hxxps://consent[.]net-secu[.]net/en/?code=868b2a83e6772fac8a70c9fe5dc40396

Analysis

user interaction
yes
max time kernel
389s
max time network
387s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://consent.net-secu.net/en/?code=868b2a83e6772fac8a70c9fe5dc40396
Sample260910-trtvssvsgs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3564	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335306850571923"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{E9DC865C-D3FA-4163-BC56-B86B00F7114F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1436 wrote to memory of 4548	1436	msedge.exe	86
PID 1436 wrote to memory of 3564	1436	msedge.exe	87
PID 1436 wrote to memory of 4508	1436	msedge.exe	88
PID 1436 wrote to memory of 4508	1436	msedge.exe	88
PID 1436 wrote to memory of 4508	1436	msedge.exe	88
PID 1436 wrote to memory of 4172	1436	msedge.exe	89
PID 1436 wrote to memory of 4172	1436	msedge.exe	89
PID 1436 wrote to memory of 560	1436	msedge.exe	90
PID 1436 wrote to memory of 3856	1436	msedge.exe	91
PID 1436 wrote to memory of 560	1436	msedge.exe	90
PID 1436 wrote to memory of 560	1436	msedge.exe	90
PID 1436 wrote to memory of 3856	1436	msedge.exe	91
PID 1436 wrote to memory of 3856	1436	msedge.exe	91
PID 1436 wrote to memory of 2132	1436	msedge.exe	93
PID 1436 wrote to memory of 4120	1436	msedge.exe	94
PID 1436 wrote to memory of 2132	1436	msedge.exe	93
PID 1436 wrote to memory of 2132	1436	msedge.exe	93
PID 1436 wrote to memory of 4120	1436	msedge.exe	94
PID 1436 wrote to memory of 4120	1436	msedge.exe	94
PID 1436 wrote to memory of 3644	1436	msedge.exe	97
PID 1436 wrote to memory of 412	1436	msedge.exe	98
PID 1436 wrote to memory of 3644	1436	msedge.exe	97
PID 1436 wrote to memory of 412	1436	msedge.exe	98
PID 1436 wrote to memory of 3304	1436	msedge.exe	100
PID 1436 wrote to memory of 3816	1436	msedge.exe	101
PID 1436 wrote to memory of 3816	1436	msedge.exe	101
PID 1436 wrote to memory of 3816	1436	msedge.exe	101
PID 1436 wrote to memory of 3940	1436	msedge.exe	102
PID 1436 wrote to memory of 3940	1436	msedge.exe	102
PID 1436 wrote to memory of 3940	1436	msedge.exe	102
PID 1436 wrote to memory of 4876	1436	msedge.exe	103
PID 1436 wrote to memory of 4876	1436	msedge.exe	103
PID 1436 wrote to memory of 4876	1436	msedge.exe	103
PID 1436 wrote to memory of 2908	1436	msedge.exe	106
PID 1436 wrote to memory of 4632	1436	msedge.exe	107
PID 1436 wrote to memory of 3208	1436	msedge.exe	108
PID 1436 wrote to memory of 4768	1436	msedge.exe	116
PID 1436 wrote to memory of 4768	1436	msedge.exe	116
PID 1436 wrote to memory of 2292	1436	msedge.exe	118
PID 1436 wrote to memory of 4880	1436	msedge.exe	119
PID 1436 wrote to memory of 4880	1436	msedge.exe	119
PID 1436 wrote to memory of 4880	1436	msedge.exe	119
PID 1436 wrote to memory of 2912	1436	msedge.exe	120
PID 1436 wrote to memory of 4704	1436	msedge.exe	121
PID 1436 wrote to memory of 2912	1436	msedge.exe	120
PID 1436 wrote to memory of 4704	1436	msedge.exe	121
PID 1436 wrote to memory of 900	1436	msedge.exe	122
PID 1436 wrote to memory of 900	1436	msedge.exe	122
PID 1436 wrote to memory of 5396	1436	msedge.exe	123
