hxxps://punainenkolmio[.]blogspot[.]com/2026/09/hyokkays-kotimaiseen-sipuliskeneen[.]html

Analysis

max time kernel
598s
max time network
596s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/09/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://punainenkolmio.blogspot.com/2026/09/hyokkays-kotimaiseen-sipuliskeneen.html
Sample260926-vbftnsxfmf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1531437071-3039716239-3530695936-1000\{52B2E98C-C3FF-4973-974C-DE4F77F34102}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1531437071-3039716239-3530695936-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe
740	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 740 wrote to memory of 976	740	msedge.exe	84
PID 740 wrote to memory of 4300	740	msedge.exe	85
PID 740 wrote to memory of 4100	740	msedge.exe	86
PID 740 wrote to memory of 4100	740	msedge.exe	86
PID 740 wrote to memory of 4100	740	msedge.exe	86
PID 740 wrote to memory of 896	740	msedge.exe	87
PID 740 wrote to memory of 896	740	msedge.exe	87
PID 740 wrote to memory of 2104	740	msedge.exe	88
PID 740 wrote to memory of 2104	740	msedge.exe	88
PID 740 wrote to memory of 2084	740	msedge.exe	89
PID 740 wrote to memory of 2104	740	msedge.exe	88
PID 740 wrote to memory of 2084	740	msedge.exe	89
PID 740 wrote to memory of 2084	740	msedge.exe	89
PID 740 wrote to memory of 1124	740	msedge.exe	91
PID 740 wrote to memory of 1124	740	msedge.exe	91
PID 740 wrote to memory of 1724	740	msedge.exe	92
PID 740 wrote to memory of 1124	740	msedge.exe	91
PID 740 wrote to memory of 1724	740	msedge.exe	92
PID 740 wrote to memory of 1724	740	msedge.exe	92
PID 740 wrote to memory of 4228	740	msedge.exe	96
PID 740 wrote to memory of 4228	740	msedge.exe	96
PID 740 wrote to memory of 4228	740	msedge.exe	96
PID 740 wrote to memory of 4404	740	msedge.exe	98
PID 740 wrote to memory of 4404	740	msedge.exe	98
PID 740 wrote to memory of 2296	740	msedge.exe	97
PID 740 wrote to memory of 2296	740	msedge.exe	97
PID 740 wrote to memory of 4488	740	msedge.exe	99
PID 740 wrote to memory of 4488	740	msedge.exe	99
PID 740 wrote to memory of 4488	740	msedge.exe	99
PID 740 wrote to memory of 4592	740	msedge.exe	101
PID 740 wrote to memory of 4696	740	msedge.exe	106
PID 740 wrote to memory of 4696	740	msedge.exe	106
PID 740 wrote to memory of 4696	740	msedge.exe	106
PID 740 wrote to memory of 3844	740	msedge.exe	111
PID 740 wrote to memory of 1596	740	msedge.exe	112
PID 740 wrote to memory of 1152	740	msedge.exe	113
PID 740 wrote to memory of 4408	740	msedge.exe	114
PID 740 wrote to memory of 4408	740	msedge.exe	114
PID 740 wrote to memory of 1724	740	msedge.exe	115
PID 740 wrote to memory of 1724	740	msedge.exe	115
PID 740 wrote to memory of 1168	740	msedge.exe	116
PID 740 wrote to memory of 3628	740	msedge.exe	118
PID 740 wrote to memory of 448	740	msedge.exe	117
PID 740 wrote to memory of 3628	740	msedge.exe	118
PID 740 wrote to memory of 448	740	msedge.exe	117
PID 740 wrote to memory of 3808	740	msedge.exe	119
PID 740 wrote to memory of 3808	740	msedge.exe	119
PID 740 wrote to memory of 184	740	msedge.exe	120
PID 740 wrote to memory of 184	740	msedge.exe	120
PID 740 wrote to memory of 1100	740	msedge.exe	121
PID 740 wrote to memory of 1100	740	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://punainenkolmio.blogspot.com/2026/09/hyokkays-kotimaiseen-sipuliskeneen.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffb247ec188,0x7ffb247ec194,0x7ffb247ec1a0
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,13171397951183242751,16944604251289302448,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1792,i,13006198919485044596,11513114808052192792,262144 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,6329122088688095346,6504599978522499770,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,817445124260870788,17413922270403376604,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,7437898587369649209,15259127667121780525,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,11074967634186111043,13669219167057193050,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,3951634003006333427,492633054707922182,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:2
