244	msedge.exe	91
PID 3244 wrote to memory of 1140	3244	msedge.exe	90
PID 3244 wrote to memory of 1140	3244	msedge.exe	90
PID 3244 wrote to memory of 552	3244	msedge.exe	91
PID 3244 wrote to memory of 552	3244	msedge.exe	91
PID 3244 wrote to memory of 2396	3244	msedge.exe	92
PID 3244 wrote to memory of 2396	3244	msedge.exe	92
PID 3244 wrote to memory of 2396	3244	msedge.exe	92
PID 3244 wrote to memory of 4452	3244	msedge.exe	93
PID 3244 wrote to memory of 4452	3244	msedge.exe	93
PID 3244 wrote to memory of 4452	3244	msedge.exe	93
PID 3244 wrote to memory of 396	3244	msedge.exe	97
PID 3244 wrote to memory of 5088	3244	msedge.exe	98
PID 3244 wrote to memory of 396	3244	msedge.exe	97
PID 3244 wrote to memory of 5088	3244	msedge.exe	98
PID 3244 wrote to memory of 3108	3244	msedge.exe	100
PID 3244 wrote to memory of 3108	3244	msedge.exe	100
PID 3244 wrote to memory of 3108	3244	msedge.exe	100
PID 3244 wrote to memory of 3712	3244	msedge.exe	102
PID 3244 wrote to memory of 2596	3244	msedge.exe	103
PID 3244 wrote to memory of 2596	3244	msedge.exe	103
PID 3244 wrote to memory of 2596	3244	msedge.exe	103
PID 3244 wrote to memory of 1248	3244	msedge.exe	104
PID 3244 wrote to memory of 1248	3244	msedge.exe	104
PID 3244 wrote to memory of 1248	3244	msedge.exe	104
PID 3244 wrote to memory of 2140	3244	msedge.exe	105
PID 3244 wrote to memory of 1784	3244	msedge.exe	106
PID 3244 wrote to memory of 1784	3244	msedge.exe	106
PID 3244 wrote to memory of 944	3244	msedge.exe	108
PID 3244 wrote to memory of 944	3244	msedge.exe	108
PID 3244 wrote to memory of 944	3244	msedge.exe	108
PID 3244 wrote to memory of 4688	3244	msedge.exe	109
PID 3244 wrote to memory of 4688	3244	msedge.exe	109
PID 3244 wrote to memory of 4688	3244	msedge.exe	109
PID 3244 wrote to memory of 3476	3244	msedge.exe	112
PID 3244 wrote to memory of 4704	3244	msedge.exe	113
PID 3244 wrote to memory of 1488	3244	msedge.exe	114
PID 3244 wrote to memory of 3712	3244	msedge.exe	115
PID 3244 wrote to memory of 3712	3244	msedge.exe	115
PID 3244 wrote to memory of 3712	3244	msedge.exe	115
PID 3244 wrote to memory of 2536	3244	msedge.exe	116
PID 3244 wrote to memory of 2536	3244	msedge.exe	116
PID 3244 wrote to memory of 2536	3244	msedge.exe	116
PID 3244 wrote to memory of 5484	3244	msedge.exe	123
PID 3244 wrote to memory of 5484	3244	msedge.exe	123
PID 3244 wrote to memory of 5848	3244	msedge.exe	141
PID 3244 wrote to memory of 5848	3244	msedge.exe	141
PID 5992 wrote to memory of 6188	5992	msedge.exe	145
PID 3244 wrote to memory of 6264	3244	msedge.exe	152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getsolara.dev/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x290,0x7ffb1433c188,0x7ffb1433c194,0x7ffb1433c1a0
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,16821655403465892912,16492501232942131181,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,7259107037245733142,15864030244374971714,262144 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,6801646113672116087,8724142792162785538,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,7700759776069739655,3721425455573327101,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16991272437652225729,4535529012388767171,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,11047018608814824141,9676909364276900162,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,6722837351009362655,14448955725355519689,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,15358376936832527497,11106309537412870840,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,4117521361753856253,2114172817952129028,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5720,i,7637840914915086398,304442606064391761,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8003663407022930836,7413643939865639125,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8003663407022930836,7413643939865639125,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6096,i,7490315074248224256,1670889253123507087,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6492,i,8605524412877281133,7081964249807366978,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,1069387268991235697,13096673365771001222,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,8574139403889747630,11434037399304085773,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7144,i,6535858971062663004,14676765666245026931,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7408,i,11575449156579521771,9357121238462876188,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=7432 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7848,i,10819843946845329771,1122483884151958074,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7768,i,906508186417820776,4676536694363071018,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7844,i,1290180547832931358,2645296710001148765,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=7804 /prefetch:8
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=120,i,5084136198654161516,1496730486802575700,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=7772 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=2144,i,13206594445994284691,898172309374223402,2097152 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,914896605205134817,13405572810897482205,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,4509953735912475922,3312362255448523352,524288 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2724,i,11130139622673094141,16518403598084997793,262144 --field-trial-handle=2272,i,16020362146032976546,3939872071374503334,262144 --variations-seed-version --mojo-platform-channel-handle=7676 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault59525974h46d7h4af5hb41ah2ba1022804a2
1⤵
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --default-search-provider=? --out-pipe-name=MSEdgeDefault59525974h46d7h4af5hb41ah2ba1022804a2 --edge-skip-compat-layer-relaunch
  2⤵
  PID:6188

