hxxps://hays-globalcareers[.]com/?id/24550/xerotad3r1f/apply

Analysis

user interaction
yes
max time kernel
328s
max time network
330s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 23:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://hays-globalcareers.com/?id/24550/xerotad3r1f/apply
Sample260824-3s8vsafd83

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	31	https://hays-globalcareers.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a3063ea71d48ebb4	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2804	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320888753951974"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{5AFDEC23-E302-4C92-9D6F-81B4BFBE9157}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6088	msedge.exe
6088	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 2024	4428	msedge.exe	86
PID 4428 wrote to memory of 2804	4428	msedge.exe	87
PID 4428 wrote to memory of 2012	4428	msedge.exe	88
PID 4428 wrote to memory of 540	4428	msedge.exe	89
PID 4428 wrote to memory of 2012	4428	msedge.exe	88
PID 4428 wrote to memory of 2012	4428	msedge.exe	88
PID 4428 wrote to memory of 540	4428	msedge.exe	89
PID 4428 wrote to memory of 2000	4428	msedge.exe	91
PID 4428 wrote to memory of 2000	4428	msedge.exe	91
PID 4428 wrote to memory of 636	4428	msedge.exe	92
PID 4428 wrote to memory of 2000	4428	msedge.exe	91
PID 4428 wrote to memory of 636	4428	msedge.exe	92
PID 4428 wrote to memory of 636	4428	msedge.exe	92
PID 4428 wrote to memory of 1824	4428	msedge.exe	93
PID 4428 wrote to memory of 1824	4428	msedge.exe	93
PID 4428 wrote to memory of 1824	4428	msedge.exe	93
PID 4428 wrote to memory of 2296	4428	msedge.exe	94
PID 4428 wrote to memory of 2296	4428	msedge.exe	94
PID 4428 wrote to memory of 2296	4428	msedge.exe	94
PID 4428 wrote to memory of 2228	4428	msedge.exe	97
PID 4428 wrote to memory of 2228	4428	msedge.exe	97
PID 4428 wrote to memory of 2228	4428	msedge.exe	97
PID 4428 wrote to memory of 4280	4428	msedge.exe	99
PID 4428 wrote to memory of 2160	4428	msedge.exe	100
PID 4428 wrote to memory of 4280	4428	msedge.exe	99
PID 4428 wrote to memory of 2160	4428	msedge.exe	100
PID 4428 wrote to memory of 4984	4428	msedge.exe	101
PID 4428 wrote to memory of 4984	4428	msedge.exe	101
PID 4428 wrote to memory of 4984	4428	msedge.exe	101
PID 4428 wrote to memory of 2712	4428	msedge.exe	104
PID 4428 wrote to memory of 2712	4428	msedge.exe	104
PID 4428 wrote to memory of 2712	4428	msedge.exe	104
PID 4428 wrote to memory of 1376	4428	msedge.exe	106
PID 4428 wrote to memory of 5764	4428	msedge.exe	120
PID 4428 wrote to memory of 5764	4428	msedge.exe	120
PID 4428 wrote to memory of 5764	4428	msedge.exe	120
PID 4428 wrote to memory of 6004	4428	msedge.exe	123
PID 4428 wrote to memory of 6012	4428	msedge.exe	124
PID 4428 wrote to memory of 6020	4428	msedge.exe	125
PID 4428 wrote to memory of 5452	4428	msedge.exe	127
PID 4428 wrote to memory of 5452	4428	msedge.exe	127
PID 4428 wrote to memory of 5580	4428	msedge.exe	129
PID 4428 wrote to memory of 5580	4428	msedge.exe	129
PID 4428 wrote to memory of 5980	4428	msedge.exe	132
