hxxps://www[.]xeno[.]now/

Analysis

user interaction
yes
max time kernel
373s
max time network
374s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.xeno.now/
Sample260905-e77z2aen6t

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
32	discord.com
33	discord.com
36	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1128	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134330565987676169"	msedge.exe

Modifies registry class 11 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F0F4302D-B4FD-4FFF-A546-BA9E8F58A0AD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F0EED1C1-1C5A-4BFE-855F-F9A5E68ABC52}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3800	msedge.exe
3800	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 34 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe
2828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 512	2828	msedge.exe	86
PID 2828 wrote to memory of 1128	2828	msedge.exe	87
PID 2828 wrote to memory of 1228	2828	msedge.exe	88
PID 2828 wrote to memory of 1228	2828	msedge.exe	88
PID 2828 wrote to memory of 1228	2828	msedge.exe	88
PID 2828 wrote to memory of 4404	2828	msedge.exe	90
PID 2828 wrote to memory of 4404	2828	msedge.exe	90
PID 2828 wrote to memory of 3268	2828	msedge.exe	91
PID 2828 wrote to memory of 3268	2828	msedge.exe	91
PID 2828 wrote to memory of 3268	2828	msedge.exe	91
PID 2828 wrote to memory of 3556	2828	msedge.exe	92
PID 2828 wrote to memory of 3556	2828	msedge.exe	92
PID 2828 wrote to memory of 3556	2828	msedge.exe	92
PID 2828 wrote to memory of 3336	2828	msedge.exe	93
PID 2828 wrote to memory of 2600	2828	msedge.exe	94
PID 2828 wrote to memory of 3336	2828	msedge.exe	93
PID 2828 wrote to memory of 3336	2828	msedge.exe	93
PID 2828 wrote to memory of 2600	2828	msedge.exe	94
PID 2828 wrote to memory of 2600	2828	msedge.exe	94
PID 2828 wrote to memory of 4640	2828	msedge.exe	99
PID 2828 wrote to memory of 4336	2828	msedge.exe	100
PID 2828 wrote to memory of 4640	2828	msedge.exe	99
PID 2828 wrote to memory of 4336	2828	msedge.exe	100
PID 2828 wrote to memory of 536	2828	msedge.exe	105
PID 2828 wrote to memory of 2444	2828	msedge.exe	108
PID 2828 wrote to memory of 5036	2828	msedge.exe	109
PID 2828 wrote to memory of 4968	2828	msedge.exe	110
PID 2828 wrote to memory of 3296	2828	msedge.exe	111
PID 2828 wrote to memory of 3296	2828	msedge.exe	111
PID 2828 wrote to memory of 3296	2828	msedge.exe	111
PID 2828 wrote to memory of 1268	2828	msedge.exe	112
PID 2828 wrote to memory of 1268	2828	msedge.exe	112
PID 2828 wrote to memory of 624	2828	msedge.exe	119
PID 2828 wrote to memory of 624	2828	msedge.exe	119
PID 2828 wrote to memory of 624	2828	msedge.exe	119
PID 2828 wrote to memory of 3508	2828	msedge.exe	120
PID 2828 wrote to memory of 3508	2828	msedge.exe	120
PID 2828 wrote to memory of 3508	2828	msedge.exe	120
PID 2828 wrote to memory of 4736	2828	msedge.exe	121
PID 2828 wrote to memory of 4736	2828	msedge.exe	121
PID 2828 wrote to memory of 4736	2828	msedge.exe	121
PID 2828 wrote to memory of 2312	2828	msedge.exe	122
PID 2828 wrote to memory of 2312	2828	msedge.exe	122
PID 2828 wrote to memory of 2312	2828	msedge.exe	122
PID 2828 wrote to memory of 1436	2828	msedge.exe	123
PID 2828 wrote to memory of 1436	2828	msedge.exe	123
PID 2828 wrote to memory of 4368	2828	msedge.exe	124
PID 2828 wrote to memory of 4368	2828	msedge.exe	124
PID 2828 wrote to memory of 4368	2828	msedge.exe	124
PID 2828 wrote to memory of 3800	2828	msedge.exe	125
PID 2828 wrote to memory of 2236	2828	msedge.exe	126
PID 2828 wrote to memory of 2236	2828	msedge.exe	126
PID 2828 wrote to memory of 2236	2828	msedge.exe	126
PID 2828 wrote to memory of 3612	2828	msedge.exe	127
PID 2828 wrote to memory of 3612	2828	msedge.exe	127
PID 2828 wrote to memory of 3612	2828	msedge.exe	127
PID 2828 wrote to memory of 3268	2828	msedge.exe	128
PID 2828 wrote to memory of 3268	2828	msedge.exe	128
PID 2828 wrote to memory of 3268	2828	msedge.exe	128
PID 2828 wrote to memory of 5036	2828	msedge.exe	129
