hxxp://bit[.]ly/4fhvnBW

Analysis

max time kernel
898s
max time network
738s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 09:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://bit.ly/4fhvnBW
Sample260825-lzrfmsgp7t

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
125	api.ipify.org
121	api.ipify.org
122	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3732	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321255231925271"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{DEED85B4-8EEC-4CEB-AAB0-4FBB6C4632A8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3736	msedge.exe
3736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe
1768	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2196	1768	msedge.exe	85
PID 1768 wrote to memory of 3732	1768	msedge.exe	86
PID 1768 wrote to memory of 4968	1768	msedge.exe	87
PID 1768 wrote to memory of 4968	1768	msedge.exe	87
PID 1768 wrote to memory of 4968	1768	msedge.exe	87
PID 1768 wrote to memory of 3224	1768	msedge.exe	88
PID 1768 wrote to memory of 3224	1768	msedge.exe	88
PID 1768 wrote to memory of 2684	1768	msedge.exe	90
PID 1768 wrote to memory of 2684	1768	msedge.exe	90
PID 1768 wrote to memory of 2684	1768	msedge.exe	90
PID 1768 wrote to memory of 1588	1768	msedge.exe	89
PID 1768 wrote to memory of 1588	1768	msedge.exe	89
PID 1768 wrote to memory of 1588	1768	msedge.exe	89
PID 1768 wrote to memory of 2616	1768	msedge.exe	92
PID 1768 wrote to memory of 2616	1768	msedge.exe	92
PID 1768 wrote to memory of 2616	1768	msedge.exe	92
PID 1768 wrote to memory of 4692	1768	msedge.exe	93
PID 1768 wrote to memory of 4692	1768	msedge.exe	93
PID 1768 wrote to memory of 4692	1768	msedge.exe	93
PID 1768 wrote to memory of 3044	1768	msedge.exe	96
PID 1768 wrote to memory of 3044	1768	msedge.exe	96
PID 1768 wrote to memory of 3044	1768	msedge.exe	96
PID 1768 wrote to memory of 3712	1768	msedge.exe	98
PID 1768 wrote to memory of 3712	1768	msedge.exe	98
PID 1768 wrote to memory of 2276	1768	msedge.exe	99
PID 1768 wrote to memory of 2276	1768	msedge.exe	99
PID 1768 wrote to memory of 4496	1768	msedge.exe	101
PID 1768 wrote to memory of 1296	1768	msedge.exe	107
PID 1768 wrote to memory of 1296	1768	msedge.exe	107
PID 1768 wrote to memory of 1296	1768	msedge.exe	107
PID 1768 wrote to memory of 2352	1768	msedge.exe	111
PID 1768 wrote to memory of 2352	1768	msedge.exe	111
PID 1768 wrote to memory of 2352	1768	msedge.exe	111
PID 1768 wrote to memory of 2448	1768	msedge.exe	113
PID 1768 wrote to memory of 2864	1768	msedge.exe	114
PID 1768 wrote to memory of 2372	1768	msedge.exe	115
PID 1768 wrote to memory of 4172	1768	msedge.exe	117
PID 1768 wrote to memory of 4172	1768	msedge.exe	117
PID 1768 wrote to memory of 3780	1768	msedge.exe	119
PID 1768 wrote to memory of 3780	1768	msedge.exe	119
PID 1768 wrote to memory of 3308	1768	msedge.exe	120
PID 1768 wrote to memory of 3308	1768	msedge.exe	120
PID 1768 wrote to memory of 3736	1768	msedge.exe	121
PID 1768 wrote to memory of 1268	1768	msedge.exe	122