PID 4428 wrote to memory of 5980	4428	msedge.exe	132
PID 4428 wrote to memory of 6088	4428	msedge.exe	133
PID 4428 wrote to memory of 1248	4428	msedge.exe	135
PID 4428 wrote to memory of 2792	4428	msedge.exe	134
PID 4428 wrote to memory of 1248	4428	msedge.exe	135
PID 4428 wrote to memory of 2792	4428	msedge.exe	134
PID 4428 wrote to memory of 5464	4428	msedge.exe	136
PID 4428 wrote to memory of 5464	4428	msedge.exe	136
PID 4428 wrote to memory of 5428	4428	msedge.exe	137
PID 4428 wrote to memory of 5428	4428	msedge.exe	137
PID 4428 wrote to memory of 908	4428	msedge.exe	138
PID 4428 wrote to memory of 908	4428	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hays-globalcareers.com/?id/24550/xerotad3r1f/apply
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffa61dcc188,0x7ffa61dcc194,0x7ffa61dcc1a0
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,11160266967858400516,10808373452366178384,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,17553791718643394679,5839057961268790354,262144 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=2524 /prefetch:2
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,4618239945853929892,3621047698520567039,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13223712489551013357,17691634242191106865,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,3661634416533218874,249032216365005834,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,340595183127678407,8361740094388955985,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,15860653978029480910,7268847557421355512,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,2518321206910699679,12687934365468997042,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,159130522020539091,7366660928986079667,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,16820882265791620692,11847640122906496844,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5592,i,7201640713971451811,3764403613062024469,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5784,i,9346722837300717651,2072498929737973738,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15866199978475815904,3914046805575051334,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,15866199978475815904,3914046805575051334,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4240,i,7640268677576857843,12960699048847335230,2097152 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1763080271459053938,5538519398902435534,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:8
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,17980777900864391301,5214461251065873327,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,4577673963256875530,15062954218802496787,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2104,i,11597015424631950917,5709018881329165985,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,11000298032687709448,762265198553670223,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:5580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,9165653836936479898,9785362284774055741,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,11141865154128165182,12976489215006697543,262144 