PID 2828 wrote to memory of 5036	2828	msedge.exe	129
PID 2828 wrote to memory of 5036	2828	msedge.exe	129
PID 2828 wrote to memory of 1180	2828	msedge.exe	130
PID 2828 wrote to memory of 1180	2828	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.xeno.now/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe8b7ec188,0x7ffe8b7ec194,0x7ffe8b7ec1a0
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,3673282180023614780,4882903950271150007,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,6061560055598054086,18084468012364813506,262144 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,3186344045451844544,2489195803807389079,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,5588910599491398238,10826190655053946091,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,13540146478017775064,15991839529791519174,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,13944765322718680773,1089802299799341501,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,1580273576566084071,5168795777589381501,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,17994533080591282178,14665679951509635571,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16972378817034233017,12727568011012742364,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,17612034806767819598,15551851917309789952,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,17612034806767819598,15551851917309789952,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,3815507459073588936,7893285586832019754,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,17635037187305616755,8657423436142713721,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,18255023060980243751,3524942860087153535,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3448,i,11135101144228710827,10545816868539593431,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=2828 /prefetch:1
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,17858287569784164628,6421722866323149426,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4380,i,142903704804008240,11620333167556783496,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5232,i,10642453319363006023,5836241815130343515,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4348,i,17306896982442529258,12688644600280729976,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5620,i,8706752521972768914,9739759688018756927,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,6471668203705093722,4172368093090385949,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7116,i,8194638185190369721,14547724121621377713,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6924,i,16797680279049119855,7227901584671916309,262144 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4800,i,16510888515615917004,1409993415754633269,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5332,i,9121429767426952192,4863014076942124573,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5304,i,9156739525048924731,12364952911100993484,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6972 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6416,i,14041951401853364380,6608211477514469137,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6984,i,14805434210738522710,3678080127782764274,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=5572,i,18288283659243076176,8610151504393316178,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7472,i,9891572034117751628,15087213009406154934,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,5051268552874627821,17030576538294355124,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7752 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7756,i,2402258813904506150,8362819987908856006,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:5744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7124,i,10132607304314127541,15442727431952530543,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:8