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5188,i,16873061761382771336,6662767261390771587,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,17537623436847297118,3260269803864574656,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,11348438258684659210,7425484038206255589,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5636,i,7737984772289585628,7276069582035320591,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,9589412291738976219,10280978662984097373,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,9589412291738976219,10280978662984097373,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6540,i,8384516365953510284,5921082649916684788,2097152 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,10611099293410705990,483185467998720,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:8
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,8042674729082557033,2130632079858862808,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,13062249024468432075,6064494104291654193,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12865194197786092894,452898076572610541,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,6509878785052391655,3221056181172707553,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5512,i,6816533119127380166,9554962622585606,262144 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,4154692796093087449,6356618860004332131,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,1494094484889741104,2240086766140364537,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,18209487255699428690,8877077662371718700,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3336,i,8711349930467630163,731191917074255573,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:8
  2⤵
  PID:184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,10071071173975285337,13274972485476666800,524288 --field-trial-handle=2392,i,14417667629452893534,1337926027015689053,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67eec63ac68fbb0c1370804e730eb2380e37e239eeab08ad3acdbce09f2d4da7
MD5 01c96e75e4fea28f5b0070be7d2642b1
SHA1 2bf70d62314d343b1de12a799097bd6bdeda356e
SHA512 ba15fbcf47b54f0dd13d6c3fe38c3aaee1e1084d8dfdb2fff0655289696d4edfd95df9f4d568129ce17fbb46e9d8dc819a710205be11e86776404ec9304c340e
TLSH
T116D02474D3300531F0154073FF1507440D05C50C0717010DC03050DF5CD01544101040
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0f5f1e00629f744ed0cefa4d3e68242c542dabc25f6f6dd65620706038a82ca2
MD5 1b67fea2e2133bfa56c46409a0385110
SHA1 6dcc1bb17ce325aaa77a5daaaa59411b8a575827
SHA512 243b0896595b49997a889879907933f07ab8f4261ab1a5b7510f603d2921e02c857a12734f35bde1df83f4cd3c294af48a696aabac2698f80a5173e7910c9dd8
TLSH
T14AE078D819CCC35FD3047447416EF74CC190370BD6CC6A7D3705844C754199077C1555
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7510bb29f195be759c467593355a162c81d6c403d87e5d4cfc7a10e6d3d5f8d6
MD5 c41fb26a0bdc0fb2c22df6b1429e996c
SHA1 196c9901b047d2024a6c5fb357eefb3bed23edd3
SHA512 61cf59f0ca7e876865c3a606ccab52f41eb08ea0c850a960aa77fcc1206ded5d4fb59f5a5417383bab9945bf40ecd9b947337e164b65b82f7fa674ca6292e077
TLSH
T17AE0D8B804C8C21F920474CB61E8774CC3D0BF0E96C86A1E3F14944871428446682652
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bd9e09d88b7448c94defe7532a8c39e696151a4cd136c46bdd3c441fd2db4a2a
MD5 3089b9eef6a665a6d9597b0b82b35053
SHA1 4fb346e9b4e2035a7b45bac677ed6f19b8429644
SHA512 221cb4297468de32efcec50c3d32a36e3d9ab9ebcf27630828d208dc2ce8e6d66152394afa2da82a98af56759ce7eec830b158d336a9fa1016b58d54e67e2076
TLSH
T1E7E086A805DEC6AEB70875C7426C978CC2A03B1B96CEBA6E3704DCC47741958B392693
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 346KB
SHA256 9be344d8aab52c80881980d24ba1435146143794aebbeb98bcae9a4b41f0bd16
