Resubmissions

12/09/2026, 17:32

260912-v4lwdstwfy6

12/09/2026, 17:32

260912-v4fdls1fng6

12/09/2026, 17:31

260912-v3xw9scn7t6

11/09/2026, 18:28

260911-w4trnsag246

11/09/2026, 17:58

260911-wkajpayfnd6

11/09/2026, 17:28

260911-v1yqsa1tcz6

11/09/2026, 16:48

260911-vbabwsxdlb6

11/09/2026, 16:47

260911-vav7zazxcs6

11/09/2026, 16:17

260911-trlt7ahp216

11/09/2026, 15:48

260911-s9an7shl4s6

Analysis

  • geolocation tags

    cacanadananorth-americatoronto
  • user interaction
    yes
  • max time kernel
    1799s
  • max time network
    1800s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260513-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    10/09/2026, 18:03

General

  • Target
    http://discord.com/login
  • Sample260910-wngr6seq8t
Score
6/10

Malware Config

Signatures

  • Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs
  • Suspicious use of FindShellTrayWindow 37 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://discord.com/login
    1⤵
    • Checks processor information in registry
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffaf729c188,0x7ffaf729c194,0x7ffaf729c1a0
      2⤵
        PID:4952
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,8941668661997894456,18372052573306079583,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:3
        2⤵
        • System Time Discovery
        PID:4124
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,16821675925315029444,11424941334499656890,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
        2⤵
          PID:4484
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,12172462449340166952,11193702914666657294,262144 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
          2⤵
            PID:3832
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,599142120208655944,15161872504426313013,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
            2⤵
              PID:4448
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10179515337053800837,13660776283229306755,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
              2⤵
                PID:4180
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,841768079575964578,3745846727907062839,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
                2⤵
                  PID:3588
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,12817887296939035670,12996711638199199711,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
                  2⤵
                    PID:2180
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,7064682007410911578,3497930965740275039,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=4800 /prefetch:1
                    2⤵
                      PID:3272
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4413530635680930125,12808601380346323303,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
                      2⤵
                        PID:4432
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,5390303937600495971,8366192421098424294,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
                        2⤵
                          PID:4380
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5396,i,8161819245567962720,10527508031120833111,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
                          2⤵
                            PID:3880
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5444,i,14998158637481300680,11000483653388509072,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
                            2⤵
                              PID:4704
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,5084249722410349074,4245030348206659145,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
                              2⤵
                                PID:1700
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,5084249722410349074,4245030348206659145,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
                                2⤵
                                  PID:1096
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5708,i,6737454028587928271,12219216147681184511,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:1
                                  2⤵
                                    PID:1240
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6860,i,3746476819297753369,1302581923913236236,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
                                    2⤵
                                      PID:4144
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,3918554938048803290,5440334562309740976,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
                                      2⤵
                                      • Modifies registry class
                                      PID:5496
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,14800725297728807888,6329543966959645850,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
                                      2⤵
                                        PID:5504
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6916,i,132004153841557530,17719673864854343172,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
                                        2⤵
                                          PID:3116
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7244,i,2692772464622021390,11869209524362624881,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:1
                                          2⤵
                                            PID:5740
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5192,i,17608404103571269812,8816461977243731686,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6600 /prefetch:1
                                            2⤵
                                              PID:2100
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7444,i,11159839521286426902,7509877445443087222,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
                                              2⤵
                                                PID:1048
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,5252636822316732562,14567907698782219852,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7052 /prefetch:8
                                                2⤵
                                                  PID:5188
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7076,i,12257151946755048970,11688350557598179278,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
                                                  2⤵
                                                    PID:4028
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,12638056852546238771,8067387510988289676,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7028 /prefetch:8
                                                    2⤵
                                                      PID:4696
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7604,i,4153297671731812457,1797472500562014261,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
                                                      2⤵
                                                        PID:1104
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7848,i,5368462489832148196,12248930926373528933,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:1
                                                        2⤵
                                                          PID:5156
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8136,i,12788408688209382443,3281961123809444373,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8120 /prefetch:1
                                                          2⤵
                                                            PID:2704
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=7544,i,8840527352844051813,16147233943851500839,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
                                                            2⤵
                                                              PID:3636
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=7904,i,11907837043146834329,18258029258721688548,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8016 /prefetch:1
                                                              2⤵
                                                                PID:6040
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --always-read-main-dll --metrics-shmem-handle=8012,i,5785335591783220148,14149363433942458570,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8048 /prefetch:1
                                                                2⤵
                                                                  PID:6052
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7536,i,14455598694579583073,7401547935774761117,262144 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7976 /prefetch:8
                                                                  2⤵
                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                  PID:4464
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7552,i,8987368632453802754,9358413358025400087,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
                                                                  2⤵
                                                                    PID:912
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,10405532413241863471,11908756974772800389,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
                                                                    2⤵
                                                                      PID:2888
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7940,i,1568879057129294706,12364132753407167284,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=7464 /prefetch:8
                                                                      2⤵
                                                                        PID:4880
                                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7376,i,6894908147359172571,15671899823463175036,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
                                                                        2⤵
                                                                          PID:1872
                                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7392,i,14106948733671859545,6018828712532989180,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8148 /prefetch:8
                                                                          2⤵
                                                                            PID:2636
                                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,17434226922092292227,9992581809177726196,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:8
                                                                            2⤵
                                                                              PID:4068
                                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8664,i,536854195265210107,5559417492444088205,524288 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8684 /prefetch:8
                                                                              2⤵
                                                                                PID:1064
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=42 --always-read-main-dll --metrics-shmem-handle=7468,i,15350009787650937180,8925371389601106374,2097152 --field-trial-handle=2288,i,12754932433852997394,8323821669549955327,262144 --variations-seed-version --mojo-platform-channel-handle=8908 /prefetch:1
                                                                                2⤵
                                                                                  PID:2940
                                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                                1⤵
                                                                                  PID:4684

