hxxps://rblx[.]pk/rGoLRyl3

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://rblx.pk/rGoLRyl3
Sample260825-drd7castdt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5600	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321012636087621"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{817A4162-E93A-4322-B452-93C1F687DE1E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5564	msedge.exe
5564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe
1948	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 1948 wrote to memory of 5324	1948	msedge.exe	86
PID 1948 wrote to memory of 5600	1948	msedge.exe	87
PID 1948 wrote to memory of 5648	1948	msedge.exe	88
PID 1948 wrote to memory of 5648	1948	msedge.exe	88
PID 1948 wrote to memory of 5648	1948	msedge.exe	88
PID 1948 wrote to memory of 5708	1948	msedge.exe	89
PID 1948 wrote to memory of 5708	1948	msedge.exe	89
PID 1948 wrote to memory of 5828	1948	msedge.exe	91
PID 1948 wrote to memory of 5828	1948	msedge.exe	91
PID 1948 wrote to memory of 5828	1948	msedge.exe	91
PID 1948 wrote to memory of 5888	1948	msedge.exe	92
PID 1948 wrote to memory of 5888	1948	msedge.exe	92
PID 1948 wrote to memory of 5888	1948	msedge.exe	92
PID 1948 wrote to memory of 4440	1948	msedge.exe	95
PID 1948 wrote to memory of 2236	1948	msedge.exe	96
PID 1948 wrote to memory of 4440	1948	msedge.exe	95
PID 1948 wrote to memory of 2236	1948	msedge.exe	96
PID 1948 wrote to memory of 1660	1948	msedge.exe	98
PID 1948 wrote to memory of 5012	1948	msedge.exe	101
PID 1948 wrote to memory of 5012	1948	msedge.exe	101
PID 1948 wrote to memory of 5012	1948	msedge.exe	101
PID 1948 wrote to memory of 3244	1948	msedge.exe	102
PID 1948 wrote to memory of 3244	1948	msedge.exe	102
PID 1948 wrote to memory of 3244	1948	msedge.exe	102
PID 1948 wrote to memory of 4736	1948	msedge.exe	103
PID 1948 wrote to memory of 4736	1948	msedge.exe	103
PID 1948 wrote to memory of 4736	1948	msedge.exe	103
PID 1948 wrote to memory of 5492	1948	msedge.exe	108
PID 1948 wrote to memory of 5520	1948	msedge.exe	109
PID 1948 wrote to memory of 4492	1948	msedge.exe	110
PID 1948 wrote to memory of 3920	1948	msedge.exe	111
PID 1948 wrote to memory of 3920	1948	msedge.exe	111
PID 1948 wrote to memory of 3920	1948	msedge.exe	111
PID 1948 wrote to memory of 5136	1948	msedge.exe	113
PID 1948 wrote to memory of 5136	1948	msedge.exe	113
PID 1948 wrote to memory of 5468	1948	msedge.exe	118
PID 1948 wrote to memory of 5468	1948	msedge.exe	118
PID 1948 wrote to memory of 5468	1948	msedge.exe	118
PID 1948 wrote to memory of 688	1948	msedge.exe	123
PID 1948 wrote to memory of 688	1948	msedge.exe	123
PID 1948 wrote to memory of 688	1948	msedge.exe	123
PID 1948 wrote to memory of 2952	1948	msedge.exe	124
PID 1948 wrote to memory of 2952	1948	msedge.exe	124
PID 1948 wrote to memory of 4844	1948	msedge.exe	126
PID 1948 wrote to memory of 4844	1948	msedge.exe	126
PID 1948 wrote to memory of 4844	1948	msedge.exe	126
PID 1948 wrote to memory of 5568	1948	msedge.exe	127
PID 1948 wrote to memory of 5568	1948	msedge.exe	127
PID 1948 wrote to memory of 5568	1948	msedge.exe	127
PID 1948 wrote to memory of 5564	1948	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://rblx.pk/rGoLRyl3
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcff25c188,0x7ffcff25c194,0x7ffcff25c1a0
