hxxp://edgwaterit[.]us

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/08/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://edgwaterit.us
Sample260828-3ed39aed47

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2348	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134324331304350296"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3053180483-1881419501-3594244048-1000\{A75541C6-D8A4-4651-8515-0D6CA2779D6C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5228	msedge.exe
5228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5036	4588	msedge.exe	85
PID 4588 wrote to memory of 2348	4588	msedge.exe	86
PID 4588 wrote to memory of 3488	4588	msedge.exe	87
PID 4588 wrote to memory of 3488	4588	msedge.exe	87
PID 4588 wrote to memory of 3488	4588	msedge.exe	87
PID 4588 wrote to memory of 4280	4588	msedge.exe	88
PID 4588 wrote to memory of 4280	4588	msedge.exe	88
PID 4588 wrote to memory of 1208	4588	msedge.exe	90
PID 4588 wrote to memory of 5896	4588	msedge.exe	91
PID 4588 wrote to memory of 1208	4588	msedge.exe	90
PID 4588 wrote to memory of 1208	4588	msedge.exe	90
PID 4588 wrote to memory of 5896	4588	msedge.exe	91
PID 4588 wrote to memory of 5896	4588	msedge.exe	91
PID 4588 wrote to memory of 5092	4588	msedge.exe	94
PID 4588 wrote to memory of 5092	4588	msedge.exe	94
PID 4588 wrote to memory of 5092	4588	msedge.exe	94
PID 4588 wrote to memory of 5596	4588	msedge.exe	97
PID 4588 wrote to memory of 5596	4588	msedge.exe	97
PID 4588 wrote to memory of 5596	4588	msedge.exe	97
PID 4588 wrote to memory of 1004	4588	msedge.exe	98
PID 4588 wrote to memory of 1004	4588	msedge.exe	98
PID 4588 wrote to memory of 996	4588	msedge.exe	99
PID 4588 wrote to memory of 996	4588	msedge.exe	99
PID 4588 wrote to memory of 556	4588	msedge.exe	102
PID 4588 wrote to memory of 4364	4588	msedge.exe	111
PID 4588 wrote to memory of 4364	4588	msedge.exe	111
PID 4588 wrote to memory of 4364	4588	msedge.exe	111
PID 4588 wrote to memory of 5812	4588	msedge.exe	117
PID 4588 wrote to memory of 5812	4588	msedge.exe	117
PID 4588 wrote to memory of 5812	4588	msedge.exe	117
PID 4588 wrote to memory of 5896	4588	msedge.exe	118
PID 4588 wrote to memory of 5896	4588	msedge.exe	118
PID 4588 wrote to memory of 5896	4588	msedge.exe	118
PID 4588 wrote to memory of 968	4588	msedge.exe	122
PID 4588 wrote to memory of 968	4588	msedge.exe	122
PID 4588 wrote to memory of 968	4588	msedge.exe	122
PID 4588 wrote to memory of 3740	4588	msedge.exe	123
PID 4588 wrote to memory of 3740	4588	msedge.exe	123
PID 4588 wrote to memory of 3740	4588	msedge.exe	123
PID 4588 wrote to memory of 932	4588	msedge.exe	124
PID 4588 wrote to memory of 932	4588	msedge.exe	124
PID 4588 wrote to memory of 932	4588	msedge.exe	124
PID 4588 wrote to memory of 3928	4588	msedge.exe	127
PID 4588 wrote to memory of 904	4588	msedge.exe	128
PID 4588 wrote to memory of 5252	4588	msedge.exe	129
PID 4588 wrote to memory of 2900	4588	msedge.exe	132