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,8269707146277986547,1674449086660014279,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=3352 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=3848,i,960882796013609326,8641351749574819211,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=3808 /prefetch:1
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7492,i,6650330950789825436,10828267925655081240,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:1
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=37 --always-read-main-dll --metrics-shmem-handle=6684,i,17840609348908510755,2561404114372833504,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=38 --always-read-main-dll --metrics-shmem-handle=5316,i,2685644035666164915,3091229516634047865,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=39 --always-read-main-dll --metrics-shmem-handle=3848,i,7043390411604677757,17567914190153517482,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=40 --always-read-main-dll --metrics-shmem-handle=6476,i,7955996266501490245,5408385528137993307,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7500 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=41 --always-read-main-dll --metrics-shmem-handle=5396,i,10571507667624546609,5031324386535801147,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7256 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=4800,i,16963968814568099943,6745877696285391194,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=43 --always-read-main-dll --metrics-shmem-handle=7104,i,16765848765181303822,8120435226868249196,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7272 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=44 --always-read-main-dll --metrics-shmem-handle=4728,i,8465472186927140474,812000336530019317,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7904 /prefetch:1
  2⤵
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=45 --always-read-main-dll --metrics-shmem-handle=7924,i,17744384308999324781,14339157957696217922,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=46 --always-read-main-dll --metrics-shmem-handle=6112,i,6002126580601862641,9958314137708813900,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=47 --always-read-main-dll --metrics-shmem-handle=5476,i,3521697994397169085,16787975249101446367,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,2391199534899427384,6482451091874047994,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=50 --always-read-main-dll --metrics-shmem-handle=6936,i,18082220755123547319,13873906142223155083,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:6104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=51 --always-read-main-dll --metrics-shmem-handle=6532,i,838464549044714523,15781218831319070058,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=52 --always-read-main-dll --metrics-shmem-handle=7512,i,17565686872702427694,5748308183247492612,2097152 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7340,i,14449031198104775419,12717705486770247021,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7388,i,15580995409717681488,1224795803530432987,524288 --field-trial-handle=2060,i,17590600392813397387,4708255941934416794,262144 --variations-seed-version --mojo-platform-channel-handle=7212 /prefetch:8
  2⤵
  PID:5448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a46abaea3dd3504bcff9a905509244fbdd3a8b44536ceff4e12d6d2e7af7cbca
MD5 bc639d5028f1a906c5b960510a1d8cc4
SHA1 ddc571c8f0b35653695a7756b3c0052952ba46c2
SHA512 e01dc3169692987fb4566a731f860d1e8d955677308de278dd8c9075b932433e52dd3c5564ca136d1b2e7595573234ee9188d329121442d49f24554dc21aada6
TLSH
T12EE086F809DAC6AEA314A58B41A88B0CD2D13F0AE7CCBB4E5714848C72D3564F6D7DB4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9b534fd0433b66a99899d98c3cb8120d8724d1ec52ad3529c0753c73eb730d6
MD5 381fd4e705969c3990b0116f66bc4502
SHA1 78d217649aa77eb0a3a2ba5db9b378a5f84e1d67
SHA512 a11a8fc2f940b868b3f01037303e4cdd0db5f25409c9bf8d6042e10dc5ff18e8b2b6c7edf66a5ceecb4b772ebb91eee6a142dd380c4b08ab2835481be277795b
