hxxp://mail[.]3auuu[.]cn/

Resubmissions

23/09/2026, 18:52

260923-xjacza1z5k7

23/09/2026, 18:44

260923-xdgvvs1y6j7

Analysis

user interaction
yes
max time kernel
628s
max time network
626s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/09/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mail.3auuu.cn/
Sample260923-xjacza1z5k

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process
Email address	143	[email protected]	1896	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134346631570193689"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{8B43B83D-865F-489B-939B-01E7A83FE0C9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe
668	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 668 wrote to memory of 1884	668	msedge.exe	86
PID 668 wrote to memory of 1896	668	msedge.exe	87
PID 668 wrote to memory of 3916	668	msedge.exe	88
PID 668 wrote to memory of 3916	668	msedge.exe	88
PID 668 wrote to memory of 3916	668	msedge.exe	88
PID 668 wrote to memory of 1080	668	msedge.exe	89
PID 668 wrote to memory of 1080	668	msedge.exe	89
PID 668 wrote to memory of 2392	668	msedge.exe	90
PID 668 wrote to memory of 2392	668	msedge.exe	90
PID 668 wrote to memory of 2392	668	msedge.exe	90
PID 668 wrote to memory of 2352	668	msedge.exe	91
PID 668 wrote to memory of 2352	668	msedge.exe	91
PID 668 wrote to memory of 2352	668	msedge.exe	91
PID 668 wrote to memory of 2732	668	msedge.exe	92
PID 668 wrote to memory of 2732	668	msedge.exe	92
PID 668 wrote to memory of 2732	668	msedge.exe	92
PID 668 wrote to memory of 2640	668	msedge.exe	93
PID 668 wrote to memory of 2640	668	msedge.exe	93
PID 668 wrote to memory of 2640	668	msedge.exe	93
PID 668 wrote to memory of 4596	668	msedge.exe	102
PID 668 wrote to memory of 3820	668	msedge.exe	103
PID 668 wrote to memory of 4596	668	msedge.exe	102
PID 668 wrote to memory of 3820	668	msedge.exe	103
PID 668 wrote to memory of 3784	668	msedge.exe	106
PID 668 wrote to memory of 4756	668	msedge.exe	115
PID 668 wrote to memory of 3168	668	msedge.exe	116
PID 668 wrote to memory of 4844	668	msedge.exe	117
PID 668 wrote to memory of 3740	668	msedge.exe	126
PID 668 wrote to memory of 3740	668	msedge.exe	126
PID 668 wrote to memory of 4332	668	msedge.exe	129
PID 668 wrote to memory of 4332	668	msedge.exe	129
PID 668 wrote to memory of 1504	668	msedge.exe	131
PID 668 wrote to memory of 1188	668	msedge.exe	132
PID 668 wrote to memory of 1188	668	msedge.exe	132
PID 668 wrote to memory of 384	668	msedge.exe	133
PID 668 wrote to memory of 384	668	msedge.exe	133
PID 668 wrote to memory of 1100	668	msedge.exe	134
PID 668 wrote to memory of 1100	668	msedge.exe	134
PID 668 wrote to memory of 5000	668	msedge.exe	135
PID 668 wrote to memory of 5000	668	msedge.exe	135
PID 668 wrote to memory of 260	668	msedge.exe	136
PID 668 wrote to memory of 260	668	msedge.exe	136
PID 668 wrote to memory of 4452	668	msedge.exe	144
PID 668 wrote to memory of 4452	668	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mail.3auuu.cn/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7fffce4dc188,0x7fffce4dc194,0x7fffce4dc1a0
