hxxps://nuvaliatech[.]activehosted[.]com/box[.]php?nl=21&c=628&m=739&s=584eb92b71431af175c185145cb7e209&funcml=unsub2&luha=1

Analysis

user interaction
yes
max time kernel
388s
max time network
384s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nuvaliatech.activehosted.com/box.php?nl=21&c=628&m=739&s=584eb92b71431af175c185145cb7e209&funcml=unsub2&luha=1
Sample260922-2k1nrstdka

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345903761579880"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{AB57D9E3-F7E8-4B08-B8B2-08A58E498B69}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe
780	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 4688	780	msedge.exe	86
PID 780 wrote to memory of 4684	780	msedge.exe	88
PID 780 wrote to memory of 1804	780	msedge.exe	87
PID 780 wrote to memory of 4684	780	msedge.exe	88
PID 780 wrote to memory of 4684	780	msedge.exe	88
PID 780 wrote to memory of 1140	780	msedge.exe	89
PID 780 wrote to memory of 1140	780	msedge.exe	89
PID 780 wrote to memory of 3024	780	msedge.exe	90
PID 780 wrote to memory of 3024	780	msedge.exe	90
PID 780 wrote to memory of 3024	780	msedge.exe	90
PID 780 wrote to memory of 4384	780	msedge.exe	91
PID 780 wrote to memory of 4384	780	msedge.exe	91
PID 780 wrote to memory of 4384	780	msedge.exe	91
PID 780 wrote to memory of 2960	780	msedge.exe	93
PID 780 wrote to memory of 4640	780	msedge.exe	94
PID 780 wrote to memory of 2960	780	msedge.exe	93
PID 780 wrote to memory of 2960	780	msedge.exe	93
PID 780 wrote to memory of 4640	780	msedge.exe	94
PID 780 wrote to memory of 4640	780	msedge.exe	94
PID 780 wrote to memory of 4680	780	msedge.exe	100
PID 780 wrote to memory of 3924	780	msedge.exe	101
PID 780 wrote to memory of 4680	780	msedge.exe	100
PID 780 wrote to memory of 3924	780	msedge.exe	101
PID 780 wrote to memory of 4724	780	msedge.exe	105
PID 780 wrote to memory of 4640	780	msedge.exe	115
PID 780 wrote to memory of 4656	780	msedge.exe	116
PID 780 wrote to memory of 1608	780	msedge.exe	117
PID 780 wrote to memory of 2524	780	msedge.exe	119
PID 780 wrote to memory of 2524	780	msedge.exe	119
PID 780 wrote to memory of 4244	780	msedge.exe	128
PID 780 wrote to memory of 4244	780	msedge.exe	128
PID 780 wrote to memory of 3832	780	msedge.exe	131
PID 780 wrote to memory of 2532	780	msedge.exe	135
PID 780 wrote to memory of 2532	780	msedge.exe	135
PID 780 wrote to memory of 2376	780	msedge.exe	136
PID 780 wrote to memory of 2376	780	msedge.exe	136
PID 780 wrote to memory of 4132	780	msedge.exe	137
PID 780 wrote to memory of 4132	780	msedge.exe	137
PID 780 wrote to memory of 2556	780	msedge.exe	140
PID 780 wrote to memory of 2556	780	msedge.exe	140
PID 780 wrote to memory of 2712	780	msedge.exe	141
PID 780 wrote to memory of 2712	780	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nuvaliatech.activehosted.com/box.php?nl=21&c=628&m=739&s=584eb92b71431af175c185145cb7e209&funcml=unsub2&luha=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ff93580c188,0x7ff93580c194,0x7ff93580c1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,6561106363482817234,769403545813155662,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,13156968966913295084,7877900841380485970,262144 