PID 4588 wrote to memory of 2900	4588	msedge.exe	132
PID 4588 wrote to memory of 2900	4588	msedge.exe	132
PID 4588 wrote to memory of 5864	4588	msedge.exe	133
PID 4588 wrote to memory of 5864	4588	msedge.exe	133
PID 4588 wrote to memory of 5228	4588	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://edgwaterit.us
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc8260c188,0x7ffc8260c194,0x7ffc8260c1a0
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,4747676819749603684,14640539529035527699,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,3895022289879435523,12250306097010199742,262144 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,7870529284694822114,6336664607299828035,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14170869131995491990,894073974637895836,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,3359870760076098108,4246381472578760033,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4948,i,9329360207242232408,13373961866673154405,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3500,i,14762301885896176830,13820327072678447386,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,12526771330217227049,3375687815386229123,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4812,i,17489384141184704453,1817514822328657183,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,8630094533965209628,5864307420022618323,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,8630094533965209628,5864307420022618323,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6080,i,10522203764543653816,13520791190415655006,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5984,i,18109508630374669772,9815232027912684680,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6064,i,15725160618436853337,8161391872683716140,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3784,i,8599522230734726179,18213294987630871144,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6356,i,11636864074364550732,2996854683458680318,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6248,i,10919395837949972468,1202990459466057157,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,1546676143600365,4563635314617639812,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,6434171453335687544,5442877926062193198,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,12664094421131004565,14957337412778049017,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=3584,i,9815850754658149451,4291946378193611550,2097152 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,17791302460054902759,879393990152314087,524288 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5032,i,7806817267036432871,4900291929262125500,262144 --field-trial-handle=2052,i,18090809430470562047,810855857185222786,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5228

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9300dc4b11c647d4484e20f994dffbbd9939379d590fc7dedf9875372c431ce1
MD5 b031933009b03b3dcfc6f363760f83dd