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,4534424050326620019,15668784980090950884,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11655810849737227599,11299861543058641536,262144 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,619396097367615243,3785016866628954564,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,175931240861227177,17066617388648458989,2097152 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2795329603140495229,3996185683695435082,2097152 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,12467160514399428779,11527771087207610906,2097152 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10609589427482739888,3482291300258024339,2097152 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,9356858616869917491,2584589395217274412,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,464941002407608320,714682145009261205,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17699155368034196278,12104599961075327678,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,17699155368034196278,12104599961075327678,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,10319259781325233831,10023387144668084273,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,9150288060347170570,14586946071459801374,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1457135752904987595,3538214534885027789,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,12244971188589400260,803062868856697095,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,3395783997010270886,16319480514231140778,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6780,i,15384138151309943418,326216240938509999,262144 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5820,i,6059162698483904930,4495300877728508252,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,13875952791009096733,9497238044115001635,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,12940092074395647204,743527260447217742,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,17911537149045517211,3236866333558099842,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,9539877825796605446,3451062097530201835,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,18249389913494444304,4911150431558662338,524288 --field-trial-handle=2272,i,10895660269391249690,10481105054294669088,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:4452

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 124088d7a12e5641ecd280ec056235169f366fe00726cb88679a38f702b8e119
MD5 ca6b6a3b64f2c6e1619f698b363a2756
SHA1 b21d76de2463db833bc9a57d14eea211ba399a61
SHA512 d3c102fb1393e6abab8eed548b4b48258212f376cfa3aaf78e280e72a85ecbefb7817941ba6a8534ae3180e2a2ebb28c3c452b16077080bec1f7c60b084cd87b
TLSH
T197E0209819C8D31DB34164A741BC570C8381370FD2CC6E0E37048448B003494FE937DD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7e91c60f7dd519d570fe1f353987086f96e5ce085d789d24be4d092e3797fcb6
MD5 29974e7ebe1af4b0b60e3c6e10062ebc
SHA1 72b42c5f80b1405516e33a4b354e987256d8734f
SHA512 b96644c201d79a61992570f836c7bb643ad3e0f67ed62c0c86778d72f2703fd79bdf83538544d0c097cdf0842454d813004e28fa2f5ae1018beb42243bc72d84
TLSH
T1DDE0DF8C05C8D22EB28074CF4268570CC382BB0FA3C87A8A2B088C857013280A3A2692
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6afd4e50e1e1b5e555cd1cee3b878372707ea45f9a87ddb0b7de7a089c63e168