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,4561934165594979407,15582289771823911404,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,7387457318414048772,1939146804488943031,262144 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,4566833373298208319,10584151629262823334,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,3771052353447683288,16978023666461898494,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,17897458521145111394,5033364999456242318,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,9608195287588472062,15488991488923793867,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,542405109483207015,7768986603764139886,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,18367864979108778023,6011595650213252882,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,18367864979108778023,6011595650213252882,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5864,i,8199285328295666914,8646262389387402476,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3548,i,6481130887230265260,16847132532759894848,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5916,i,13095755231385189405,16142024847931659574,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,6582833834638988354,13551810911226010611,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,15915851285623554502,3931103215922545038,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,4822538026654086328,16545113936993395263,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6424,i,17580443949810610041,11078926192839756456,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,4896344297969281589,117590320521395126,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6888,i,761493086335402335,7229726062752391249,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5864,i,4657352119166668327,7578495806317012247,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6352,i,3311683126422553745,17020004633416226320,524288 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6764,i,1586697540581879862,8837359253409791528,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=772,i,15271701970333261064,5873081014675880855,2097152 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5412,i,5575280575162364401,10754316131012931343,262144 --field-trial-handle=2344,i,3660766017449074497,1556357367096946260,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5564

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 f01c58b9e5cbc3c57b808ef0b3923b825bb656f58fd4e6cd6b0bd89bf5fd2311
MD5 ed6f2ead82d1b7239da26fc3c396f5c3
SHA1 9a8ef61708a6648597edd5a629cc19ebdedc3f58
SHA512 691c55b3be880db1f380e2f47bfcdb78f4894e7daf92e50e480f2f7b90283f4e8c3ac0136770217468a7f04eb892a4bc363da6b9830b5e1de8a4d08a39b73370
TLSH
T1A9E022B6EC22FC2708FD4759A01A8A67E70123573A40894F3B3C81088FB166A96C9D9C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 32KB
SHA256 5b2d32fed6aeef96782e8421c1399fa9c2db4e566d081a4f111cedf409fe622f
MD5 feddbb69f84a9dd854b108ac0868fdd9
SHA1 f30b69bc8990f7c6d7e2fd4edcef3e6888142cee
SHA512 2f08822961c73204174f225967b39e090a6480bc59107c0a71cdfd52c77c72b80a210af14d7d01b07e2e9ac35cd8aeeacbe6dd9a6e8507d8f122f534ca3f2056
SSDEEP 768:SgdqKZZvDdbq9qQCYVy9JSAIjfaW/puvlL0hYyFIDA8+ZN:dAQLdbJYk9bIj1x6ulN
TLSH