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4226528270781716646,10542125484306505456,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,15271197339132814421,11941620490519824626,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,18187996866746367182,13907260064361691486,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7012,i,3752121621645714956,12708964261588760883,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,9332162850040742826,15298243964721696320,524288 --field-trial-handle=2600,i,7322297839191852060,6822484569055006639,262144 --variations-seed-version --mojo-platform-channel-handle=7092 /prefetch:8
  2⤵
  PID:908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 707c0a63a018be182dd327d61f24ae614d8bf02ffda39fdb66cfe859df8e6d90
MD5 2c06dd9a8eeb3e210783d42396870f59
SHA1 ce3b609af27d6c15d832d559b6c1f61710ec43dd
SHA512 9d0211e9b2e3b08c98a2e522305d7c597845ab72a08bf4e84d98dabce6778c27176a8a6048e98c7d318423219947cbcc6a95ea0cc735fb94e03d9ba054a7a5a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P72:fwUQC5VwBIiElEd2K57P72
TLSH
T159B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d7e821205838234e9351fcd78639bdd272720578a416acbaded5f2ac8dfada61
MD5 0a17ef7aacb3871813ba932e272a4b0d
SHA1 a67037a515d805676534baf7a8f4ddd979a83526
SHA512 e1b10fc7de1b66d3ab041aef965fd7122dff3c48469589b681ee64460ec7a0c3440f10387312536aac86d763a1cf0e9b4813564f5d447d57fa481ed63895f542
TLSH
T101E026A404C8C2BFEB00A5CB52BC632C92A0B70E96C8B98B3714C4947082440A2C76D9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 791244633cce47cf1072fbd6d08f12d006fd0f672d16bcdf827668d1a46628fc
MD5 f5f0c063b556f771596ffc4f275e8ded
SHA1 eb834179ca14b32aa072ac885877805b83b6b977
SHA512 f2924fea5f7a1cc794d018601b2268b8984be2654ef0e620e9425eea7644a4af1f5e57d116f1cfb1d2b3a8992af31de1bf802629deb60a24c2078fcafd135e17
TLSH
T122E0D8581286D179A90C95C792DE6B298124700DA54DCBE93607E9A42410882439D6D8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 178683ac580af9ed3714fc105df29722259a785196ddb6686f8ec132483dafcf
MD5 a85093b35b6464c4d48b36b99df4f5cb
SHA1 029e0f17e0c4983e63b26afa5309549fbf44462c
SHA512 a1779f5c97070b9b493499cddb64337dfad28e3ecde910618f52d7d8248b6dcb3c7a69cc1c51149509fc52ddde30ff9431d37c0513ab209e318bd02d43fd1e78
TLSH
T153E0269D04CEC27EB704A587617C934CC2843A4E93C8ED9E2709C485B417040A38E6D8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a5776a476bf23992778cea667f34e4c5e7f07ff78162d7a43296769b2e80fb23
MD5 5b9d92ad824d11a3b73b0d5b4f8d5a3f
SHA1 55e532087c9288c634c8c59fadd789872f1da143
SHA512 21e2f10d31ed17df5f871c43fe7769931323f671593a6e5b27059a9572f34d9ce30c4623bc1e3eae06be2e778560eba4d6832e5f0420a45543fabd784acbf71c
TLSH
T1717150B5150EB8A9E35E0138ACD25E0CBF3140E8F817BF7D1A508F72552D72842F6B66
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592551.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592551.TMP
Size 3KB
SHA256 42be4930145c0d67ad3a86060be4a6829ec51047f0c789306ec9e17de9ef6c88
MD5 5c5dac16a1b97ed947ebd759987ace3d
SHA1 ecdfc2710b98f00752f174b50b52a75bdfa306cc