MD5 f3c485266b2aee3af60b2c8a88c6fe81
SHA1 c7f8458ca68e14410087fc85e3a516921c3b1374
SHA512 0b7137de7c82f3c663c5734febffb12c7188a365e4b285fdb066fe72df94185584e32ed9d3b7338e0527cd5fab66ef3edee13662ab68a19b99688b1e90c8327a
TLSH
T1A3E026A854CCC2BFB3A0748B417C9BCCC3C2B70E93CC6A0E5B08C4A47012890A386FD1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 175816ce1c02e7cd4e6e36881bac44520b5233f21ad11ee0121c01ae3bc00754
MD5 a350cb1f97f4c9c594637d0f09977ab0
SHA1 eeb447b2b7da1dacc57f0f28a76a7c83a5de3c72
SHA512 bbc8268855d896d0c23b19861474efbc471776ecf22bf1a870ec4a57c25ec3c48a479bb952978002e1fa2f20a26867c1cfe33ea2edd09714aaa75a289598dd7c
TLSH
T190E0809C15C5D35D7344649B817CB74CC7D1BB0F96CE6A4D1B1488C4714368466937D5
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b3c5db54c43667bcdce2c79ad7f75fd482adb3344d639e6c2154b744341aebb4
MD5 93270e1b2f15665fdc3cb01ec0db2401
SHA1 69284f5afedbb8ed1c85459eb84e017b81f5bbab
SHA512 87ab593677658be64c4017546319856898604711c49d8969126ef9985cb06ff469b454e863f83fcc9a5995db73fd0ee6849a5e06149b914dc6b2887f15e5d541
TLSH
T1DB61958267934C90FF9895BCE1C5158B39B0E88B4FABAE5F1DB4D8BB5836350C51F450
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a19f30f3d88c72dcea6796c186c882325fdc5b5052bdb10f5541fca56b71e9cb
MD5 d2a44700976123b2b56da609f33cf6c2
SHA1 590cc2b87f0fdca8a71940fde7d336d5ea5ad1bb
SHA512 281fc81a2fd9bf14826efba08023986e1fc0e224ac251cbafaafbe655c59f7a9d3f7993e327ec1e29bc5834de375352ec4b50be3b06474fcbf03b75455b57ed5
TLSH
T1D871A8426B424C90FF58A1BDE2C4158B39B0E94F4FAB9E5F1DB4C87B593A394D50F850
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 62582ac68387c499e3fba67183985657e6591967174d384fa96e0bb8b0733cc2
MD5 19d28ff3c93891c66021cbf49af825cc
SHA1 0cdb5397ff0b4b13010bd50303a35d235226f764
SHA512 99d53d63514141d6b2dd191987e8e9ddcc1e5fa9b4742fe35fd61dfc9a22bd75144d1568ae836facb15b38e5db71928345b2ce27b87f25ff85df67731b096302
TLSH
T16671A8426B424C90FF5891BDE2C4158B39B4E98F4FAB9D5F1DB4C877593A380C10F840
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592c65.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592c65.TMP
Size 3KB
SHA256 c4156be1b330514d25495aa9815976cf6dc02c14d987dd7ae4b9cab9a9bbbfa6
MD5 9cec92575c0bb8881bf710791843b751
SHA1 d31459c5a93a8bf84db0708118d9fc7e98d2a7ac
SHA512 fb6356e4e1145d026c092851975751557cdcd6523caf2ba6ddf8033ab4e26094fabbd1a5c2349c4dc76c9813ca8e1e9be03cfcbd511daaf02841ab98dd3d0dfb
TLSH
T14461978257934C90FF9885BCE1D4158B39B0E48B5FAB9E5F0DB8C87B5936714D51F090
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7a18ad02b20526c6ca3613f79b7bae50695aa28cef3c9fa8f1ef6a9ed7d3b6a6
MD5 bba543d4fbb86f3e699be78c4dffbf5e
SHA1 a85451d57a17df1e92a880226ea5b4c21c396dcc
SHA512 386980021b8c625bae40a9bdf79357aab4b8ca5e266f0c8ebffd96ce6c5886af945894d35c8ac42d6f7810d405a42ebf0388fda50b03ba8f2f889a4ad6147774
TLSH
T1A6319AF787B086BE8E0152F0AA046E2BCE6C0516436C3C6A86D0AF2797F3471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 50f38c84e117144f4c5c42e69db5f4e950b6d7fb43c89fe1a0b46d01b59c138b
MD5 fb74768342c7d3f617f30c19917921ae
SHA1 9566052d52d9dd2fcd4d9512083241abd4d83c36
SHA512 2ba7fcfd35bf7ea603dcee8e055189310af62537bad2f124ffa308aa7fb5557e69cefe09f36093c96ff2c64166e605e311792446eccb4c85d49f7e0d29eb818b