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,1881061355237753680,14848413630742846859,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11177821482091701376,16250635430794425212,2097152 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,13343923448449334520,8975646930317832847,2097152 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,6497283127741896459,7526335134343076525,2097152 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,12849542029794890614,10675752517271239636,2097152 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6293915599185527749,14535429012450798609,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,17646915868607771359,14949797928042083410,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2304056470130498733,15957197388776367089,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,2304056470130498733,15957197388776367089,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,13316672281007098822,443054832160543569,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4956789705972923871,16819131962060542818,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,11556496934866069010,15392953719961335542,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,14124798306350249665,9159053978391549086,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,16050111906112274833,17165327064597540185,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4240,i,3173469651560992036,6432751522735310612,262144 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,14253759706586352038,10486543520929240642,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,14366069718212526659,9729636983786132080,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,16368549343283206105,10372063694511660367,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,16033007440398037595,7626981327900126793,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,7188107025115693424,10691889242049356577,524288 --field-trial-handle=2572,i,14685611961845450284,8721973581852389708,262144 --variations-seed-version --mojo-platform-channel-handle=3264 /prefetch:8
  2⤵
  PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4020

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f8cd1b1a6a50452788d75bc614ef8a0ee8a58187ff2c34768da41ca8aa762a14
MD5 2b47e5a52f02fe35c0c16d72f64c9dd0
SHA1 6c866e14a417a78feddbf8150e35cf1e723cca60
SHA512 e33a210bd7bd011607f99ff60660b1e9730e35411d891f55ba5dd4564af72757820d5dffd54db11fcec63604c7b8c686216cbad859d3ee8adb50dccaa6480f78
TLSH
T1B8E020CC05D9C33DF11D68CB45F5D70C93803B1BE3CCBA261704C4C47183440E6865A2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 10e08b6e4bc5e367c053f608950f50c619ba8787225774c42b351490b3782c7f
MD5 d02658c042dd2f5958ecad3a1775dc63
SHA1 a689df48c38fe81e6579e0a497b3247d1fa5e686
SHA512 13b1af536a51b485ebec31a2281651acd0fcfa6f81a741fb6e05dfb90a592d55e0145f2c104ae17b5a72970bd9ad42d90ba52fb3c274c94ac18d9d67432eebff
TLSH
T1BEE0809805D5C3DD730568CB8574974CC5D0374EAFCC6A6517148AC471C6544F6B5771
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11fd6226e2171335fca5f2a4a1a80605610f1d69a8f25b9f903689e2135e4f4d
MD5 ade374315d9c261ebd78dc5fefa21008
SHA1 2e595755e2322b6155c64222467834fe1da02717
SHA512 b2189000daa491e99f05178076772f14a130e947390ff85aacf9666f94c21f81d9c3c372e3f459ab46738b7dcbb1329f293e243f13b4717340f245c4c20da9fb
TLSH