SHA512 b3eff07109b820b1ca95ac59558df204682ce86ef8e626b7c3f0bb5c6efdc56b9034ffc05bd476000d8196efe57dda9c85ccc1982f69b412db4da59908570e07
TLSH
T135716FB0150EB899E35E01389CD25E0D7F3140E9F4177F7D1A508F71551D72881FAB26
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b05a3f1-3891-4880-a80d-f778ae8bb74a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b05a3f1-3891-4880-a80d-f778ae8bb74a.tmp
Size 6KB
SHA256 dafabeb3d8ceab54a155da57c94193eaaac645655839fc2f6a4349d4d08d242d
MD5 ab44f472388386a9b95b5b4e4dc12d76
SHA1 85ee819a92fc1fd9af242e0b43c209b21fbe42d7
SHA512 2b47adc82678f32b79724e208148d8d352523ada368523a7bfdafa3c5bb9d956c5c2e68b112afc6655882a78fba05456bb7d68670f51c10a08f6b3345ef4e631
SSDEEP 192:D9DiTW9OepYH0bEfIG/y/25HQBfLbL34PFqT:D9DiTW9OepYH0bEfIG/y/25HQBfLbL3V
TLSH
T1BFD17AB396E5C26ED9225EF1DB18BE16CF1D0628022CBC1E8AE4FF47A3D2171D11165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

833d698d-f0fa-460e-847e-beca344db5e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\833d698d-f0fa-460e-847e-beca344db5e8.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 2ba68960dc4d4cc78d93a1e4f59b4f36d1103d2a38e400c3dad27bb668cc88a1
MD5 9e5c7f307ac5e92bf12d020364a6da8c
SHA1 b270612e31f1959628d54e65438a86cf87448e45
SHA512 93572dcdc2e801398aa05f393c1f33af212db4d5bdc70d0b931adbfbf35624217bfe7c495bd91ba06e28ce413f06d9aebf06d0e08d0db135e058ff04cda25a24
SSDEEP 192:D9DiTW9OeZPtmEfIG/y/25HQBfLbL3nFTn9Ziw:D9DiTW9OeZPtmEfIG/y/25HQBfLbL3Fb
TLSH
T178D16AB396E5C26ED9225EF1DB18BE16CF1D0628422C781F8AE4FF07A3D2171D11165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b27ba8d5f4a987f3ed856eadf76e46e2e688cf8632537b764bc632629bf673cb
MD5 de18a7c6e878a6f65d4e468c523205fb
SHA1 d8ac976d715e8fa513c10cf67d048f3b5d549f52
SHA512 77a1d28f48862296d18b8677d3c96e6423162fdd5126146a0e6ea664b02c95e021ee9da5ddb22f9ae64054bd58645eb750f1e5276752a4828b4213bf3a0fea73
SSDEEP 192:sxZeRLyM/jK1Ml8UQm9y/f0s0KTHIdp8cuHW6+WN3dKdYzqrb+eaIg5QJ:sxZedqgy/f0s0KM4HbAdDa2
TLSH
T12C52C752AA349977CCDBD20DF9857F63D6F5147292940E44AAFCCA1C04E7ADD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 290427b5451d8de3ef84552175a76350c3dea71adcee357af53f8ea642679028
MD5 a81400511ac6be230d7bfe9088338a27
SHA1 3ca34651d15e1f8bf2ec77fa0326a64a89530c08
SHA512 34840d52a8c3607f558d6f63fb334264ed5a9b147c461b80cc12516185abec96f93d17f7c3020d59a791102a7373a3b12254c74dd77a812c534b8c4b6ef0160d
SSDEEP 192:sxZeRLyM/jK1Ml8Mky/f0sH1FHIdpGc6XHW6+WN36Wup/YzaGAb+eaIgrJ:sxZedMy/f0sH1mCXHbKFp/xTa9
TLSH
T1D752E811AA34A9B7CCDBD20CFA557F63D7F5147292950E44A9FCCA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28815cae62be684baa32849e3e4cad4cda8042705e14763f8e38212ab89e2088
MD5 7bccf9228b5d43dcb0dfd03807194cc9
SHA1 8efe2fad4f7e55f792528a8a162b0157120c1bdc
SHA512 5b3e3105fe4d21a89be4227e253b34ce5c42830172b5f6f5c180fe9dfa684b49c0282bded4c00164156118add6f1ad46ac7029dafac69d2307a2e184f35a0da2
SSDEEP 192:sxZeRLyM/jK1Ml8M9y/f0s0KTHIdpGcuHW6+WN3F6ZYziob+eaIg5QJ:sxZed1y/f0s0KM2HboZEa2
TLSH
T19D52D811AA34997BCCDBD20DFA457F63D6F5146292950E44AAFCCA1C04E7BDD220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c7f0e9ed44d5324098a17aac43f4532afc01511b6fd220e853c38f5e361dea0b