TLSH
T19E2168F783B085BE8A0092F0AA04AE2BCE6C0557436C785986D4AE2797F3471E141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c7e36d50787db84dcb658806d33d9727b60a76c8df29e23c5b0cb1a851410cbd
MD5 1eee221d04eb9b26b7cd04ade512f410
SHA1 f8b6733dd4128383a282a2ec105641cbc271bf30
SHA512 f179df4ad2014dee1bf7e1a1e123bd3869b08635e7c8ba80420274be337d9817f8a89ff9df8413f979ca4937b4c431af717a07ebb2e2f1c564f5faf188cc8aac
TLSH
T17A118BF783B085AE8A0052F0AA04AF2BCE6C0553436C7C5986D4AE2797F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b8999657ca4f50593e18c4d3539d047cb3f1910aef92d7ce5e952b76cff580f6
MD5 66d9ff821fa6e47dd3e0f7e7c3d3f67c
SHA1 e7cf3d1208686b3d153f2df05d4e1a78fe464167
SHA512 8fbba6f21cf898105e8aab3efb6c850760bb196e77eea65df689de358e721e697dce13ea92d129d4e93b5b316b42f2e6e3736671bbbede99c1c65125cb74dbc0
SSDEEP 192:sxZ2RaWr/f2sAFVIdpGZHzW/6+WNRf0/YYB5h7IgrJ:sxZ23r/f2sEmCHNW/ff9
TLSH
T18722B7566E38A97B8CC7D309BA15BF53E6F9543261D41E48EAFC861C04E7ACD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e1125099d7f72077fd7754dab5a8bc6184ac9cd661ea4ab2390d5f3a9c80ee42
MD5 9f43603bd83080978eae31febc12be03
SHA1 a01b880c386e49a8453f40b6b86b00f69c4d99c8
SHA512 823c971e29ecdd06a7d0413e3eae5a9147488255d21bef9c66b80dea78d55f3a9d598b3214f9064b3868a5a5cfe174a82fdb6deb6090b568a16b54810e1d358a
SSDEEP 192:sxZ2RZWr/f2sTsFVIdpQZHzW/6+WNRzzFYYBfUh7Ig5NJ:sxZ2yr/f2s0mAHNtFfo5
TLSH
T1DE32C6566E38697B8CCBD60DBB55BF53E6F9143261901E48EAFC861C04E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8250704288a2a653b19ab6db81ef23641fa8c7ca9cb83c68597d55c8f655c686
MD5 6d9acd57b36a0e5c50df401094aa9bae
SHA1 09e42a0c9d03696cfa79f4bfd47f2fdd07d00877
SHA512 6668969089c5808905d7eb850966ae361082dc75cdd8f882630215e4e16c012b6ded7d63112353e7263cbc65286ce195fe1480f5a35b653918e851ff652baf42
SSDEEP 192:sxZeRZWr/f2sZsFWIdpXYlHz3M6+WNRzzFYYBEUh7Ig5ZfhJ:sxZeyr/f2saXoHJtFfNzr
TLSH
T14632C7556E38697B8CCBD70DBB55BF53E6F9503261901E44AAFC8A1C05E7BCE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 672eec4078a99dec65f36b89145bfc36c2291b2133853556daf7ad40837b1af1
MD5 85d8145de6749bbe015c42079b32cca5
SHA1 b1793a81c0092a158bc824681d8707e18ab8a386
SHA512 80269eddfd10b4f872ba612b2d3f50d491a545efe2469f75e3a8996a2af1e1ef5b361ea3ae6e52b11e2643ffd612284a57e9e276f314381831cc0504249df9e9
SSDEEP 192:sxZoRZWr/f2sZsFSIdpX+HzU6+WNRzzFYYBEUh7Ig5ZmhJ:sxZoyr/f2sabOHBtFfN6r
TLSH
T1A132D7566E38697B8CCBD70DBB55BF53E1F9503261901E48AAFC861C04E7BCE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bdc4b6a38f74585e90c0f168f3b5bf6b7c688d6fdb5167817cd6eb07378c629b
MD5 62239c5f05f36a9242ec247497d42390
SHA1 b7b2019c2af2c3ad03826aab093b4ddd4415a6eb
SHA512 752568302bbe0691a046b40e35fbd68ad2ac163bef114c609cd8abc7a39b5af181bf0e1c569c23c87411ba5bb77494372d21030a82fd84a9cc07a949e333c619
SSDEEP 192:sxZ2RZWr/f2sTsFVIdpGZHzW/6+WNRZPZYYBbh7Ig5NJ:sxZ2yr/f2s0mCHNvZf55
TLSH
T1F822B7566E38697B8CC7E609BA55BF53E6F9503261901E48EAFC861C04E7BCD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 45b29bff66a6010d4f653fdec435931c5bbb18651ef3b9242dd12cddbafde3d3
MD5 22eb35faefe1e17ab846b3fa9c7aa88a
SHA1 39c81a01a4c9562f3396c20d9824bdbf50d2cbf8
SHA512 e183bc31885b0c9fdf30b7132ffa1854a80f1a6d672f740118c0635ff2d7344378713246fffc63ac43113de5c7407679a1d30b4677baa0c66a5ac5ebfbc1716a