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UninstallOptimize.docx" /o ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f7645e515b0b4f695de90735e552622f7ce6f1c1a3a56484ed2bc0028c44641d
MD5 85dcbaf06af48cc371e82dec7714b80c
SHA1 6c6aec56805968a47bf993bd3de21001933919aa
SHA512 7a4bfc32ce6ce6554c16186c045652652911a4b23247f765bc069ffbebc3e8aadd24dbc6761b122c641b79c43a4b9476ef6e84351f742fa92ad1a29932cdc770
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T1A9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b29851f04ca6ddd20a9fe76668e74634233e8dadca3d4db1dc1d9d3eacc9a1ba
MD5 ec573965ada1268d3bd3736603b247cb
SHA1 4c39e59eb2c90e2a227a2939b7d99bee54dc8073
SHA512 2afdd71fa0b2737cc0ce3b583e2c89efca5eb9cfa4753d58cf24311b046c15a3c30fe813c060455e73ec3fa6f5aea38f03acbfce437e457559d927c61aff9d3c
SSDEEP 48:8M99pPRvKjxD0WX71WyEmVjGG0KmkBGjlECgvLWi3Js0d+HqudsPYKk+bfVIYm2Q:8ME0+ayz1WiZzTk4lGe6CokS
TLSH
T1AE91C728D25AC81DD7F80E3CF1C11634747A05894A57AE55EA20BFFDE58A77161C2C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58f037.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f037.TMP
Size 3KB
SHA256 0b6a588ef3a378dad49c91ab17487b103dcdaff2c08ae5cb40923a994a866db1
MD5 4f93861e4f2a2ecb8c6062d1572a544d
SHA1 a31054d1c275288461aa4b545911116a6402224a
SHA512 6bcff220e5940df88368c5028b04c67c21b80fc21fe4bdf55b4b850e2aaf661e652dba7e7f67df99acd9fdd168ba0ba3326d03132f8c6447a87cf0f8f2a6594c
TLSH
T189610B380262C84CD36C153DF1D11234743F868A9A1BAE662E14BFFDE9C9B31A1D6C0B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 15KB
SHA256 d24ea2580470fe633dfe0199b42170b136dcf0bbde937610d8fc931438e6d269
MD5 9ec2c4f79232a0c407d609e234f51872
SHA1 ae69e49cac5d8f225ad4c83b7e5874ec7797cbfe
SHA512 339af7747572fae9300c06dbbbec7a0636cc09826ebb203e17683f5d48e1eee8aea211ea146916593ab85cb314434758be1338496a95ab167e8231b0773478d8
SSDEEP 384:DvGs8CAsvjsfsueUIIgBEJor7VIv/A/NV/GXBmFuB8rgIZVVZFUrQG5Vx2VryVQK:NKeNc
TLSH
T1DC62ADBEC6F4C97D982116F1A738BE1ECE6E0559525C7C1BC8D69F8B93E1431C20198E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9f2ae2ec5763833323b1dc546741d464a73d1b08ca151610d061bbcf0d55854e
MD5 6bf23b437e33c82df10250eb4a5ba693
SHA1 d7196a12f59d71b8291c508c53b5fe7dea8b8e99
SHA512 117437f4eccbf719f5d362789af016f10d7b51af211c2692754b793cc8afc8d76ba984011db239272533609544b7bcef3fe6d06a5d3c89274c5a8a983ef20ebd
SSDEEP 192:sxZqRcyM/jK1Ml8Mkpn/fXsTDk92qEdpa7YHW6+WNZbw/YHW6KMIgrJ:sxZq2Mpn/fXsTDk92NpHbe/Y9
TLSH
T1B042DA126A3899B7CCCFD209F9557B53D6F9147292900E84AEFCCA1C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d902e8ed77d2d219fece5793a1e7722ade989e8b7f1ed0bf9fd50a05e16caaa7