PID 1768 wrote to memory of 1268	1768	msedge.exe	122
PID 1768 wrote to memory of 2968	1768	msedge.exe	123
PID 1768 wrote to memory of 2968	1768	msedge.exe	123
PID 1768 wrote to memory of 2948	1768	msedge.exe	124
PID 1768 wrote to memory of 2948	1768	msedge.exe	124
PID 1768 wrote to memory of 4332	1768	msedge.exe	125
PID 1768 wrote to memory of 4332	1768	msedge.exe	125
PID 1768 wrote to memory of 3208	1768	msedge.exe	126
PID 1768 wrote to memory of 3208	1768	msedge.exe	126
PID 1768 wrote to memory of 2808	1768	msedge.exe	127
PID 1768 wrote to memory of 2808	1768	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://bit.ly/4fhvnBW
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9116dc188,0x7ff9116dc194,0x7ff9116dc1a0
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,11188702389429992029,1394624787914364959,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,16487701312274807879,17911879034198388254,262144 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,6906744172372379796,18111909277108771219,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7529220947590139175,16327754252962350938,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,9163685611278614578,16211170188642569823,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,16933654436661149197,13669351063741859313,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,801404858937363237,10742529801247158667,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,9997115906991703032,12217547747085351170,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,16582592596309439290,12525600631500291254,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,2509914927636485077,10366665797961657856,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13082643026021551718,10833055166081167845,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,13082643026021551718,10833055166081167845,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4264,i,5577148806114463821,10137670644954343097,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6344,i,240311517272960048,11539525937707502748,2097152 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,15046520397719390169,216926871980109996,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,13840954722201449485,3906471123181002664,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,8664796155050448906,11595687786246005582,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,16226553225745540980,15499407228372916969,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,7586465725723212018,3838313798143731814,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,4543251678563390107,13994379724236029929,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6160,i,5638647141894665959,9862619458677966334,262144 