hxxps://odd-squircle-862816[.]framer[.]app/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 09:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://odd-squircle-862816.framer.app/
Sample260825-lfb7lsge89

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321236958148634"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{FFDE97F0-537C-483D-B07D-72678A96F55A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5776	msedge.exe
5776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe
4268	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 1088	4268	msedge.exe	85
PID 4268 wrote to memory of 3716	4268	msedge.exe	87
PID 4268 wrote to memory of 4108	4268	msedge.exe	88
PID 4268 wrote to memory of 4108	4268	msedge.exe	88
PID 4268 wrote to memory of 4108	4268	msedge.exe	88
PID 4268 wrote to memory of 3812	4268	msedge.exe	89
PID 4268 wrote to memory of 3812	4268	msedge.exe	89
PID 4268 wrote to memory of 1956	4268	msedge.exe	90
PID 4268 wrote to memory of 1956	4268	msedge.exe	90
PID 4268 wrote to memory of 1956	4268	msedge.exe	90
PID 4268 wrote to memory of 4732	4268	msedge.exe	91
PID 4268 wrote to memory of 4732	4268	msedge.exe	91
PID 4268 wrote to memory of 4732	4268	msedge.exe	91
PID 4268 wrote to memory of 3764	4268	msedge.exe	92
PID 4268 wrote to memory of 3808	4268	msedge.exe	93
PID 4268 wrote to memory of 3764	4268	msedge.exe	92
PID 4268 wrote to memory of 3764	4268	msedge.exe	92
PID 4268 wrote to memory of 3808	4268	msedge.exe	93
PID 4268 wrote to memory of 3808	4268	msedge.exe	93
PID 4268 wrote to memory of 3480	4268	msedge.exe	97
PID 4268 wrote to memory of 3480	4268	msedge.exe	97
PID 4268 wrote to memory of 3480	4268	msedge.exe	97
PID 4268 wrote to memory of 816	4268	msedge.exe	99
PID 4268 wrote to memory of 4164	4268	msedge.exe	98
PID 4268 wrote to memory of 816	4268	msedge.exe	99
PID 4268 wrote to memory of 4164	4268	msedge.exe	98
PID 4268 wrote to memory of 1352	4268	msedge.exe	101
PID 4268 wrote to memory of 3300	4268	msedge.exe	102
PID 4268 wrote to memory of 3300	4268	msedge.exe	102
PID 4268 wrote to memory of 3300	4268	msedge.exe	102
PID 4268 wrote to memory of 5932	4268	msedge.exe	119
PID 4268 wrote to memory of 5940	4268	msedge.exe	120
PID 4268 wrote to memory of 5948	4268	msedge.exe	121
PID 4268 wrote to memory of 1812	4268	msedge.exe	124
PID 4268 wrote to memory of 1812	4268	msedge.exe	124
PID 4268 wrote to memory of 1812	4268	msedge.exe	124
PID 4268 wrote to memory of 5248	4268	msedge.exe	125
PID 4268 wrote to memory of 5248	4268	msedge.exe	125
PID 4268 wrote to memory of 6016	4268	msedge.exe	126
PID 4268 wrote to memory of 6016	4268	msedge.exe	126
PID 4268 wrote to memory of 5792	4268	msedge.exe	127
PID 4268 wrote to memory of 5792	4268	msedge.exe	127
PID 4268 wrote to memory of 5792	4268	msedge.exe	127
PID 4268 wrote to memory of 3912	4268	msedge.exe	128
PID 4268 wrote to memory of 3912	4268	msedge.exe	128
PID 4268 wrote to memory of 3912	4268	msedge.exe	128