MD5 4d99a071cce39c92f928d9590d67e177
SHA1 d2b6bfaf663f5f3d8478d3785632ec0a8c96155d
SHA512 96dbf3b42b85598786b7c338a179ced8c918ec4b4b90b0f00ec824d76f25eac6c668eed3993aafc672ca40251a307f174f8898fa15e1c4255625b60f02524acc
SSDEEP 192:sxZqRcyM/jK1Ml8Mjpn/fXsiDk02ghdpa7YHW6+WNZbwuCx/YH2OkxMIg5EJ:sxZq2bpn/fXsiDk02+pHbep/0e
TLSH
T10152EA15AA3899B7CCCFD209F9557B53D6F9047292900E84AEFCCA1C05E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c4bafd3681d1c4150be272c18507a8e6be565230f933aafa403d7584edc7c086
MD5 40473581b54befc3444df3666b78e6a6
SHA1 f7a2822e031274b8fe7d12da1bc565c723c6407b
SHA512 b193a9eddac46ff83c759888ce61981965fa260f0259edde45cce1d811500c4f06809c368730ba89ffef81535ca8e4fdce2cc7f8e567077687dba69bfd6b6888
SSDEEP 768:ZgUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RCroVB0T:ZgUZYTMWvg09ou1ja7eLZmRZAT
TLSH
T11CE21B2B680CCB7E4F844E5DEC26AF963ED801CB5A584D544BEA894C03CB3EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a74d2c8a2208e4764d8e7985826c42efb69a7e8e8bcd9dede06710dcfdf20422
MD5 bf485bbebb20d6d92a91f6cc02739297
SHA1 c7c799b6af45baecb31655ea5c2b636f298ce2d0
SHA512 bba795a171473241311e311bd320ed314b2eb7c9a3881e1ef78ee603f9feedd9dbbd81e0494317e9328906a466249951c17788e57bdae867e71ed601e1e14ba2
SSDEEP 96:KA1eK2AAv+KAgmiSgKXq8OgKXqSeGbg0GwQxFU1sDsxKr4DmxH+2Ns/:EU1HQHeGbg0GwQHU1gsK4Dm9+2Ns/
TLSH
T19ED1076271BA02422D3E6B1893D4975FCE4272633018E52F3BAC41B18D67E629CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 81B
SHA256 1346fe6efa190f0bfd656ae87f4621c5f9ac83b3e0d65e0dda9ac48685098cbe
MD5 c385063fc199cbc436392e97a084c336
SHA1 c6ebaf81899d9771edc963455a4f5de54bdf82c7
SHA512 0eaf31572fdab1d86ddb8dd550b62ebb5aa7928bfcd9a46e26aa489b99cb2787289ea0367519fbd4168e9b33fa99ee1c5897c39bdff1cefa564b76832ddbd15c
TLSH
T13DA001F74C04C4AA4A71B8E86125B35DE15B829C8CC4EDF1D40880422138B774016A54
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 162B
SHA256 bd7b8c4dcd524f824f8326a38f602f7a6d189e6f160cf8937cf3ea8aa54f5b6a
MD5 02b3d7938fa657a6b8c431c89396118f
SHA1 8ec5281c1b1c73f303edc35f0afd4d7d6162f0f7
SHA512 5d20ed6a68a9757352c0dc63f6c94dfeb1ad2fd09c6a75b10f2de4061b4bbf6a81f964554ab8c135eb5521bfa74f965e39cd2bda7e45557bcc0b99ac0602374e
TLSH
T129C08CE79C10C58A477079D85120B30CD2378C8E8DC4DCE0E508B04A20B8763C042A26
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 155B
SHA256 534324fba981ab57b18a83acec11f530aae889408797ac59b21cfe848c0ff042
MD5 3acf0fb227865600066fbd4b19ed77c9
SHA1 d1846e13ed9381b3e11062435d9736159029b514
SHA512 12e06855f427aed1352ef8b1641b9a67e874bdd2c4a64c4ba7590ddf74ad6a4a97ecc3ab3174d58b960cf24f2b180c69a3fa4a6bd871792a3345ebdd577d3609