T15051D8B755606CD3FBA651317FD384A33E3D8D8454834E912594F8F8F95A79C9072014
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 28885d77b641b883df430eeb114a8d2f58e3fc4c332d762f5a77ef37a91ff6e9
MD5 82b9243c1889239c79faddfebc74c56e
SHA1 20872425bee5585697de3b9b7a758fb384920c9c
SHA512 7f4aadc88f04cbb7aa5304fef3c8b023895d6f37da9cd8d826d72fe4d99d0288e8c291de2bb8930db8876b1bbf95b0b5da6052577db87b7899c4a0b68c26ce8a
TLSH
T16E6108B745607CD3FBA6A1317FC381A33E3C8D8998838E953184F8F4E90A79C94720A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593e96.TMP
Size 3KB
SHA256 c2e254d403554bb2505c299420e112896cb0337b80b84ec9e755a3d207081d86
MD5 6b3cddf5f44fb2befc15c6cee471b2e3
SHA1 00df01e2febf678d4f55918aca88b940f338b3b0
SHA512 ba312d97ecfc987a1ff17e7b605520aee7f4eb5699e6557def401d91f27e5b4a36fa2ba92cf3f354d1fdc6b6576f1b2a7c7d3bb68015b2ef4f5fcef5bfd04e3b
TLSH
T1CD51E8B756606CD3FBA651327FD384A33E3D8D8454838E822594F8F8E91A79C9072014
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 abf62d651e0f3fd0b6d5e2232696718f8a14d0e32d59b744eabbecb3d895369f
MD5 695d2f8cff09fe4c6752f5fabf96b4d8
SHA1 dfa47f2d33f4dcd65e2edcaf771f44179a35c725
SHA512 a76b161b603092c490bcae2d5fb0906c2bcbf9d9cc3bae1184f53c77347ae4eca104e429271a7391a2a6960bd2861cead0821253dfc555c318b97af8ddbddc42
TLSH
T13A3199F783B19D6ECA0197F4AB04AF1BCE6C0A15133C7D5A86E06E17B3F64A0D00066B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8f4c9260d4931c324833c75da41f97bfd8d1cf90ee2f0999830728235f299613
MD5 22d8379113ee0a47fa6c686fc3e7135c
SHA1 1f39b333b56ec5a07489ca7f26c6503440854287
SHA512 6e8be1fad4eb3efc97551c89de5c89fdc79270f6fc94dd2a82bab23781d4420ff0fcec3aa1f5895138c6f4f78116a2048ba1d10c4d29176bd8b9753112c59089
TLSH
T129418DF783F5996ECA1196F4EA14AF1BCE5C0914537C3D5A86E06E17B3F64A0D000A6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 24aef97e3ede7df0db4082460605078da0bc4e02975484d322630206bd691cf3
MD5 2cc4c0ff3966acbccfca3b87700d95e1
SHA1 0ac50db868ca45cd524793bf3905e1425a9b538d
SHA512 83be102027b4280a7df783c0d162134b9f3412e07416f6c091043f7c2cc1ad5b5221971b8e6834246eab8c6eccf36840c03e889f6648aaa9942eb06e06682d90
SSDEEP 192:sxZqRpWL/f4sABIdpRxHW6+WNOQW/YrZrDQZIgrJ:sxZq2L/f4sAq/Hbo/r9
TLSH
T13022C852AE38A97B8CC7D31DBB15BF13E6F9503251941E98BAFC861C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5801f0c741db3dc4ef282ee15d797298086613ee4561b3634aa7cc9e6b4e3efb
MD5 112c871bba40d435d8caa8bf77ecf58d
SHA1 cba061dfa0e5d753b2f19d73f2ff4d89c7a9730a
SHA512 9d84da94ac2a73aa5fed3d9bf84ef803c3fdad47ee7fc2665b6d89d13ad1b0ff944dc0a95708ae2c52e74389c44182f79597bc9fabd28191035aa74581ae594a
SSDEEP 192:sxZbRpWL/f4stEyIdpRlHW6+WNOdLXYrNDrDQZIg5cBJ:sxZb2L/f4stE7PHbAXcieL
TLSH
T15222C856AE38A97B8CC7D24DFB55BF13E6F9503291941E48AAFC8A1C05E77CD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 7b39a19188937af6e231b769fdd74aebb8e51ee1d172ca20160b7e1110e0c205
MD5 63a83b132a7c24ae5d8b4c99c5944ec2
SHA1 d3d6c1e18db88dfc67a029ab7e3a9acd58963c40
SHA512 81f36b3b1b17f8bd8580cde3b88cc7be716500e6c2efd35396c6ffb1bef3fc650859319169f225d117e3ec32a67986b81a0adb3b2177c4d697f4fb603338b9f4
SSDEEP 192:sxZbRpWL/f4stEyIdpvlHW6+WNOdLXYr6ArDQZIg5cBJ:sxZb2L/f4stE7NHbAXv1eL
TLSH
T1E722D956AE38A97B8CC7D21DFB55BF13E6F9503291941E48AAFC8A1C05E7BCD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a381afafe2b2b54f2a5d150db82564f1de76790dea6178017a887f6b93dfef22