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,6127623341638464127,17162793422175061666,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,4651192378222084288,17416786074983432723,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,2126128920982070661,2852169613771416485,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3208,i,2205666414959432916,10012808372947504052,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,1266408111646544920,4450120596513358060,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1504,i,678060996265687269,15041955486948642062,524288 --field-trial-handle=2232,i,15818608336770921739,5634348241522249208,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 5a7e573f728d5633c9b5d475ac30b179e59d9a5f0b80e02d4f68d288bb557348
MD5 6c725ac6f9d92ceb1b8733837e0e252b
SHA1 937adc791a8e67a783e005fb80d20f7e6e151ed1
SHA512 7fff76d30b1f4de7ec59187573c41cd051367ba78f1dc7358c8f8f0bedcafab95bbb21797c8e8cbbadcbd9250dcb2e02339b617d62d200715adda6d23d60fe8e
SSDEEP 192:0j4iZ88888888888888888888888888777PLO:0j4iZ88888888888888888888888888m
TLSH
T10CE15D4382D6D3AA9F0510DB89A4636D0170370FEBECD918975C8DD9304E8AEF5F6BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 61d025a7de0e655a4b9a0f511d1d0f3d713ec9a4c90d8989693b8abca768cb06
MD5 807d78635f19f286ec3a311bab50c87c
SHA1 3533299e9a985768b5c3581b505558490dc25c84
SHA512 c7bcee4b2c72b629f3268655cf0b5a6184c874a7f263c5dab681d51b3177a15753337f97c92f976ce63a46d77a7f2ad93b888c8c89a4f4bb63f0e98c229a140a
SSDEEP 192:0jKyr5AZUUdIHBBNNNGGGG3333444JJJJii4LO:0jKyr5AZUUdIHBBNNNGGGG3333444JJp
TLSH
T10EE1374382E5D69AEF0A50DB4AA8635C0171370EEBDCD94D079CCAED314F4AEE5E1A90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 8af38bcf1662500714f4de77bf2006c06fec14be11bb71ecc83a4a4abe2372b2
MD5 32d2dfb9c1825866ffc7812b6cfbf569
SHA1 02212089a42bc61424966279b0236c5815736c8e
SHA512 7360273a2a7ed25baeb247fcd1a42b8472bc33b571debe7669c7d1321a77161db9d78c48460283b6edb98a2c4cf51cc32068e8077aacd1c841878577a96b32c9
SSDEEP 192:0jgEjjjjjjjBBBBBBBBBBBBBBBBBBBBBBBjLO:0jgEjjjjjjjBBBBBBBBBBBBBBBBBBBBg
TLSH
T1A5E1305742E4C36A8F1511CB8AA4635E8170370AEBDCDD09135CBDDD304E8AEB5A57F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 4231811f6360ce3b6cf177e5a970d576b7a7837e7123a70fb410767d01e63f0d
MD5 2c544092bf661bc5a6e51083571c8a11
SHA1 3b8f668961df6ffc538ad70708d4d4336c862041
SHA512 2fb07c3bc86ae1151caafee0d41cd541ac6a2a6f864a9856c9fbe8770d700a25c9f1254883773b3c2b4289d211cbafebeb84e6e499f64a8389cf3409401a0221
SSDEEP 192:BjkpGGGGGGGGddddddddddddddddddddddXLO:BjkpGGGGGGGGdddddddddddddddddddw
TLSH
T1AAE1275687D4C2AE9F0620CB99A472AC41703B0BEFDCD918578DCDD9304F89EE5E5BA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 e73811557f1852d96a439e047f84f4483188b4366a2181007410169aa270d355
MD5 cfa5adecb880610b3457e0a746945799
SHA1 a7929541651e88a89de10396f05f949b8075ddbd
SHA512 167ae0abc4c202b7c3dfbacb8605653bb20bc2f213838c3a3edad37a365d5a863733e19024fb20a782a10a401aa3a909237baac15df46da83ec307c1d308dd05
SSDEEP 192:lj7leJ77SSxxwwww333OO66D4452ffUUUVtLO:lj7leJ77SSxxwwww333OO66D4452ffUM
TLSH
T1F5E1454782D4C79F8F4515CB89A8636C41B03B0AEBDCED4C138C8BD9318E59EF6A66D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 313KB