T168E2F1200ACF08D28B4BD65E54B4282E5675F4985D5CDEE6CC3CA3238A95EE2B8C1DB0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 260eabd2c8fa523e9f4d9ab5123e802dea09d56b7282955732b6beba9931dc81
MD5 a7e6651226c6b591561db7aa0e038efb
SHA1 564767c2966ded4e87c9eb719872c8a6fd304b76
SHA512 5585325a48e2ef3c90cc64602417ecc3134d4d0c51743e8207956200eb72413674be0042459772d00ac7d7611e37eef17f1c86854db0a1c67a54b227a7d6a1d2
SSDEEP 96:0R+rUwLTet1sutW2rDjZa3A7yqwN42fc1q1+9RgXznLk:0QrUqT0e2DZa3A7p44J81+9RgznI
TLSH
T159C12BB96AE5A2C1EB5080FC7DA1084226772DD8F2CB0E1390483BB8791E7D6C1D609F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe598757.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598757.TMP
Size 3KB
SHA256 1dfc8bf4c6d600fdcc5b1bc1f31eb87601f671be0cf9d09938d7e6fd12b17021
MD5 4691ce8e39df4b5942e8ea55aede1aaf
SHA1 c2687c199dc396b6334a3747e06bb718ac1444aa
SHA512 d7f514257e24caf86395e4b9265d280b84b44ebef9c3445041dbb433da60fa59630f6cedba9307a1de65a8a90883afa0b80fe0ef24442c7a8d4dd05b3a978c26
TLSH
T1D551B3383952CBE2EB50C27DBDD4029074736ED9F5C30E6910603CF92A2CB62C15A2EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 777a673f7603e38ee13739c3f77d9fb83037abd61831338fb1fe9c1c8c7a1bc4
MD5 52a46987140d339655cb49f629eb8d6a
SHA1 36eca649e38bd3791b5da67a1bed66f03559cea5
SHA512 70ffa7ce3c2a22ca70e92a58e32ac5b387ff99f027934f87bd62b95ce1a5f785384ae957159739d63609e730aef33a2631c66193be055eee9e8aa1be8adb4e98
TLSH
T11271DDF3C3A5822DD91195F0AA14BF1BCE2D0452436C3C5A88E4AF0B93F2471E152B8F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 460afe1f4b46815e98c62019b6145bb1c31efe861a514263ae14a433c67b0d66
MD5 f4f7e5e54a45cb356890c80b1b92c4ab
SHA1 5456d03a93d7419752e4fe9983dcf47af2344165
SHA512 179f482bafbd8f66c333a33c705edeee9b487b31dbbc54e15f8612102fc4fd9d55eb71660729e29d846b1e7e95cd7c14a555b0491e02f8e8eccea42d4b2fc1a8
SSDEEP 192:sxZ7RXyMqZjK1Ml8MkY/f8sNEZdCvdFbbpSiodp41cnHzL6+WNBXD8dC/YvpkaJE:sxZ7AMY/f8sNEz4d9potHch3/MyE1c
TLSH
T14482F8066A34697B8CD7D219FA45BB63D6F80163E5914E44A6FCCA0C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 169ac1f74bb68112b2194023e26307b7a2e5a82c654413117496c776b25e3f69
MD5 92a0b779f497636d6c98be1d0257c030
SHA1 ac46a0576a7361acd97caa88f622063ea9b3dbe0
SHA512 8b33b820c3d744b92fcd38e4a1822e6852ac8d7a585193b787051768568f9e23144ac1da3b758346994125da136939af45d08a9865ab2fd3574a71cfd58650fd
SSDEEP 192:sxZ7RXyMqZjK1Ml8UQHkY/f8sNEZdCvdFbbpSiodp41cnHzv6+WNBXD8dC/YvpkL:sxZ7AqEY/f8sNEz4d9potHIh3/MyE1c
TLSH
T13382F8066A34697B8CD7D21AFA45BB63D2F80167E5914E44A5FCCE0C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 be1cb16e0e12c444e41793c30c6dc000db63fe6ecc709a62cac70e6af2dfa9f6
MD5 78ca1d9af5bfc20ee25c4be438f1c0f1
SHA1 932e6c6ebefbe1d49bddb403a1e5f5c2137beaa1
SHA512 1f6b445c71939f09fdb4867c75f0e41db56c4e010ea2166f888eed79bf2f54e53222fa3aadd275b3e23c6a16fc2458d0683a8e0e5f56c37efd8c0c2f5c373585
SSDEEP 192:sxZMRXyMqZjK1Ml8MkY/f8ssH/aZd3zodpLHW6+WNGYv0uaJy+5Igj4J:sxZMwMY/f8ssH/azcLHbGLyEjc
TLSH
T1FD6209066A34997BCCD7D21AF6857F53D6F91163A2904E44A9FCCA0C04E7BEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 92ada351b6839f7d34e5f020b0bd1f8b2bef27e45bce25d2a380e429981d1575
MD5 c49124070673d84b59d1e0682b2273c4
SHA1 5dbdf5274fa2e17bc2a9e3218e552bb813e97ef8
SHA512 b0edd55863acaaf8c06cbc88a22ab0b5186511133670f9a992171244b80cf23014a95ff28a9181807166f987f55d9997f8835594a3c5b2a41c88e2b28a071d88