MD5 e647620f6984920a793bcae680f8790e
SHA1 fbb6aa16b94f4ce255db8a5675b0b2b4b5ae1ac2
SHA512 0057bc4630cdc4e69ddf401cb15791d3e9bb6676efcc379b93038e3f804beee787c2d7130982de1cfe75b7fc0e0bd4dfeccc776f6efcfb7fb05d5e3480d2166d
SSDEEP 192:sxZqRpWL/f4sVBIdpRxHW6+WNOQW/YrZrDQZIg5JJ:sxZq2L/f4sVq/Hbo/rp
TLSH
T18122C956AE38A97B8CC7D21DBB15BF13E6F9503251D41E98BAFC861C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 81084cbf2c8cd684e59a3927eb415426b635c0d2bdb3b9e3b43fe9fd24a914a1
MD5 e3aebb7992f021250cbb0a5ac66ae92d
SHA1 f8bf9f8a30f186fbd2f98e5e2c315138ae46c258
SHA512 1d5fc5c792902c46169138b7c7a07b41d065e0b78b494416e454a52ff186fc4781819c84466cc28f38e333c916da4dd248417a5fe47135e318b1ec0cc5c56673
SSDEEP 384:sxZb2L/f4sc66s8qMpRiYnazAW8pZS15posJWeT+gE7NHbAXvmeL:sD2L/fI4Mnc7WeT+gEJHbGzL
TLSH
T1EDB20706A924C83B9FC35D18693C7E33E9EC506212C5DEDA1AECCA1C01AE1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 09cd1288c74fa4295ff296bd5e461f1b763db0d72cca6409a0b7a77c68ec1d40
MD5 b00607c075d4f6a392f3e2fe39156932
SHA1 7c9047736548861265a914a97e7366f6770b9ff3
SHA512 1207e1a4075c22499d73d5192bd402b6bab81661c3f88413cd7f685bc24db1a7809df7d22fad637356d556b6e5cb6b79e68e76f0eb3fa8d1e4756c259f9415f3
SSDEEP 192:sxZqRpWL/f4stEBIdpRxHW6+WNOdLXYrNDrDQZIg5zJ:sxZq2L/f4stEq/HbAXci/
TLSH
T1DD22C856AE38A97B8CC7D24DBB15BF13E6F9503291D41E48BAFC8A1C05E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 eaebe1a00a4314ada2495b40ff131eb2d220ea6c0cb701012772fa2df5d0b145
MD5 b7d4e937a47ab12c6810b55445e8ecce
SHA1 65e1809f0521698baf85c09e863bacc9510187df
SHA512 b5dbfc5badcd0f521d0b5b6c9c00572919aa5778f484e895cb72cdab67488da2f058c75dc7520e5739ae36220b54da31085a4e0741361ddfbf162663727872f1
SSDEEP 768:Edy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbfroRbJ:Edy4J/DWvbtBhu1jajiLm0bMxJ
TLSH
T17CC2FB3B684CCA7E4FC00A9DED5E6FDB3E9802C796948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53161de4-0c75-4ca0-92f3-e1fb6a366bd7\index-dir\the-real-index
Size 360B
SHA256 3155cd65432ae8ed76d8e4163cbcfcce20cb8db9f3415e7be95696253a883514
MD5 f509403bf6d4a2c9a1879fcfbd9b9718
SHA1 be287ac5d5981ead768a21e59d3bbc7ca043191a
SHA512 9c263afadfeae3534e004699c35608d83aa4319f6f16c860f0d01f8d173a8c8ee9456663b66542ef9cd42cc2163feee5cd62bad85a39c56ea81d8e9bc2a0040f
TLSH
T14DE02B8D1D13424AF8044570343DF4769A3124EC93545A0F70FD902A8C0E384BE03718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5de0be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53161de4-0c75-4ca0-92f3-e1fb6a366bd7\index-dir\the-real-index~RFe5de0be.TMP
Size 360B
SHA256 dbe9088082cebaca81da427acb8d2bad7b08ed9ff5af0ebce9876b192c3d7d5e
MD5 2687dec178829bda966b83aa6ed2b322
SHA1 c0b2081b45dd1a174c1d6e287d795df164301332
SHA512 cc27496313336a97d87774f8ccb1c2ee58afa651de149d0db8a092a87b6a89611a8db0dfc0b30f883522289b777a3de63bb82478ad694df33a48962bed3fe300
TLSH
T169E02B5906138146F8580071346E6071A2711448E360360F61EA9096C846B449E02B14
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b3f410ee0021e1fdef7bbcc29fd89b426883563504ca51581a659c721c15268d
MD5 39a7594de6da9dd94785b82efb0e9c52
SHA1 6bcda2308293a3164cedd1fd838953fcc5ff2f44
SHA512 a1caaedca69f40a578b96586d09faea330bc74db5f750d75d782a80f3980a443b9aed5aa625416d63d3276fb5b465a119ec814d4755a7ba6f7c7a1862c430bbf
TLSH