TLSH
T1E9E026B408C8C2BEB350A9CBC178470DC2C03B4FA3CCEB8A1710889C32075B0A6C2DE0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 23KB
SHA256 4d374f815118157d4ec62c285937df74fec28c75d9eec110f48d3e04cb321ba8
MD5 ce7b262351203b245322fe75044fb61e
SHA1 46fc201fa3a9a56cb91f3a08f4a380f6d2283e0a
SHA512 0af2f8fa0171107ca26b73d1eeed9599c0b67953e163441bf65dc3a5bae5c9aa82bdcc54255996e8d1d472db1b09ba3286859d595619f1706a8e61c464081dff
SSDEEP 384:zApz2RXdsOYVa2CE00K/4dJfoLdmiJo0zADElg9jIKauH6CwJ6k5zRv2LbFq:oamOTZE0hAdJfoxmiJ9zdC9SpCwJoFq
TLSH
T130B2E1833404A6947BFF27130CF66A08E6B2B67BF63273054465483E42B52FA5B5977C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 344KB
SHA256 c1ba7027e790c346842569dc60319a75bb54ad9875b3a114cd3d60febdc1ecb0
MD5 a76556d1143eac7869c5cdd2ba75aee7
SHA1 62ace25f7a400460ef1550bd536b8006aff57655
SHA512 b6763ac3d83198054c3e24685aab797d60c39df22f0eeed2ff4217bbfb891efa1f2ffda857b079443e0ee66fa3e0b2f1cca34867fcdd8a709b88abbd93c33e4f
SSDEEP 6144:+1/dG8Lx2NjYH/1z2cvc5NFLhVke64uBSCGJ0qHQzr+LZ:+voj2hrvcdnlJWF8HQzrQZ
TLSH
T13F74231F614B6C6CECDE01C7216E44D5D32B8F52CB231ACBE649D16B04E749C8ED9A2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ca

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ca
Size 21KB
SHA256 b7582acf1f182c6a66e203cd6eee889d409cd05ff4950975128a32fc3e0c0418
MD5 e126007f6b835ef3a0916864cf476699
SHA1 04eb8318f173d6fdb5417e92645502d93966b8a8
SHA512 5e169a71116c41508283ee7224b7fee51c6b737a909c269e062e7494c9e7a853dbd4a762ddd9d9f104d79965d5570c2511df5b1c08c840c2037a4901af8a7140
SSDEEP 384:7zhykQ67ifiZgQPmqN64Q4PBZtjCiMEZiRkCYzMNFMvj686avLDo1bo0/GZl:5VQ6kU5Pmqk4xZTF2Ct6YLDkpql
TLSH
T1EEA2C01F966DC059082EB5CC9795B522D0CB8391E5CD106FD8F54C2FB4B277236E8B86
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cb

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cb
Size 1024KB
SHA256 f0a92cc2ee5a3a17eec63f2e3ad541b7e71852d2b508e0df6401b5031bd7e2cb
MD5 acff64372470194003e8d5a95ec6f2a2
SHA1 b954814e16d2aa6bb780e0383871e70a5d4e7241
SHA512 d15ce34ceb294145881326d193e79e73fdc721a1fd4eae52d4aa7aeb828eda9b3109196a6bc316cd2213c31f7aaf22e626d1a9f11109d48dadde1c65a18470ba
SSDEEP 24576:n6neh8WoAH462PvGkjYLzLzvaw8m4cYuD7Y2t6P54ncUhs1dh:6neh8gYf33Yjzvaw8JaftEpjdh
TLSH
T1EE2533086BB8763CE87C5BF55EC54777B29DE01D925D2B0A97602E788EAF6FAD0041C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000cd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000cd
Size 42KB
SHA256 180d9a87b54d68e6948e260ece8ebeb0e748a7115e543c6ee8f72fc6ef9f142a
MD5 3fb943f9af51ff7d47be0a750e4086c1
SHA1 9c526b276a3fcaf770a68674bddcedaaef82c295
SHA512 2739a05804c91fdff5634fd297ab1389c4d2bf7a591d2564444010a1c38a818c0e161d0def52ecde940a3df9bdf5c2130dcf073a4e144062412df323a40a7dc3
SSDEEP 768:Whh9H587KhZX4UQ05FK16EPCdVbJOKJi2W7WEweUBN0KpEiJ1EYhnEI9m:Ehn8J6KZCVO1x7ZweUBpEiJiYhnEym
TLSH
T12F13F17D5DC105C016CB62F6E548236523511C9EAF068F4AC6CEB2C394FD63BAB292D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000dc

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dc
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ec

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ec
Size 76KB
SHA256 db94180d19b81b521796a38b37d30f8f0668d1a9ac91e9ac95b36fe6634e3cce
MD5 5b8173e77d3ae7aa8b9e4915486d44f9
SHA1 42329777bae3164eeafdcf180906d5ec3b130e23
SHA512 3f283f99fb32e1c5d98777e455bade7cfea2366144eff1e7e12ecf8e11388c389bffc9f86e07985ead09f3c3dfab0bb9db482a2d26e45d03d8e9d09b0785c1c9
SSDEEP 1536:Iuawy7Bm+8+BU5yyP8JhDdJcVrwMhZjdDugc+AUDjOL+luL4t:owIXVyPoQrw4ZjdCb+AUOCluLS
TLSH
T15973025B0360F426049E5551588390EE7CA07086D831BEAD22D2B0DCDFB6F4B6BBCCD6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 5cea7bc7a694d88115a70ea6f9a001cc6d9306a9a5a1e3ea421b736cc583f6d0
MD5 adce76a0ad2d8d891fa321d071d2f483
SHA1 01d1205cb226efcb4fd274347b5fd83254297e42
SHA512 cf64a4e81ca92a401d2b408c504470496d64955e07077843dc7fc2acdc6e16075281dac3f33de184506d5451191fdd2b686ac5c5fd5b1c6b790219291b3592c3