PID 4268 wrote to memory of 5776	4268	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://odd-squircle-862816.framer.app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,17485927427921738051,12790726183846984260,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,3316305667358623513,16281810009853616955,262144 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,13307015299729936817,4540668698827606976,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1288362943838732732,4619743523949497136,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12197208128383883156,6261708629909936376,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,5758806897979522939,15016422604862991546,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,17923553280430307408,3231340946593142931,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,8816899805526733210,15101160645250039733,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,6282608667992837021,5838756719818547636,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,15263109443309283602,708541258894108915,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2923589468263625958,13773258893362945678,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,2923589468263625958,13773258893362945678,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6364,i,841313952738359321,10623393858109064296,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,7500135992592363909,4967792060831075256,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,16878281745268317257,3808035062490602542,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,15469223112727162465,18419443395542022200,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5416,i,11687333361583406489,3359064310791525903,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,4042512391039477169,9440146715742106782,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,2355995230144302978,7725206286458837128,524288 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6976 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7052,i,17955742697395145157,12999662075928419044,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7096,i,6152959861392616169,5236782219015869536,2097152 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2112,i,12401674662463423819,17595997613774270131,262144 --field-trial-handle=2300,i,13042551934578739207,5846379367440634651,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ae53e618032c667892ed21a0d220c217b0a8d7911b3dee86b08e6a49f9b5961f
MD5 f9f19468189111f8249d81621e4a102d
SHA1 fa68cce6f26f82bf96fb875ff427a4ef9e9673b2
SHA512 d53cb2328cd19d1ba8512d1ff3633af39c02eed400e5983853154f5b66c3341ed3d1103439b7c80316b2363de07a7530588d76f9e262920e057331d68d3f3bb7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T18DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 11KB
SHA256 752fb3fcf87a494e21d724744cdfad3f4468ac06ef513bab4605c2e666f6e4db
MD5 16acf93b887a1b44af6a53a5e9be89e3
SHA1 e1e0e28dd8297351658d86f7eabbcdf270f34bf4
SHA512 aaa9e45ba4f198f6b84baf24e0e4d7d03886d2b0623df238e59d512a94590d34266c31539a165bd4deec7f01e42e35aa3ac2593130cafa87dbd664b7fe73adcc
SSDEEP 192:AoFc+8pz39Lj5dGavyfYBFDjvXkIl0PiWpsjNUXecI50xTLthBUZQpLXubhvwSDe:AX+8pZLj5dG3fYBFDT0IlkiWpsjN5j5G
TLSH
T15C42952A88FD41A5EF164C70C0C91C9632389C76581BEF43154CA4FE65AFFE1F2A5C28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 401497101ac3aa0199a7164da1b986c5aab6cd7dea24d1ee40cd638492f8b6fa