SHA1 a9d3126d19c73dafd7e12a688bb3a802627790ee
SHA512 f606a12a9a0879bb3f7d6c9bcb6e3754434b9f0d8f1d351e8104aef087c326f689af5174eddcb6a3cd1f1d07864ff544fc76e73f8b76bf6d4330e19666cb7b28
TLSH
T18FD012BA2A4E7010F26D4A31B416CB00776D15A12852A705E22D944C99A90A562C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8da58a9b03c676d64167caf3657c5315a0b78038e3ae23bfef432a40d8d22290
MD5 81f1d957977f2d73471366011b7128bf
SHA1 c3403bfa34ee45b494966cf8be9bed08da2c5168
SHA512 171afd7f20b750bc0bdc1fc9fd4cf14984e63031e562c60a7b1bab3112c84572ebc63669b744e0e5399b2f5453039fb86937cf7ab417a72da7f1ad931c88f0c5
TLSH
T152D012B62A4A7010F2694A31B456CB00776D15A12852A705E26D945C99A90A566C62C6
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 ee8210d4874f6da160dcd29a660175d1634361a35f90b168d162a6919606ae64
MD5 47f6e95d0e46a4eb9d820da97f2a7dbc
SHA1 a2df76a1e294901a71360b0c3fa505ba80369d80
SHA512 059ad17415cbb266d3e22882badc3c605cf3d9a94131f168319e152a4a25dc008286b2d87057dc5c4fba4b587782f2b13850d6d0ae740ac888d7a383f5524b8a
TLSH
T1D1E02B69CC21EC3708FD0728A0094A96E71013173A40895F7B3C830D8FB862645C9C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 343KB
SHA256 07afd00bc6b13e35f702104aebea04e61d7f90b8447559279895e5f72cabd471
MD5 f39ab38ee79b1eb354356116d49017c4
SHA1 b97e8c1d90d46d372791af31561daa69e132d7c0
SHA512 01217bff1fb5b28e6d1e5e02473ea3154c97f36f87b8973da56e8ca84b636e0de2c318cedffaedf0c76ee90d3eb2e26e6689d5a973538b6f0f91bda10c7a5253
SSDEEP 6144:nQbTrYgHjNyXvc/D0GyVq9bk72B3QM/lUs7Jv2zjWriqGfkMzZh1RqXOzKY:nmTsgHHLlq72iM/mPzjWrykMzZhXqXSV
TLSH
T1177423D43C829CDEB5717D27911A93A6C213B4052D40E39377DB808A7E8B5E852FF86B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a00b9fe604fc730d26351442e18c86278a752c7e33d5d787960f67db3160452c
MD5 157d754a794c4b41fdd1271a38ed3449
SHA1 1d0a2d27f94273f55fcd6dbdfd5b4589b3d328d5
SHA512 9e6d553bed5d3f6a313f9b6f27d9a443d0a162ebcf39943e999a3a8fbcd0fb53e36b9f2a9ff8828efd7e02b3cc10ae728b2b266784a6c4baf2c3e3892418fe0f
SSDEEP 48:XImIYZPZzElVjPhn6na85yu+XVdXFuEKIAK2l/SctTNFXebQqu3caivW3gjppCw:Y3WPpE86X0EKIAK2YoNFXqQgrjppCw
TLSH
T11391D6F49687D861DBD50E3783C2F9383A7141D8FE034E8E116780BE1D6A798C18E7A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe591023.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe591023.TMP
Size 3KB
SHA256 f731b0d96497c612134a3235f897fe67c3e69e033d6cf27b6bdd6b3d6afe8b89
MD5 5ec20d632d613902e534796e76cd8678
SHA1 2919ff4bd3631dc11ff465ef6388c59c5c28159a
SHA512 6e0bde75706802caf1851db019f89bae22f4be04f1ece2dbfa82da31c0cf2c80f14eaa4889a75923b08f905ed04562b477dd7ab4df731e8887ce2f82ee18f35c
TLSH
T18171E7F4EA03D9A2DBE90E3383C1F270397185D8FA534D8D226784BD2E5A768C10EB04
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 42ea190ab968222431aa705659e0aba2579dad967c560bb975e83928e9910d47
MD5 fe49d52dc3b4cbda9f497d4279b0c28a
SHA1 cb38d4abf2417155f2c475dd85fd71c84757a347
SHA512 a0d33ee5bdc1cd0e90e8eb07aeb7ff0c414906bbab870669d4332aea5151f30fa7db9e181f9b1f5c0fc37e439006a4c5632a2c94dc6290a91f0ebfd76cf5d324