PID 1436 wrote to memory of 5396	1436	msedge.exe	123
PID 1436 wrote to memory of 5252	1436	msedge.exe	124
PID 1436 wrote to memory of 5252	1436	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://consent.net-secu.net/en/?code=868b2a83e6772fac8a70c9fe5dc40396
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff8026cc188,0x7ff8026cc194,0x7ff8026cc1a0
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,7420213388955735032,6061888638046899312,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,15446119254656955046,16107667769650163514,262144 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,12547413553484822978,78200407759940735,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,1362588381973039449,11963962041705890640,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,9713970770332627152,2716725934772825260,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,17913327240663120715,12881162420454070092,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,6203446253862587727,13193837891145240712,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,4267873459050842825,2047889153819086134,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15683435408228775667,8834441753679651307,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10349551946686382563,9854312375209422458,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,10349551946686382563,9854312375209422458,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6116,i,13664609718339895119,17570215817216947189,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6340,i,4497410972309223662,12941794832615030812,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6572,i,2547425177312641866,13258071153743004210,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,195345450694020407,12725697752127746843,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,1844345731344248188,5227848897871519881,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,5942341898628899440,17170892014828141514,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,18051999865398370320,11979156604681912854,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4560,i,8588722859426320358,2200857647504901454,262144 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4488,i,13131428043267934756,7844528152033208762,2097152 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,6070422972452014875,12918751901127395532,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,4084885822031421618,12076357892011172299,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,189453809888771951,5778410562576136543,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2584,i,361501546940538423,11629306799843492221,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,1020493237978184255,6471472653268874826,524288 --field-trial-handle=2292,i,5734459049978651729,5750315488285326367,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5252

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a6673ce49b12fdcbb7d76835e1b016504a29767f7212d8e801c405cb7104ab24
MD5 ca6c08209c2d38cddd20d85d8c5dc47a