                                                                                Network

                                                                                      MITRE ATT&CK Enterprise v16

                                                                                      Replay Monitor

                                                                                      Loading Replay Monitor...

                                                                                      Downloads

                                                                                      blocklist

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                                      • Size 105KB
                                                                                      • SHA256 83a8a4722b592160d32a2028e38ad6f74177396a278b3e08d360409db103964f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      settings.dat

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 5058bec69519543d6f0c441e2e2c3bfb76e59a8d2b455005d4e48ae989187219
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      settings.dat

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      settings.dat

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                                      • Size 280B
                                                                                      • SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      LOG.old

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                      • Size 331B
                                                                                      • SHA256 8d7f0d88b3e8e2264094819f130821456e60b764cc04d3a249c3a218a34dce01
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      LOG.old

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                                      • Size 331B
                                                                                      • SHA256 a26bbfd69eb299a938c547da6be6103cb2d89609f51a182b07087d6da22030eb
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      BookmarkMergedSurfaceOrdering

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                                      • Size 6B
                                                                                      • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                                      • MD5 SHA1 SHA512

                                                                                      f_000099

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000099
                                                                                      • Size 33KB
                                                                                      • SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00009a

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009a
                                                                                      • Size 96KB
                                                                                      • SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00009b

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009b
                                                                                      • Size 408KB
                                                                                      • SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00009c

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                                                      • Size 72KB
                                                                                      • SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_000107

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000107
                                                                                      • Size 30KB
                                                                                      • SHA256 1230a480ea1b0580bbdcedd704381f8c22b625304a0694f8c82f269cf48d9516
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00010b

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010b
                                                                                      • Size 101KB
                                                                                      • SHA256 1e87f1ee8d03da0c822b9f8295170db74fc059bda009fc9f31299c123a5a79d2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00010c

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c
                                                                                      • Size 41KB
                                                                                      • SHA256 99f4122ee9ecd69a7904404a974ef594125b831cba01658acedf92d4db9e867f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00011f

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00011f
                                                                                      • Size 452KB
                                                                                      • SHA256 3419dbf81935502fa877332ba104193a786a8bec64f5c69524a1831ffe86ec9e
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_000122

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000122
                                                                                      • Size 52KB
                                                                                      • SHA256 71d7e3adabb54df0b0976241822446f37cf13413834de4b9f7cf96545f3e2d4f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_000128