SSDEEP 192:sxZ7RXyMqZjK1Ml8MWOY/f8sNEZdC5qbbpelodp4EnHW6+WNBXD8dC/YvqaJy+5K:sxZ7AuOY/f8sNEzWcpe6zHbh3/yyE1c
TLSH
T1507209066A34697B8CD7C219FA45BB63D6F80163E5914E44A9FCCA0C04E7BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9b3f28e-c071-4442-8137-b55265901e21\index-dir\the-real-index
Size 96B
SHA256 65e9f17d1738d640ca71a111a205965cdbd12b48063c8d3934d1aff21bb90689
MD5 9d83c272beeffed23a35c6fc6ae16e46
SHA1 af5d25435185fa76809cdf6e89f76af1274dc392
SHA512 78b7c8879d79bf82f776fa220e74d7b6c4b186a81ae75ce58a4279383e7c58668c1509b9942fb84515c56f5c7150296f1e3cc8c9f13b252ff83e6c22964892f7
TLSH
T148B011283E82A8AAE02202B200C2083822A0CCA003822323E382203ECCA23C00A00080
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59579c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9b3f28e-c071-4442-8137-b55265901e21\index-dir\the-real-index~RFe59579c.TMP
Size 48B
SHA256 3f6ff937034491182f66f1ed51b9ea4bb7a3be4a1af7e81e0e17b25b6250c73a
MD5 b4701ec7b3a6f6c8e027b2fc34a54a10
SHA1 699ebb50124bd3104054dea18ecfdf7b0712778d
SHA512 0cba8b463edfe7aa6df7b8915c01004c8e73b313a1ef2dc8f4e800bc6c20c932fb1b50c40ef6a904ef4fdfdb001023d2c0bc6b7ee156f52130986607666a6367
MD5 SHA1 SHA512

Submit Download

4f2277ea2139c475_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\4f2277ea2139c475_0
Size 81KB
SHA256 3603abb223a2f48b5aaccc46c9e6fe694f335977e2bbaca3dd2bb312cc9cb3ff
MD5 f092f70d32b72f636eae0c6e2e2f719b
SHA1 8edc3c12175182fd192b3f4ca2c542763b84c890
SHA512 9feef157b2233764fec08d897d867853761794f7e8f593e3be182ff56228d4f0f4ec01bb524df5439f81140067257ee6d8aa81439c9f5592d3d4ba278139a6b3
SSDEEP 1536:cYB+b6++HqsJ00izhh2VMGz4XLHAyOAqUO4P2CsXEoTrv4a+gNBrqHPwqYzG1/E:cgN+nKrVMGzALgyOpY2d/Ty/E
TLSH
T1EF834CA7B262B03587AD11D59456BB00F22B07561444C8FCF07C66D63B28E8B67B7FB8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index
Size 72B
SHA256 d00d54e7fd42534642dd226b48a5a77206198ac098ada9efe14f3e5071235f9c
MD5 21dad3ebc75291a0c1839b60e0fd021c
SHA1 d174a3ea7f972b041c5d858686d3c956ae1c88e6
SHA512 448142edb236b5b670bbfbca338754f7af31c1efedfc50f7d2796fe87b11f7756e503fa54e8bd47ddd999224c8a3cdf42959aa203d07bc7c45a61f2659bd5eb5
TLSH
T187A0027201582459D044CBF4657501706357FD17424E430740D1EA59CC6219DCB61061
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bc34455a-c0c0-4ad5-9d7c-df0e9e63825f\index-dir\the-real-index~RFe595421.TMP
Size 72B
SHA256 9a4a2491180ca3cd48a1602af24ffdfe5c22b38fadea419f410b36f0a948bca7
MD5 9fb5a12866fd3b030192d2f5d6c3a766
SHA1 cca87dcea31c2f51a3f66d06f8d13800775ba624
SHA512 779f9c9cc59f46975003ea714d246ce84d61ebe982e92b2781ca8902912ed89c43f49e1f68b47de819b8bb1b086035b9125ad8969512b6a6db7d0ab9d8e805f5
TLSH
T1AFA00224425A0056D00847B9559D02643306DE152503471B44A0245D8CA55984D01140
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bdd346a5-f617-4e24-9cb5-fa3a03929e83\index-dir\the-real-index
Size 72B
SHA256 ae6e68ba7dd78b7639ec0b53f3217e668bcdd91b1e69d8ca064436445af24566
MD5 ac92bb7f2a5832a0e8cdab08b6300e31
SHA1 51248176e233d4134b3cb0c30df923ce6cef62c0
SHA512 16b04a3d3e72686e6ca96e43bf04abacd21cde4e1913b4905927216928cef2b84dc05b0f5b38fd09675301bfba4328497a0ec4c884aeb3610ab15c550bf9d382
TLSH
T1FBA00212235B4195EC044277218F115132969A181616124746A5B2B989B058C4111541