MD5 38194a625020e5519b4705bdfd2de805
SHA1 48114db9640148d51bb7eda979dcdee6c5bf659c
SHA512 ea258b1a6899e234ca9b4e7e557dba9d64bd83481946bbe3079ed686b16fe5a8f24901a96461805bb0810a4fc48f08ee608b5b6cc806fe66c39f6bb089a9df00
SSDEEP 96:nZBkmnN8alpo2/ALbgDnq8p9yVvCneM8MqBY5sYQX268N//0hd:nZpuanObgrpAVie9TBorG268lMj
TLSH
T157E1711A898E06A6EF544C71C0C91D86323C8D76061BFE83114C98FDA4DEFE6F2B6C64
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bb8b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb8b.TMP
Size 3KB
SHA256 9551992756d2356e6422478c6989db73b617b36bbe1c39916ae03c3edc635ea7
MD5 c1eb8b87b0edbd031d44213af91658e8
SHA1 7c15866bc150db98923207a70ea0fb773e577ede
SHA512 eaf0611cdc3cef09ed13ba0a8490c069280b42c9237f8409dc1bba761fe80ee8b4d3fb3e216e1643883be8abda75a9440e990041d5a0aae1bf6d0e0dbf67d608
TLSH
T13E71816F8D4201D3EF611131D5DA1A03373E8DA94903BED2125498BDB81EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 52fc8b3c7f977886108fec5db13d1b5287b855692154154a4ef7aff9076c3b7d
MD5 35a96bd540610358b4a59062466a06d9
SHA1 0829ad542acc24f146569452b94995068af85489
SHA512 a56c4943e35a2abc6946baf583b97506c8541bce1c706ba5e6f24639eeb8cb92913091d6b635ec9cdd6f0856cbbbf77def6ac63aa6aec89c9d13a3bbf0819d33
SSDEEP 192:D8jQjejRjWjoPjBjPjCjXjhjrj1jPjljiOjTkjhi75TzcZ1gG6ey:D8EKlaUP9b2zlPJbZmOHkti75TzcZ1g/
TLSH
T199D1C0F2C3F6852C9A1245F0AB247F2BCE1D058543B83E5745E49F5E97F2872E290A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 8d305cc185634a1d19669d397d65dac2ab8d5a8ec3952e0685d5e42b6bc388d2
MD5 e9a0fe7e0a17a46b5dc89e34137fb3d9
SHA1 bdbae10c839830365489f15616d0f95ce34f03f1
SHA512 8ff40463be55394aac352211c5dec5a21ab6d1fc83a22806a199a0c1b7bda637efa8e48ce88a1e118ab322f7ea4242270cef5d1ce8bc4b763678ced651809aa3
SSDEEP 192:D8jQjejRjWjwpvxEwUQPjBjPjCjXjhjrj1jPjljiOjTjhikc57v/+ciGKtcigJis:D8EKla0pvxEwUQP9b2zlPJbZmOHtikcF
TLSH
T1C312CEF2C3F6862C891255F0DA147F2BCE1C0946436C3E4A85E4AF5F97F2472E291A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bcac8e06c518d369da182fe111069700cce434aa3c0604b28b09785c2096ebb4
MD5 719d80e451e0d5eca7c970d54bb056e0
SHA1 23b5ef7eae8555a98fa0dc3b92b8346f62dcfa8f
SHA512 c00c8d3ce2f7f2285ea753ec92ab6703423a5b616f8dd64357c9a61da446fbea7bdf9cdf0fceb2e61364aad3b84ec4111fd01a80fffb4578f09c06c45d71fd74
TLSH
T109D02223220072F6BABE7EE580AAEC8FC36600A51C03FDD421D0AC9E153A46E4627246
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59c22d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59c22d.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 485d844524eb4c8c02b9b45dc2bf71e76c092b5577d0cca7cf462ca485cbc60d
MD5 dee34ffd38f774a52ee492c97cb0f7b1
SHA1 8b6991ad24d7f1e839add06025fd09d58f82d7eb
SHA512 da2eabdb7e98602ab8d5fbb93e3122ef12aab40860bfa2ae72785b0d473bac6fc09ab8c5fa495a69de559a9b7685f3349a6602a50af6a5f8b9bd6ef4e4afc1a8
SSDEEP 384:sxZvWsmzJ/fIsf4mRF7yfHbWryb/mlxv3S:s3fmzJ/fsm/oHbWEk3S
TLSH
T17082E80666209977CCDBD619FD25BF53D6F80463D9944E4CAAFCC90C04EAAED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ed0a4a82b81ca7557ede4162ffe3a6ce515d90bed7f09a47057c91ee52e83d2a
MD5 c0a32524d790017b2dd766142562985e
SHA1 58f79f191f8911480e37475a939a9605532a77a4
