hxxps://www[.]mediafire[.]com/file/96367cmoobirhbp/coldwtf-src[.]zip/file

Analysis

max time kernel
899s
max time network
893s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
13/09/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/96367cmoobirhbp/coldwtf-src.zip/file
Sample260913-sswkcayelf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3140	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134337901228390504"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{91B0C8F3-54B1-4B7B-AE39-627FCB654251}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1696934516-3600988056-1840298893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2972	msedge.exe
2972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2804	4984	msedge.exe	86
PID 4984 wrote to memory of 3140	4984	msedge.exe	87
PID 4984 wrote to memory of 4652	4984	msedge.exe	88
PID 4984 wrote to memory of 4652	4984	msedge.exe	88
PID 4984 wrote to memory of 4652	4984	msedge.exe	88
PID 4984 wrote to memory of 1128	4984	msedge.exe	89
PID 4984 wrote to memory of 1128	4984	msedge.exe	89
PID 4984 wrote to memory of 1780	4984	msedge.exe	90
PID 4984 wrote to memory of 5452	4984	msedge.exe	91
PID 4984 wrote to memory of 1780	4984	msedge.exe	90
PID 4984 wrote to memory of 1780	4984	msedge.exe	90
PID 4984 wrote to memory of 5452	4984	msedge.exe	91
PID 4984 wrote to memory of 5452	4984	msedge.exe	91
PID 4984 wrote to memory of 552	4984	msedge.exe	93
PID 4984 wrote to memory of 552	4984	msedge.exe	93
PID 4984 wrote to memory of 552	4984	msedge.exe	93
PID 4984 wrote to memory of 5476	4984	msedge.exe	94
PID 4984 wrote to memory of 5476	4984	msedge.exe	94
PID 4984 wrote to memory of 5476	4984	msedge.exe	94
PID 4984 wrote to memory of 3332	4984	msedge.exe	98
PID 4984 wrote to memory of 3332	4984	msedge.exe	98
PID 4984 wrote to memory of 3332	4984	msedge.exe	98
PID 4984 wrote to memory of 4716	4984	msedge.exe	99
PID 4984 wrote to memory of 4716	4984	msedge.exe	99
PID 4984 wrote to memory of 4716	4984	msedge.exe	99
PID 4984 wrote to memory of 2352	4984	msedge.exe	100
PID 4984 wrote to memory of 2352	4984	msedge.exe	100
PID 4984 wrote to memory of 1316	4984	msedge.exe	101
PID 4984 wrote to memory of 1316	4984	msedge.exe	101
PID 4984 wrote to memory of 1804	4984	msedge.exe	102
PID 4984 wrote to memory of 1804	4984	msedge.exe	102
PID 4984 wrote to memory of 1804	4984	msedge.exe	102
PID 4984 wrote to memory of 3948	4984	msedge.exe	104
PID 4984 wrote to memory of 2736	4984	msedge.exe	109
PID 4984 wrote to memory of 1584	4984	msedge.exe	110
PID 4984 wrote to memory of 5256	4984	msedge.exe	111
PID 4984 wrote to memory of 4060	4984	msedge.exe	112
PID 4984 wrote to memory of 4060	4984	msedge.exe	112
PID 4984 wrote to memory of 2972	4984	msedge.exe	113
PID 4984 wrote to memory of 3612	4984	msedge.exe	114
PID 4984 wrote to memory of 3612	4984	msedge.exe	114
PID 4984 wrote to memory of 3280	4984	msedge.exe	115
PID 4984 wrote to memory of 3280	4984	msedge.exe	115
PID 4984 wrote to memory of 6064	4984	msedge.exe	116
PID 4984 wrote to memory of 6064	4984	msedge.exe	116
PID 4984 wrote to memory of 1512	4984	msedge.exe	117