SSDEEP 96:D1RODTg/Cfhaaij6IzlGwBME9yxY1cZ6GaMsw:D1EDTg/Cfhaaij6IBGkMoyxY1cZdaMsw
TLSH
T12BB19CF3C2F8C96E980196F0AB143E1FCE5A0565526C3D7B88D8DF8B97E2472E14164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 42f57010f096cc9144a692056bffe6ec031c03526bd18d58a21ed37040ea3cab
MD5 740f0d6f0ade2823cb9de8f9f2fbedb4
SHA1 2b3801b5741c860cba172d4725b69b7b38cb6ae5
SHA512 79938b0dabdf83a9a2fdc7b1c68dbac64ec52abf20c824b906625b547c0bb7c60e7d3672986dfc112e12e38406372338a8b13b311a1737e2d85b9f9244ae47ea
TLSH
T109D02223124430B5BAFD3E9A626BFC8FC3260127181BDDD510D0ECAC093646C0A2B241
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 06b8b8280fa6bd49fc310a189073195210c9fab9254deda369fe9ab32151a468
MD5 8ba8ab024a224f213fb274d54b866538
SHA1 0a5cfe74c16f77ae376df769e32a0db2a4b27d23
SHA512 555e99238598624ae022b1189c6d14ac03cfb6afeb6951f9eeba2faddfa3870323f46d34a66729a54b7b5762aac999bb88b2960257bb95a81179b8081ed937aa
SSDEEP 192:sxZzR5yMqZjK1Ml8UQnky/ftsa7EZdOzodpWZsGOHim6+WNpXFdYvEVEQ+/dIg5+:sxZzyqky/ftsa7EzVtHa3d0Q+Sl
TLSH
T1DE72D7166A34997B8CD7D219F645BBA3D6F91523A1904E44AAFC8E1C00E77EC3207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 5af65f054a6692e16e6602318f076a20707a53515e487323de02f35bec90713e
MD5 3d71a4cb8fb0fc0165808374534ca720
SHA1 d7f3bf90080fbec8e99cc48f9910268c49198a4e
SHA512 615eb00c2b1054f48ed0d3f112fc265c2ab4bfb99adea999aae8b496624ea28d1321330e7e1fe7458e2335fc1f03d2b66323f41b99cdc70657cdb315249f4e85
SSDEEP 192:sxZzR5yMqZjK1Ml8Mky/ftsa7EZdOzodpWZsGOHim6+WNpQEXYvXVfQ+/dIg5gzJ:sxZzyMy/ftsa7EzVtHaFXmQ+Sl
TLSH
T13772D7166A34597B8CD7D219F645BBA3D6F91523A2904E44AAFC8E1C04E7BEC3207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 0ded55f286dcb374e2ce96ea863d894128d673cbb67486f72ac9d1a734338e70
MD5 64a475770106676fd3e07d7739afb891
SHA1 3a074851f7faa3a507fefe616d243dd07b6ba52d
SHA512 825733cf3026f4d3712ca521a8e52a04f5976870c7a7a35e567b37e6d8a5fe9e838844bf9a5105b6dc39de3d93e852e2d92c61952791356d68413020a6782f11
SSDEEP 192:sxZnR5yMqZjK1Ml8Mky/ftssytaZd5zodpItHim6+WNGYvIuVfQ+/dIgjzJ:sxZn6My/ftssytazykHaGCQ+jl
TLSH
T1FB62E8166A34997BCCD7D219F6457FA3D6F81123A1904E44A9FCCE1C04E7AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3ed28410c95bcdd49b775e999633ec95a9fd79e43121075d441a0e078c22041
MD5 f69e750b13c549c16996bde771106f07
SHA1 f3ce7bce220e59cf4ead817ef6423038f0d78324
SHA512 f942c9f08562a4828ba0e5eddd4688fc3995511e90fac2e939ef5f22ba5105f580b294d4c4e56e3adef92b0304627a7501a96a18e13b795a929ffee8b420600b
SSDEEP 768:ZYsv8Od/hWvFvmX8F1+UoAYDCx9Tuqh0VfUC9xbog/OVA0LlEe9NsQroIRLO:eY8Od/hWvFvmXu1ja10Lm2NuIq
TLSH
T19BD20B3B680CCB7E4F840D9DEC2A6F966DD801CB66984D5447FA884C03C77EB521B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\13df48cf-aa2a-45ec-9edc-0812ffe5dcf4\index-dir\the-real-index
Size 72B
SHA256 f17baac907fca38144929bd4fd6658650babca5799471431feb359ff9ae7a027
MD5 d1439f47b10ec6fbdf7f28edcb96bf12
SHA1 73600fe1129bde1967199a634c9f8c36b408268e
SHA512 24044c3ef5de913ae2fcf17ac10aea2336c148dee07ecf40e7a8f137d1575d0524f804715c19ada0f7a2820a7b94727e8d3873a325d842a34bc856fcdaf91867
