hxxps://www[.]taipeitimes[.]com/News/front/archives/2026/09/10/2003864001

Analysis

user interaction
yes
max time kernel
376s
max time network
371s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.taipeitimes.com/News/front/archives/2026/09/10/2003864001
Sample260910-ypltmagk4s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335438905702913"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{5DB9D4AA-2A8F-4E92-B85C-5B4C3ED8F004}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe
4876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4876 wrote to memory of 5000	4876	msedge.exe	84
PID 4876 wrote to memory of 4544	4876	msedge.exe	86
PID 4876 wrote to memory of 1064	4876	msedge.exe	87
PID 4876 wrote to memory of 1064	4876	msedge.exe	87
PID 4876 wrote to memory of 1064	4876	msedge.exe	87
PID 4876 wrote to memory of 3524	4876	msedge.exe	88
PID 4876 wrote to memory of 3524	4876	msedge.exe	88
PID 4876 wrote to memory of 3684	4876	msedge.exe	89
PID 4876 wrote to memory of 4172	4876	msedge.exe	90
PID 4876 wrote to memory of 3684	4876	msedge.exe	89
PID 4876 wrote to memory of 3684	4876	msedge.exe	89
PID 4876 wrote to memory of 4172	4876	msedge.exe	90
PID 4876 wrote to memory of 4172	4876	msedge.exe	90
PID 4876 wrote to memory of 5068	4876	msedge.exe	91
PID 4876 wrote to memory of 3084	4876	msedge.exe	92
PID 4876 wrote to memory of 5068	4876	msedge.exe	91
PID 4876 wrote to memory of 5068	4876	msedge.exe	91
PID 4876 wrote to memory of 3084	4876	msedge.exe	92
PID 4876 wrote to memory of 3084	4876	msedge.exe	92
PID 4876 wrote to memory of 2984	4876	msedge.exe	96
PID 4876 wrote to memory of 2984	4876	msedge.exe	96
PID 4876 wrote to memory of 2984	4876	msedge.exe	96
PID 4876 wrote to memory of 824	4876	msedge.exe	97
PID 4876 wrote to memory of 824	4876	msedge.exe	97
PID 4876 wrote to memory of 824	4876	msedge.exe	97
PID 4876 wrote to memory of 2708	4876	msedge.exe	98
PID 4876 wrote to memory of 2708	4876	msedge.exe	98
PID 4876 wrote to memory of 2708	4876	msedge.exe	98
PID 4876 wrote to memory of 608	4876	msedge.exe	99
PID 4876 wrote to memory of 608	4876	msedge.exe	99
PID 4876 wrote to memory of 1228	4876	msedge.exe	100
PID 4876 wrote to memory of 1228	4876	msedge.exe	100
PID 4876 wrote to memory of 228	4876	msedge.exe	103
PID 4876 wrote to memory of 5064	4876	msedge.exe	105
PID 4876 wrote to memory of 5064	4876	msedge.exe	105
PID 4876 wrote to memory of 5064	4876	msedge.exe	105
PID 4876 wrote to memory of 2592	4876	msedge.exe	106
PID 4876 wrote to memory of 2592	4876	msedge.exe	106
PID 4876 wrote to memory of 2592	4876	msedge.exe	106
PID 4876 wrote to memory of 4568	4876	msedge.exe	107
PID 4876 wrote to memory of 4568	4876	msedge.exe	107
PID 4876 wrote to memory of 4568	4876	msedge.exe	107
PID 4876 wrote to memory of 3240	4876	msedge.exe	116
PID 4876 wrote to memory of 4268	4876	msedge.exe	117
PID 4876 wrote to memory of 5012	4876	msedge.exe	118
PID 4876 wrote to memory of 1668	4876	msedge.exe	120
PID 4876 wrote to memory of 1668	4876	msedge.exe	120
PID 4876 wrote to memory of 1904	4876	msedge.exe	121
PID 4876 wrote to memory of 1904	4876	msedge.exe	121
PID 4876 wrote to memory of 1904	4876	msedge.exe	121
PID 4876 wrote to memory of 3836	4876	msedge.exe	122
PID 4876 wrote to memory of 3836	4876	msedge.exe	122
PID 4876 wrote to memory of 3836	4876	msedge.exe	122
PID 4876 wrote to memory of 3816	4876	msedge.exe	123