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000128
                                                                                      • Size 17KB
                                                                                      • SHA256 31ad0482eee7770597b8aa723a80fd041ade0b076679b12293664f1f1777211b
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00016b

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00016b
                                                                                      • Size 1024KB
                                                                                      • SHA256 e76f5ad294004d4b3c5866526a85bcf7ad9a29eba095f015088020fda5df93f2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      f_00016e

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00016e
                                                                                      • Size 1024KB
                                                                                      • SHA256 4d0ab1ae9f55a4b6cc9c9ed3d44ad23b21c3fc1f775c0ce88123911125bbbd64
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      temp-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                      • Size 23KB
                                                                                      • SHA256 2f3974643e9ff021d74f4f2d3b0c02978d04a3518f43e7c69174302cbb7398b6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      temp-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
                                                                                      • Size 23KB
                                                                                      • SHA256 15023649db20174776753702037221efb35c9222841c5ea46c6278587c44f5d8
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 21KB
                                                                                      • SHA256 3f830bb5be9eef9ebc30487eb4889c2ffad557a1eab5686d0bbb8372a83eb37d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 21KB
                                                                                      • SHA256 159775bd9eeab5ba53383f04c7a3b7b03b56108aa67fd179c4a0848ce236c173
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 e757641cc879f97e638f5cc8240b7c260b7730c18489decfc4be9f3443c25520
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 361e9e937003ab6e5115d616a64e8acabe5f893ed17cb2dd1e7e1f8015a8a3bb
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 0157545fd62794db7b7efc603587d9efe49d23e4889310325b3555265b39f59d
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 25670e582cb26fedffbebdac6e83b5e4da3da996423e1b50374ce2cd9cfa11d5
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 bd39ba8b98e3b6360d8559f5726af9954082210b5679d3eae189e81613b390d9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 a7c9004833776928eadf4137271ce3b40d9357b053077c84e5bae12b0a163cb6
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                                      • Size 23KB
                                                                                      • SHA256 c873dd0d7dff72ed472584cf1b07203874f38a9a99c54a82c43aaa3f44bffb2a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index~RFe597788.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597788.TMP
                                                                                      • Size 3KB
                                                                                      • SHA256 acb183bd4d2f8ce3b0e223b6673bf4ab2f92f211c5cd8fc337563c9f52d8940e
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index
                                                                                      • Size 96B
                                                                                      • SHA256 274b297c624502b383cae9ededf05a13c28147bc0953e47481f32b7b48f00296
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      SiteList-Enterprise.json

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                                      • Size 2B
                                                                                      • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                                      • MD5 SHA1 SHA512

                                                                                      Edge Profile.ico

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                                      • Size 70KB
                                                                                      • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 23KB
                                                                                      • SHA256 99b093fc8c479305aa2712688d9e8a9273521ea83cd74e7e6ad4719e43249879
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 24KB
                                                                                      • SHA256 cbc579a8f17a60b59ef87bd5337c623fd57e94667bebbce96af365c15ff707e8
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 14KB
                                                                                      • SHA256 149ee1b4be9b6863367c3f7d3f75d5b47af07acd43e169a02f09155d760291df
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 111B
                                                                                      • SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 111B
                                                                                      • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 26KB
                                                                                      • SHA256 51c76b9d47b0632ae88af4a491dace60eff382264b9435adc3b471a4b085ff5e
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 25KB
                                                                                      • SHA256 f705afdf33c6ef40c962ebeb50f3f4485dbaf434b82851e18b43e4713ebac02e
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 26KB
                                                                                      • SHA256 ff27a0eca345a77fe9e91e1074cb001b41b1008a3bfbec08aed9fcf793d88e9a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 26KB
                                                                                      • SHA256 5633abb1b6168dfab8d7fc9725f94617c3efa9ff3a1adaaa79f667814abf24a9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Network Persistent State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                                      • Size 22KB
                                                                                      • SHA256 fe25a358b511641cf3eacba1629f16778f2ca8ef115976c63e5b62a707d6c9d9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      SCT Auditing Pending Reports

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                                      • Size 2B
                                                                                      • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                                      • MD5 SHA1 SHA512

