hxxps://discord[.]com/channels/1452956377663275010/1479280921453527161/1548116315711995924

Analysis

max time kernel
900s
max time network
785s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/09/2026, 16:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://discord.com/channels/1452956377663275010/1479280921453527161/1548116315711995924
Sample260912-tnvb6aed45

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
56	discord.com
95	discord.com
5	discord.com
6	discord.com
13	discord.com
21	discord.com
54	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2724	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337892301514165"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{C838294D-F75C-4208-8EB0-B85630DA4B62}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2116	msedge.exe
2116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe
2644	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 3140	2644	msedge.exe	84
PID 2644 wrote to memory of 2724	2644	msedge.exe	85
PID 2644 wrote to memory of 3860	2644	msedge.exe	86
PID 2644 wrote to memory of 3860	2644	msedge.exe	86
PID 2644 wrote to memory of 3860	2644	msedge.exe	86
PID 2644 wrote to memory of 4676	2644	msedge.exe	87
PID 2644 wrote to memory of 4676	2644	msedge.exe	87
PID 2644 wrote to memory of 1592	2644	msedge.exe	89
PID 2644 wrote to memory of 1592	2644	msedge.exe	89
PID 2644 wrote to memory of 1592	2644	msedge.exe	89
PID 2644 wrote to memory of 1692	2644	msedge.exe	90
PID 2644 wrote to memory of 1692	2644	msedge.exe	90
PID 2644 wrote to memory of 1692	2644	msedge.exe	90
PID 2644 wrote to memory of 2080	2644	msedge.exe	91
PID 2644 wrote to memory of 4708	2644	msedge.exe	92
PID 2644 wrote to memory of 2080	2644	msedge.exe	91
PID 2644 wrote to memory of 2080	2644	msedge.exe	91
PID 2644 wrote to memory of 4708	2644	msedge.exe	92
PID 2644 wrote to memory of 4708	2644	msedge.exe	92
PID 2644 wrote to memory of 536	2644	msedge.exe	95
PID 2644 wrote to memory of 536	2644	msedge.exe	95
PID 2644 wrote to memory of 536	2644	msedge.exe	95
PID 2644 wrote to memory of 1136	2644	msedge.exe	97
PID 2644 wrote to memory of 1136	2644	msedge.exe	97
PID 2644 wrote to memory of 3492	2644	msedge.exe	98
PID 2644 wrote to memory of 3492	2644	msedge.exe	98
PID 2644 wrote to memory of 3936	2644	msedge.exe	100
PID 2644 wrote to memory of 1108	2644	msedge.exe	106
PID 2644 wrote to memory of 820	2644	msedge.exe	107
PID 2644 wrote to memory of 4204	2644	msedge.exe	108
PID 2644 wrote to memory of 4656	2644	msedge.exe	109
PID 2644 wrote to memory of 4656	2644	msedge.exe	109
PID 2644 wrote to memory of 4268	2644	msedge.exe	110
PID 2644 wrote to memory of 4268	2644	msedge.exe	110
PID 2644 wrote to memory of 2116	2644	msedge.exe	111
PID 2644 wrote to memory of 5088	2644	msedge.exe	112
PID 2644 wrote to memory of 3568	2644	msedge.exe	113
PID 2644 wrote to memory of 5088	2644	msedge.exe	112
PID 2644 wrote to memory of 3568	2644	msedge.exe	113
PID 2644 wrote to memory of 2568	2644	msedge.exe	114
PID 2644 wrote to memory of 2568	2644	msedge.exe	114