PID 4876 wrote to memory of 3544	4876	msedge.exe	124
PID 4876 wrote to memory of 3544	4876	msedge.exe	124
PID 4876 wrote to memory of 3260	4876	msedge.exe	125
PID 4876 wrote to memory of 3260	4876	msedge.exe	125
PID 4876 wrote to memory of 4516	4876	msedge.exe	126
PID 4876 wrote to memory of 4516	4876	msedge.exe	126
PID 4876 wrote to memory of 732	4876	msedge.exe	127
PID 4876 wrote to memory of 732	4876	msedge.exe	127
PID 4876 wrote to memory of 4112	4876	msedge.exe	128
PID 4876 wrote to memory of 4112	4876	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.taipeitimes.com/News/front/archives/2026/09/10/2003864001
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x21c,0x264,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,1955489237964576304,18348400939213762831,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,16612920956103927017,4668998286584459046,262144 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,9471089826110665195,11541240026498695491,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,8319393525574913578,11108102529511708608,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,14936506346611677989,15191361538048556837,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,10164757076357862735,17997087757579801953,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,2823684742640467530,10007434270378851142,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,4721559911414195171,16888117652512755811,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5276,i,9717282703605400452,1338444100277111278,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=4224,i,17143943944835785157,6700800741378160448,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5600,i,5669835881952378969,11923949004582381534,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,15999260510639459814,13204978225408894817,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,753172861826737328,7967714573148863238,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,753172861826737328,7967714573148863238,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6360,i,6350227827513012015,13347445938051221381,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6720,i,14159238038140115661,4124929443460483929,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6764,i,15655297139647063404,5870225464130785270,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,7449736440390088500,7173365494102832653,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,18324976098711550242,7297320550153986661,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,4431236089600605312,17133748138074639811,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,4957416713070356822,3356219659504555921,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4700,i,14204550394578181538,10506260329470631070,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7472,i,14832639546668023150,12197264061419446458,2097152 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,5375406066196448531,13450641577467467917,262144 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4028,i,11054048554064160773,11397094412376844948,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,1386776252186678788,15545490775639406086,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,17933318657507105214,10565112706744193012,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=7448 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,14098509767362886541,13451181814783831851,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7316,i,17670431920979783260,9492964285644945044,524288 --field-trial-handle=2328,i,12190421320198697677,8236826975100689214,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:4112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 291B