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59579c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\bdd346a5-f617-4e24-9cb5-fa3a03929e83\index-dir\the-real-index~RFe59579c.TMP
Size 48B
SHA256 fc76c2cb41cd335e4881ff19a64439ce595a6534ef796e022ac64970ae616647
MD5 5dbfb3c86bb5f419581b0c10b8277fb7
SHA1 2bab9c07292edf17eb5a5b059f40381652f2c65b
SHA512 9233f232203ba2d58b232dc8921c7ee421f5bb55c7bdfeeddbf34a31a60471e33c111daad587b13510db7ddc337693591ad028e6635c2286c833fc02c38805fb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cdf12dee-6673-4e91-954c-23b338c514e6\index-dir\the-real-index
Size 3KB
SHA256 369d8bb88c6b21bbf338627f60ede3f143a2efda53194286731f0f3843ba0c1e
MD5 103111e28048986155f15c7a00e2f9f7
SHA1 293113d9178ce2336ca4a8032b33728d36a5feef
SHA512 8d322f73c809f89b76b196ec55beb19c91628fb6ea7f81a4cf71dfa7597cb5ff80145781be56f3be75e6e86fd8ebccee406bc30d32a6178bab02fae1606f6fc8
TLSH
T16651A70F8D461F16CAA906B318BA00507B7EE8DD57408A9735DCB171B8C73752C1D67A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e6392b72-b563-46a0-851d-26cde0dbbb59\index-dir\the-real-index
Size 72B
SHA256 3b519c3a8ddd4658bbe28e79b054577f56205f022c5256a5839c0078fbbdb792
MD5 7d3b9d9add64804a0b696accf8782634
SHA1 07f64f980bde29ddecefc8e3c9e85596ef639a7d
SHA512 33bcd8600b1bcb2633b2005bdc1c79063a1ad1768e12c3b7ba97ab3a742fbd4c3e375840ae154e84337a2d769c8b8aded43c375d7ba0938f5fe56eee2cb6ac4c
TLSH
T10EA0026003942291D11322B13B9603816312D9A47305130F42D20694CE61DD09A4114C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 624B
SHA256 99797f1c1b6b324b12ee7924dc02f9f913d25258d3fe1ea54b998856a7799735
MD5 b729ed7ea6b637c46777f914c87d700a
SHA1 789a067254183f75fe944a11a44879d03bf54fc2
SHA512 c41d5129d3d561823bd15a2ad7998f6c53683970c21008cdbaddb41fbc3329169fd643129724de45beddd5f2ec79934bf78a67827c1380f8a1d85b7c7bb813ce
TLSH
T1A6F028B37FFB2840BDBFE3DA103004A1001A7C14C8849D6F6917B68B65B2729205EDB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 619B
SHA256 f054f1353e2afaf526568fc40aa797a21d6ef8eda64732bc5d228329a2244895
MD5 426e67c50e33c20abee666e06ce6cb3d
SHA1 60820cdcea4dc3e07178cc032c8fb2f6a41f1477
SHA512 1eadd663b3519d758f4382688848f1121c24ec82faeec74474735eb671b06a39e31bbc3c68713a4032e45e8a967b79df24c0f028adb29d3a2ab3c8f79edb7d27
TLSH
T176F028B37FFB2810FDBFD3EA10300465041A7814C8949D2F6417A28755B2725201ADB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 6209e5910de388f73c9ca92335fdabe46659aff66fab9f4b0c32133aeb97ab5e
MD5 83775e39b90c14422626ff34e7971435
SHA1 cf336f45463a78c9f117b32ca34ff034707e3a6c
SHA512 9cbd1f3e87ffe54e6aef975a41fa5dde2c6d9c651a2a13c3a8928ca52f28df6ef61de687cdea0cfa000606f7d809359e91b3ff94fc9b0eb4cc147c3fa06ba3ef
TLSH
T198F027B37FFB2C10FDABE3C6203114A1044A7C549880AD1F6826B28B66B1329215ECE6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 cfe3c227944d3af2c8092d47abf585ff123b8edd8354b19718652e10cf220e27
MD5 af4e49c399cff6f75cf145c82d6aad12
SHA1 b1d77dd9e00860cfbeeef70d08beae68b688a6e6
SHA512 759c2bd44f15d56931d1b02f16273f75a4bf330f00e5f51f2f53acfe99563f0bfedb3eab8e4c5b921165a33ccd9ab69dfae773a13bcf33f4756c4ef292a4ad28
TLSH
T1C0A002648E899106F640467510E591D83F5149FE02052342949CD5B88CE168451C1241
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 90bb53ef25a9bd48bf645c2f8330ffdd14e31d5f1be19eb931397bea361ef262
MD5 bcd0b318e2cf3ca126cd9b6aa9e444b4
SHA1 43a337c143e4815b8da855f9b3c4324bd6b4d5da