SSDEEP 192:sxZ2RaWr/f2sTFVIdpGZHzW/6+WNRf0/YYB5h7Ig5vJ:sxZ23r/f2sJmCHNW/ffH
TLSH
T17422C7566E38A97B8CCBD309BB15BF53D6F9543261D01E48EAFC861C04E6ACD220790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 b1b1e3c7e9bae712acf57cb9a11484daf6edd98fd778fdb09942ed74c59216db
MD5 a5f7e1a5e1432bc419c4497102d5ce5f
SHA1 5102f540744aa7169b01d6e6455d43728f9fa097
SHA512 798515e9517f26dd7c17030ef39b645a7d25347319ca5ddeb31ff423946190d34fe249350cd4dc83679a94543fcbd9420c48f036e7ff6c2540285b9d34a2dedb
SSDEEP 384:sxZeyr/f2sE66s8qMpRiYnazAW8pZS15posJWeT+EXoHJtFf9zr:sWyr/fy4Mnc7WeT+E4HJXfFr
TLSH
T149C2E605A924C83B9EC35E1C653C7E33D9EC50622285DEDA5AECCA1C01DD1FDAB47817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 99e43c25b91bea67aecfedee78c5af2bda6b1d068e77482e488a234274104f8e
MD5 a3624df83ac77d33a6f23e1900630007
SHA1 ce6f2a87b58225b4ca202aff18cdf3feadf33237
SHA512 64a9cd6a52e38d60a5bfcac9fde63f081e91bd38495dde70ad6678c49707af4c2c6068bebecce3e7b1c2ce0ef77470b09cce72392d38762da1f83c98c0c7ad50
SSDEEP 768:5uyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX6ropT5s:5uyYR7jWv3NpBu1ja/CL8OXxo
TLSH
T145C2E93B640DCB7E4FC01E9DDC5A6FDB6E9802C7A6548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index
Size 864B
SHA256 13c75b430c0864031d4a469c667ab526923d61ae80aa06833d414d1fdd603c71
MD5 33d557c3fe6104f35d0810be2e3a3642
SHA1 7b1befec49b974c2eab8a4814fba8f2b7ab03b81
SHA512 465ee85159a6b4c9bf10b1d3e9a9be7f73fa67338c4d0ea6b07f1c19a8d9bc14d301b2e40574d0be6635f4560afacb7fa084514ea8a5115ba273c3fd18937b0a
TLSH
T16B11DDDE1D534A9BFD540378243DD886A27902CC1310760FA1AEE12A8CD7B407E81AA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d73fa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b6b8ebb2-83d0-4fab-964d-d231837aefb0\index-dir\the-real-index~RFe5d73fa.TMP
Size 864B
SHA256 4fdba677cfff1121ce0089087407a2086f03dcd1a635b89109459fc664fd7d48
MD5 165ca3b36b443dc3658e7fcffaf00d25
SHA1 7c81272e9dceaf0835a542f1b2caa7512c3107e1
SHA512 0536a927d514b5dc7b48c2bf41245148b5abf87601e8783e90c2100e2310008ec3ae3a89f90e7c75cb79c083e4f26981da5f710a0234e5615988207faa05e439
TLSH
T1E81141E901638B06FC4803709A2CE9467175824453547B4FE3EBE12ACC82BC0AD83FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 802069898df44246083263f341e439929a51506f9f340c98012b1628c8917671
MD5 116695f13420a7c6370c9d85a2588109
SHA1 7ae846c62c1d1b1d139123d3f2d3f59644050072
SHA512 a5cd50411d5b23476a3ea1ec4ebe1a2daad661ff96eb1101399a8ac09dca13480cf78f2edda6d84afec549d385661e0d8c888d2717b3643e9f76f25a1a2fff05
TLSH
T142E0C0FB2CF71820E86F83DE107080A081517468CE44EE4F542ACA8311B135D344EC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5620f675722d9be80bac5bf877d74cedfee78f7eecf954978d59afd2a7972819
MD5 7c551e05847f1c10ff97e07a544ae006
SHA1 31af92c68583f4da72756b7c57c039d69dd763ff
SHA512 a9a698e157daa8e9d9af994f374ddbc0eca5c8540dfde3ddc8b50eeb1fbcb777989bc5df19bc3d7605cfa76a0502254a728d558bd3741356626dc5c29c54163a
SSDEEP 48:KghwdR7/DcbvaHISpcK9J1jcxBMY6LBByL2xMwuUUNb4PgISINK9s1uNxmdYHYTs:KAmYKDKmut+KmsNlKKGwC+z
TLSH