PID 2644 wrote to memory of 436	2644	msedge.exe	115
PID 2644 wrote to memory of 436	2644	msedge.exe	115
PID 2644 wrote to memory of 3620	2644	msedge.exe	116
PID 2644 wrote to memory of 3620	2644	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.com/channels/1452956377663275010/1479280921453527161/1548116315711995924
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fffce59c188,0x7fffce59c194,0x7fffce59c1a0
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,12472684371659534410,6306736583297059601,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16824924471750821917,373366901234514510,262144 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,11794587753862271598,415989168233905333,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1940488919545705480,10007416871568971089,2097152 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,10577813735677706778,15126412203516501587,2097152 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,14845573956683657121,2041666951748024864,2097152 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,14612704342622221795,18212423590413092345,2097152 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,2112971291240089470,14924116228532020930,2097152 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,10732273857014220451,12610437739645327812,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,11967367144548907961,11675013054028738937,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,194942689838708868,15917333450593143002,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,194942689838708868,15917333450593143002,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,5578966936421815814,12687069683398722944,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4938586748237434564,17915469702795852995,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,3338227590291920328,2809643883816902059,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,8233643469579753572,2373016601420233534,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,8405769674212323393,16891622687538708235,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6268,i,1433395739735343487,17273182528505122203,262144 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,2771885045234117907,11331577329061712584,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=3908 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,10816001841876049972,99057289325709547,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,9168169618945126144,18080480824007768750,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2588,i,12926795645054576008,12139832565969367395,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,15419747708054860133,15672846159316363506,524288 --field-trial-handle=2256,i,7170985027498744835,12182607569448358295,262144 --variations-seed-version --mojo-platform-channel-handle=1516 /prefetch:8
  2⤵
  PID:3620

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b83cbf64cc348bda7418cf4d51290f954f1a229bfc174076604c71e6316695b1
MD5 e74d8b44e8d40662fd1b1b255738f7f7