SSDEEP 192:AvkWZ42DELpz0a0hlq/iiwpquJnJ/a4MfoWlT:Wk0lGCqW0T
TLSH
T191E1C7889FA72D23EB14CD75C3F109B675328694049F0FB62438C7FF998E3A85A25C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 91ed334e577f168e7fe34d5c65be865b0d8ab7f8ea46ca9f0eb0eff527c03216
MD5 bd42b14a36cb8a4d2b27fbeeed722423
SHA1 c140454db796e7f3e09296dd7c461740ebc9e546
SHA512 346351fe9c099576900c2dab59f91eae3077c9e4127161f607825be06ba845adf7e7e0dc956dba290e476f62db020feb2fbee072558954c15886c413e320ce41
TLSH
T122716F1ACB834C43EB018E38D3F1167135329B98466F5DBA2174CBFF6E0EB519519D29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 978d85fe9f3d3c3480c7fddc3e29eecc8daf55a5b11928e54e013c75e40fccf4
MD5 a09a8f2be8b8f770bc4ce0a02cd9f97e
SHA1 f554027b5fbf4760eebf9abcdee59a26fadbb6b7
SHA512 3d42ac6a5ccb499e7df8dc2ed53387efdd50a65201a48b29c829dd58fe2b7c1351c6c2a2138105fd80f61372cc074fe55b9ff62c310aed3b102d93b9403de34f
SSDEEP 96:zS4JzwtDb4dkyEELkbn7Bogo5W3lct/CQ:zSEz8b0E1bns5pT
TLSH
T11BC1B3968FB30F27EB819E3AD3F10972353186A4456F0F7A1078C7FE190E7A19915C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 8012638749685f4bfcf0e20acf89f1041a76c44499f6769b9bfde50e2f955697
MD5 7a423b267e4bb0760ff686176aaffc42
SHA1 bad88fe205a04de0d354e32931288ba6d272deaf
SHA512 8072d5d4d740319afd784cdb031d948dc099204cecd90dc348942269923304e8304ad7be529f925f46cda83b68d40757f2eeb0c50ae90bf68cc5a9d48683a3cc
SSDEEP 192:6vkWZ42DELpz0809lq/iiwpquJnJ/a4MfoWlw:0kKlGCqW0w
TLSH
T1FCE1C8989FA72D23EB14CD75C3F109B275328690049F0FB62438C7FF998E3A45925C56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5cd8cb8654ad66c4d5ee8515c15e0805d5dea8505fbb9796fa53d9fd0bdf9b2a
MD5 5f62378330c4b4ae8878e32666b605d8
SHA1 2e7d54f11f77266966f1cd7614acc6b177182c8a
SHA512 4b232dcf70ca21ee0afae104bb6661b2f8314ebe5e6ead3117f133b88188297656c8c5a8a83d8d85b05334e8be7dde55ba0620fa4f2691e29246efc1b2896818
TLSH
T167716F1ACB834C43EB018E38D3F1167175318B98466F5DBA2174CBFF5D0EB619519C29
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 7ade949f1c6a3b360179f82704a18208c0f8a47975314f1e5910fa8fcb679f0d
MD5 e713ee409f0be923b028d28d4beff05a
SHA1 d36bfddef98121ac95fe347718813265ab4a997c
SHA512 2323becb4e566cbada815cfc124f09a474e3f5995f2100496ef745b0980db3e33e15279c6c6cf883a745685b1d721a19cc21c399bb43e3ef343d94016345a408
SSDEEP 192:dvkWovDvwpz0AyliUiiw+0nJGd41fBWVn:oU0lVxCGn
TLSH
T17AD1FA989FA72E23EB54CD75C7F109B671308694059F0F7A2034CBFF998E3A05625C66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5cfe6bbdbf3ffc8e5514e0ce6256616bbd6f85cb4c5f183983be40814f4854c2
MD5 603ac67217f756e66b7f9866f972ce3e
SHA1 3a3ba466f6488e4c24ed3e85306cad60349b2456
SHA512 b06f8c64a25b5d9635c80f100714b36ae2d5398c05a4329c29e95f13b957c674eead3e38bc518b394222cfa916f9bea0f1cbf43eda358b6135e81027f5478d3c
TLSH
T1A3716215CB834C43EB019E34E3F112B575314BA88A6F5E7A51B4CBFF5E0EB519619C28
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b85e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b85e.TMP
Size 3KB
SHA256 1e0ca70a7a84cd8beb749f44738f588d12ae54a4666463f2624d1b4355d3a44f
MD5 96f246fc9eb7edc647a0ec4ba83ed600
SHA1 2fce428d8a7f247f17bc655eafd405d590926491
SHA512 4c10ab5a2c3ace29eda155f55c9580446dba7868ba3a90b634447e9fa067573c9bb9c7c2c29d02a01b025df37e1cdd3f25ee8c8f314137900a79d315ec325850
TLSH
T153715F19CB434C43EB018E34D7F102B175324B98466F5D7A2174CBFF5E0EB218519D28
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 23KB
SHA256 359909e831741e6c46263c7635c12e36eb2574b36ee517bc8e40538e347098f1
MD5 5dd81778080263a05442545ecc2a0e55
SHA1 060f46026859dcc1f478194037843a857422f04b
SHA512 93a9635cfaf92e4a8d0c3307995348b0abae141accd808bbc9d1ab1d070d7faa7fa4cf4c939cbc9230b0ca0a74d1db36ce5cb642211b39d8a5877d369bc6ecff
SSDEEP 384:DHtowYGPXPsPHPxPbPiPvPTeGd6C5cqN+t8H3ejJeN54kJgevBeeJZJ4JXmI1RIq:D/yvJL43Tn769IofW/0+opcJdm3s8ct6
TLSH
T15CB27BF7C3F8866EDD1162F09A243E27CD591915432C3D1BC5E5AF4BA7E2470E281A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 c0150e814e2c373f77d9456ed27eb7d9d4ab1e7a5707000a664cc8c256cfc9bc
MD5 14e0229bceb0c415153b7c05655bf9bb