SHA256 8d5b803eacb099b0dd7699e6da34d6e530fb3d18cf7ec5a1a61e2eb27b355df1
MD5 3c05fb3696ece9f9bb9818834c456188
SHA1 8f13469e153bb9b246c07e70e1c63b83da268629
SHA512 ab70a91bd4fc4379840f2810fde255cf2f1c9d846480f2fc7b476de4107c1e72520cac7bf2b6fd7089f567235d6cf56120880dbec772517dc0a7c0dce04b7b63
TLSH
T15DD02B4546C5C76E9340A6CB4624874DC5983B0FD7C87B0E0F40CDCC314B498E9976B5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 2f1a5e20fd0fd409116ab0cf488bd46ea710baf06328fce21daf5c3ccc539401
MD5 7f297d4e9eaa45f415b884c75fa86c18
SHA1 d97c31597fd9f71869d58950e1ec1c03325bae83
SHA512 5ccbf13d51fabf4e97ce2fbc4d6c70c6f0c8350f2bf9a0b555e4daaea567e06ba72c60d9c2ac0cc44398ce1a32e86e33bb553c9ff2dd7df7fcae065d9edcc328
SSDEEP 96:z02eC11DWjxDa96zH6iiwcEsFa5nwcke30E:z02e8WjI96VpsFaZwcxEE
TLSH
T134B19573C569D163FB9121B28BC315EA797E44D9F123BE8A2017E47D7339B98C019380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8e7c91b6e9b93703808a5d29bb34bcb320ac299132182c7df9ff49c1e1e0efd8
MD5 b05e3fa0f75fad989499332d1bf2266e
SHA1 4aa6ffddd927be6485d86dd28ca17fcfb953d5d3
SHA512 d03aee46e261d091767b32abc75ac9e4796281d7c555a71677d8fa08a1a90abab1da2eb689e0f190b351e77d431495f37cfee6e06abaa7d382287d0768876d11
SSDEEP 48:oW2oLCfzh1uLabVvJTQatMF7CYSz6825Sz6bdOWMQEsT8ZY5m2Ljk2+GH3n0g:oW2hf11EMxUawMzv6ZVEs+Y5TH30g
TLSH
T1A7915D37C559D463FB1101B28AC201EAB9BE88DCF103BEDA1017D87E7328FA9C125384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5874dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5874dd.TMP
Size 3KB
SHA256 627b10426f858f833ababc568450dafc3ff2c9305bceb19b92a595039dd13aa9
MD5 36dc35171afc374f1c910f528b42aeee
SHA1 4ce2caf501edba02ef48f1d9e7b66dc30d84c2f8
SHA512 9b457daa47292706ef2d873c21f542fa721271920c7fd79d6d1d5d193a08687f406d0e8262b21f6aa7b75bc615027fd90fcdd6d7c5d34c12547177059206e8b6
TLSH
T1E8615E37CA11C463FB6601B298D302DA747F88ECF4175E8D1117157D3718B29C228784
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 edc66cc6f589bf4daf5f56861c75ed4a447c46432df4938fd1b9d8c2153fbac0
MD5 8741f732665b5cc1cfe35b58ad4a3d35
SHA1 5a80e47194901a946f80add00e8237e7aa1e6feb
SHA512 f6567f271ae3369ecc379467e4824cac4d55e6f3f1a378d05ae4656447a371f8eabd9b3c767b3d00a3e3568a9dfaceb97509c1c0b322e9ed728f1421c690cc85
SSDEEP 192:D95Uqe6wfkJu8PaJPseJkJVJZFJYJJiB13P87VRMUd7NOtnPi0sPiQPikVrKRA7U:D95Uqe6wfAu8PyEGkJVJZTEJiB13P87g
TLSH
T10E32EFFB52F4867ED91162F4ABA43D5ACF390418923C395BC5C6BF8753E2872D20294E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 2c2b5ec97c35e836ba598f9c42eda863f757dde76843afe10568729d874f74bf
MD5 8ebbe9157cb2f6f73b0d153b8c434644
SHA1 70ebb02d8d6db82a69e3865de21de9aec9ad5df5
SHA512 3eea91965245fb972dfa352406e99ae1cfc90651349936530a4d5a739b52cb91075e7f6a2ce154a00200e33a0fd2e70859a6b311116eb8e780af3777aefc116d
SSDEEP 192:Dykeweg2idJJuZMJjsXJ+J5JMTM3KHKFj87VBM/L0KoRy+yObO6iAnPiHMmqEsPF:Dykeweg2irJuZo45+J5JMTM3KHKFj87J
TLSH
T1C722B2FA83E8C67ED81112F5ABA4395ACF390518923C395BC4DABF8757E1872D30154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 67839789885aef7c7f342919fd4a56224f7321d1f24122b0c53c2968aaef17f1