MD5 b9720ffd9d5f38486a60b22f09ad59d6
SHA1 4e90fe1bd65ff1e99bd33dd47ef2bed112943f0f
SHA512 ae66e6339e32640e98e7e357d593890f58b4307587702e9ae1d7c9a4c6f559f4d37e0c8a5171db7ce6e792f5c95ecda221332052e6b843e5647928fb99ef30f7
SSDEEP 768:0vW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjjroI90OFYx:0vW7kf0Wvqinau1jaa5LA3jQDx
TLSH
T129E2FB3B680CCB7E4F841E5CEC266F966ED801CB66988D544BFA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 1KB
SHA256 0ae1f5a2320266b2274b116621249a68e38a81d6639088ed0a16c2e935e4ffb1
MD5 675ada6e2036dda3f58cd8e34409b778
SHA1 79f6162cd08a9a98be45a4cb83ad2444a7dd922a
SHA512 64fa17b54b2580012183b8c10297e8b351ead04ef11f405761ff8079535ceca99693e8539045fde20588bbff82ea23e21f1a20660a8d39e20d60bb7277bac4e6
TLSH
T1C93111498E81D9AFD5E485F2117775A93370D9DC23516793883C62363C277592A0B098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfd63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cfd63.TMP
Size 1KB
SHA256 b92f48b55e2b7ce8a8c70a77bbe0791d19073a913b3ac2fa402c6262307cad39
MD5 e151a87189f701ea025f51822f079d9d
SHA1 45a67ebe19095a779d4eafc1ab29c034cafc0e9a
SHA512 607e8dafae64a174df7e4cc1744e3361729fe844b48ec009ae7db84a37693ab2b5cde7b1cca9d2f7f0bed55c6ae10fe18dcd8c82ee055b2b19e2e7fd5010ea80
TLSH
T1F931758F4B81590FE8D440720557A4B83375CD4053227793987DA3396C7579D2E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 52fd269b1bc2b1ea66ed20fc206be735d9e3ad79773e441e81ed753945d6bbd7
MD5 706bc4cfeeb3fe3dece05e87642751be
SHA1 9ac712448bb8f92b42a5e94b72fc1c89bb0146ed
SHA512 fde717d26c95429875213850400cc23149ef58681e6d2ed6a258c264480cfa3430de96ed821d43c5f5870966e149ef1389e3782e6a4f96ebb303319987596edd
TLSH
T11AE068BB2DFB1834AC6F87C538B064A0868539189500EC4E3027A28730F2351280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 1adb063138a9fa772b006cf322177678fcfa716806e39c4d8033b2764a5a580e
MD5 0195319f15ade2bba333b3c740b4e1ba
SHA1 aeafaa204980811b91d04647289df534d299cb09
SHA512 f26a9159ea56c710df164d161f552fe61df271263937b519f48101c603d6a22113335b2a6cfde48465258ea6312e69808d73bd48a9ff6f898247e467135d861c
SSDEEP 96:KIbCKcrUAKdamuj6KIwDudwk2UQj9g/STcjKb6Ti:sM7N9e
TLSH
T16D91771A327B0A113CBE2889A3968A375F4235637014B4AF7FB910795D6BE210DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594d99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594d99.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eec9c8e5cd4486f70a27cd3675a85b345497e9ed88335aa09b993e2c064b640e
MD5 71b5de76221a5fa34ab10f7a80b5828d
SHA1 546050ab5aefd612b10b774277b372c8736978e6
SHA512 079fe0e82f35b1e81401bb0c4103a5afc4cea02b3352e914ee1a6573d4a56f8719402fc886993e55dda331e81735c3e61d009c4f06d4d85e477a38f1efb52c56
SSDEEP 384:EDiFZ3yFaeO8hsNI8TUNTUlIl/ZbEnDSd3UCEJr5PcrF2q0IT4:EuFZ3Izhhdwg76OYh5PcrF2q0b
TLSH
T1D4C229F648E3893BD95E9743A77E2D139EBCC167B9815A44B3D95A0CCD861BFC306804
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee68a4f96b45ed2fa61adc4ea69b3826088c29003b6360dc71563250cb51d00f
MD5 a612f1fd4fd06991182470023244ac77
SHA1 97002b3bdc70b057f290813b6a078c8694f8832c
SHA512 6b69ef252e4e9298b151085294e69d30910d1e4fba52ea8b4c5cfef3761bcb4f7313c1f4371c7148caea723874e76504d5a35f55d59bf6b1d7cfb1aad006769d