SHA1 cec1cabd103f18062e7cb4e4d6f0d8b419a6c0bd
SHA512 21049ac949a133b2d3655a743fa48fb77fd023763be431c403808d8b8cc86ade7133ad2fd2407bc2f19378bde77d294fb858d77ccfdd369434389ccbd4e515c6
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9fd4c46a8a464df3a94f5b0d828612fe170a86f98e9204468b847e3e1dea8dd3
MD5 4a59ec99f6c43cb1767671bda2c7d5c3
SHA1 4b0a58b75238ad47f22632e23ab7dddc3374ee8b
SHA512 c042f4506941e8fbb4cdc4982adaf2c5fd8ec6b7809627a76112f2ec8f78439b7e65f97d0bffcc3c6136813e4c4e091d96f087c7d70422a9a3d5bd63ab3c6474
TLSH
T128E0CDD806CAC76ED388A787426C770C87D13F0ED7CC7AAA5744C4847181648F7D6BA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 557B
SHA256 53e08a03fe963260ba50143a128fa36727a26b8d392da33bed0e498d611e6f3e
MD5 9bdc315e834a7a25afa7e6497c1f82e9
SHA1 a8e983dcb34b15f3f84e5a3875e91d835dde5962
SHA512 12ead95aa285b63d3e20b81cbfdeca9be98be4bb6999768f5431fce3a63e3ad0625abf11633cf430a619df9aa9f2b316a42a87f2e1e73aefc4a5704c282844b5
TLSH
T1E6F08B494BD4CBA5CBC9E75B81A866080A52FF89FFCCFA2D63C5A48C7882141D7872C4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 29KB
SHA256 3b84daf343784dd91ff9ad53daf82192d73e4a387d9e43eecf878323c56b2967
MD5 e653688133018eb7728d2cd265a9803e
SHA1 713f03e2cb932afa8c112343964813cf631e83c7
SHA512 2a56683dbf14f99cc1802a36469ffa47fb4786a441c9991e715707a20e403cdcedf01dc6e2af1c4e7262c61f19302ebbc6b5f82f5edca38f047e0aefc0f9ddbb
SSDEEP 768:3eKrNAVISg2SP+HtwCGFWbrEHoZrqKMUSBNkf2cRLj:D0ISgfP+LDbrX4/J0rRLj
TLSH
T1C7D2F14E45A7556A3AD7DFB3EC90250826305C73721C36D98B41DDC6EA0827E0AAFCEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 20KB
SHA256 f48b0833a0f26ce178da04308d75562234585c2e8b18a27258e61808dd627539
MD5 090badc176f4fa2f40a90bf97ecef21f
SHA1 49c0b438b23f559257a8f9c22442835a74952d32
SHA512 795f4b96b0d63c841405049bdbc762ab07b25779304a18ebbad03cd3f1d11643f471ba86fa8e77dfe06e647fd317fe6878748055096a4a5d51847b7a138ef6d0
SSDEEP 384:6UOg1y8PJKYfYqOOAuHn2giUWCd9fcIkpfKJ:i/8PULLOXitCd9bkp6
TLSH
T1D69281F04BD56D56FFD93038A4C27C7521A292C74ECA1BCF8938D4E83787AD4AAD5802
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4de67affb9a0b93d8e6b7367fe95801c0baeba55661553ba1ba141aa933c71b7
MD5 66bcbb0d7009b68fd628706dc2c97888
SHA1 d1885d09bca97ef04d3d73c95cf54c450d3b7671
SHA512 d36f726e700285d921bd037dfd38ad5644ca9cb9532ab8a0017bf12f95de56fc3ae00f0100ea2e1d7e608af012a0367333b5e49e06245382dcf29de35a077c03
SSDEEP 48:D+Nf+YJarTlltH7tJpFSLMw4BBVZIE02x1NaixC6/cd/91W3/t0Rd:DsGmQTlltbJcf4BLZIE51NHxC6kdA0r
TLSH
T1458119F502A22AA7EB1D4131E4EB690A367787594E932E16CEBC853C35C3F80FB14909
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 112dd499d19ac5a449073731b1be984ab264ee3c66fa847c1cce93b0f3e1d87e
MD5 026697bd68fba99cab923c1ddfebcc6a
SHA1 9a694f21af6dcae17d1922de67ea4425aecfd698
SHA512 7b3138a401b8af27dbe2ac39c4a7fc6735d9f2040ac9d8ed303c6b83f1d1596a25a9d368e999de8ecfce2a02d20cad575df3bead3e7fefdf604182d84a857b24
SSDEEP 192:DOMazsCnqyRXoc76Eys2io3r9XQ28mDyXeT3ilH3CziMl:DOMazsCnqyRYc7JysbERApmDyOTSlHSB
TLSH
T1BAD18BF2C3E9862DC96512F5AB253A17DE5D0D1443283D26C9EAEF1BA3F2470E21161F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 3534ba19105da83f6ea774f5e89c90ef528eb79f1b96a7e23c0514862384e8a2