MD5 d9479f41e302542e3448d873379889b2
SHA1 0f773d35483b681e71903279aba3990a487a3bcc
SHA512 b0805de7fce33123b4db7c678961229becb9f25165ddad4b9b16c9ec49f0deb64394b17fd231c3005010806854b65ae52f007f560489c2a4f75817635c9f468f
SSDEEP 384:Dykeweg2irJuZo45+J5JhTEJv1Tj87VBV07NktnqEsTQqVVXKRA7+b5hOpSyWyTb:FTdXi8UOwZv
TLSH
T16152C1F682E8867ED81122F5ABA4395ACF390918923C3D5BC4DABFC757E1872D30154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 2a5fe36905afa9c5cf3226675e65b72f57c1d4ffdc19a02b4895a3cfc18475d5
MD5 ae827238275c55815238a36bed528937
SHA1 173c5f9eddaff7afae423b21f1d362fa9704deff
SHA512 d0fe8123e914c5a25e83189b2f1517390910c4d4d97ea8d64b325cdff8066684ba07840e4679bfd6b330a12925bb7a45bf7b6c7d84c15fe9c0c895fe5ed05afd
SSDEEP 192:sxZQoRZWa/fsspdTIdpSEHW6+WNApe/YCpWrw+SIgrJ:sxZQoea/fsspdMbHbR/Gw39
TLSH
T10222A7126E38A97B8CCBD219BA15BF53E6F9503291D51E58EAFC861C04E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f42886b4d68c7a03df8f7ee8b7216a3364f1f04f43944313a88866280f107bd7
MD5 c3af5ea00f7dd6cb7b636cb987809813
SHA1 62318739906c9c189f9e96314d9226c8cd797424
SHA512 8d2ae7f19f946a8dc07be17530baf65a871e3a276ee6574c1af8c20f9f6f473b699828142e4529bf06288acfe27a301017cca1eb523c2ca5d08a4db5be63b259
SSDEEP 192:sxZQqWRZWa/fsszSTIYgpQEHW6+WNAzUvExYC1kLrw+SIg54J:sxZQZea/fsszSLQBHb4xAw3y
TLSH
T11922D9526E38A97B8CCBE21DBA15BF53E6F9503295D51E48EAFC861C04E76CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 f24a8333e05ed4b1ba14e5b37136d8e68fcfb0021a9af712fe867c5da79695ca
MD5 c888d071570ad23fae14d49167ce757b
SHA1 f665b54282adfdce62a7dcea8910b99cb5f8f385
SHA512 e3d1a13e7fee57c35309fcf98c86c53c7dd8b00e333c940b97925a41e7a5e983c5f32955f33952527d53f42f592c06f3caa1cee434d01f5d1017d64155dc0bbb
SSDEEP 384:sxZQZea/fsszc66s8qMpRiYnazAW8pZS15posJWeT+J3QMHbHp2wcy:sIZea/fo4Mnc7WeT+JdHbJ2wX
TLSH
T1C8B20805A924D8379EC36D1C643C7E33EAEC506222C9DEDA5AECCA1C019E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 dedeefd78d0ca2b33291327534d8123fe14052c9672558e092e7c763378a5c87
MD5 b2921b7ee2ace6696d86804a588fe9ea
SHA1 e7d55ae85848b95b45bf74e8db976bc8e09cb669
SHA512 e494be30524d6c613a7287a6d29ca707e5d2bab70a98d6a9670d52316b2b3b0d4b73e7bb283952e5568befaf4913490816989891a3c2c18511d9cea71667f0b4
SSDEEP 192:sxZQoRZWa/fsszdTIdpSEHW6+WNA9nZXYC5Wrw+SIg5SJ:sxZQoea/fsszdMbHbmZXmw3I
TLSH
T1A522B5126E38A97B8CCBD219BA15BF53E6F9503291D51E48EAFC861C04E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 aa2890c18f98dba62c635239caec6eb3eac75fb3e1f0df730e97b4cf8a65e4cd
MD5 c7231764a0992c9eae7203ca56ddbefc
SHA1 2237cb57ce9f06d0b5b8240a4d0781e839135bd6
SHA512 8257659a537f576720f0bef346f74b4e16d0bcc1b10726781cad847c9a9c2fafb6c72a7d7accc078e883c963f35dc9159767cf689dc806eb01b4ecb3cfa1a099
SSDEEP 192:sxZQoRZWa/fsszSTIdpSEHW6+WNA9nZXYCoorw+SIg54J:sxZQoea/fsszSMbHbmZXLw3y
TLSH
T16522B8526E38A97B8CCBE21DBA15BF53E6F9503291D51E48E6FC861C04E76CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 80c8e33e1e70f74532e1726d3341ec16cd2d91876807e020991fe105be5c780d
MD5 ad7db7917d69d541e980838bc5896bf7
SHA1 9c9aa870989b68a1063a41bb8a10533ec141e88e
SHA512 d9adc2b57b918f4830e6d200482d47389f7a95cd03f37e379a2d310096646a9a01e767fb90be6da09276bb8e7a188b99a3e1b86e3ca68024415f0c2d0d5045a6
SSDEEP 192:sxZQqWRZWa/fsszS/IYgpQxHW6+WNACRpYC8Lrw+SIg54J:sxZQZea/fsszS3QMHbHp2w3y
TLSH