                                                                                      TransportSecurity

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
                                                                                      • Size 6KB
                                                                                      • SHA256 16fb301813fa28dd878fbbd4ce82820cec5926626c380c3a473761e351f32d92
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      TransportSecurity~RFe6adc1b.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity~RFe6adc1b.TMP
                                                                                      • Size 5KB
                                                                                      • SHA256 8404fa10d7e89242d93f38171a3a9df25105445648211d2da6c15858e42d21b9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 18KB
                                                                                      • SHA256 af3f6f8954929380d06ffe952811f17d078a99ed5bf575b2ad2834183c67df5f
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 13KB
                                                                                      • SHA256 b4d5ae2e60ca3258a7b7aff646b6d74b6568628dc6bc03686c1ffc3bb72369e2
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 16KB
                                                                                      • SHA256 1e4853de81d70bf1b3f7d6ed84da861aaeb148cc2a3646f6a3aae7cd0c59d228
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 15KB
                                                                                      • SHA256 1a4fea1cc426aa0936cddf774b0249ce1f8dc7550fb1880b45f5f203c9b85345
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 15KB
                                                                                      • SHA256 079b6b2e4ba813665085efdae8e0f3564c3414a3856f5374a1c97558d7e85ec7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 18KB
                                                                                      • SHA256 e6ea867e7bf4742344ecca29a1ef5ad635ea83d0666bb691bbed59e85b9b4795
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 14KB
                                                                                      • SHA256 da2f60b658dedd5ead1aafb8b915174b098424075b672779aace6caacd3add33
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                                      • Size 16KB
                                                                                      • SHA256 51d9bb520fe9c64961b2b6f68e7b2f986f60977ceb88eb1c42efe53636bacb0c
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Secure Preferences

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                                      • Size 30KB
                                                                                      • SHA256 47b132890a5bd45de2e3cd4b7c5adf0ce91a79690a169b7d215e06adf1756d69
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
                                                                                      • Size 1KB
                                                                                      • SHA256 d1eba0e8ad7abd49dc235cdefaabf93a01471900d1834ecd1b266461bfc1cd21
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
                                                                                      • Size 3KB
                                                                                      • SHA256 fb8188c35f5e557e42b98acc2653a67904faafa6c6f462b81e8cc4521d9cc44c
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index~RFe58b495.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe58b495.TMP
                                                                                      • Size 1KB
                                                                                      • SHA256 96a4c13d9435bfdab09d697b2d7aae0c13d63d099a720020fc3b1fb48fb874d8
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      index.txt

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                                      • Size 371B
                                                                                      • SHA256 144cd8077f4fb4739c8a9eec26ac84481649ee45cb79e7e1b556dc91aa7878fb
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\00124e3f-8dad-4b93-b4b1-9e26ac23fcc6\index-dir\the-real-index
                                                                                      • Size 72B
                                                                                      • SHA256 c987f9139e9b6c6fd33335cba7697694ab5acc9351f094fac37aac32473cfdad
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index~RFe599292.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\00124e3f-8dad-4b93-b4b1-9e26ac23fcc6\index-dir\the-real-index~RFe599292.TMP
                                                                                      • Size 48B
                                                                                      • SHA256 0f1b4a50096c9c37899184800d2998d172ac345f11ac3229485d4122d99063f0
                                                                                      • MD5 SHA1 SHA512

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\89c63856-9ee8-48cd-8ddc-3bfbdbe511d7\index-dir\the-real-index
                                                                                      • Size 72B
                                                                                      • SHA256 a27db4e3e8cab7d40f70b34aeafb79837101284a5fb097e5f5a55c67d24dfe71
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index~RFe596884.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\89c63856-9ee8-48cd-8ddc-3bfbdbe511d7\index-dir\the-real-index~RFe596884.TMP
                                                                                      • Size 48B
                                                                                      • SHA256 65dd8931fb1d115cdfdaca21080035f6634fc90c7c0748917d7c7fa791f0eccb
                                                                                      • MD5 SHA1 SHA512

                                                                                      index.txt

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                      • Size 233B
                                                                                      • SHA256 9a362cfa74f362379a9959df89869d728be494d451f7089fb77ebec2b1f70c62
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      index.txt