PID 4984 wrote to memory of 1512	4984	msedge.exe	117
PID 4984 wrote to memory of 3844	4984	msedge.exe	118
PID 4984 wrote to memory of 3844	4984	msedge.exe	118
PID 4984 wrote to memory of 4996	4984	msedge.exe	119
PID 4984 wrote to memory of 4996	4984	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/96367cmoobirhbp/coldwtf-src.zip/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb0982c188,0x7ffb0982c194,0x7ffb0982c1a0
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,12278893578123787864,5662028323147838151,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13096093649578652807,6158159414218649872,262144 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,4206322385833120725,11729384024505862497,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,12582320363125117784,7567304604047242751,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15989718837060990845,13670836264091205543,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,5713307771031032955,3132763079320784905,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,6366535826155783639,13572715935976305718,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:2
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3640,i,17644178244417500281,6538105076962001585,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5276,i,4470926657175495995,421361874543272348,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,16836797661217129037,5313837480215832406,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,16004056113613480056,12161115652108961970,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5788,i,6998882995965679332,11519963070821559392,2097152 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2193732930131947979,5574800048684526323,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,2193732930131947979,5574800048684526323,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,5851938860965446070,17576581839735778028,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4424,i,10922060982683516320,5996017302956042262,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,6651887072878951951,7003624948610171812,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:8
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,12678032484206876035,10856936137755886739,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6700,i,11000625550486971265,11007412911258308284,262144 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=744 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1020,i,1962357285943958969,5897074439275186771,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,16496251574307835368,14593022308064145944,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=3612 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,580776305293805718,7248857197721000062,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12656924671585294680,7942279876862741953,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4692,i,7136909852710522435,11840611561769608771,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,14444601988489295876,3167114720659205226,524288 --field-trial-handle=2328,i,13867577732786771476,17155076939368427660,262144 --variations-seed-version --mojo-platform-channel-handle=4720 /prefetch:8