T1EC22B7126E38A97B8CCBE21DBA15BF53E6F9503291D51E58AAFC861C05E76CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 865de6e521636f4c42b8e73f8d71613d502d7fa42cf05e67e987f10011f757e2
MD5 bd3a2d4b0ca00b5acf90c70b0b60c0b5
SHA1 ee4eb8be50458cc924c32034ab26c8a2aa866ada
SHA512 dac08f4bbca906ce30df87a3cd46e46bb109b92fada3e3ad9dfe6a0ce2383481565f4b33578804a3f51b75d2e1000f308ab9847f1843883925950ddbf2af4023
SSDEEP 768:vlqbUj+WvSCU68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrQroo:vlqbUj+WvSCU6u1jaaZLbWr7o
TLSH
T1BEC2E93B240CCA7E4FC01E9DDD5A6F972EA802C767588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 360B
SHA256 641d23c6c0ce35b08da737590cf3e70c4cb7b763f13c44b9d1d4bc128f70c1f9
MD5 0c40aa961e54eb2e1dd276f5a1211bf4
SHA1 1a17c18905be7e9d62cbad8f20a7f2f21c09cc3f
SHA512 d665b2a98ac585eb3c6ab5398472654e6f86051cec91f48e7c8a249bece097128013a6061fb64f5084f67a4de831fad77e339bd7741e1c0e9ce51d3bf4ea11f3
TLSH
T192E02B254ED1182ADA600E72247250A9B3F14DFCA722984A243DA56F2C1A34C94162CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca2ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5ca2ee.TMP
Size 360B
SHA256 a4404dfe21ebaec068796d3d65b234e8c685e43604ed355bd77c14ec490c4741
MD5 03828117a6b878eccb7a2a3ba7cd8d97
SHA1 131f49484b727e2144fc08d15398f8014f2b1631
SHA512 9ffa359930dc5d62f6b90919574202fe623f246e2702e4b7023621350b12557d5320277498fb17ccc7e60ef548a9e578b6fa52a986ba60c3facad36ef6559a02
TLSH
T15EE0954487420521DD200577141254EEF3F4CDE07535B98B347C696F2C2A74DD9531CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 aeb95789587f6ee9ecda4116fc6b080a0336feaebc0c2aa4a7291e2542e6707a
MD5 7a554dc0b26a21895ac20b06a8bd455a
SHA1 68d4911d170156040179a9f6f3647684f78f3098
SHA512 ecf0e8f62e219ac5d1e4a1cbd4297de88db05bbf6ca52cf274af380ae636a457d1ae9450da6406940f10f70da834c06077d652a7200b6cd244abf43a46c05d55
TLSH
T117E0D8BA29E72860BC7BA3F5247148E002597998CD86BC9E1069A2D750B3361285AC61
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 225d71f8c4df76ef2e11f935484125873b61e34b8163d16c380d1184d7f60cf1
MD5 8f20a3229f78ab07a7440c347f7f25e1
SHA1 c15c453230e2ad7bfbc1cc58f1c0ff5fb96c5e09
SHA512 fb7c43e917fafe5e2200005f41e82ff9ecee9afbbace24341521f4328d2d01caf2a56192c6b6b59631b7f6f65053077918254baad00a6c1666004dfb036bc36f
TLSH
T142A0021053558011C0C012FC109103902311D91451116BDB49B1D859AEA0DA5FE46106
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 356B
SHA256 6324347bdf2e00ffcf85aef3f33cc0b468f3fb30b20cae60930afae7166f064f
MD5 d3a508467bfc0738c230b5beeb20c378
SHA1 e1964c5c001dc57f0383534dcda75b6fc6e3c45a
SHA512 6b65ff98c8d9777d17d3a790ce710448274c3f85a7ba57249d1c7232c3468c5e429295c8a5ccb07208be99422e7f696e440ff0710ac55ac0b6205421c997d220
TLSH
T19EE07510303A02C07ABE79444254D71B714172732514F52E3AE4F2B68957F040DBAA9E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 1f8c267321dcf523c46a3caeae4fe5f3e236c93bc02ac1ea14cee0328ece1e30
MD5 8925d0fa3af3fbbaec38f0bf8f98c9da
SHA1 3c6b7d28306133fc65a62538766a1ccff98329c0
SHA512 3f23ca6ff290690bcbf6399d76531ea576beca2b6bf5eebdda688b366451596d183263e90edb88e843e6983a1b38b86b3462af1d5fe0551d4058925da4aa2eb6
TLSH
T1DC213811713702C07EBD35088254E75B664271733114F62E7AE8E176CAA6F445DBA6CE
MD5 SHA1 SHA512 TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 a1eaa918392eb6bc6409a203715fd18d2736fe8c8295e4ad4776bbff0c197d4a
MD5 cfd07d5458bc058bc8f61e884d26ba26
SHA1 79d98164a7a5a0284302c97d3ce35b1f39b69297