SHA1 274571a893d99afe45f887bf62213edcdf6ce25a
SHA512 fdd52b8ff528e9564308a28f53b7774dc738711d7dccce592af97c88bf2722ddb380e7bf76101bce36a685c115e53c6bb3d415de6eecc3c382b674f304fb5a40
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7j:fwUQC5VwBIiElEd2K57P7j
TLSH
T1B2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 21f4cb70556976a575a23221835666a8da154314917df23b60020cc58406ee32
MD5 30f01121b67731729c9c51297bb76205
SHA1 3d4386f3e8cf27307be32e82eecc1a01f55753ef
SHA512 becdec212ee12a3ca5d0f7d5ffe9901f02d7b2b52e7f9d4a67952746b992be1cd3d5e090e5549fe88f400fa8f0ee4519323604ae60e93d20d5a5a3d30fd523e6
TLSH
T101E07DC805CCC36EB74876C7426C5B0C82C2374FD3CC6A5E27148AC8B245848B3C26F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3d2d7af377a5f493d18473a5f781259ee9785d6a62dae3f13ddc3a3e2ec9340f
MD5 9865aad7ce0587026331884af65d5dc4
SHA1 7b2f8bb06dbc081a79df71c01807cea654cb478c
SHA512 ed31e85e940d732f5473be0b0cbbce6384bebfaa98ea68e0a1934b35150cb9297ff4335a3b52a1831fac5fd5355fb61356b3b3f750e08c581ca1162e675218e4
TLSH
T158E026D516C8C33EE688A887416857CCD28137AB9BCC6F5A671084C9B402144A3C6691
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b27125ccde86215c7f758677b398f654a2dae55c5f5f7a0c9327794017b97d1a
MD5 82400f0c9d627e34626ec5ae9d6f6914
SHA1 df21f550af5b4a009c135b6f07692f8dfcd14e5f
SHA512 75faec1326448fb4e8c2e6e7ed525f771408cca5247f27512ef00a9c39ca39a73e9bdcc1ee7ce14acaaf27744d3f67e0c0f89ac2d4f913c3673f796075de2844
TLSH
T147E0269409CCE22EA698B85B41785B8DC2C1370AD2CCBB9A1B24CAC47081E44F7D3690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 78ef6a92559bf2697a9371869d7f982d0b98deafcf83cf4d3d6c03f48bbebf93
MD5 139eca54544d624f00b0ce24f0f23c5f
SHA1 320ca6108d0212a0b6302a303fa90411063a6710
SHA512 c422805da2ac3a607eb4a70d367c9ad08a456d45ef066b77c59f3a32d314427fa3fe2c8a4e7bc3c40b17431776847d4953f89a9163093634d43d97f4dd786b92
TLSH
T1FFE020D878D4C25FF184648751B4774C91D2375A93CC6A1D670088C8B142440EBC1559
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2096788d327684da49f35588800f1abf226dbabe96c16c91a71fd870a57c2817
MD5 9e46e5053b05092bf376648cc51acb69
SHA1 d1ddd77cb0e4a1eff46a967334b42ba662ef5511
SHA512 81bd36dbc1bea5d138d0ba97c0ed08cc85907d188737df88dd6dbc4978b164abedb32c9896e63e3c197e22651e1b8aa586dfcd1cd0c6943e073cc1111bea982e
SSDEEP 96:x+Vld7jUealtMIwcvWYyBZDgkVuVA+JaBH4DgcwwxGaDZbJm0KIE05szzoPbNmxX:yfsddCZDgkaDWYUBCyz2QxDXnT
TLSH
T1B2911B4156424890FF9885BCE1C5658B39F1F54B8FABBD5F0AB8E8BB9476B08C91F0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 930d51dd1101671bad4eba928d0013d5912a89d4438f87e3567e60be04397839
MD5 33608ba91df348d36b481885191ef4fc
SHA1 96a92d6884b1ec2da4a4383f6acc78ae9d1142b5
SHA512 7a6ee399335427b64d2844d013f3ecf3bbf324541d6296642a9ec21245904a5f48899fa65823ebd664f45aaaac45df11400be6f8af0010a43782e8ae87bf24c0
SSDEEP 96:U+Vld7jUealtMIwcvWYyBZDgkVuVA+JaBH4DgcwwxGaDZbJm0KIE05szzoPbNmxR:lfsddCZDgkaDWYUBCyz2QxsXnm
TLSH
T186912B4156424890FF9885BCE1C5658B39F1F54B8FBBBD1B0AB8E8BB9476B18C91F0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 081edbd90776cb9247f9d3b47f07f40a1f8bbc30e1628dee776a747d8d9ecb68