  2⤵
  PID:4996

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11022d35-b00a-4c56-8ec0-8c3687effc18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\11022d35-b00a-4c56-8ec0-8c3687effc18.tmp
Size 18KB
SHA256 4564c4f722ebcb7ff16a1849d9a5a32ebbe0dd6c3293ca166981ea33250f2014
MD5 450398187ded46a7549ae4a707e34771
SHA1 93cd46328079ae6bdf8fc248f0a728474952644a
SHA512 be4e65cc8544f6ee7545ed1f809f093c8d68e7bd69bba98225b305a805430e4c98694aae69cee2a8866329232d9cdb64471223a3b2e3d4990c09f98c99ad4f47
SSDEEP 384:WZcIGsN1UFVdWpuwf189iX5FRMolsa+VYslrod:EGFdWNt4a6olhgZu
TLSH
T14B828D726D686CBB49F3E291F84736134EF49167EBCC7E948AEC5B1D00DA2981307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 daf8c1243ee20a2e95a6bd65ee87f94e97a213f1bc26473da181514314bf0e5e
MD5 22b29b46992ba3d1fd586e35207b402b
SHA1 03a007676fa49e6e9fbeffbbc2e943124c1b3d3d
SHA512 3634d483353d2e9fb49d846c71c6867053c6a8f1ead10608addea75574d5ce0e36c8de933f71d10bae9682752372e6f7925bbc3c9d982dfe840a9d664f859687
TLSH
T1BDD0243C3F514D50DC0041710530D50435D3CC1740D017070C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

7c16d3dd-31de-4e82-9f7a-9804265e71d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c16d3dd-31de-4e82-9f7a-9804265e71d3.tmp
Size 9KB
SHA256 c59353345d8fbdea4a4f7d24da2192a81a10805b04113e4743b5abe71ae98404
MD5 99cdd20e0abf0c6263ab7f29efa41b43
SHA1 2ead1f7fea7f8434026b35639f8a18884e20608d
SHA512 26387c42646ed47fa04e8082335e27d73a61f26efa4cf7df67e77907ec94121c2e568db231586011b01d05b06a180c27982099e116865e696ecca6978424b956
SSDEEP 192:sxZGLW9/fYsd7gaIup8FHW6+WNmOt/Y3X8+HjUIgrJ:sxZGq9/fYsd7gasHb5/H19
TLSH
T1F222D6526E38A97B8CCBD219BA15BF53E2F9503195D41E58EAFCCA1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 baa93170e87da967160cc2e70fac5eca5a6e5beccd4d9441cbeca3293a8f3204
MD5 251e9f25c7fe1906e56b13e5e337ff0c
SHA1 a2b34e6cc021aba357e90694ad896b16c17b2078
SHA512 212153cc3c94acd796008b69fa05b904292b6b04ebb4761a4cf499f4bcdd692f6e5f3195e9edc5dfc1bc721e38242b4e114fa8b3a3c0733dbf4aae6ae247c6fa
TLSH
T1F7E07DCC88CAC22EA348A587527C7B0C82A1370EE7CC7A9A3724CCC47001464BBC6794
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7e14bc7b4a237a9e628a9316af290c77269ba336de222c8383b92f4409a9b6a2
MD5 dfa2570b0f83bc375546b05d52a83a9c
SHA1 94607ea27230c27dc9e0c341b26885dcb373363d
SHA512 2beb726fb12f2fbc99fa32987f8a0274087a778fcaf215a647aba3970885967d45dfc750fee0d7a820f187bc486e6110bc1b05326afb27176bbd42451cb5efa6
TLSH
T166E026C405CAC22FE258A64B82789B0CC381370E92CC6AAA5B00C9C47082140E3CAFD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6233ebf716d1c4e43d36de5b8e170400fad3b5be001569b0b4b9c6a452ba5530
MD5 40883c6ca057382ff94b2418874b1385
SHA1 4f07f15bceb31876d6bd58808e82151c18914254
SHA512 1ca08466679d8ce76134559bbaadbc3e258670e31caa78f0d94c39b52ff7591d13cfa82a3f8d75725712d3d4c1bfb2cb555eef896ee2a7df843b8785409efaeb
TLSH
T1F7E026D404CEC22EF24CB4C741789B8CC281370B93CE6AAA1704C8C9B182040AA82F90
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5cab76d897dd850a38b68b9ef58462ba492c2c6d46a9bed1328c9c8c2e69417a