SHA512 85e61e69d4bee5e676b5862f86c9c9b0e5782078e3b24f947465e48b59068ebe95ec58c6fd46583962efdc38ea5d14d703c9a4b5d3c89b5f272f5f370b9753d8
SSDEEP 192:sxZ3RwyM/jK1Ml8MkJ/fIs34LeIdpTwHW6+WNors/Yw/rkFIgrJ:sxZ3WMJ/fIs34LPkHbF/U9
TLSH
T1E05208156B34A977CCDBD209FA45BF53D6F50572A2900E44AAFCCA1C04E6AED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d81053aedf8aa2bf30a133df85645d97f5fca57fe34d9f8c949908ff23962d4f
MD5 5ef3d57bda4c8e1c6d2b0db575bca8bd
SHA1 1428bdd0c3ac2d1baf3ecab39687d50eab950f15
SHA512 b23e4f20d8891b21aa529fc5497114956d020dd9d7ec643577c69ff9182233f2feae70802343eed1e57a275d35b7cc7e37967a8a992411113f2200f8a7b76d34
SSDEEP 192:sxZ5FRwyM/jK1Ml8MWOJ/fIsf4myFdbd3kdp47wHW6+WNBsClrs/YwE4iFIg5zyJ:sxZvWuOJ/fIsf4myF70XHbny/ilO
TLSH
T13662E7066A2459778CEBD218FA05BF53E6F8047295944E48AAFCDE0C04F6BDD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 e644ea11a66f2205d96c96795c734420e5e3375445d904d173d9fe2c4a9155a7
MD5 83a335fb6369b937d6e1143fbf3e80f9
SHA1 2b81ab793c15f12f969a76bddc94ca6aa05d9c94
SHA512 7f1d52e67ccb9339b59ea9b0352509687c2320b8bd2e9e8dc115d9bfd1357dba0b7c06a9ddb3a51b640f7963f9085aec5fec9fc2f28c0306570cb6fe143c1517
SSDEEP 384:sxZvWqomzJ/fIsf4mRF7yfHbWryMdIlxv3S:s35omzJ/fsm/oHbWbu3S
TLSH
T10282E81666209977CCDBD619FD21BF53D6F80463D9944E4CAAFCC90C04EA6ED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 430b5d77bb5ca0eab31bafa655bdf5515a8ee847458430fb79754181e53b9de8
MD5 0a6dcb37d377608a1d322d5e53329c38
SHA1 0f87ea0e088ced341f42127bc49f15ca6d4a3002
SHA512 3c3fe681b50a04a9ab947b2aa42c1f180880e601da37ee99b6d2ab9ffb4dcdb0e149a755af6e7552fab22931096f82dd588b583f48ddde126f5c35c2a8e80d7f
SSDEEP 768:Ry4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d2rohmcWraB:Ry4jeXmWvmKLEu1jacPLZQdNHWG
TLSH
T1BAD20A3B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 3KB
SHA256 18338f3fab5a0380146ffda5916d20ad35a22dacc6f46b21a7e73223c9a3ccd4
MD5 4923fd9cd97ab08d2cab0a77b4183d32
SHA1 fcc967952d0d4e65d7ea35a612ee3f18dacbb317
SHA512 6e81271c9444a333c32f331dcaafa6d4e817ec26a5a0e08588f1c245f39c7b8c96750c08aed2d0a3ba0fbd549cfc67087a22f9d5c053eac6309db36c7abba9b2
TLSH
T1ED51D84F8E4A2D5EC9AD06B229FA015133791CEE4754CA873A9CB171B8D337A1D0C616
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 5928d2c6c2aa0571367eb4424597d1c18db994c8493eba4bbd9ca3299048b6ec
MD5 fed2b20baea831718922827e91a33980
SHA1 5b51c4f8fdb4330146d7c7c34e186f88a9207287
SHA512 99272e2cd3d47ea3f65925d5e34dc20671f91f0e868efb5d310988fa01cca102cdb58628224ce6d7ea5a987f373c221c0083a83b88beca86d3f1092b1825c344
TLSH
T14F31634A8D95DD5FE89849B605B7B8BC33708DCC4721E263486C22727F1635A1A4B0DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593c05.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe593c05.TMP
Size 1KB
SHA256 376b5048fe11656d7eb29b9b04d966d513768d7a16f13e45c62a1fd1f02e5f34
MD5 63fdd074c7090ef13d420106fd9db11f
SHA1 8b312607e8c3e0d5e882d999dcc116307b2526f2
SHA512 6ee1ea953863c7b9c45adc71976fa56780e184925d15a2b7d6e0277b5566505a3caa60fa3c770bf372c32ce1dc28f070bbabd393edc1a8d171db4cc3098b4492
TLSH
T18F31604B4A808E1AE484507B0AA2B8B8733289408311B393987C6239AE21B9E1A4F0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 e6bbd2defae730892bc0554f30ffafca895b1129aea0ab31b3125b4f4cf0320b