SHA512 c08326cc49fb1b916a8d4690b9fca42d3e63fee82ab48f823e64f9d2813d79d4e8c9e32e4d2de64f469c25ac012eafd8e77746d1eb8750303f3b617de4eb7094
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGz:05ppxnY753RNBvRJJdt7p5J9D7nr
TLSH
T18DB27B5A713A0212397E2948B39696374F4235A33058E4BF7FB814A14F67E225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 1f54699c354ae13b6ae225de3c1022febd6ed80918cb9bd51d3fe93f33153a96
MD5 f21cdd3422ac237247d85664fd757589
SHA1 0a463606a5695610285d6087d9f0df569be8d25a
SHA512 42063808bc676f36f4cb434c03d4f20e5e4e25af4380ac54ec15abb6e61367754a7c8eecc5ab02c72ba1b32a0ecbf93e0445114fee3656a585b5b2739d3c523b
SSDEEP 384:npviF9CcmyWCs3sNj8TUNTUlIm2QckCr9lqKphifGGY6sK3pwe4KV8p0lHrty/7a:p6Fccps3CwgbkUYkFGYa6I8p0V7
TLSH
T199B25B36EC58DABBEDE74F89B74E7A07DEE0112785989AE4CAD81D1D00971DC070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 56b943d49dd0717b5884fb8e96cb2c08a414fc74518c0411f80c5402b5b05f5c
MD5 b5d4b72f9d3cc9d98ab1967533fd0af6
SHA1 8248f3c67699a6bf7e5b7a2161016f30f8ae67ce
SHA512 d841a81e2e480e78aca2adaf00ff7c5b6cca72680728ce0547b4efc042806068702e238fa50ee5fe4fdec76174a4a0176f9af7af1259ba794b276fe9516902d4
SSDEEP 384:nphiFiZcIm3sNb8TUNTUlI4BQckCrtC9phifGGY6sx8rB/VivJuXty/7IgPon:pIFQm3KwgkkfzFGYBCB/ViRukw
TLSH
T1FEC25B32EC64D9B7FDEA8B85E74A7A03DEF44053898C9AD4D5D85E2C009B1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1867d17f1534fccbd3e75372f6deddc8374f02510542b71c9366d55d8c328ca
MD5 13275666ea7facda38d55549bc797e58
SHA1 5da83990eec01cbd5ed6af5ef90ac774bb034f61
SHA512 40d1231933c83e1e23ba14673476c0656709dbffedf04972751c23fd6137505e7b809cf2e84e80c6105a4d75f9df4e2003dd0af42d00761b17c1f1f476d09583
SSDEEP 384:nuiFiZcIm3sNb8TUNTUlI4BTZckCrwrvUm2phifGGY6sx8rB/VivJuXty/7IgPon:FFQm3Kwg1kamoFGYBCB/ViRukw
TLSH
T154C24B32EC64D9B7FDEA8B85E74A7A03DEF44053898C9AD4D5D85E2D009B1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 5bca394aefa41868e99ea07b7108246f6399c5195cd0212603e8442e309962be
MD5 3b8016fae81aab3a0b303a6019ff2fd2
SHA1 2a7ff52dccaad1f86464a35d365b360aa0680a71
SHA512 8606f2b2744c8b39a5897648954cfe307d483bcda0fa3f8570f62768c4fbc97cc1c0eea411caf8e7bd6650e2fc0c99761276292f0832e20f3bb8812bd80acd74
SSDEEP 384:npLiF9CcmyWCs3sNP8TUNTUlIm2QckCr9Y8uphifGGY6sx8rO/Ve4KV8p0lHrty2:pmFccps3awgbkUnQFGYBCO/VI8p0V7
TLSH
T18FC25A32E854DABBFDD64B99A74E3A03DEE05227868C9AE4D5D81D1D009B1DD430BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5177db78f147102f6ef07cdfcec5141bf2e3801f35df6f27c558ae964514b0bc
MD5 f9450d9aca01793d3faadc9472d6eca7
SHA1 10025e315130d12cecc51783d1970ef725d241a9
SHA512 7111080ae484e75107ffa4b0c716c4d54fa0695a682081305a8564417d7e6c7f181fc443bbc3267f0ff7d4fa800dbea7894a0902f7830a81027220e8f60031e0
SSDEEP 384:nIiFiZcIn3sNb8TUNTUlI4BTZckCrwrvem2phifGGY6sx8rS/VivJuXty/7IgPon:TFQn3Kwg1k4moFGYBCS/ViRukw
TLSH
T140C25B32EC64D9B7EDEA8B85E74A7A03DEF44153898C9AD4D5D85E2D00DB1DD030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c34df47d1296a99d276df4917cda76fcb93f5bf974c57b4f6d2eee79b7c34dc8
MD5 d9f80e6383e59f6da618dc99e70f9d88
SHA1 c561867e93e0f9be4d8583603e70cc621a60bbcb
SHA512 7d32966120674c9b160e90ad087e254b59f069e21c777454752503094f4677d4a4788d1464117fdb909e4ae6b28557f5d92ed7b89d4a7c1afe55ba7de950c720
TLSH
T1EE410759B6F91148B3776F5A9BF769AD887FB9732E0AE45D00110E4F0A23A40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download