MD5 d43a2d4e74d5c6921510d61c4835e82b
SHA1 61107c2243e52439dbb202b8f6d60fd06693297d
SHA512 1910e2e81fa6523aa71123ae74660fa4f2a9bc97d5f4332179b8dd2ffbbe8bd2e8bf8be340d592a545715f8e7fc664627688e4b4cc756cef61ff7c5df8eb4e09
SSDEEP 96:xwTk5K3qjsv7+XLpkQUtZHBjZoZfGcl9v4e:xwQw3gpkQQBVobke
TLSH
T16181D7826480B0A2EF4D013BDBF318CB767090B855477FBED110E9B86746B4FB875890
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5936a6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5936a6.TMP
Size 3KB
SHA256 3f09ce2564d199d9858c44ea1190cff7276cc50363d4a9795344f16ea8564212
MD5 f331dbe3a638b91031b3d09ab964a991
SHA1 8cd4fa86945a6c49ca6fa25ccea1d350e41c538a
SHA512 84a3e69145a6024b6bcb8f6349fbb4cd7a081958c39a20abdaf5b62e7a7a94ccc8bc59a6d6b82082c0efc8ba8fd2115975c4ae97b41971d5d108a274d3afa759
TLSH
T10B6180811590B0A7EF9E4433C5F120CB367054B4558B7FFEC264DA786306B4FB9B5190
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 55147bf7d9530832452447b783e30aad74ecba718ed068f28129e7979cf4f24e
MD5 82f632de000ec5d32fee82329732c42a
SHA1 67b4d41d05a996c7cf2fe028f22ed66be1b8392a
SHA512 45960569c727b871ad938e9bf5a2d29294fb73922646290851afad1a0b966f71c3238b797838dcd83a79b61b37ab76667c02421a5549bc8021accdda25dcc734
SSDEEP 192:DdkeuSG7ytWBfe4UZOr7y4IKY+pk6YKrhLAY+Asxma79fo8LUrAJRhfO+HU5Gj4T:DdkeuSG7ytWBfe4UZOr7y4IKY+pk6YKx
TLSH
T1660236F753A2D65E9A115BF49604AE1B8F1C1626432C3C2589D1FE87E3A3033E06E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 9f33a95efe7e999f209019e5f24f10cc076ad14a0b6b16e25d41afdaef515e52
MD5 eead615809dbf57ec035f2fad90a5db6
SHA1 6ff735bf57d8af7076cc62eda7c9f01bc91dc6c9
SHA512 fde0855c14b7ef463cd7097ac1cd18da471d0e58ca4f2e5b353f45143d2d207c7f554d3cf07076d41aced1c0d857eefffce99da32879f073140862047549e687
SSDEEP 192:Ds9t69LJz3XqJeDl/Yy4IKY+p+4mmYRrhLAYtk4INNfmakU7o8LUrPejJRufOGBr:Ds9t69LJz3XqJeDl/Yy4IKY+p+4mmYRR
TLSH
T1F2229AF382E5D55E89115BF89610AE1BCF1C1659832C3C2589D5FE8BE3E2032E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 d6dd8b08c1726e204c91f6561948900e939daa1ce2914f060b1397ecf3c39082
MD5 cd65952d5bf7ad553c82e3aaf5b8e215
SHA1 b2a114164fcb649cffa357ced9c40c39167c3d0f
SHA512 221219905a6e18b95bc51e4e413d12bad3f5c3a15664892546799fcacbdd74277751349dabf320778cbb6e91cb7e2f433c93aa810e3338d16dc51555ee4fec87
SSDEEP 192:Ds9t69LJz3XqJeDl/jwy4IKY+p+4mmYRrhLAYtk4INNfmakU7o8LUrkjJRufOGBE:Ds9t69LJz3XqJeDl/jwy4IKY+p+4mmYy
TLSH
T1DB229BF382E5D65E89111BF896106E1BCF1C1659832C3C2589D5FE8BE3E2072E16E64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 55cde69909ded28a5dc9c07fc606a0d931adb3c1cf94132e72555f513300fec7
MD5 1bfba29278b79767d0508f4616084978
SHA1 6805abddbdeae54260de9a8284a0d831bf277c0a
SHA512 a5f39e2ee1a2095aaad3e47b90cf02633deebf4b0151a257246b6fa87f3cf4e7af82201a30080bead70f4396b3082f416cff3639ddc7763dab70a916db9e46e8
SSDEEP 192:DdkeuSG7ytWBfe4UZO/7y4IKY+pk6YKrhLAY+Asxma79fo8LUrAJRhfO+HU5Gj4F:DdkeuSG7ytWBfe4UZO/7y4IKY+pk6YKz
TLSH
T17F0246F753A2D65E9A115BF49604AE1B8F1C1226432C3C2589D1FE87E3A3033E06E75B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d73a956a53b3570eb0d546cdfd7bd9db7c721d2147b76c530bf37ccd8441b613