MD5 041678a3b18606c3500f9080f71d4540
SHA1 6695685ecb5904b6a1b5a8fbbeb395fe7600fc7e
SHA512 d6959a5def838221809aa73e9d2bb3dd5172acf65d349460a75b40f39123bb56d786fe243b7f5a40362b0e245b27c70c2ffc412ed43993b4e86f8d8aad9840a1
TLSH
T1FB61958257834C90FF9885BCE1C5258B3AB0E48B9FAB9E5F0DB8C8BB5936714D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8de2dc1b1f25aed6acd288729e23fba372ac5d3f204a186af1cddb44771c1221
MD5 3f7e764136d1ad138d92f282b707c173
SHA1 e88ef5002741f109bac49bcb5eab5aee7b6a685c
SHA512 73e7c231c5cd4a3b5ecddd2efdee0a0b2a568e52679bad646d506855cda0cff7deee5674b8296d126063af8cfdaca8035af8d3d7ff77de46df074eb2f7d8b7f0
TLSH
T1EC3168B387E4835DDA1556F09A18AE2BDE2C0914431C7D39C9D1EE5B93E31B2F042A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3ec3172f75035fcb8526c2455a43b5362f9d60c3113d2dce64ffa4643747eb18
MD5 64a721bcaa8dcafdcc879fffc04267fe
SHA1 1526f0120047d617857154f416eacd106d1210fd
SHA512 be5ce95ce1d3009db56d7d564c9b54bef1bcc80a4574a497662bb7229712f5f59aeaf576d067e444527693b1be125aa6724a4a91076edaa0eb06a3e706947a44
TLSH
T1D831AAB3C7E88A5DC91113F09A146E2ACE2D091443183D2AC9D5EF5BA3E2571E14158F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 db869e5a71aa76fbcf13a3365bdb154da2fcce5b15dfec320a257bb4722ccdf2
MD5 c2c81fe5f93722566ffb2694d201e1a8
SHA1 9fe494abcfd087190cf924d552001118c66b0c7e
SHA512 687ec3627f419dd1892c9733fdcd776fe5076fe1c053b23a119483c7f840d9e4af821c227455c7c9770e23f7c42d5c4b0580424ca030ba1b7c018812367a418a
SSDEEP 192:sxZlRhW0/fesdwRIdpEtHW6+WNzKJ/YYBysjGIgrJ:sxZl60/feseasHbw/f9S9
TLSH
T1F02297126E38A97B8CCBD219BB15BF53E6F95032A5941E54BAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3b72b3545c4bd1e522de945eea5dec7f4566f32ebdd1d13c03d507d25e80382a
MD5 66cbd46975abbfc502b171f27a9373a6
SHA1 33221ca7bb397f15f1809816ab8db1b4051e401b
SHA512 c5630f286f898f15d90e9c3f76cb05fbbc12cd9af9dafba46def3af415fd1a6fd2c13b612e677fba5dd1d94bc1a6aded56c6cf064e648a6dbd7e7413c1521020
SSDEEP 192:sxZlRhW0/fesxwRIdpEtHW6+WNzKJ/YYBysjGIg5yJ:sxZl60/fesyasHbw/f9SE
TLSH
T1E822A7526E38697B8CCBD21DBB15BF53E6F95032A1951E44BAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2e9ff36a825d3b308ee0d8f446429b2eb0d560f92402dcc5b049375e342f6374
MD5 55636f24b4635b724d11c9bb5b7b5539
SHA1 c3f2080530299125e73c98dc035368f617f98f6f
SHA512 f6ce53c29e888d3b95f22034b4c654ef37155ec76bfba1e74744183b2b8d35f686d32f9d727eb768d448e2ca5d3c4975c1d30ae2f9ee478900fde19420677148
SSDEEP 192:sxZlRhW0/fesxARIdp+tHW6+WNzKJ/YYBFsjGIg5YJ:sxZl60/fesOaaHbw/f2Su
TLSH
T17822A7526E3869778CC7E25DBB16BF53E6F95032A1901E44ABFC861C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48cc916443fc64b8c73ab1af9a89f6280361a40eab9ae3f2af17e845315794fb
MD5 974b08c079659e85b1374a61c82b36c0
SHA1 2af1b8603a0b6528dd2ebe8d6f1e6c99ee023c2e
SHA512 9198e380155bb9c61ee022b0c30f0d3b6b5f77ce8c312b8ee7f7b29c90ef13ba94e072d91caa896b8185a88fb58a853b23d4408602bb93eb5ed10b3c9d495cbf
SSDEEP 192:sxZlRhW0/fesxARIdpEtHW6+WNzKJ/YYB4sjGIg5YJ:sxZl60/fesOasHbw/f3Su
TLSH