SHA256 819b306947d8e83981455e5ccaea9e804a10567592be95cf67d5ca39bfb7681a
MD5 56b16b9fdb1e320a33d302942936c757
SHA1 d00a08ee07c2a305f8411945bb462df4ea05fdc4
SHA512 84933cf7d4a919800261a2a0a22ee3465d38091c2baae8953279af99a60b20bc9e42bfca85eced44597df4dd213cf9cbda52b35c93688e2ba6fbef9e9338cfd4
SSDEEP 6144:9s4IFEf9KMkqtMjd4gtQimhUd7GjHdf6AsJ340EYTm002Tq/EU9IkL7XAeKn9WQF:HIGf9KMLtMjCMNdKbd6AsJ9EYTr02Tqy
TLSH
T12164238FFBA9AC12B1DECF64C9E64694365ED6DAF7219220C70CA0C4846C6EF15F4493
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 363146f8867eea34b536748ab517fa8183543a9711e0c584cb315fe1af2474d0
MD5 4c8b94ee82fc64e7b02d4e833795c39f
SHA1 02e61dad0bc82b10ac51a09f85ec785ea7e008fa
SHA512 a0b0eff3df2573daea097ce5016fa07ba6216d4e24afd66810939a0a783c9252c0b3845ff98466ae7bc72ecac6b69a305f3b4587f1fed92b83019de3624cd383
TLSH
T1CF8182094B934CD1F7B41973F4AA89077B70C149F7B36E0290D494BDB32DBAD402581B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5918ce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5918ce.TMP
Size 3KB
SHA256 5bc89e34841a59bd6b9bb8c35732f33b6f0201480b0d4f3f4e1265da44d277a9
MD5 d052364a6efced6213f7d0b5d98dd746
SHA1 f738f59912c5fe64b4358e2dd81f2a58b3f0f8d6
SHA512 64f85c92317acbe282fdcab1cabc8d1f162e82cbca39573d83d4d747bf1a4829252892992f6f43a03e11a75129d83436500da5f62181ee4fba16fb87906b12f7
TLSH
T1A3612A0A87534CE1F3701173F4AE42463B72C199FBB79E10A4E484BDB72CB6D856652B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 face35eca3c7a4049f2b161d172e85c082e0b7edf8e9cd4ad22ee328676e46f5
MD5 652d477a0395a3d0c2a1f2ca4aaef8c2
SHA1 4daffbd903f34d5a59cb9ce9bda3e269aa6e1ca7
SHA512 bf30a29f7dbde227dddbe7db8f6c5ed9d3c199926a6294719ea1ac2a4a683e6081518f60032e63602e639678d306860f366a3845b6b8698738060e383b4f1ca9
SSDEEP 96:D/OoqKaN+NVeYzmiVzZsiyJXFlhcIpxSqYBg/GwwGj4/3:DWoqKa8NVeYKiVtsiyJVlhcIzSq8g/GB
TLSH
T1E9A14AF687B09A6EED0291F099246E17DF190916837C399AC5E8EE4BD3F2071D14174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d5ae5e0142308ce4b7b96f5734d2d9c7ba047b7dd18646348530981fddf64a98
MD5 68a12a88e38d1a9add5a723aa8831212
SHA1 b9c71f755eeb1e57b1050007e895f35c9bc5c445
SHA512 09da641879e412dae98d9b2faba065615fe8e2ddbbca43bad23754767c41135fb304d61c92ccbfc8da5bbb81f2e4b1f463a3fb7c24edf0a6a4a6e0d8bc58607b
SSDEEP 96:D9OFQ6Ef+/2wzmiVzZsQbPurRJXFlocbpk1SqYy/mGwQ:DQFQ6EW/2wKiVtsQbGFJVlocba1Sq7/J
TLSH
T1CCC159F6C7E49A6EE90252F09A242E17DF190916837C3D4AC5E8EF4BA3F2471D20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 67de37bdd155ba273b015b24e80b30f1f4627811694552ad3a0daca94ee1e87e
MD5 c5000f34602351b8d017863b8fd4c472
SHA1 d18f3281a447bfe8b9e15e2f3add63e9f2a61c5a
SHA512 89072c4fd144b3bc64b57f8ad54ecef25e0ed5f73d20e53bf3a1505ec80170265882abb75cec249239e95264cdd1edab8f853708522dda1ad498f001aec481ad
SSDEEP 192:sxZmR5JyM/jK1Ml8Mk6/fYszKmEIdprMHW6+WNwbQ/YL2ivAIgrJ:sxZmlM6/fYsOmdAHbD/19
TLSH
T10852F811AB34A977CCDBD209FA55BF53D6F94472D2900E44AAFCC91C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6fd1689a4d3c352462c50385bb1755154e56c70eac2412ac00f806ff40c25dde