T12591891171BF2244387E259892A1872F554232B73488F63FBFBC00668E6BE459DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e3cdf6f-5394-4d2b-9445-170342b6b086.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5e3cdf6f-5394-4d2b-9445-170342b6b086.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 5fb6772655af678ba416609cb73ad32a141cde5c36223ef1999a011404704f74
MD5 3a1490e6daab314e39a594decdcb7a51
SHA1 6a355fd85479fe2ce88b4d0e3124c4aaf28248d5
SHA512 f8cf9bb6553dcfce852db8431048a5b57b73459e5689a7c888ff96132be0045f947dee2708381579bbf89b49e020d1e41dd4a146ef47b2b16efde1c43af0fa7c
SSDEEP 384:uiFiZcIdzsNb8TUNTUlIlH8DhtNixSvQX5+DtE8A1WpXM9pOwTeUCg3ou:FFQl6wg2BfYkDrupOweGB
TLSH
T142C23AF648D78836E9AE9B43B77D2D028EBDC063B5849680B7985A1CCC951BFD309D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9b2c833cd0d8a0ba409a3e92afe846ae7cf53d2540641cfdc4526607b40e12a1
MD5 f29d3a9e654acfe33f5a9c6759ab8dab
SHA1 a7083f36c55b65ee96f8f9be0bf66b890d4911ed
SHA512 e9635572cf3a5f6617ffcfc7c83e12764854cf1c7669a99494b9a338c065ec66fa819b82cf4881d5e0ffc30b081e72d109ec8aaeb75873831f6953630372f6cb
SSDEEP 192:EON76nnHGQmiUyVTQYcX5hQDP1UjzorA1WXMcTGU6:EON76nCqQNX5+DtE8A1WLSU6
TLSH
T17502EB34ED786C6B8EF3AE46B08637136F952167A5946BC0DAE81E1C00D769C230A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 550dd071e59bf6754cb73f9f585b22ead0f0239701c6ad9f59e5301d83fc8723
MD5 4d9630c547f6305d6429e55ea0109c44
SHA1 dedeed2b86c8f35d52ff70aaf03df6ac632a0911
SHA512 0675eac8b82aada4e3120b65eb1e7d753ea0a8b15f66d2e5d86f84b695b53fdd267509752a7c9672508261b0777161b7560bc01cda50148bace15e5a8d8de01f
SSDEEP 384:FZcIhsN5K8DhtNix5vQX5+DtE8A1WpXMZpOwTeUCg3ou:9hwBwYkDrQpOweGB
TLSH
T16A829D369DB89C372DF2A686B44636039FF99063E2C86BC0D5FC6B1D01D9AE51309D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 96ccb78af022459bd23c87a4f961856277188cb35eec18b1b6b6f4be6e8c9c42
MD5 1a5e0021fb98017571748135e873ec09
SHA1 e5dd7dbc21789edf03a2bfbb735ad0fa97d5443b
SHA512 97fc67458be9dd726c4399f83321401f90af605b860339cb3a98d5250db4392a92d55b501a6ad6474cc4b5cdc292f0cc2081407f6e2a09767198c3b2c41420fb
SSDEEP 384:WZcIhsN5H8DhtNix5vQX5+DtE8A1WpXMZpOwTeUCg3ou:Eh7BwYkDrQpOweGB
TLSH
T158828D369DB89C372DF2A686B44636039FF99063E2C85BC0D5FC6B1D01D9AE51309E23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ca8c6dd082a670716145f0856f8001d1abae3a920984b828d1c4ca02f21965d1
MD5 9fc305266b6d5390bff588389ea07ef8
SHA1 eba8c9935118fccff0899a87902c54ba59da52d7
SHA512 40d297746ab5ebee45d0531e9929eca72b16c0d39e094c9313307ef1191ee5abaa524f3ac8ac33bde93429490ea9213485d2d7b55d0a0f1f751c52f0807e2175
SSDEEP 192:EONs6nnHIQmiUyyTtYcX5hQDP1UjzorA1WpXRqlvg3jr/5OU6:EONs6nIhtNX5+DtE8A1WpXMqpOU6
TLSH
T150121B35E9B8AC2B5EE36986B08735136EA55127E6487FC0D6EC2F1C01DE6AC530DD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90212d2d-cce0-4efd-9f01-57ee0f4263b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\90212d2d-cce0-4efd-9f01-57ee0f4263b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3f42d9ce4e63625070afbe0f2a44a3f26f963863c1cdbecad275b794f65a129e
MD5 4b5f6bb57ae200f884e007aa541d5799
SHA1 d3367b4a868086f3bed01318049168fc07a4821c
SHA512 0e35ff39214327aadc209be8b624466a1bcc3d9f0ade38e527fba7efa01a2783a7e400d8f3d444c355b9e3b3ae07c8c9ca92da81da8f01c5b5e492acbf29ff99
TLSH
T1FE41D458AAF91048F3B76E46ABF2A96E547FB9372E47949D00010D8E4B62A40D861737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download