MD5 479563f9a5d5885fc1e3cf88e4855f24
SHA1 0d6fb2ac93d9b67323875d573117e10493808db2
SHA512 19cf88f6ddd0341cb489950e1e43539dfda2f433da50ccc092879abdedc91cd3e8e05d5608ba523e5c1ee31e9caabcb6ba14b0ccee7a7df6678b7bd76e6a3be5
SSDEEP 192:DWFAS0Ku0cyRXi26E6D2io3riXQ28evyXeT3HH3ikTTDqzeGj44Ml:DWFAS0Ku0cyRy2J6DbEmApevyOTXHSkf
TLSH
T148C1ACF283F58A2CC96152F4AB156E1BDE580914432C3A6AC9E5EF1BA3F2471E21071F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 9f690b32800a2848b203f54f01c59d854df21c3ff71d44835be8bbe7bbbb1daf
MD5 db228ebf2c77bb500edb9ebdf36b1a59
SHA1 20e39b13a3191081e091ef3347b5be4c228ed522
SHA512 b6b4be9111ef454992af2045be9bbe0a992a2317a5ff85e66563df37126eec1eb0d3d6e3e8cf734347a23f3f0aab0693c510ff5703eec0815011f0dbfd299206
SSDEEP 192:DOMazsCnqyRXo26Eys2io3r9XQ28mDyXeT3HH3iXGTTDAqziMl:DOMazsCnqyRY2JysbERApmDyOTXHSXGd
TLSH
T109E17CF2C3E9862DC96112F5AB253A1BDE590D14432C3D6AC9E5EF1BA3F2470E21161F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eb5a7109fa49339603df83e0494aad583e995be64354b79c0fedc718144eea5a
MD5 51fdacfdb446f3327ee359d6b7afe693
SHA1 bd34246e8b0a7c193624830386986bcdbdde86dd
SHA512 e00d8e746f6f85eae0919a01902fc094e4c896e21c0e8aa1344e2544d7fba2f52e74e9eb0ca570974b01306ece3b91afa208f294e91b2dcab4540f94adb8a69a
SSDEEP 192:sxZC4RGyM/jK1Ml8MWk/fZ7s+dIIdpgWHW6+WNT5n/YHkEtXIgrJ:sxZHsuk/fBsi5nHbd/M9
TLSH
T1694209126A34AA77CCDBD209F9557F93D6F54472A2940E44ADFCDA1C04E6BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 31180a4c5985b43783bf13edcfd1d035632fb92694f3fa0c33fe49ee355569e6
MD5 dba0d0a11c16a19890413e18c9ecc459
SHA1 a96a34784482e9c56bed0d5bbf1cdd717e5d68b1
SHA512 395995a252003352a0c87bfe96c8e5da83a337a597aa88cf911060beb5f09dcd7070635e8704ac77a7d5f654c48b583078c2fa63ec447dbbc6b28c81fa279e94
SSDEEP 192:sxZM4RGyM/jK1Ml8MWk/fZ7s1dTIdpgO7uHW6+WN4MW5n/YHkEtXIg5EEJ:sxZhsuk/fBsHMKHbA/MaI
TLSH
T10952F9166A345AB7CCDBD209F945BB93D6F54472E2940E44ADFC9A2C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 adf079d24bf7e38b96a704e8c7f609843bf1e5dd89326af460ef08452cee7028
MD5 fb50bb8705d76fe6c4350bfa5c020fb1
SHA1 8d4acd233464232da1644ea05321369b01fae29d
SHA512 c9f6dceac637fc367d7a7eab60ce73c80d6d1cefab8fc7e5ad98a0aba757dcb82737f6dedb9cf88301e933b3038672d7f29393b1207e0fd0a0c89906c6ab3f3c
SSDEEP 192:sxZM4RGyM/jK1Ml8UQfWk/fZ7sMldTIdp+y87uHW6+WN4/zCW5n5i+HYHl+z7XIc:sxZhsquk/fBsMXMdHboJHoS0I
TLSH
T13062D75269345AB7CCDBD20DF941BB93D6F54462A2940E44ADFCDE2C04E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 720B
SHA256 f2580218af7e48404a1ee532d362e724a9c72dea3dfcd410dc0bb162dfa55652
MD5 e3c73180eb85acb999ed13c65283fa07
SHA1 235d008f11f06db8eb8452c09ac083c8ba3500b1
SHA512 688c53ea9113986a67b704c7d33f0c385e59e99f3e3a4c802766e12be10d1fde2d0cbc40029d780cdd32f6c786a41f4b1f8b037e4640d8b5223a2a638437e19e
TLSH
T1FF01C01A6FB04D6FF865027618F6A0F4F33158CE8722D13B682D2A273D1730839666DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfd15.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cfd15.TMP
Size 720B
SHA256 8a7424217382f98c0843eaba0c32894062f502307d2a07cd42f1a3d4041cbefe
MD5 b1f05c707d2ca666d71c41c30c66c302