MD5 713b71a8d80a88112e20544eb8984cfa
SHA1 3e59497046ead97a2f835e5e0968895c64746d76
SHA512 d81c51823d15f154c50d5d3fdb77af28e4433ca526c2f2ffee8aa95fd304ac34db4189b37d7ed07aec361909403c121ed9c95499421b5b2954eebb8ebcc5f774
SSDEEP 192:sxZmR5JyM/jK1Ml8UQKjk6/fYsgK9EIdp1szOHW6+WNNzcbQ/YLRRBAIg5eJ:sxZmlqv6/fYsx9dOOHbl3/34
TLSH
T1FD52E715AA346977CCDBD209FA85BB53D6F54472D2900E44AAFCCE1C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1e7ca45d8927bdaf0fff863364f8df8f766febe9d886332e054467418651e583
MD5 93237c109b1c9dcb295494a8aa4986cc
SHA1 1d6cd32877637e8d6ff5eaaa08f903cd3a61481d
SHA512 195407917a46bd0af981f46c85cba05491eca107be7ee4285c78c2f2df29676a3fdcfb5210fa8a84cdf5a1159cbc85ae97fceeae25731510c70b2312106d633d
SSDEEP 768:s+s6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNvroqa:s+s6pD1WvxzWju1jahILIsN8qa
TLSH
T16DD2EA3B680CCB7E4F841E5CEC2A6E966DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 4adb13f27ee7c567d5b805504f3e2bb402da12973694ed52a48197f40c4dd654
MD5 0163357ccfbf172acc0de1903364b115
SHA1 169db3dde7c173413f53dead6e8233141d426245
SHA512 9f62d6bcaa2da1dd6f4e57b3a6752854c975854d95f358098b7b15b029171885ca81c8efc7320074b409987481abe65d5cb5730f5949a5e57a4db00b7ac6abc7
TLSH
T1AC31F08D9EA099CFE8A480B21572B5A4737198DD4B26B3139C2C32367E633592A475DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce8f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5ce8f0.TMP
Size 1KB
SHA256 3425b94fef50f2fdbf2b4a82bc7d465e28f0d008fb6a6bebf39723180e202134
MD5 990297af8e5064b5561c7be94bc0675e
SHA1 245613a7763c642de2caaa5f0d6d2903c7677680
SHA512 f4067bf1142227b0bb5e0f27192005bcae125c7e931c962313b8be45df2a2f2a67aecb8c4a8580639ae72b71c572a326b5d0643eed00d6c2cdd5f2febcb9c5cd
TLSH
T11831024A4A918D0BE8C4507B1963B8F8733589409315B393A57C62399D21B8E2A4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5e89d4692c67b50e7e91347daac8a84834732d7a93d098172ed0fcf7d953b84a
MD5 cc5d45cea5dd1d7fcfc0c9d556e4aa65
SHA1 35d841b04c4b65b0ef76912a6dc3c218b36a412b
SHA512 e4886d00897430be31a7282d274cac455678923d80523324ed61fc7bb71131fbe89695f064cb8c095e0172f114ad1983cec432459ad5ab15052f143f6728f7ce
TLSH
T19EE0D8BB6EA76820ED6FE3E7247054750142385CC805BC4F546E96D350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a0171ee876c0dbb7961e553d220035bdc39aff1e9da155edd97b9fac1bcda956
MD5 4a3b46410240661d97be81078cf556f8
SHA1 bdd6f2767176d131f32dd26e24974710ee25e75a
SHA512 18a29e797a380bd36ebfdaa7b2c4a2bbb54111bd81c2211d9e47af1dd34f2e94201a6c3883479768d20e139f0a81408d2d9aa131ccf95d3e576edcf449da7e92
SSDEEP 96:KUAAKtePGhOKy46CK8K/aMHeKIoWKqsKHq5:ii1Z3CN/W
TLSH
T160E1694272B702123C7E690C929987675F8277633414E42B7BA850F28E7AE341DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

04024b75-c382-48c0-91a2-01d72f5e8fea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\04024b75-c382-48c0-91a2-01d72f5e8fea.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 a34ae490e0e4fde4fb72e982ec6f3ca7f7d495e1a50b29c7e6ba612d10f02977
MD5 77357f74646c6eb400cc929a8ce233c7