SSDEEP 384:R3yFaeO8WsNTU/ZbEaDSd3UCEJrwPcrF2q0IT4:R3IzhWtPOYhwPcrF2q0b
TLSH
T14B826D3698B46D7B9996F041E54B3613EFB8816BDAC55F84E2EDAF0D05CB28C030B805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8929665d9044610d3a6018f67e846694ec437ad19a335ddaf281caf2f2365b29
MD5 1a1a40880b161c8a2bd104088d2808b3
SHA1 d666606ac068456ab6484dc71a786fc027d7f28f
SHA512 f7b5992a3227f897db8970d014d7ea4248bd00912e43784489c04e5bdcf99016405451992c5588662995b4cd6d624c39d7485b95d6d950df54830a111839b2ff
SSDEEP 384:63yFaeO8WsNTUmZbEaDSd3UCEJrwPcrF2q0IT4:63IzhWaPOYhwPcrF2q0b
TLSH
T168827E369CB46D7B9966F041E54B3613EFB8816BDAC56F84E2EDAF0C05CB29C030B805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a884a8a853b204d82f826e311a3032440e6b7502897b91b495c61fc684b733e2
MD5 9daae47181735a59690f6acfa3d2338f
SHA1 33fa869558cd274f37e28580c9405b135a99fcf8
SHA512 fffeb7b586bbeb9dcf234cc82c1ed6c944f98ff2871f53a756cea73553cd9cb416e8c16d45e261bca21a442c835b420b2a468ab3e1d6e862af81ef29272b8aa7
SSDEEP 192:MONi64BAQmiUyA1CW5GBPKb++FdG2MaDptWU6:MONi6eAL0WNd39PWU6
TLSH
T17D02FA38AC786C7B9EB2AE45F5863B175FD8113BE6C55B44EAE85B1C009774C234382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 32487240ced235a5b62dab1078947ff04402d9c749c572f96aee22a7804cb876
MD5 0bda14f82e584cea5a238d273be5db55
SHA1 d064cc4926b481c44d94ebb22b0ca22c27032d7d
SHA512 fa30e7a4e70c32986ee7862ddb86c12eb26baafddb5a3931e35f867c370618cccf060ec2510b71d2411fbc6192cd3ea30482f8b4d0ba9bd50f3fefdeb2fac594
SSDEEP 192:vONZ64BsQmiUyuCR5GBPKb++FdG24RFC1SJroAWw4qxU6:vONZ6e86RNd3UCEJrZPU6
TLSH
T189121935AC64AC2B5D92B541F48736139FE4413BEAC56B84F6EC6F1C01EB65C2306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ed883255fcf023583ee7c46ce6b25594e6709aad32699fbf3994dce04ef237ab
MD5 5600601922e2eecd8cb991fca680e10e
SHA1 21f40ad5ea77312d2d183a0a778507fa65d97b59
SHA512 8eb33319d3218114f15b5266f82e517a281e03084fe12a6b40c3dcf9296256c80886932cc9f41cda8b402da7cda6cca45c9ea4544a91538d8a87b89ee2f90940
TLSH
T1B1E00445D305054FC43403301457373157D1C10D017147475550C1543D133001F003C4
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a9106.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a9106.TMP
Size 392B
SHA256 1931dd061a4ac1525c75c2bbe4642cf2bbb111f27ac1d70a76700e44f21efe3e
MD5 3356f2f42c525d5c4f5c9674e5700f33
SHA1 916835c126b29a53947bbdf1c22c8b76cbfa5a88
SHA512 cb449be2d0dac79c9e28fbf393c987b0b6390aff5ad80a88eae3523f0160c98907460f490c76f5742d507598d36aa1f9781b9191ef0f34405be4f595ee5e118d
MD5 SHA1 SHA512

Submit Download

003c1629-eda5-4033-8e7b-8eac9dfd29af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\003c1629-eda5-4033-8e7b-8eac9dfd29af.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b1b94b306b488259d13baae006a7554cf7b21e33f55cb0fcc2b2f4a73bc33251
MD5 44ccf086efec163bd56e51a7ef4d01c1
SHA1 0d461e5f2c634eac82e13412edfae2eaf6e91e68
SHA512 10c8b9d6ba61709082e26eb3f8317c0b4e0df0c0e6a044603403c8fcda6c99d14087a928a048b83078140399c95697cc888e578a4edf77091ce5ccbe132be991
TLSH
T121414D9CA6FD1148B3B76F5AABF7A8AD443A7D373E46D45E10110E4E0A62B41C872733
MD5 SHA1 SHA512 TLSH

Submit Download