TLSH
T1D3A0023056582402D416177032994954363088DA56110A5250EC206DC8A0AD3C112554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590d83.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\13df48cf-aa2a-45ec-9edc-0812ffe5dcf4\index-dir\the-real-index~RFe590d83.TMP
Size 48B
SHA256 9e8d5c274ebbcff7605880bdb7b8f49ab61c79a4613f33fc5154ce04a0f7f25a
MD5 d3ad13759a3b718118a79acd57e80276
SHA1 f7df9599add55719c88d15742c6ba7fef87250d8
SHA512 93c2438f23aafa61988fa6487defda7b17ead7244dee9b95dacee8c0630530e6ae666d4c6013f92368000a0de837fee4f04325ee3580dcd88090d6b9746fa6a5
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\6d5dbad3-d727-4b86-ab82-47c02de228af\index-dir\the-real-index
Size 72B
SHA256 9759fce6e0a251698570d60c77b4052e915e689b90eca95f1a8fa0316335a811
MD5 7f78d15a897ded8b07c6df0b262806ff
SHA1 e8930487544441d41044bc079382a664676fdb59
SHA512 5c7c3a90e9a6c43f20215a3e9b3ce17dc79ded5bf029c90f46a73838df83da8f723c74b40aa4171fe864265a3559dfba33e3e66e498882e84f2de75059ef7b69
TLSH
T174A00251559C8255D40256B4934115D33350C9151E41C3C761951385CDF3D405D03255
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d4cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\6d5dbad3-d727-4b86-ab82-47c02de228af\index-dir\the-real-index~RFe58d4cf.TMP
Size 48B
SHA256 4f13bdafa2b0a5b6f74740b86100312726c880e208c80a8027fd70df27d91aa4
MD5 2b9579f946cd91ff65b00f7ba7199a53
SHA1 84654322cd2cc35fa3eda7b820ca9893c793281b
SHA512 9e9737d38a8adaae7c4deefedef34f62938afaddcf1549345fc4e5361bba84b4f1b644577ea32166b362ae5614e9b2fc4ae688aa4f7959f048c73c89e831fb22
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\ff2e509b-9252-49c3-8989-1d0654500c77\index-dir\the-real-index
Size 360B
SHA256 603a65c689d87a98d0394507b542071aff2285b8763b6e8b54f0ea19f6cd8561
MD5 e1671334694747121212c2d0ca35892d
SHA1 e5631f3dce6d2b768ee9395e3f601bba33718809
SHA512 ce161a8e63d66568c25ba8cc8307c25fc8bd3005253149f1bf3e079c610fa8aefbbc9157b89e30e75b4420bc9015e5417c7fb1f85f2697c279362d2c1057db88
TLSH
T121E02B271C897833C6106675107A04B2F33475CD050E5A857D8CD0616D86104A92131D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590c99.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\ff2e509b-9252-49c3-8989-1d0654500c77\index-dir\the-real-index~RFe590c99.TMP
Size 48B
SHA256 e88fd8e0ac568a98c254756af3e85ef658d6eeab5fc41ac3d949c9234e2a78ca
MD5 505cc2f5380b099f93cae623abd2b60e
SHA1 5792a5f77c5c293cfd10989301e5efc56746a738
SHA512 67c3311b3fa4d8912590fc19136ae4b7a2b0dd9e647a8cbeb51aeb5fb8a6ba2338c44b8145688cd33d2ce94e855b4d73dd10af50820121dad6ea4b843708084a
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\index.txt
Size 341B
SHA256 1e8f70862c0a240e20b6ddcf195ee05aedd8341561cd05da0bc5a05d94379242
MD5 1f350b7c4dcd48e7d77f42184a0c989d
SHA1 fc441b1bfc9bb7b4f5f5ed8e0b88d7b9183441bf
SHA512 2aaac80e046f8c63f7456e3fe07af42a30d2b2f1470775aa24cc821162f3c5c33e624eb503cb47002901ce2cf78dd51fe0eb516f8f1e83afb0bc0b83db16de2f