SHA1 1d660a62a3259d4999cf87ee7418e78dc6251e9e
SHA512 ac93b73092e2aa4604b78bbeb859c70b29928cb35b006170f097f0f7761dd6de3cb3f1cfd6fa186bfc24ba0a9b17bcf8a80e9eb4184649c29c68eeeaee034cb2
SSDEEP 384:OiFiZcIFsNA8TUNTUlIlYxAzgpgua9pd1wyciv6+aWof:lFQFxwgwsb4yciSlWI
TLSH
T12BC23BF218E74876D9AE9743E77E2D078EBCC063B5956A40B3D88A1CCC960BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4507f709c49489f3d4f2f669a848ff84bb8ecde5047d40c6a171441f8a6e80fd
MD5 b0d732afc3d9cfd65780d85940f6a34c
SHA1 fc0ce6420ab0592fe38539e01e082a3b52546029
SHA512 a4c166775637a78b1fd5fdcbedcefa95da4ac58ea0089d434064743019a00c849d20e37b658dd53e85c043ba5cfa60173bbd9ce8216a6a35ea473732bf4fcd8c
SSDEEP 192:qON66O7+3hQmiUyOsOIGttb0/+Fd1DgGyOiU6:qON661eGt9pd1Hy1U6
TLSH
T1CF02E7396C782CB78EF2AD45F68727179FA5117BE9A62F40DAE85E0C00D765C2343827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fb769411fa6467fe059c38fee397d37960f6912321a95d381a0a74e330d6f5c2
MD5 9d8d460597544b174983440d014d051d
SHA1 1bec1260537288e1b745e7393aa5c1cc58b9a7f7
SHA512 7b14fc4039552f0b2db7df95fd59acdb9a901049c63451285739c8cf9520f50cbaf6ace2c3335fa3ee4ae9f9062509e3127440005342702fbad7d734a925e6c0
SSDEEP 192:uQm+xasuheOwQxMGsNvoTxQz/Dg7+3vx6QmiU1OWOQgB4atb0/+Fd15GXLMyGqg9:qZcIhsNATxAzgbgua9pd1zyciv6+aWof
TLSH
T1C5828D356C785C7319F6E245F68736079FB880779AD96F8091ECDF2D00EA5AC2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4f5fe3768f62c2eb97cacc6fdedcadb776427d13150eb881d9757a745b2663c4
MD5 1055b54a4afeb4482ca98272b6ab1d98
SHA1 ba3df851d3dac25762580702fb071d8c49520dc4
SHA512 40a5ef4ac23344e6118dcfa83933cb8b41fa2b03a6ae08b0cc03f816a85db0679cd081038550e0dfcc61620329e78296667a92280d0ed8015b298b72ae05489f
SSDEEP 192:2ON7V6O7+3WQmiUyO1OIbttb0/+Fd15GdcNyGqgpU6:2ON56Yjbt9pd17ycU6
TLSH
T12C12093578686C775EA2A441F5C736178FA5827BDE9A6F80D5EC5E0C00EF56C234A822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 4e4bf2a1dfa91b47a50cb3f01f7ef6093f2f89920c418f8ce313a3cf92add466
MD5 7c9a54105432006f783dc1364de48992
SHA1 a3f4401d103004130ef4a3970ee79b81cd1a8b32
SHA512 59d3fce2ea687d6f34abdd0bb3b427e5cd99c9d6b36811d849105d56c155d38b3b389d54f9a2f5dfe7fa948e886c4dfae26a13fb9f5a1301fd6e3fb47402cd22
SSDEEP 192:ukm+xasuheOwQxMGsNvoYxQz/Dg7+3vx6QmiU1OWOQgB4atb0/+Fd15GXLMyGqg9:eZcIhsNAYxAzgbgua9pd1zyciv6+aWof
TLSH
T1D3828D356C785C7319F6E285F68736079FB880779AD96F8091ECDF2D00EA5AC2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5169105-c5b2-4cc1-b21f-378ec38d3a5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c5169105-c5b2-4cc1-b21f-378ec38d3a5f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0dafcb8b1c420bda5cafb6c6d5c124f1f8af984a80ceca83d837f1e32989a8d9
MD5 cea80d6258badec629391d5c2d1d322e
SHA1 7e8346d6c4618f7850bab7c7ba6ff6ad384b4260
SHA512 ed77e79d529c9d31a7f2be65ca689c2c046fdf5344b0cd85ef4fb96e1a6116321c37b75d07985c6090460862183d2b41b0e85c95949f8bb1999d26d2bf3ca2e4
TLSH
T14E412598A6E91048B7B76F5AABF6B86E587BB9332E46D49D00110D4E0A22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download