MD5 aaecdf736bb358db591badc31d519b7f
SHA1 2cee32c9bfef0e05cc2a46b6ce4342bc47338940
SHA512 e810d78d5be02dd34ee8ec1cf7cfea6fde93e7eff4ec722b3ee1a11fddf4423544fe87598f21072a151a772604b4fc47cfe5acd5897a62c51bb229cdcfe6b480
TLSH
T144A0021412C040B2D02312B3299A01862710DD64D202230B41E80A55CC90B55DD4231E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\834819d4-20b9-424f-9271-71c3bb438301\index-dir\the-real-index
Size 72B
SHA256 820448118df5c13d48a9c32896aeca08e4a009879f649b1188984d1742e3d232
MD5 5dbc4444acf13da39badef6cba21cedf
SHA1 afdf38e46d13f2a64455d573469a8c6a27242b3e
SHA512 59ddefed7e41cff5a13e16337014c5d904231391c6d5680be86193c7ea73db5c9cda6a71aefeee0c79733ce3b37ea25ca41f0203497029350dfb835960e3ee60
TLSH
T1F8A002118B944407C45392B1259313415301DD902541130740918058DC918418D8244C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f71a1d00165c3dc04c7c465c4c7abe2dbff0a46c9d04ff5f30c08d38da8abe3d
MD5 02f359a1b6dc743fb86c0a933803c13f
SHA1 6e5a6388aa7f3e880d8a52175bf22b884f383762
SHA512 3ab6fe4144551ae6ab521100f1527d93e23262165dc8950e3773c2060e8d38764994bda52416c74f933e58bad71b2bfdfa69826f28f9043ab03f4e91c0881114
TLSH
T10FE0D8F62DE72D20ACBF47E628B245A84146F5688555AC8E2416E2E751A12682026C61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4d570194ecd334485d44e68115db2d8ef3a6070ce521b231e46713f72d37f3e4
MD5 85c22ec53e883f040eba298cb758d50c
SHA1 d9b98b35e50d4dd2fdb0e10e970db2272867e1ac
SHA512 ef6eb728826268a1565676f196083124d6d6c7eaecd9645972003372899bf013ec8ff155700e0de0db6f830f52770ada33c5e0273499f11221fff91228b7f224
TLSH
T13DA0029B89559095E050437094B101CD233489DC0645229142AD417ACC5024051F7019
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5991f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5991f5.TMP
Size 48B
SHA256 6df63f4a6d24ff80d61c1d08654d627723c596a6d74be2fd08b6698365eeb530
MD5 39e6be005340f2c71b67574ceec84654
SHA1 f8535865ecfe9919dbdfffc4e6b67d0a008e0203
SHA512 9573f6c1bee53806bde294b02452c8f29ccc9907465c20a7845fa35b14f4f3f0ff304752049bba4e0accef01ae125afd0bc02638297975b1c092ced80fdbb400
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 78eea9dac00240e6c90a1b5e2401357103f6cadac9615d1b372d27c137f5357d
MD5 15702a127a490e4d5a7d7a606218380e
SHA1 3259345c5af63938e3fa3dc4d364ca241605b296
SHA512 9df24034c1d6138fc57ba50ee56e009d854b39e39ad91a80bb0c0d702c7f357a822c7a7a54d10e04cc35525dbe12ab0f3ff0446a8e8f70aa018900bea1cff4f9
SSDEEP 24:KdZRfZcZHZuaZLdZzZfZn4Z3Zb+Z+IjZ7ZnKiZwhaZFZn1EZRZ3SmZJMZ88ZPZsd:KMUIjKJSUjyxEIHK1+cduIfKfaYXylz
TLSH
T12491742139BA22017D7E290C85E4C7576A53B6A3341CB52B3BAD40B64E6BE109CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0bb1ce7a-cdeb-4856-990a-d459e8a5f739.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0bb1ce7a-cdeb-4856-990a-d459e8a5f739.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9a121d82f9627a1e88826420ea4c61e129bc383eacb87d31efab03e5194c008e
MD5 ee5fa31ad87eb4bccf8a6540eefc321b
SHA1 96cea690346eab389ec1553d67d55dc74ee70266
SHA512 8f40cda6939fd40ee06cbded9f0616df1d2ee59957aed8e145bfeed42102b0e19b80f9fd8b3fa1c1358b9fe2ca673a22388b08a794949940b15e01449b248902
SSDEEP 384:MZcIhsN6y/5Stomaf+68R+XGxJrEnFJiv3uIoc:ahY/SCZEhqJi/uIf
TLSH