SHA1 c76040a94dda834b3909698de9d9e62208d0e7c8
SHA512 33f8842cdbf225f8778f12d809b54391d1b9f3247b228491ce730515c6fde58561ccbb5073b34eed91de187455530ee0992caa8ecf8b770d4cc72406f64c15fe
SSDEEP 192:DHtowYGPXPsPZJPxPbPiPvP6Z1RIQfwxfJxJ2J+PfIP/GPQPoRPjqPxP9PYPvP28:DHtowYGPXPsPHPxPbPiPvPE1RIQfwxfr
TLSH
T158F17BF3D3E4876DDD1256F49A143F2ACE191924432C3D39C9E5AF1BABE6470E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 50d6884cabf03087506aa167926dbbef9987d90e8faf84f7d939710521fd57e7
MD5 2277abc427021128257e6d41c8e40d55
SHA1 da8983e3946f2c9de86b2fe2220c35c92e84cbfc
SHA512 9ce2f42e22ffb65823bfbd05fe314e1346362236613d1ddfc26eed094533220019bd04bd3dd329dd7afa39661735d2b59d28c01043076d91655c8111860f004e
SSDEEP 192:sxZORKyM/jK1Ml8Mkd/fcsLMqiEdpVGHW6+WNxB2/Yw5VrIgrJ:sxZO4Md/fcsLMq1sHb2/Z9
TLSH
T15B42E9016B34697BCCDBD209FA51BF53D6F9457292940E44AAFCDA1C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 b60f452a7e14a47c3baf1ade75bb2c246bfc23e03cdc76bf4aac6453e0b6341d
MD5 f6f2693d8c3db99678e5beb46034bb20
SHA1 b90964d086223cf3d70cde82949c476880fcb5a4
SHA512 be790dad6da69f45cd1654bca82ae8d11c5eecf9a1a466cfeea09821f0fa33da61bf7951eb7e8c82046ae0a7a16cde4c49e0d231ab7d0471394983e626c74ab5
SSDEEP 192:sxZORKyM/jK1Ml8UQQkd/fcs5MeCIdpYajvGHW6+WNn/jN7/8WQHs7vFYwskwmrM:sxZO4qjd/fcs5MerEHbnbCloFlM
TLSH
T18662D651AA749E77CCDBD219B945BF93D6F5457292800E44AAFCCA1C04E6BED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7b25a9faae591668b599a5ac05f78759c15c8bb7488286df95edd45f86ca34b8
MD5 b2e7b350822adb3406bf79fc9b82f876
SHA1 78bfb79762c7b4a4c582781ec6e42122d68f5da4
SHA512 b4d2d0fcd512febe5707937c76e84b85849d4e6d02e5e144a71fd8f4af79a741be8dbb93fcaa14b4a9609d96d7ec064ede758f7e62237805c63cb5513a7b6242
SSDEEP 768:J64jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+durohcdcja6:J64jeXmWvmKLEu1jacPLZQdljJ
TLSH
T1A5D20A3B284CCF7E4F844E5CEC26AE976ED802CB6A584D5047FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 e5e8610c626b038040f61764d910167c45e050a64d30242bc78e0ec5685467f3
MD5 36e598df9b41f417cdd3c5d257f1d340
SHA1 3a0064c22e320f76c5e35586677473ef5c209ee2
SHA512 f82d6600341b83a68997ae3ac4a7835d3e857324cfe59547d1c77e1a820f2c8830c954252c6fc8abafc0bb598f7b65d184add28a4f435a3544ba3e44446af3a8
TLSH
T19F31444ACE91DD6FEC5845B618B6B8B8737089CC4A11E313587C21337E2376A164B5EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfdb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5cfdb1.TMP
Size 1KB
SHA256 2b431da5c80f0dd574ddc72b6ba0fdb6f15c12ff4a3c7869f07bef6bbd69239f
MD5 3df19f9626cb08189bf542973d9f6ae3
SHA1 105a64111ca931c7c7a5b0395539e1c407f5191d
SHA512 2253b08d8dd94468a918dfbd349db5fbcff1cab3dba5b6333a14d8a4dfcffc284fbf746e417cb5cefea9a688b7e144510a433fd3ee6adf138fcf47f8e93eb67f
TLSH
T1A431664F8A808A1BE8D450770EA7A4B8727598404311B793987C6139BD267BE1F5E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 dd1d453e5b47b054d7dedc938280980b7e61290ae3040522d504e51a20a681ff
MD5 4b64526434f759d44eb68f9b265bca1d
SHA1 cb61b0c6d5b613ddd29fb074936cbe054b6bff17
SHA512 9cc3eda4bcd61e2b5d8c969defd9ca8e83bc76bf83a0d239670b020de943c3289f54914245d98217063b7efe72eefd5a415b1617b886798ccbb5c330300ce315
TLSH
T1B0E068F62CD72E20AC7F47E228B204A44106B428C550AC8F2416B2E750A02682016C20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 413b86099a44d73d30548db1ac678b963948fc5cf1df4c4747492071ef3514c1
MD5 094343ed5518742e9dc52747fce53142
SHA1 d6f757e96d2bbcf47300bda1c8828367591497ce
SHA512 8d1f516469a286b58353ffd84f3a8c1c35af807fa6788067f18dc490542e4945b49e2acd6f9b874b77d316a7e588d6b1208681c5487506fcb164ffd3693dd9b4
SSDEEP 24:Kdk/fkGkNkEakhdkVklk14kBk9+kIIjkhk1Kikyhakvk11EkHklSmkvMkq8klkOq:KA1IBK2s8rydTI1K8cQIAIbKFqcjyb
TLSH
T121918141727B12527C3E294D9790873B4B4236633029F96B3FA844A55E2AE361CFECDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\f7b42279-9fcd-4084-9ba0-5067af5aef51\index-dir\the-real-index
Size 72B
SHA256 9a044363327d1fe1e71aa26b3024b700846882033c0d67958d61745f2ac80b3e
MD5 931b43bb740526c3e0eddf8245f12e6e
SHA1 af9bbe064a2cf344d5b67dad4f777519856729e1