TLSH
T1A5C08CE38D00C58A4770BAD82020F31CD12B818D9DC4DCE0E508804A20B87238442A36
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe583a93.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe583a93.TMP
Size 165B
SHA256 72e170ee753625b2e47db2f620bf639f55365c84bda4efd2b959b50ff0843ecd
MD5 4ca037ba2e769be30a12411a65377217
SHA1 fd7636c9cbcf3467c688423216704e661fe27b94
SHA512 a42e626af2678fe180605b7571d157aad1a5cec2c97f9172cfac00db758382df70934fdbe6be93cb0ee33e25c4dacabfc61cec84fc8ab6c2a90ef6904b7f86da
TLSH
T131C08CE38E3282AE0B38B8F69025328CC213DD8E9CC8ECE0C805F05220FC723C012B14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\b7b0221c-c18b-44a5-b7ec-17292b55d165\index-dir\the-real-index
Size 72B
SHA256 27f99be67e066780974c846d95939ad56f6717dc213e21f00909b990b54d411f
MD5 aefa952e8e6757c7654713924ec4554d
SHA1 fd5db6729753b3ba10d31bd7e30a3fc33afe794e
SHA512 a7514fcba6b075b2216f76ec32082fbb4cd768b2e78e0de40f3f2e74010c8e5677024b8a3fe910c5ad5266ea8c4526a072cf17a301f28f4e1bfdcd751de575d4
TLSH
T179A0026583D95061D05016B554994BA63315C89405020703C899418CDCA13C59DE1065
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f3b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\b7b0221c-c18b-44a5-b7ec-17292b55d165\index-dir\the-real-index~RFe58f3b2.TMP
Size 48B
SHA256 843233662ec1e11b449512387f2e73e6fbb4ad182e77ba03d8993c1869bf895f
MD5 996b187ca645c0f0557bc7534ab0a480
SHA1 939110ba141e8f2f6d1d9608715728af26984660
SHA512 fe7b9054f5675a724243861389a9a9269c1c25b43413543f26d46af131d5887099b765f6d12aa86d7b5c1b441c5f7de1ed22de9d8c2ff4ee3d7f987c378fc216
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 95B
SHA256 3e46e8026ad32460ec56446df4496086a31d4936956371a206ab35ac6132d91f
MD5 93ac6ee0acc223b23db53ebb984062b4
SHA1 457be7fe40baf3613578d7b465d3a4c478adcabc
SHA512 c673b0488bfd4a0be96ebb6b625facb0471b21695e4398a5c4b81f747da3903218f25aabbf16cdabc401bd161518c780a22fbc50769c634c641cac6936bcc141
TLSH
T144B002FB4445D9D55E7138E7414533DDC57273DC5C85FE8DD4752059322057F5011E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58a592.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58a592.TMP
Size 182B
SHA256 75403c7a950de2915caf5950170fc830bd28c617b22cbc15a33c397f0ac85b5a
MD5 c8e6590a9ac5f03ce5446e37a3781eeb
SHA1 f8b85be7a8076293ce0bda4f94cd2a13d65b6353
SHA512 861f3b784c9b7c0a4235a6021a5c6a79bccdfdc6f9126e0d0bd4e2b5f508da3ee1815cd8648efe29298677340a9b7e30b89ca2c633f072a0e7c4db631eaf9025
TLSH
T124C01277559499552F6138EB515173C9C9763FD80C84BE4C845630192A3093E5411B54
MD5 SHA1 SHA512 TLSH