T11522A7526E38697B8CCBE209BB15BF53E6F9503261951E44BBFC861C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 4e1dc69d58c96f21cb2980e923be29008df93575122f8a1d78cb27624e77c602
MD5 b3b74f5086f9b5ea3ec12aca081c0281
SHA1 2fec5e28b77a1190acaefacdd99bfe598bdf9b49
SHA512 8d94f238abeba46f14d86902f17e0ca5b27b809e24c7625c745f137d67df92565bc04a51f799d124cf17c67a989c78ba6ea0b4d9af2cbc9e277fb7ca4f19e166
SSDEEP 768:U5yYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXbrop1y8:U5yYR7jWv3NpBu1ja/CL8OXof
TLSH
T11FC2E93B644DCB7E4FC01A9DDC5A6FDB2E9802C7A6548D4047FA984C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\temp-index
Size 864B
SHA256 fe0fd9fbb11a16eb4b5434205019a61335de41baccf15d065ffb302df36fed09
MD5 28e398e85850277327680fbcf2e74a2d
SHA1 5706536fc85ffe2d53266a266c85adc9dc639c40
SHA512 caf01b01f6f5cad7279751db5fd3932b60ea383264ee75bc072f9017d2d78aaf2ecb86a6163c2a1228efdb7d655dd8eb7939f8832e29b16de9254ccbdcf61654
TLSH
T13C11DDDE2D534A9BED580278243DD886A27902CC1250760FA1AEE12A8CD7B407E81AA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6c97.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index~RFe5d6c97.TMP
Size 864B
SHA256 36918cbf5d51367806306437deefbe82545ca59c22de8dce8242c7dcb3c4b4b7
MD5 ff9d6ce9db1d4ead076a415fabb23510
SHA1 5145247f85fc928e03a62b716742b310cdad99a9
SHA512 9b4fe0dc5559c025d2728e5eafbed8ba1535768a0235cea07fef39943b9c5374133f4287c444087ce7de9dd0ce7b150169659e63f8e598069f5508fd86846c46
TLSH
T1CF1141E901638B06FC4803709A6CE946717582485354AB4FE3EBE16ACC82B84AD82FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 802069898df44246083263f341e439929a51506f9f340c98012b1628c8917671
MD5 116695f13420a7c6370c9d85a2588109
SHA1 7ae846c62c1d1b1d139123d3f2d3f59644050072
SHA512 a5cd50411d5b23476a3ea1ec4ebe1a2daad661ff96eb1101399a8ac09dca13480cf78f2edda6d84afec549d385661e0d8c888d2717b3643e9f76f25a1a2fff05
TLSH
T142E0C0FB2CF71820E86F83DE107080A081517468CE44EE4F542ACA8311B135D344EC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c43ac51d57c609c64a6cb4095dc6b83e577eaa17479d74b6af466fa20edb1d99
MD5 24d19324e3e07a23f90b4efa87d84eb0
SHA1 25f304b75ad9cdf9a5685e1e4759e8692dd405f9
SHA512 9f7e01787aeeec4468ab5d02954f866edb22289eedd4e5fbe91fb5e649dcaca65366b64ceb1b88ce41a36609167e3b199071df2ca6414ba4fd138aede232c6ef
SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHY8k:KAmYKDKmut+KmsRUgKpKinw5sgev
TLSH
T121912010727B124438BF258992E1C76B464231B77558E63B7FEC00A2DA6EE045EFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de67fc2-cc8c-4bb5-b483-45c17f7d9e10.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9de67fc2-cc8c-4bb5-b483-45c17f7d9e10.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 2d1cdb376f70d77bc546c7755b6c5abd498b34ca8066958efb6913282666ae7b
MD5 5b4d87622a334972f766b248a165f315
SHA1 5305a0137bae65a3acab029b2693d07e9385e04a
SHA512 7ec1b6aceb916de6853439c4803916b5a5bc23763102ec39399afe967d6faea4371e3d1eeb45d349bd89fada734669a6af9280447bab92009ab996611f750f5d
SSDEEP 384:AXsNcAGoTiPLcQX5+DtE8A1WpXM2rjsa+VYalo:AXIToXkDrPrjhgg
TLSH
T16C624C35A9A4AC378EE36686B04732139EB455A796C83FD4DBEC6F1C01CE69C130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 14KB