MD5 c907d8a547fbdc9b7801f6848452b55a
SHA1 bf18b453340630b38cd15febe8bd6c5d07075da5
SHA512 c4213c681b4e313ab9f67d4036085e4a57ecb671ac62c01dc7d829d8191073d31d8898f2d8b94ebe14036258b54149bc6aa0ca7f981473505c954e34a5f70804
SSDEEP 192:sxZGLW9/fYsc7gaIupuFHW6+WNmOt/Y358+HjUIg5KJ:sxZGq9/fYsc7gaCHb5/X1Q
TLSH
T18622D8526E38A97B8CCBD219BA15BF53E2F9503195D01E58ABFCCA1C05E77CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a70b98a720fdd18905558ed83060f132eabf76187e91f8188b6230e7ecfc3b45
MD5 a54afa26c0fc095401a092d758c171da
SHA1 2fa2661849959e05184d4bdc5c1c54f25123dac7
SHA512 7753f4833efeffbf84d150d05ab99249e3b963cae513ae080a54e6b2626cd3880645d4f6d2441377ab6878da4a2b018df482173027d60fb1e41189b527250c32
SSDEEP 192:sxZGLW9/fYsc7gaIup8FHW6+WNmOt/Y3e8+HjUIg5KJ:sxZGq9/fYsc7gasHb5/U1Q
TLSH
T1B322D7526E28A97B8CCBD219BB157F53E2F9503295D41E58ABFCCA1C04E77CD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 e01b2defbe62173a3ad2e7602511996c6d9f85a4395457d36dacc215cae9ecc5
MD5 1adae410bb279fdbbd321c5cde116855
SHA1 c549ab25e01783a1c0aa5ec582471b26ffd850f6
SHA512 6e7c02818538b9643e392af4e06152a4813fb79dcd41e2b5ee0e6122139695b7e89d0eb675311ef69f2fc0d4e4e5b59396116a4b2df5ca28dae5362f9fce367b
SSDEEP 384:sxZGq9/fYsc166s8qMpRiYnazAW8pZS15posJWeT+5gaCHb5/XmQ:seq9/fI14Mnc7WeT+5gdHb9XL
TLSH
T172B20705A924C87B8FC39D18693D7E33E9EC505216C5CEDA1AECCA1C019E1FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 f3d47c90a3b680f43337e75895b52f6dff195eb4793850addd6a9914876c5cf9
MD5 4180c862bb7060e0fbc4d32240bb98b2
SHA1 10ac06a80d1f0da2133e70aa3806e59cc2cf26d5
SHA512 ac891000b6aa0db459d6a44ecdf39234bc2d03854b9f89f351bceabedd5f956a328c6823fe480c97f61eb91a34c8c82c6dff6b0f7b828b96b9e913eebdeec26e
SSDEEP 192:sxZGLW9/fYsc7gaIup8FHW6+WNmOt/Y3X8+HjUIg5oJ:sxZGq9/fYsc7gasHb5/H1S
TLSH
T1B222C7526E38A97B8CCBD219BB15BF53E6F9503195D41E58AAFC8A1C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 77f2834f2f98184c8dfa3bf40742696cc2d09291b193f11cf0d99122fcb3a497
MD5 ac7850a22fbcb898aba605495e727696
SHA1 fc88fc1c9a9a0acf51cf7bec4d271c9c521e81ab
SHA512 21eeae5d1a0025c326dd3adb3ee3079272964719cbf087930ff44be5462bafc774c4b149ff2ce1a20d9548e36bfba68fd44632754b8ea289dcae20c85c026202
SSDEEP 768:sm30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72nrolZMh:sm30AbSWvS299u1jaLmLZ120e
TLSH
T1E3C2DA3B640CCB7E4FC05A9DDC6AAF9B2F9802C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index
Size 864B
SHA256 209e30b815dcbc8f6975eaaa11711f12c6c08e6ebf12946fcded7fb63b0e8cd3
MD5 c911a461b572a1682680cd46b914218c
SHA1 9c1b570b2abc7b698131e86e4396b8fd9a692fb5
SHA512 0e4778eb3eca8e483e246c758436835e29f2eec85c09ef7ba9b76a851a7f2973aad1daaf971d60b19a0858cf7523aceee940b05b21c781c6343aac9c3b51dfd9
TLSH
T1791102D75D539F1AFC440374607DA856B1B501DC53446B1F92BEC12A8C927506D446A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5bcf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4f3a185e-5bc2-4345-ae38-581f252b2759\index-dir\the-real-index~RFe5d5bcf.TMP
Size 864B
SHA256 d41dc0f74116be568e878525564a41c71d4fc3ce1aeb912fcb6649c4cb5069a0
MD5 6932069a6608f98ea6a8a63025186d55
SHA1 f4d0704fb497c3229a6622820414522470f1e976