TLSH
T1B4E0267B53E1022AB731588927F4100C481F3C2F8D13E81CC120319FA5F76A19E66E11
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\index.txt
Size 451B
SHA256 5d7017f928f48c24a4f738e603b0c4cf2939867efbf329f787108f0de62b88b5
MD5 ebe6e1135781db8be1d7b5a7bd3f06ed
SHA1 a571eee05b4059fc038be5a55a44765a20abfffe
SHA512 4fefb45087a0e3b4afa86b48922b30cc2afb6a92b04c8add5251b98cebdaef1575e93f47ccf0da0e2dec7a728faf2b50226b7e2ace39b1629b58266e745880b8
TLSH
T12CF05C7763E1123BB7718E8526F4100C48AF3D1F4E57D96C8231125E55F3D609D61F22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\index.txt
Size 456B
SHA256 88d0a12fd42703ed546179b746c6f034b5e98dcfb23190012b381a8d44e1e9c6
MD5 18a4ac236202baeb67b1e22ebb3937b2
SHA1 c264ff100020823f564a2e681bad8b2e5e50e4ef
SHA512 64c3ea352f5c442385408cc9dcbcd24ae3b81a124360feb4a5f6cd61190c45e42a71a3a86e69657a26c7ea8723bb39c87b3a803e664470ecd956c26d8bdfbaf7
TLSH
T15BF0277763E1122AB3718A8526B4100C48AE3C1F4E53D96C8235225A55F3D609951F22
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ba52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\daf537019cb4bdc2a6469a680f3793f8c2f5f4af\index.txt~RFe58ba52.TMP
Size 241B
SHA256 72f0b6df6017c2db4aef0891c382052c8be90e2f6d7b83ae59c472b151e55db6
MD5 07e8d1e706c1a7f3f8589b99e1ec7644
SHA1 bf1bd0ee6055ff71eb8c8689992bf6b23eb68d9b
SHA512 27cd02ef9041450c9877d1ffffd9446bf61d72631feecd6363f46492b8bfc8385cea32f4648a2ab5e15464f991e22229cdaa4d7e552a5ee14090b875117b67d4
TLSH
T1D8D05E7B63D0131A631160860AF9640C441F7D2F9E06D9188128319B25F71555A69D11
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7f8cdbb08be1f20d038e0b4f7928ce6fdd945c143beb5ab0a8421e26454f62bb
MD5 b94dd702150ba9c919f8af0f2aef1d37
SHA1 25d0337eda5868656c7802bce701759444489194
SHA512 c886a1035df7965e4834f7f9107526a6f8442af545213a1813e1af564cffc2a67b3a19364f1b12ec45c437aba66804b90ec5aa05a71d0db0c9e5d9b74454aa9a
TLSH
T1CBA00213517F1083D1960270A18B068476346C148722135144B808B89861341591A044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d491.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d491.TMP
Size 48B
SHA256 23a32ffb53fe5fb1cdf29e8d9a497a6506cfb70cbf6e06cdcc9f354d179c5515
MD5 56b8f664ad4a63d0825dc4caed4ed3e6
SHA1 5efadc0faa63fb01ca579d6396630163e2f244e7
SHA512 d9b872ee5582abdfc86fdda178b8c430b4832bd0d6d804f831b65d64267872d15833735ad8f57f42d478b1d25e53410f2a7e9aeaaf7524b505d4f27f78006b46
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 b69abfa938602ab37fa39e6ac4addf3b7689e6c0338ef1bd4eeea61238404cb6
MD5 21ec3dca049e2b1e913cba7c237911bb
SHA1 0f0b0bb460ec72ca7d5995b9f887b08c627bf356
SHA512 2c063cef33843d86cfd575275c0ba272e97315a959ec81945482ac4cf5df86571f527a947660ce9ff9892c2b25e643c08bbede9d1215c59413f5df07cf511fb2
SSDEEP 96:Ko7iKcsW23iKoM7LKKc026WEKjKkAAK9Gq+xGKqkJ7yKkc++dmKWI94gK966GbGr:05ppxnY753RNBvRJJdt7p5J9rL9J
TLSH
T1EDB27C5A703E0211397E298CB39596364F4235A37058E4AF7FB814A14F6BE224CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 05f2040c1d7ce67c4a3bd73917db9cdea2123d2cb975f9ea9b15111061f784d3