SHA1 1b1829a0f0d10507a719e1b917ca4f7ea019bce3
SHA512 22d14fb613615b7acf90ebdb4c53c3a2b7d8657f8fe291f56537da6c39e81ea4c82ef651e84a47e7f5d316fd968162e7b8d0f27d19d1005fc3090051c0eb0616
TLSH
T1D901C0675A914D57E484023B1DA190B8F23149008352E2B3646E152A9C35B8909160CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cf535e4a645b29ea5646460c5b60d564413dffcf9e12f950eb73581cc75b33cf
MD5 9deafcaacd623ebe3ffb6276f475e6ee
SHA1 2531ef6e7b76cc2114eb3b951742631b359f996f
SHA512 df18ae7cfa7e6c5f04a45b963304c6ff07d696c8bafafe178421f31f080a2d89393878adb5c5df0e730aca72427cdcbc815332deaad5e83c0bad35dc3607c32c
TLSH
T103E0C0F73DFB1810AD7FC3D744B1E4A401013CB8C64CAD8E00AFA2A310B23402806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 186148e65b943c90700e522f3b72091c99df91d43c193c1fa03330996973045c
MD5 0e00925bf2af7376726758029a53371a
SHA1 0c5e3fde5c725887f6e0cb7bf6aa9704986d8808
SHA512 2b842bab0894fd28c07f1cc20952e5384d429f46f4a1d411a7bf910e4f630584b409ec571fadee8afcc4c249acde1d2a9722418ad8b714c06d5d450b54fed359
SSDEEP 96:KA1eK2A84YKR+Ou7KKsk/LqK4gyufOKYA4:EWX5JB95
TLSH
T1D4D11C4670BA02023C7D2A588794975A8ED671633028F42B7FAD01B65E67E31DEFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abd32ce3-d798-438e-9a5e-be8d7d51f4c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abd32ce3-d798-438e-9a5e-be8d7d51f4c2.tmp
Size 30KB
SHA256 5428033813e57e92be5a5829db57c758d1ffa9c7c27c5d01433d4ab21648d251
MD5 b1d41ad32b5062b17b60dc0b695aea80
SHA1 8c0422a76edc2e58d4b23493576f4ce40b112232
SHA512 1056d5e01e97a605cacabaee260d5a5164ce62ef9ad23fc034d79e27b433893f1bfcee65090c150c4b73c3a47bd6010b18a672bf157c8750017a4ef1e9ffd183
SSDEEP 768:RUUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RmroVZ0B:RUUZYTMWvg0Pou1ja7eLZmRdcB
TLSH
T1F5D20B2B280CCB7E4F844E9DEC266F967ED801CB5A584D5447EA884C03CB7EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

246b840a-364a-4f3a-84eb-65b4eeed56ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\246b840a-364a-4f3a-84eb-65b4eeed56ae.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 7acef3aa3d780a2520e169a950c0f473b26063714dfe7b492dacfdeded6d60c7
MD5 a002d57ac330eb772154dc44fc118ab9
SHA1 b1f76f87587b026c2c13e5dba2d43658f71c7d1a
SHA512 7dd58ffadef42f19ec5b35183706dbf0e4e2e92002bae29028299f1b6fc83581e59f7afcc8d22364c7866db5760ff3b8206c198124e70ece59dbf35480007091
SSDEEP 384:MZcIhsNpdMIP0KvWKzX5od+l8yBX0d+2uysa+VYx+om:ahY0ZeO+cluyhgi+1
TLSH
T13C826D726D64AC7759F3A285F84736435FF88063E6CC6F8486EC6B1C019A6E81317C17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 30b7a5aa758af1225684854e8a9e47833adf0b9eff08884a0d1a470913f243c3
MD5 2eda5d4c23a76de38ac687bf1db3ed07
SHA1 28f25322d121ecc5ab5c99eee7a8fa80a120c090
SHA512 7ca6106c4cbda9cdcab8a37878d4c806e32bf8363a7611505b0aebec1039ad759f2188238a0f48cb7bbc9fbe4de94c50bd4510e9962d07ade532e677535bb445
SSDEEP 384:MiFiZcIisNL8TUNTUlIlcMIP0KvaKzX5od+l8yBX0d+2iysa+VYx+om:3FQimwgq0xeO+cliyhgi+1
TLSH
T121C22AF258D79876D9EF9747A77E2E024EBCC063B5885A40B3985A1CCC961BFC306C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23c6b36c6efa0c534d56053a5c35f674bac4bb718029f1111953e7d873e33350
MD5 99464c20f1ad76962071fd467f9512f2