SHA512 5b7a501ac4024e1b0b2cdaef51667c2a606b9eb3b6e10c473ba74bea608775285a0c902b7870d90ec8bf483c81d07951b68c15d78f930d92538610de7e4c2fb1
TLSH
T18AA0021053C51446E0101674A08D1BB63325D891190107574494568C9CD12C45911015
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cda4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\f7b42279-9fcd-4084-9ba0-5067af5aef51\index-dir\the-real-index~RFe5cda4a.TMP
Size 48B
SHA256 0d49327b5005fdcb91f53f72fb519a4895fff7a4cb258c3db26598e80a13df7e
MD5 6cae36f6ad75c5ec84a185b706a01911
SHA1 0233468f714a0cd065172d0cca8bc677aa96e70f
SHA512 af9d62aa6209f691d3781c46ad4b91b409b5a7a50a87ff175df90406c5e74b71420c333dc2731cd32d594263379b04d8b61f285af48c06ed2da3f28ac4d24119
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 95B
SHA256 3e46e8026ad32460ec56446df4496086a31d4936956371a206ab35ac6132d91f
MD5 93ac6ee0acc223b23db53ebb984062b4
SHA1 457be7fe40baf3613578d7b465d3a4c478adcabc
SHA512 c673b0488bfd4a0be96ebb6b625facb0471b21695e4398a5c4b81f747da3903218f25aabbf16cdabc401bd161518c780a22fbc50769c634c641cac6936bcc141
TLSH
T144B002FB4445D9D55E7138E7414533DDC57273DC5C85FE8DD4752059322057F5011E24
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c8c1b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe5c8c1b.TMP
Size 182B
SHA256 8eb751f9a6c1e404a6fdcf5489022f98c02a2164f05e702d2569ba98f457167f
MD5 5cd60a19379a331f408ad3223651dee0
SHA1 9ca2d60bba6d3bdb9109cf63fe8317fcc29f1207
SHA512 6a18a47867a7ecd4054b015b15b657d382f9ec049181fc7a96e4f95be751010194fcdf756c77f334f8c0675fbfb65e3606ea1180f6cdcbc670fa6983c2a62817
TLSH
T1F5C0807B0085DF952F653CE7510933C8C6373FE81CC1BE8C445130293630C1B5510B24
MD5 SHA1 SHA512 TLSH

Submit Download

181398a5-7baa-4515-8080-574fb7607943.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\181398a5-7baa-4515-8080-574fb7607943.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c93525db211d136c851725604ebeaec0f6e1bb1b982d4682e312f6b1ee8ded1f
MD5 b73bd695d197382d6c333ab51324f322
SHA1 b6e07699db2c7902398cd13d5353ef26668efb3d
SHA512 93b633989354cce4fb4760aa20a67bdbf88365048f2713458a7fff8b261c3ca6ae68c00a19f397609510285769e8529aa681ad01cc6d35262a8b1618e8ed67ee
SSDEEP 192:qLsNlxQyToZEX2QmiU1755ZH/+jVpjzoruo8RX8EPB5cOTTWqxrsAU:IsNlxpiD3f+D8h8RX/8cTVrW
TLSH
T133423B326CB4AC675DE2A945F04B36538FBC512BDAC96F84E6EC2B1D00DA6AD1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 21KB
SHA256 48e18b652a39695e617d20176b9aedf27f0a2a4b17e14851d6d1269497d46222
MD5 d47c492c213eb83695212ece7f92e314
SHA1 429eaa3ce43ab113d957564020575ff28c412b32
SHA512 486011372e798af230b5a43abf81cf0b3b1161d699cfc9a3011491e3a05e574d4c186389158c83e729e39d5dfff7ea21619de872405898b889793796547495d2
SSDEEP 384:JiFiZcILsN/8TUNTUlIlbpiMn2f+D8h8RX/2FTVr7O6R2Feooh7UNoV:gFQLmwg/nmn8/oTVr7TRfQO
TLSH
T193A26C735CA8DC7B6DF69B45F54A32538EF85067CAC6AB90E2EC5B1D009A69C130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 38d9f42a75186c958f7351bec490ac809b9fb9dbe9604011110e7132dd875984
MD5 54dc4dc0cfa9554818c47a2fe83b914c
SHA1 f4633ba2cae546a5f90230579df44125db7c21af
SHA512 abfd621c196d505246fee7f606ccc0e8c101821f78170b72f22beb8b793cf3bd15965b1dfaedc1905dd9c69029102a8c00314185d0d3badf1826e9e4154e2bc7
SSDEEP 192:EONnF6hZ0QmiUyi7pc/+jVpjzoruo8a5wOZTHGU6:EONF6oxpu+D8h8h2TmU6
TLSH
T12102D8356C687C7B8EE2AE45F48736139FE8113BEA956F84D6F81B1D00D769C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3ef7dfab0eabb9ef0f2a97b0c2efb33c38bddd24245b6246084f235bbdc8c149
MD5 e47263eb26fa5ea4a7935adfcdb6293a
SHA1 05ccd19b35984f58629fb239e29b12de96bee7af
SHA512 f58cde61574c96e1258716c36847551d5c3a8be4af788ebc8afaf5732570db24dc773350f26c2264fa88ecf171768311e070f079a91dc88762160fd9c996425c
SSDEEP 384:2ZcIhsNlbpiJmf+D8h8RX/8FTVr7O6R2Feooh7UNoV:khn2n8/6TVr7TRfQO
TLSH
T1C6828D321CB8AC7719E6A645F44B36539FFC50679BCA6F84E1FC6B1D04C9AA9130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2dd8011c577d625fbce343043c7e2eecf65d6f89a7bd51d0b14ddf8cf27ed731
MD5 259cc1d22218ffd46d3a32b05ece2d2e
SHA1 d83a7c3e39b643029e85a52a15f8e594d8caa1d3