Submit Download

4dff06fd-120a-499a-9215-1c34b57280fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4dff06fd-120a-499a-9215-1c34b57280fd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 0bf3dadc815d9efd715e3e706d66eac81c756a6e252edcec3e17acf8a9769797
MD5 c462baef9512bd70fdb187ec3b31eb50
SHA1 17d1895fc061ae0fff0caf7a934039584471213e
SHA512 b62fce39bf5b22c64b4cc33e5e4a2f558e068070b20184cf7c639094c08e72e457134302f5e4a848ed0fd6abc01303720e97b30dff2858b47c1e0dad37de932f
SSDEEP 384:hZcIhsNVrlVMCYdwC2zX5od+hO/VuXd+2ZwUivsudoB:phSMkCqOgO9utlZwUikuda
TLSH
T17B827D325928AC725DE6E245F94735178FBC506BD6C86FC095FCAB2C01EA6EC131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6f69df7da1b6663ea939ebdf401048cb45463650d678fda1fef375e30a9921a4
MD5 a9699e047fe0a2ba2e609e29da07dbfc
SHA1 880ec1092453cbb757e0ed949eb27efdce710cf1
SHA512 0bc410c6350dfe5c3821d6958244f99d30a5fe93c154315b971c5aa54e4bc262cb9ae81b447bcb697ba39baede2c7af5c7205205193df8b95d212d168b0adee2
SSDEEP 192:yONw61VWQmiUyXSgGX5Obd+jFO/aob/ad36iU6:yONw6WjgGX5od+hO/V+0iU6
TLSH
T15602D83569286C779EE2BE49F48737239F99206BE9942F84D6EC1B1C00D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f6c0ceefce095f77dfa738d844d0bbd60f65136e764cc8e1ab0f2c7c2cdc1ebb
MD5 f7470f54015d5c9498de558683a651af
SHA1 ad7631862fab4ce0f2b5a962d080bf926aaddbac
SHA512 11415cc2e21584e3ad716b842857c65069a47a62e2a1ac5f7875b52a6810d767ec036d41339a9f5bd406772708626954cfcbfc37acdaeb404c4bdcf10ace6d26
SSDEEP 192:TONY61mWQmiUy1S7GX5Obd+jFO/aouJFd+2AjJXqBUU6:TONY6bP7GX5od+hO/VuXd+2YwUU6
TLSH
T171122B32642CAC775EE2B595F48731538FA91167DA897FC0D5EC2B1C01EB69C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 167b678397e3ffe055708ac23b2d4beddf4bf9a96bff6a5242a97475ac27aa22
MD5 9a331de442e00b71530c6d3f65260f08
SHA1 1928ebbd491829c2ebd06778c887fc4715ef7547
SHA512 ad61b0e183bc247b9fdfff01dd58ae61e358b015e6385a76e31ad5cf7b776d057b59d1054ce6de83714e5b0cba98c556f6180128899c5b498b834928a2a71518
SSDEEP 384:EZcIhsNVAlVMCYdwC2zX5od+hO/VuXd+2ZwUivsudoB:ihRMkCqOgO9utlZwUikuda
TLSH
T1BF827D725928ACB25DE6E245F94735138FBC506BD6C86FC095FC9B2C01EA6EC130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 0061054255b53b3df1b591148bd137498ab1fe51fea7cfb5fb9cc082f4683995
MD5 388cf7ebe37d37914d2e4d379b643d31
SHA1 52553e5fd4fcbbe683eb7465060463cd8622e3f2
SHA512 ce1e6e82f7a74413d48c3857c7464f07e884be958f4c422889cf7dabfa90bdf61f38410574a2ff3c8e57a53742b27edf249a5c61bd302cb3c9a02d11d31c4529
SSDEEP 384:XiFaZcI6sNv8TUNTUlIlslVMCYwwC2zX5od+hO/VuXd+2RwUivsudoB:SFY6SwgYM5CqOgO9utlRwUikuda
TLSH
T1D8A26B735958DC766DFAEA85F94A32038FB840A7C5C9AFC0A6EC9B1C019B6DC130BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ff2faf96689aa5df96deb91ce21546c8cc29737ad7383c7fa92aea8bfcb75289
MD5 a290cc0c2ae6e54a5bd6b43d6a6ccf72
SHA1 f4b946ee74e5409a476485c99c79f5f9fc36775a
SHA512 0f32a19cf97aaab2e17f185aeaa96d7480e147742f931eeee3efcc613e23f38682d4e78c635afddfb4bd8602edc3716e92468b74673297bae4b28202b2f065e0
SSDEEP 384:AsNVrlVMCYN2C2zX5od+hO/VuXd+2ZwU3T:ASMmCqOgO9utlZwU3T
TLSH
T1EC422A366828AC775EE6A545F44B36139FF851ABD6882FC4D6EC6B0C01DB2EC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c613d865bc225c05e6a6657b55372b8b573c59a998569f87ce153f4b50c64f61
MD5 8351f5b95bcf962a99fcd38ae640182c