T1D2E0D8BB7DA71820FC5FD3D2143049910182B8ACD695AC4F0015E2D760A161179AACB5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db31f4e77153c69c0b0ae67740eebfeed4381e6c673f65fd33112dd9fdd1a332
MD5 b15f7d950601b717cbe6e312e99a2ce2
SHA1 0b21bde7f8296ac91bc1d370279306914b1a1116
SHA512 9fdef2d83dace883fb8637190185eecfef784c9606b740ad0d38505fdc3ef4bd378bff78e2813ffb79f472d9767672511841763d653d9d84f2c987d027ff2bd6
SSDEEP 48:KIDI1Ks04jyL7+/bldd+bNglIS7+K9L1J+xTuYIZrfyLWRsQO00tbYvAISotK9Mo:KIDCKs0+iQgKNOaW5eKyolz
TLSH
T10791034430BF060539BD284C89B18B2A524132B77169E63B7FBC449A5E6BE047FFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59da68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59da68.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1e988db750c7bbbc7bac058acaaf159e6b9c755094cfd60ad021b32a3a89d95d
MD5 fafc9cd4437e45507b7ffc2c4080c8e9
SHA1 8f76b524c9c2355af899f4d5812aa8b1cba2616b
SHA512 614e98cfcbebf80db8ca2a1d9d9de09cd0e72723ef9f215799715a6fe92ae0670a3b3bde7c44fb66a6b7cc1de2cd7f618329263703c073059fc5cfff9f64fc52
SSDEEP 384:QZcIhsNeupZTJKHX58EEO0yhmowTeUC8Poj:uhKXMafO0yhmowe8P0
TLSH
T175827D3699789D376DF6E145F4473A039FF9802BD6886E80D5EC6B1D00DA2AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 29a8911d2f7d32649a2e964fd21392311c377fa6c417768f2fb6b375f58fde8b
MD5 e460dfccf591a86fef0dfa1123e74521
SHA1 aafddfaf230487548b5f808233baf1d60788c5ca
SHA512 ff59dc3a58f69f9d90b536af56625b94021d707573e61b340742ca64dec9c1290916e88a07c6d342071b180e47fa0501af7a220faea53ded4dea59574b310762
SSDEEP 384:PZcIhsNefpZTJKHX58EEO0yhmowTeUC8Poj:HhTXMafO0yhmowe8P0
TLSH
T13F827D7699789C372DF6E185F8473A039FF9802BD7886E80D5EC6B1D00DA2AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 16713ec02a09c6b71abf1dc89c1e7ee4caafc7a2c63edfeab0a1569b0e4c8a75
MD5 2b2e6eeb77985f213a27f117d4e1b0c1
SHA1 6f634bbf58a4a9e883958bdd40756ec32c7e42b3
SHA512 1847bd22a3d17427fa743577fd01512c3e80244b1e0e6a45db6ed19017ac3220c54ee8a8ccf4c91d8c1096dc9d00c3362b268752bae619b49622d091aa20d668
SSDEEP 384:3iFiZcI1zsNu8TUNTUlIlfpZT4KHX58EEO0yiyowTeUC8Poj:yFQN7wgv2MafO0yiyowe8P0
TLSH
T13EC22BF649D78836D9EE9747A77E2D028EBCC057B544A990B3985A1CCC8A1BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63d163754e4826be31ddb2d42fe5f81d17663f6502f4e84877de7b0c867e6b48
MD5 f54922f9f098fbaf372ee5c4d55bf274
SHA1 b85dee8c8e16c4eebc5e15715f8cb6227566e620
SHA512 eaf1050b751466baab39d5d81607c98fd93156b17fca91e9f171abd82b75a71cf94403fd207ece596fe7e2feb8d554d47d1b67c8e95ee7840cf37c04c55c4870
SSDEEP 192:1ONl6wlDgQmiUyQQW4X58gZEOK2owDlR5U6:1ONl6kggW4X58EEO0kjU6
TLSH
T15102E835F9B87C7B8EF2AE49F58726139FA4102BE5452F80DAE81A1D00D779C2307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5c54f2c20cbdb67001c51c1ed98e13a1613d9988449184902b97eb55bc8a2f76
MD5 1dbcf9c7714d6f46da463369b8536550
SHA1 aba93d8fe9a5e311bac15e0d6d722b800092d878
SHA512 a041544554d62173fc3e7f330e73ef0105c5baa9b96f55c42e918f92f38c9fba582b32db620083f7eb64e58380a06e39f6a5f763dc4fa6b217a607115d4632e5
SSDEEP 192:1ONX6wlDtQmiUywQW4X58gZEOK2oy9veo/xU6:1ONX6krSW4X58EEO0ycoU6
TLSH
T143120836F9A8BC3B5EE2A545F48735039FA4412BDB497F90D6EC2A1C01DF26C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56284ced-724b-4cc5-ba8b-286901b15bae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\56284ced-724b-4cc5-ba8b-286901b15bae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download