SHA1 6afc1fdc728d2855875dae0b6913a907da491455
SHA512 eae2772324877843a18d58d190ffddaed6867c46bfccdd9b6f3f5389aa13f3099d0a04fff540eb956c88d1cc8fbe769f8355b8da797c86f0fc23ca7354956a1f
SSDEEP 192:yON261VWQmiUyN6gGX5Obd+j9jzoryMmM/an3Q0U6:yON26WJgGX5od+l8yZA0U6
TLSH
T19702C73568687C6B8EE3BE49B48737135FA4116BEA946F84D6EC1B1C00D769C2347C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 9ecbe40637daa7b0cfadc2782a6543d210547144c54ecd313f8ec05a130aa696
MD5 dcc7e6080f4bbfb268cf1e9d9352e044
SHA1 355c6bd4cd2c7744cee1444c00554cdff8c30289
SHA512 6db02f7746a885a9a0b070630d45916f89a8d77f4ac226402663446ee5099a9f5e09bb064b5adf30783d099d9a28a8c0b24762fa2dff1a43b63a0bd4717731ac
SSDEEP 384:OZcIhsNpcMIP0KvWKzX5od+l8yBX0d+2uysa+VYx+om:shp0ZeO+cluyhgi+1
TLSH
T120826C726D64AC7759E3A285F84732435FF88063E6CC6F8486EC6B1C019A6E8131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8454f2a028efbc13a7d9924e1dc00904c7e2261e07c8db40b2a878785b7b03e
MD5 80e26b890727431786a23374ad2bcb09
SHA1 77b6d846f2ab102721f664c2bbb5fdaeafef547c
SHA512 596a07c3ce8314c1e8d88a1876ab15f91acf038a3641d5723bdf3295401d641a0222241bb178f7a38f49508e482b8c5bb8ea79dbb2fb632118fcb09c28f55459
SSDEEP 192:aONM61zWQmiUy86WGX5Obd+j9jzoryMmLXQFd+2JjJ5qfU6:aONM6ceWGX5od+l8yBX0d+2LyU6
TLSH
T1B0120A32A868AC674DE3B545B48732135FE55127EB886F80D6EC2B2C01DB6AC131BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f8c2fa7e52b7cf8b1ff1a6e94b5a95404f846bb226ba5767fefd6746356c6d79
MD5 3afab07e72a30a2de84ab9455a22b46e
SHA1 5f19793afdfd589375be4f8b99566bf8adc880f5
SHA512 f66845dca126cbafdce86e2a91eeef9bb99a88462be93f2054369d649dccbbb3409d07b25e476177d996c350f89705f325b26aaa6debf3654684f577658bdc69
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3e30ed21797ba3e9402a3cd834e04024c31d563a7f4c991eace1f14eb469904c
MD5 e823f1582c55bd99af6610adca4db0c1
SHA1 3bf268eb0fb8dcc6c736add24cd07600ceacf4b3
SHA512 03b6a8ae5f8786337bec545aad02df2fde52b6d6266603ce500b894af9e895bf1811bed176edc0537fcc1096d5d29b480b459ebd45096928f954f30c8c73743b
TLSH
T1B4E002429380007EC42C0A3511D31B700741C11452F20347677042BC2CF03041E31CC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a510f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a510f.TMP
Size 392B
SHA256 fccdc3ea0f588cc7971191d29eb63d95af22108c9950ed554c248891f0bdd628
MD5 85ee8dcc1589d6499ab207017ffd1bff
SHA1 22ebf0566e61f183fe50e60fbe2c7f47ac8a71b2
SHA512 31aeff47c3d6ebb8d57a9029b6a03963498035133f72b93a688d58c7453b59d49fe0ec987d85b990c9216bc7bf6e424fcce7aaefa2791644fa36e124703596ac
MD5 SHA1 SHA512

Submit Download

8a766386-fd88-4d24-a0e2-e5884b20ff10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8a766386-fd88-4d24-a0e2-e5884b20ff10.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 34c060233cdc07343d2427a8e8307cd28e25d7a21cb28a82404670e59a19df70
MD5 bf374ed8a3506b391495972db03ca963
SHA1 d973b92662422e0f3ce756981370fb4ae3f8eaf4
SHA512 06a00607b95e4002e337b8c92531db80e69584c3656b7e2a2a918e5fa5d1fc7ed4838a8313bd9e67ce9a78f8e5c6791c6b89ce883e6ff7b390feb1ac1721667f
TLSH
T11C412859B6E91108B3B36E1A9BF6B86E587A7D732A0AD55E00110E4F0B23B40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download