SHA512 03dfaa761c22351d9913a1190dbf1cb9f8e9cf20d0ee2d7b11f1b094011e97c7aef6dd932cb71d49b0fb1a4535eaf1d340990984efde90b8a6c40a8a794c9759
TLSH
T14D211280B2BA10D47EC9A555C109EA07A0B17B76260DEA79235D95F48F8491C0E2FA7A
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58eedf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58eedf.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a1404f3969659f7750d670e6e7993cec6c5a18ff176b4530505bf8797c313469
MD5 fc5451cd62a482c1511a7d60075cfb8e
SHA1 29303d8a8d5ea7671b3af9518b1121c29342d112
SHA512 b979773f33225fc1be1acfa553e8796c20045678f1ca93384341431ec071a3316ef7d31303793bbdf304b0ce55cf1d954eb11c621143dbf641e59a93418c7b10
SSDEEP 384:4ZcIhsNOUEUURiVnEa+edyjYA8xuvzxV+MhdpnfRo2:GhGU6Ea30894184pnfR9
TLSH
T154827D716C786DB798EA7145F88733035FF8D063AACD5A50E5EDAF0D00DA6A8131BC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4f6d90960c13d7f7813ede17318c5f18209cd9fc7c90c4289018a863aeb8b4b4
MD5 8989a2c13e9a7eec64ccfdd25d1a807a
SHA1 55b456e8036d31081140a6095a0c26a094b4e0d8
SHA512 30b921fd91585528488e06a609c7fed8856f1c2bf6aefbf3de408d79d3a9be0533289c3c0504ce077d2d576200ba1e03479e42ca663b5bea74977b6a6c138943
SSDEEP 384:1iFiZcIXsNT8TUNTUlIldUURignEa+edyjJA8xuvzxV+MhdpnfRo2:8FQXGwgEUjEa30d94184pnfR9
TLSH
T1AAC207F258D79876D8AE5747EB7E2E034EBCC063B5899550B3989A0CCC961BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 30ccc497b59de9ee67e769fac7c8e9046a954f0f31a1b926e01c36348fa058d8
MD5 5884459d9a4dc64f1a517d3834c3e92e
SHA1 799c36e579427d20cbe69b65d14641bedcda35de
SHA512 31720aedc38515da1b0dedb0890d13b73b7228375a941277cdc0cbb30cff4f17e010843e067d10e2fa9bd385098922460aa2be07a0992ca84f97c093528b9498
SSDEEP 96:EqONkiQsjpf1bxX5ih/cIPURHl8h4otop5tnDoZBfPgvE5BzatIRdy+0Uf+FdCaY:vONu6Db6QmiUyhcHBa+jN+FdCtRggpU6
TLSH
T1AA02D73568786CBB9AE26E49F48737275FE4203BD99A2B54DADC5F0C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c35d99207ba7057c1f51a99e61dcb9b7e45a9d50797675bb0ac919070c1b3dc
MD5 dc934c1b1752d86e2ceef6ebcbb4b1b8
SHA1 b9f249c9a52588ceb8176bc55428185595839eb8
SHA512 ac418e718a8b74800d7ed2ff6911b3451ac0e9bac02313fed192d518157e184f5bd3a40557a7cf15147d4c2c3465d15ddbb8db451c89ddaa9281ebc3891a0a33
SSDEEP 192:5ONE6DbaQmiUyAcVBa+jN+FdChHtFkNzACrqcU6:5ONE6OUVBa+edyjkA8U6
TLSH
T19B12293668786C7B9DD27954F88336135EE45127EE8E6B50E6DC5F0C00EBAAC2307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5eb214894a5efbbda19936ef6339d34eda04f511d8c90d30eb972a54923d0c38
MD5 f3809a5f28983512274c30621131af5c
SHA1 58665926eb0792c5d5b99b6263d2e497bab1221f
SHA512 9411d2dc97b4d14b45a9585c5419c6390717e671bd29689d59ea16302555fa3a3990d4dc779a8c9723116a930477278880fded24786236f5067b92bf7badae39
SSDEEP 384:tZcIhsNOUdUURiVnEa+edyjYA8xuvzxV+MhdpnfRo2:1htU6Ea30894184pnfR9
TLSH
T12F827D716C786DB798EA7145F88733035FF8D063AACD5A50E5ECAF0D00DA6A8131BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

89e81fc1-fb81-4652-aa02-646fd47e9d83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\89e81fc1-fb81-4652-aa02-646fd47e9d83.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 15decbbe322e044ce847dec3f5932892727497567df54f20d409d70c44386d0c
MD5 cbc4b7d9fb21f031460d1d8ba3e8144b
SHA1 be9607ed16762fe4653d1a88ad7eed8d91cf973f
SHA512 e0593a46e0530e520d9b46e979ef4d139fa7e14ca0e17a0080bf97d545eb8a1215857360f9cdb6a58669940b2aefc10741800ae43da7a2c592dcd48c57edcf20
TLSH
T1B741065CAAFA1148B3B7AE169BF7986D487A78762E16D05D00010D4E4A63F44C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download