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                      • Size 226B
                                                                                      • SHA256 6344a1ffca4e411df9f4734ea9542b5aa9eb50cfff9a35734965e551e15049f9
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      index.txt

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                                      • Size 229B
                                                                                      • SHA256 bffda1fbf2f652229ed1e88badff814e38d43a123f4430a554bd34f944d78833
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      index.txt~RFe58a592.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe58a592.TMP
                                                                                      • Size 138B
                                                                                      • SHA256 0b1be35a466a22dc654f5dd5bda23226eb1ecacc144a199db305bcd939b2b97c
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                                      • Size 72B
                                                                                      • SHA256 cbbc398d60e9f2d39c8d563a4c355748d3d5461c1e9d1eff522b404fe1866b0c
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      the-real-index~RFe591d90.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe591d90.TMP
                                                                                      • Size 48B
                                                                                      • SHA256 eab51bf0da6ffd8d2f443f863f88ffde27a221994aa163666c13e2c14c505742
                                                                                      • MD5 SHA1 SHA512

                                                                                      sync_diagnostic.log

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                                      • Size 4KB
                                                                                      • SHA256 7b1976ba22dff1e6f8496fa1f9865b17349111072674f2874b01634515437ff9
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      2bedcdd8-a575-4a84-bc89-5e2191c749cb.tmp

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2bedcdd8-a575-4a84-bc89-5e2191c749cb.tmp
                                                                                      • Size 22KB
                                                                                      • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 26KB
                                                                                      • SHA256 39bcbcadd94ee2714749addd8e7e271c517e47b4c7b0862df2d518f3564f0565
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 26KB
                                                                                      • SHA256 4778de637cfc864d41ec10fd1c8d8e37825b62a65d7b4971c6139d4eb09beafb
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 fde2a57184dcf8667b8f7a0146a576bab811ab23dbae8bf6b5cb1ad034d2d8e4
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 18KB
                                                                                      • SHA256 0907ae01fef4899295e7bc937a50e5eabee0d8b7e319c9aa5178ca99ffc41350
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 18KB
                                                                                      • SHA256 a54202ea27fe1bb56c546e79759fad67434d59c69a11e2983ace045f6b4f9319
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 18KB
                                                                                      • SHA256 eb137ecac46011528bd322694f418728d5f068c10b58817917d9817f91afdd5a
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      Local State

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                                      • Size 8KB
                                                                                      • SHA256 4fdd1b1aa42b0653888e48fa64388bdb4d52b1b3998d5eb7ec7aa9058a5461d7
                                                                                      • MD5 SHA1 SHA512 SSDEEP TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 c2983fcb89c5682a2cfe9f8a1444198cc15360a093e12754701b54608f0c0cad
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 46a642c5843085000e8d1f8d07665c7d51b008c0e62527297c91cffa31eaec95
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 34a7f48df55e38d766d959e94583d29680382e54092bea333c18268918ce5cd1
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 3ad4c1abc482e61e975afd4267d17ebab7660a6fc9b9da4779069f404435eacc
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 61df710c7257988dc4154f4c10409d5d297480fb7166710e8457d9b341cc56dc
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 f07729353afb720ce6a6c40e49de19fd1157d4bc5f3ccca20ec02393a90b32ec
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 f00477a6553114627e678e7724af6f9672de1579333bbe6a0dae463aa347fdca
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 0d1742834ff9d9007b8be194d87cc61ce064ff8f9d1981f487042fdba4f08649
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                                      • Size 392B
                                                                                      • SHA256 95fd4c6b41efaf0a2f51b5fc21b48f3abc0eb7a7bb2a91f6847071d2d72d460f
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      RevisitationBloomfilter~RFe59b77f.TMP

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59b77f.TMP
                                                                                      • Size 392B
                                                                                      • SHA256 cddc53b1f898f20dcfa5038ac8e00a42d594207c760523e2e3aa236e10d86d77
                                                                                      • MD5 SHA1 SHA512 TLSH

                                                                                      metadata.json

                                                                                      • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                                      • Size 13B
                                                                                      • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                                      • MD5 SHA1 SHA512

                                                                                      default.dic

                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
                                                                                      • Size 2B
                                                                                      • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                                                                                      • MD5 SHA1 SHA512