SHA512 9f7957531eb0b0074827a89aaa26cd1e8117c973b5cb4fa73c5adfa8c4aa181a29d84491f2af2b2e2da1be42dad116fc61cea4d340d9ce57e64194e393761bb4
SSDEEP 192:XONY6hZ6QmiUy27yc/+jVpjzoruo8RX8EPB5cOqTWqxrU6:XONY6qjyu+D8h8RX/M9TVrU6
TLSH
T19912F9326868BC6B5DD26A45F48731539FE8512BEAC97F80D6FC1B1C00DE6AC130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 060d413d7ed953757aa1f012df8268b066023084d2924f599262f33a22755cc7
MD5 212447b3652debd59b6a0ac2727bffd5
SHA1 309340d13c40aa343a4c8f0748e459f71d94620f
SHA512 dd6838cf5c93b7a6a948a9d98175a521b0c75765c6b7e1911bdcbaa1e0b1114b0eac6c9142e031dbbe6891ae76f68bab841008bb3c3a1bccadc6813f4045fe54
TLSH
T1A0E00206D34600FEC0BC037D00C31B3525E2412052F201445A6002687C563405F34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c790d12cbb57e1bf84f7a9863e3ed96b024fd5184371545f5fb090d2eb1bb391
MD5 dc6802b1afb43a068cfe91ba5cb1f867
SHA1 64f73a4f2ee0fe5f46518f9ec0010904c92c58cc
SHA512 3eca39acc39e2ea0b86cbd466b23207935bb00041b50ce44afcfb2e8913acc307b153fd5d75638d74db27e3f4ee4ac7ded4e58a36fb2ac7f8bc271e5b26ce6d6
TLSH
T178E00156924600FFC0BC037901871A3525E1512052F201455A60426878973405B34EC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d0a86c63fdd25ce345cde30d597a459e5023f9f003e0acfd97a7a9686ee0e801
MD5 d00ba510b75242fa6e7a27dcdf29e1fb
SHA1 ebdefe6021827db2743d27877c7a8c4463c2b766
SHA512 fb832738160b008fee451b2df385a64946e73093918bd98bfbfc33b0bbcb171ef9486bd37c8f8f1f04fe501683b47ce2c59f32847d5c13afc4d59518d4aa516f
TLSH
T1A9E00156934605FBC0BC037901CB1B353AF1922453F202865A6082787DA73406F34FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9ff0692119ce8b27745228ac94e1965235623e65bb5848e07f2639a64c09e438
MD5 a0d8bf39c2ef1ee09bbae81d43c4a61e
SHA1 62869649eba2bacb513872b431a8d19b11aefa8a
SHA512 1fe1267fe1a9205ed828b836e3fd4abedfb38fd848e39bd841138ecbe94940c0f10eb0599548613bb1683ccb51f503023c1a483662f3e14d1a62954cca654af8
TLSH
T13BE00966934605FBC0BC037901CB5B352AF2922053F202865A6092787EA73406F34FC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 19504e25bfeb7fca99caa18ff713868bd1f6cbda8d8a27de3f633dc1ca1d1be0
MD5 06757c150e62609bb470b194702797a8
SHA1 63ed087658e568ae3e703fa2e4df013246fd0a72
SHA512 df35c8825130869b8f5f92d131a55976de8908d595879740e3c22dd1da67b9822402e3215f54784cea79cc55645cca8fed9bd8dc252548e3bbb48370203bb7db
TLSH
T12FE009A7A34605FBD0AC037901CB5B353AF6922057F306865A609278BDA73406F39F91
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592ddc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592ddc.TMP
Size 392B
SHA256 5aece63acc406039d09e7e4041b9bd342576b807e0f84281a4b30e0b37b345ed
MD5 d439c07b691dbb719025ed5d64a9d2dd
SHA1 e4f0395baa9ce032c4645d3a5833dbe6a1f0fee3
SHA512 012c057b2764c1d51963d7f5fc39b1d069067e247ccb46dd082edb9a4c7e249ffc99eca6de4355f53ebed384418355c3543a70ad77099337b3a153b74fbd71d1
TLSH
T171E00205124600EEC0B8037D00C31B3525E1411052720144566002685C563405F147C0
MD5 SHA1 SHA512 TLSH

Submit Download

bd04add9-ef30-4834-9ca8-acc6958c7e8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\bd04add9-ef30-4834-9ca8-acc6958c7e8f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4a224c769e484e0afb79ca6e059d7137787a38c1d3c202baa96181ecad693f9d
MD5 cb26a8ac1bfd95054f177c95f054c513
SHA1 cf04614ab06d29cf1db696370306e028feb3bcd7
SHA512 911fe31ed2af98a124f6daef4aac8e1b9c725118611519758805ff6a7d10505aa5d13314b8f3874f25f48f88cb72107d907f4e1daefb0bda7a75e5cf0e5d2e50
TLSH
T17941F858B6EA1158B3776E569BF6746E887FBD732E0B949D00020E4E0623B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 8KB
SHA256 e5729f17465be7330f6298efa5807828379e64ea8d23f7bfa0bb459de1c9ef6b
MD5 ebe10fec4f7dd3646d88e2e404e194e6
SHA1 c7cb5dc92789298db4d8c52d586a6716e84e6be2
SHA512 fda37b9c85f53a4a32900ed121920dfd8b00637637a4c999a43dd03e6c34754ff105406799c9400e1b429c40762dc3b84bf4f63990686ced480ea38a170270be
SSDEEP 96:x+KJA8yIwCmwp6pCzjSm+eJmukr4Le7+tJrukrQm+UJnIukMG:NC8pxSEg3bE5AOBIwG
TLSH
T17C02E2409BEA1655F2F6D9B3A9F36B11AF36B9079A188E1D408082091C63F10D97EF77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download