SHA512 3e0bb2fc516c65d1af3c85a7c3c2753343896e61193a15bedf1b0716e2e6d2dfdaa9c3f4831cc72bd1a8e97255e87005970e56eea418474e31dc2a9ee131abe6
TLSH
T1D91141E601538B06EC4803709A7CA94A717542485344674FA3EBE16ACC82B80AE83FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d0cb5ef5aefa6e525810023323386468dd008d5be388aab098bdf3e9d38708a5
MD5 d1af2cb4fd2c62b389fbffdbcc23fa00
SHA1 f29c4a3eb6d6c81e48023d3fa11fc77af82dadcf
SHA512 ff2c2801ecba9decd090430dcfa0700ec2d5d8e78a72a21b9c677ac0c5401c2bdde5d82dd5c69fc8d432c15bb9989b160516e1b22e7b4ca1775ef430039b41c1
TLSH
T1A2E0C0F22DF71860FC6FC3D4147088F141057894DA48FC4F10AA63CB64B03113846C10
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59aacd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59aacd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2a3ff1244af9b9fe7f6666fb5507c200620f6e719b66406455a848b337af9259
MD5 e5591b6d4267aa9fb93685e1cb97f4d5
SHA1 e6c2dca3dee48d05e9255f144c63d152a0bf0c4c
SHA512 04d1f766b007ace91d2f1d35f823f7308e96a10a6327fe1ee00d6de0cdd69072dc24247af6c0d6cadda98ab178ec2b2321fadae4b427ea266e310e2e83d32cde
SSDEEP 384:WNFiZcIgQsNm8TUNTUlIlFVdWpuwfX89iX5FRbolsa+VYslrod:0FQTrwgZdWNv4aRolhgZu
TLSH
T166C24BF248D7987AD9AE9743A77E2E034EBCC163B584A950B7D84A0DCC861BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24f18a25f91d64b7b5708bb644c07b4bd666552ef0ff0e8413e1ae79d6558669
MD5 d3b26a13b52b10d2d3ccc717f760127c
SHA1 1e75203c4b734cceb66586921b035f5627d43596
SHA512 e0af2b690da7c74c833d4b3a5548fdf8cfe294c0b4a983b3187e47433955cd9dd14ff8edfd30e8a3d13f8f6f452d1772635bc65bb4a66cef4192b8edd4310d88
SSDEEP 192:LONTB6AmwprQmiUyt16siX5F1gJioNrmU6:LONTB6ipdE6siX5FPoIU6
TLSH
T1CE02EA39EC786C7B8AF3AE45B58737135FE5116BEA942F84CAE81B1D01D725C1306932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 329147b8d783c448a0376a7600aa3a6e7cd5f649d7967cacf0fb6e206e3a2423
MD5 c31a28ead9ff248b22e9f88dccdb1c74
SHA1 5f216e502910e37945f7396732f3f4abc7c81e9e
SHA512 6098b24a32035fe0738ea0a31933853589649f914fc2110209767905e78548d79462412cf78e6097833f7605925f03a97444a5cdc5e2cfec679446023ff0bf82
SSDEEP 384:aZcIGsN1UkVdWpuwM989iX5FRTolsa+VYslrod:YG+dWNM4axolhgZu
TLSH
T134828E32AD786CBB5DF3E285F84736134EB49167EBCC7E9489EC5B1D00DA2980307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9ddae6b0e5c95569a34cdfc46e1135a3d4e77cdb881719631bc825e1eb952bf4
MD5 9a902c089a9ec6bf5517274414612a32
SHA1 5ac063c6b8e4da5290ea169e26cca26beb321f52
SHA512 6e1631c58f354bc97c820100633d6eb5774c22f975ee28ea2c8a74d4d9e306acd22df0f8b4f450ad95ba0b2d0df710120d069290f9960f4848868f940605a7f6
SSDEEP 192:LONX6AmwpLQmiUyM1ssiX5F1HzlRoB/jU6:LONX6ip9LssiX5FRnolU6
TLSH
T19C121A36E8786C3B5ED2A550F48736135EA5921BEF887F94C9EC1B1C05DF2AC530A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2ecd185ece6bd5cc099b55a4d05c343f39da6680e1e475c08efa1eec5dfe593e
MD5 6195e3ee7d4dd04377a8868975582d00
SHA1 9c77068915de2d8efba8b7b57ecc13e56dedc316
SHA512 684ec97766403d5d0746add593411dd4f4f9222c4b464a07536b20db4f1c27a4843307c3a6f5202198302628fe4251219544754218f3a5c33cb78d2783301e29
TLSH
T184411858A7F91118B3B36F1A6BF3A86E847F79272E06C15E10010D4F0A27A00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download