MD5 de0a36e40ab42ec28911a4547f41a11b
SHA1 acab1a3a866b1423a41c84e444c5bb4b93c632ca
SHA512 7dbd09fdcab065c738c954d5e611109ea244d478181c4693dd3fd5d6ee603bbf487a04c1bb43643825833148fd3cffa561a27d7abd3c7f6d9ac6f105b4dd6f0c
SSDEEP 384:nUIiFiZcIosNK8TUNTUlI45QckCrLAOfpvBftG0oDti/7cL3kW0X1puL7nrty/7r:UTFQobwgike3RjG02I7wkWsyL7ot
TLSH
T1C7E2A2F198E78977E8AE4B87A73D2D029AFCC113B5885984B7D95D0CCC961BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b69c1566ee7c38a79ef27e4a8992452a2fed78d873472bb75537de7903ca76f4
MD5 787a3483aae29257dbc13509275ef3a7
SHA1 a455caaca94ee986cc5152cb52014c7052cb2c58
SHA512 48b5d03fb40c909c11f45a1ed9ef9d87d5001132a95cbc98a5a20278fbd2a6166bb352a8616b5e3c4e393d0909a23584ebd72d70f83613cb139025c408f80f75
SSDEEP 768:paqFccps3rwgbkU7RKjG02I7DkWI8p0or:8+s3FVU5l7hI8p0K
TLSH
T115C25C32DC68C9ABECD38B99F70A7503DEE0422386CCAAE4D6DD5D0D109719D530B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 220cd6de3aa564b2f3400ce2b3db834c89fed09f0a8decab25e27cc46a736b3c
MD5 cda6ee490658bddf90e467f54884d8ed
SHA1 79b01b31c4dc5d33e751224edc601f29505615f3
SHA512 93309fa15a9065498f6d0de664bf92be06927b5c0947ff243b1ec5c8afe1cd8f9069935687793e71cfd9215a59b8dda7c7a561e9a728b1f02df30a16ab37a02e
SSDEEP 384:npRfiFiZcIR3sNK8TUNTUlI45QckCrLvCfpvBftG0oDti/7cLCkW0X1puL7nrtyv:pRqFQR3bwgikeqRjG02I7vkWsyL7ot
TLSH
T1DAC25B32D864DA7BECE78BD9E74A7603DEF4412396CCAAC4E5D95E0D009B19D030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 e1eff448cb31a5c08499d15d279225f64ea60633ba57b65420e73cf46b971af5
MD5 84215f69cb38c1bc9b5ce0b3b63d7327
SHA1 b0ab1448094a65a74e83a1f0a7a054cfee16d202
SHA512 706f8645008b174ef67b9e0b5f7acbb9a6973a3ea2731645f988f7ad7692c4981d153b6160f7a5a4bc478157c00398df5f3fd39dfccefef46fa7772135176e80
SSDEEP 384:nUfiFiZcIDsNK8TUNTUlI45QckCrLAGfpvBftG0oDti/7cLCkW0X1puL7nrty/7r:UqFQDbwgikeTRjG02I7vkWsyL7ot
TLSH
T195C24B32D864DA7BECE78BC9E74A7603DEF4412396CCAAC4E5D95E0D009B19D030BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 80174e63d39306458f635f9352ec4371b022de8b99f2f4211927d6121e6f7d72
MD5 af5af54fd7f18fd40cbc46755b7da87a
SHA1 d24b8671d829e38a10c196844b52a21cd4a48fef
SHA512 8f27376c864a12d2b9553a5a279c7ed6c56249ce84856261c0981298ee702a16c891b44abb04b157ca80c9b7ab3d3bca11044a24f407844cfbfe15d2f0679009
SSDEEP 384:np+iF9CcmyWCs3sN78TUNTUlIm2QckCr9lpKpvBftG0oDti/7vupje4KV8p0+HFB:pVFccps3GwgbkU7kjG02I7vII8p0or
TLSH
T1A1B25C36EC68CABBECE74F99F70E6A07DEE0512785DC99E4DAD81D0D109719C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6a2a9dd6d0931e2abc33f36b9e0abb7bc8221a0685d6e3d800e185c6695153cb
MD5 b6ba14524bb48dbc9e7d9c8af1fb5cda
SHA1 7f95ed50d76dc5818f05a163740e93efc43acbfc
SHA512 5601c007d08e47c5992a15b198447774f0a7885f9e9449d3578efc4f7b53addaf8ad43a7ca5425da96f994339d31b6189536b9e87659214b546af2038ea20569
TLSH
T171410658B6E91148B7B77F4AAFF6A86E847FB9772E06D55E00110D4F0A26A00C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-198-0x000001EAB61B0000-0x000001EAB71B0000-memory.dmp

Download