SHA1 6a280ba3acd8c273fef25b1468f4412f6c3d4937
SHA512 cee0382e30dfa5cfdb5d8eaace8b0da2f1b63629b408ac018c47ff9873be2bf9c8f7848675c6178fc8d67ed4b8d3e90e6aff74ef5bceb55b35f395c639b53f80
SSDEEP 384:5ZcI5sNVslVMCYwwC2zX5od+hO/VuXd+2DwUivsudoB:R5hM5CqOgO9utlDwUikuda
TLSH
T187927D725928AC725DF6E145F94735178FBC506BD6C86FC095FC9B2C019A6EC130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 61ad042f18c0ef306b724f97d2e575c59a71db30af05babf44200815e46dcd20
MD5 7a1c468147e2fd025d95232d9c68592c
SHA1 a2bd18635867ba816f96e81275d2e4341120c42e
SHA512 c8d008f6fb81571107615268aaff2059a1c2a69a3f39fefabbff1be579c00f81d42614c8e5d86f9e03b5c33705305dd91c802407767d60685c7f69ab0ff34fdc
TLSH
T1C641E95CB6F91148B3B7BE5AAFF6A46D087FBD772E4A945D10010E4E0626A80CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 fdfd514290e99e4f5784502b46021243edede590f8d670b335d1a71f1f2529f4
MD5 c4cf94886cce7255e013b08c015a2353
SHA1 2d56b9b7c859335ff76a19197fad183367e2f2e2
SHA512 eee918e1e22fff4e8825f0717493205119829cd64185971c92142a213a630134e1fa08915bcb55b3f71b6f7275320000ca89ef4aa8fb2350c84a17dad166e659
TLSH
T1D7516E58A6EA1148B3736F5A9BF2B86F847FF9732E06D45E10110E4F0B27A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 376B
SHA256 96d33338acff1e12a3dbeb9565bebbab672af8bc305caa3b31c43314f00052f5
MD5 83c477a48519f3520ae4862162965e0b
SHA1 a79878ac7a64b8df30117279988902836af8ac5c
SHA512 94ec65898c9e7470df1f3814e09f752afb7f23a2932463e8c591037228f420269d1f3d7f4e3d36769d10ceb263ea0a5c0acb67b558bbae1d686154a5931fed21
TLSH
T1EFE04FAB7325D7F28B7E62BD7AB64CD54BF18C58D26D112150CC0CC50F7058B108B44E
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 d44e2c23e1e64149ca66287ae5ba9188066d63dbb3318b96574aea8db6ee5246
MD5 cc1e5a8233d9102da7840bb85a50caef
SHA1 064754687f5380c803752730b64e16b5e158631b
SHA512 af567bbe71c2f52bc2392fae4faeecebdf71f3fc1e16d5ce5885196db402311581144e0dd3402eb2af3ae8255250a2a1be84ae38fdd56451381af18b69938c92
TLSH
T107511057428B3F5BD05443B396779791E7F0BD02E740B61DA684119E3E70E008F8DBAA
MD5 SHA1 SHA512 TLSH

Submit Download

fb3b0dbfee58fac8.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms
Size 2KB
SHA256 9e82d9ab9951000bcc344ee97c65284905387efe31c9cad86db291f2f28c3b99
MD5 791acfa15cde1bcb3788671a6079b1f0
SHA1 d803d88e6aa19d176e8ad2c826d735ba87033ebc
SHA512 ce66631840928b2076a2507b74e0ae8e1dafea0a1e421914fefe581778ff0e75e631196739716a712f4f956b5c6eda913916da444575091246847991f39cf058
TLSH
T1BD511057428B3F5BD05443B396779791E7F0BD02E740B61DA684119E3E70E008F8DBAA
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6432-514-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-518-0x00007FFAE2A20000-0x00007FFAE2A30000-memory.dmp

Download

memory/6432-519-0x00007FFAE2A20000-0x00007FFAE2A30000-memory.dmp

Download

memory/6432-517-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-516-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-515-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-513-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-597-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-598-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-600-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download

memory/6432-599-0x00007FFAE4390000-0x00007FFAE43A0000-memory.dmp

Download