SHA256 f9d6627a3830ca0c99f22236305d00274bf51d096e558ec4aad894575ec41dac
MD5 097edd171cf6670d3f2237123966a6fd
SHA1 d9291d5f959522f859b7393a103be4a02c076663
SHA512 3f85e10f93fe8aefa6ff5790561b67b080b15ecad99246bf31c2aed9d3dedb42e20d2420f5349e86d3376b698682deb94cec1a94e074172e3e2d9e2f8a5a5af5
SSDEEP 384:AXsNcAGoTi9LcQX5+DtE8A1WpXM2rjsa+VYalo:AXITaXkDrPrjhgg
TLSH
T17F624B35A9A4AC378EE36686B04732139EB455A796C83F94DBEC6F1C01CE69C130AD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 4b126231aaaeea223d0e50e468b3c47aadd37adaa64f307f3888ce1127f7657e
MD5 3c7e36278c2dd5ec1fb7eb8491c4b8a5
SHA1 ab66d60d017d7e5d9c8cdb57e4d7753cc9247194
SHA512 6d4827bb3e49a7390353657ea71eb28390b8f7e476b366d08fbe9f8ef1e2e918227246d4d794cce1be4af98c7873d16ff5c99abee4f2523d6c94d92b0ef30a08
SSDEEP 384:QiFiZcITAXsNU8TUNTUlIlYGoTiPjcQX5+DtE8A1WpXMyrjsa+VYaldoR:rFQUXNwguT8XkDr7rjhgVW
TLSH
T124C21AF259D7983AD9EE5787A77E2E038DBCC067B5846A40B7985A0CCC4A1BFC305C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b630dbf54766578c5d9e2124d5748535e8db59a18cbc2acc1c1001be0a93a66f
MD5 2f46ca8f894105d8f457d2ee53b2f96a
SHA1 e506eba3ce392c8187d18fc4158e15d266d0462f
SHA512 ad75f6da4d60326c3b0f7c76e530e06814e6c4ae2a991cc171aa3c3389e70b3f36d112e7f29270c6cb8ef31ddab4fa75cbb07bb1eb8fe67a213b0dd06d193a82
SSDEEP 384:YZcIiXsNcYGoTiPLcQX5+DtE8A1WpXM2rjsa+VYaldoR:miXYToXkDrPrjhgVW
TLSH
T1BC828E316DB4AC7B5DE7A2C6F54732039EB4906792C86F8496ECAF1D00DE698130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ad2fdea4bfb7c5edda1875975e9d06e7cc5601b191f4ccc0d1a6e0f334339ccf
MD5 c84d3f0ac8c4e1b128674fd925fdbd8f
SHA1 282e60ce919b5e6b7b291aab2fd8380c0c796d1a
SHA512 12d988d278c1c02cf9257020f93308120502b74ffa41ddf7e8e9011026d9fad8a53392046a3c083b1bc472d87ecefec8285145fe7e1d7eec70b6fb31db50424b
SSDEEP 192:EON96nnHSQmiUykjMYcX5hQDP1UjzorA1WpXRqlPg3pr/5jU6:EON96nuBMNX5+DtE8A1WpXMKrjU6
TLSH
T1CB121C35E9B8AC2B5EE36595B08732136EA55127E6487FC0D6EC2E1C01DF66C530DD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9611db8-4b05-4936-a763-316cadc46023.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9611db8-4b05-4936-a763-316cadc46023.tmp
Size 8KB
SHA256 0e547d0bf40d474ae655299eba542b50150a42c48e78e2a2488044cd120f619d
MD5 2694089ce901161deaf3b3c8101d5ec2
SHA1 352d9753a6b9e061eded1c679d850261b8eec4fe
SHA512 d967d4fd2d7198772bb10b6c1911c5feac68ce1645d3e841ff7004f5dc9a657695a4da86d6b00c14864a81a6193e09c2ef323fa560bdf763c8e17099d3c2f9f4
SSDEEP 192:EON76nnHGQmiUyrjQYcX5hQDP1UjzorA1WXMcpGU6:EON76nCAQNX5+DtE8A1WL0U6
TLSH
T11A02DB34E9787C7B8EF3AD4AB08737136F952167A5946FC4DAE81E1D00D765C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8e4ae2a9ceb5b7b798d9f3ea0e19ffb19651e92e262c9b07243398fbe5a0f583
MD5 cf0f561ad3057117361640ec267f7593
SHA1 0a641708b6faa0bcd7614da08aa8f1365e9af808
SHA512 a156f9dc9a26476feafb1c8a5b74cdffac0283a43436930715ba844508d766ac97f955c247bf4f9f73ba2abaac422c96ee260ad76ba836d780377d3d64bb2e62
TLSH
T1B241DC5CA6FA1108B3B76F1AAFF6A86E587B7D332E46D05D00110D4F0A67B04C961777
MD5 SHA1 SHA512 TLSH

Submit Download