T1F4826D315C786C775DE2E285F54636138FF84027AACE6F9495FCAB2C00DAAAD131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 22a150e57f78d73c6b8f939028da4e71532a34c3b573a0af2f6853c3fc5583cb
MD5 4908b0067dfccf1d197eceb0fe20c293
SHA1 46179910c14139f254ebd78e2b2545d26e33148d
SHA512 56a41498649e31cbd140b96ac291f55a33ff82776c9dfa6684fe72bd2ef2c0e384ae040f82c62d086b8d60670df10b236779636571ea23a7ed25ecdd60f3554d
SSDEEP 384:zZcIhsN6wStomaf+68R+XGxJrEnFJiv3uIoc:rhfCZEhqJi/uIf
TLSH
T169828D315C786C775DE2E285F54635138FF85027AACE6F8495FCAB2C00DAAAD131BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b70d89d648db227224333df888047681c1042b7da641a0e7cdcb4e23998dfe1
MD5 acccd123ef99d854f9c605152693caf1
SHA1 a4ada089b1490e9c8bc531968fd783f46719da48
SHA512 951da79ef556f7e060a4ee1021927f1329ca9ef948d4976c042e8ce61e74b3fc6061b25232c32f1d075f1f5b05c9a6366de98e8ee9afb44ae244a30a60f02b75
SSDEEP 192:EON86hZ0QmiUyY2pc/+jVIjzorRV5wOZN3U6:EON86oGpu+68R02NU6
TLSH
T1EF02D935A86C6C778EE2AF45F48727235FE5212BA9956F84D6E81B1D00C779C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 cc32e4266ca9e153d1d0589ee779ad7d130099d9f8235334858dd4a45952bc48
MD5 c8e318bb625cb6929bd8e80c1c835709
SHA1 0161b87447624ba1153ac702b6f80a541b7ad174
SHA512 376cf48380d6a8d22a33e0732aa074196be28b8e325b785e85e83bad4086f90eb2b85fc4c4adeba19e5d6bbbf2ed0d8ef585d325dd656e08c7bb59bf1c1e35e5
SSDEEP 384:OiFiZcIEsNC8TUNTUlIlwT/tFHLb2f+68R+XGxJrEtFJiv3uIoc:lFQEHwgkbmZEhGJi/uIf
TLSH
T1ACC23AF248D78836DDAE9743E73D2D138EBCC067B589AA50B3985A1CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 367c538e69900f43948f854986e288a82f220197824796af15c839bb678fad46
MD5 2f94bafb7786a6e92447f5aca18826db
SHA1 67f277ad640100cf7955496b8d23dd8f16b0faeb
SHA512 c43acb5d794086273fabec27298aaf64ecbb867bb02367f3bb68df61e72fecf83dad89935d5efc5a7c073e5a548156085a6a19797bede456908b073855c52825
SSDEEP 192:gONT6hZXQmiUym72Gc/+jVIjzorR+XKFuSJrEl5cOqdqgU6:gONT6NSGu+68R+XGxJrEA9JU6
TLSH
T12D121C35A868AC675DD2B651F48736135FE41127EECA7F94D2EC2F1C00DB66C131A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 588fd758485fd92abfd6a0db0be568f1841c2ed5a592da2bac710ae7bad81b8d
MD5 627c21ba3714275fc6d7febdb5b5bbf6
SHA1 fa9db4279d929e1c697a2d237159a243f2594e00
SHA512 a69a239fb36d7dca25eae9f1621caa678bb21f41a1b3573e139b22c19f4f82b1059f7181baee32be0b63368361edf0660830fc5606909bb1740441c5584587b1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598ed8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598ed8.TMP
Size 392B
SHA256 f77fae0025171ec3e557a0b20eb516aa8407dc6e99f41ec9d422028d14aa8252
MD5 83001abd14b41fce7c3117ebe60519f8
SHA1 21488c56c5418a87a33945e20fb02b5530a294ae
SHA512 85f3709f473ee13cbd132639aed46753e6d75efe6ca5807b1deb373494a4049b1000031ddb6c3b765b7cd8d93431ee7a7fa17d1e9b7f206a0f0ddb8e9a5a889f
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eaf77aa02fa5e0e84e3d21eb57fbb1d2d9773628774ef5e5ab93297b164f07ee
MD5 77d0ad36898658b91a4c76a8a3ec703f
SHA1 f0e236e424d72fc208030a2efae9bc301221b376
SHA512 6f654a7ee698bc35129ce43e386e40609afa6fbbe7802df80de60cdd86aa393d5235a6bdcf386232754a0d9cec15b8244b43467882f1cf1c99571a9fec1c3e7f
TLSH
T13E41186CA6F91148B3BB7E569BF6A86D447FB9372E17D0AD10010D4F0A26B04C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download