MD5 fc31feb6dbd996017ba0751ebf1a2be0
SHA1 d5e54654c86bcbfc7aeed4377e9183421b5f63f4
SHA512 21a4c7e4b3c8f42a8886bcac34a50ae30e61efd3c0443b66fd3cffc54caaf4265d4ee65521051cc530e2e1dccbfb877a303a119768406da737c3249ab577b0e5
SSDEEP 6144:r6PyntaVKs+9xeKjohEc1avaW5Id9Veu22qVTvHodWVjaVrQXcx81E+/SnCCKCDC:uPynjs+9QEcyIfcN2YTvHo0VjaV2Z/SO
TLSH
T1FF7423717998940FD4622800765A6FF51C403FAFC52AE6E3677B10B34D9E4A7347CA38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 42259c38e5e34e5608a5aa0c04b1ba5996deecdf6a3b838af13d52fd63c46bb5
MD5 045e0678eaf19cbca2e17598635cbfae
SHA1 088d886cd8d591703f64e41c8b2f589b7d65bf36
SHA512 4de6268754e82ea9a8c089d39dac32e71809a059a56cae448bb472a90667293286754f23c77a1945f0d722a1a10002c720fc0e2d66625220f1461a8c9e99d989
TLSH
T14B716045E1969C59D76B64B384C4A28732FCE6AA7CCF0FFE13E0D8B85B4E358D065401
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 a3eeb6ed817f6be9674e6fcc31ad24e7bd75ec8e7f9dc508cc3dc39d81f3520c
MD5 b01f49b36bf4cb8003f8a31369e080a0
SHA1 3ba0743081baee6fd420c1c70d0815300a682b99
SHA512 99714a359648a1839a2f2868063ba37c58ba57490f6f8f6fda41076459c982812a65090852f315d6cfcb3e3529dc8965e9779d8d29c6a323c4ad9237a9f370ce
SSDEEP 96:D/OZtJZPZKjZpZEZvZ6ZOZLPzEAZi8fZIZvEZZGZtZ7bpJZXZOBZVBZTZPZ4ZHZg:DWDJNYjLuJ0YBPwAEQ6FE/Gj5pJJgNdj
TLSH
T115B1DFB3A3A0892C99915BF099647D17CD2A0819E36CFC9ACDC46F0E63E2171D189F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 1c6c632fef0ea4b36804b95fbbcf2110ad8ecf2309687070fa18ceeba34b48a8
MD5 1e76d07f0ebcfe92a6bb69b99e7fc771
SHA1 2b74586f97aecdb67e27e38ba6c4631fda3effe0
SHA512 fd679d2e8bb8e6b93aadf3841dc98359da1e454fde052817f239bd910222b11ff1dcaa133480f3381da11fc216afdaccd90b1dc8231f74ef5a27fc27a7f393b4
SSDEEP 192:DwDJRYjLsvET9wAEQZfFE/G2pg5R9UJJg4woi8rF0sKdNfec+h:DwVRYjLsvET9NF1WOkghUJg9ja6HjecW
TLSH
T15BD19EA3D3D4892C89915BF49A647D17CD6A0C18E36CBC4AC9C8AF4E73E1171D285E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 45afedbb1997d1f28d001d1c46d2915e860dc6cec10c04a7c96b15724d8cef73
MD5 5be6a2d7317751fe734bbc3d494feec6
SHA1 d36dd3dd7606d0bdc43a5a40c4775a345e12e974
SHA512 c6183cfe142dc7e48f3086c7f8f852a075ce19c06a73870e0543f3e6e6cf0fba8cd6d0a313482f32ee329f9b76339dbbe1dda1fd4a5866ef699d6836f7cbe9e1
SSDEEP 192:sxZxR0Wl/fKs8pSWsIdpOMGHW6+WNOrL//YhhozIgrJ:sxZxhl/fKs8UW1ODHbOn/N9
TLSH
T1E522C8566E34A93B8CC7E21DBA15BF53E6F9503265941E48AAFC861C04E77DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f3c47281a6df48e9499796150e9a0c1770dead4e9e222065be39fc553135ada3
MD5 3dbbe92a03d33b65f86722a08019e218
SHA1 1812bba7f39705449fe6058110c140d41b532c64
SHA512 3b916e99fd319a1942a6c9b8dbac7572decfe294813b7553012382549f0a6797761cc28cee188663da32f9654cc432efc34d77ef91d1a2c58fd270fd2d647c62
SSDEEP 192:sxZxR0Wl/fKsTLSWsIdpoMGHW6+WNOrL//YhHozIg56J:sxZxhl/fKsTmW1oDHbOn/hE
TLSH
T10932EA566E74A93B8CC7E21DBA15BF53E6F5503265941E48AAFC861C04E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 94a19c18be59df427dbc35b13e949c644475a7a0bc5f02e2aa770bbc09794456
MD5 edcad407bac72b5d0ab2f6ea6a81fe9f
SHA1 8ca077b029958cef9c047e0c0e3ec2791bdb4559
SHA512 447549b66a5f748ab94804adb59e3b960848304cd16f44170268e890ebeca0de809a84f48278d9e2c024204dca1ce312fbe0bac46416efbfc96c8fea79959b06
SSDEEP 192:sxZxR0Wl/fKsTpSWsIdpOMGHW6+WNOrL//YhhozIg5YJ:sxZxhl/fKsTUW1ODHbOn/NG
TLSH
T1AA22C9566E74A93B8CC7E21DBA15BF53E6F95032A5D41E48AAFC861C04E77CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4973dda5d50d823d6a1d0b9780cb4484f53b9c7fa267354415e35bbf3ca92307
MD5 19ca6fd137e5c6abd1a4df04c0575f25
SHA1 019e885895eec25af62787047d2a9b6190b58560
SHA512 3c553b00e108b3e21bb5f6a09b3bf2d30bb28c1332112de617fabe20786b5781fe4461b58e11acdbf2f0f4ce9242b8173aa7ea23e6a88256ec2a5eff3a307153
SSDEEP 192:sxZxR0Wl/fKsTLSWsIdpOMGHW6+WNOrL//YhcozIg56J:sxZxhl/fKsTmW1ODHbOn/OE
TLSH
T11622EA566E34A93B8CC7E21DBA15BF53E6F5503265951E48A6FC861C04E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 357baaef84b814db78d6cd4cddecd04b1e2604746a4a18de5adbd3e0e28c635e
MD5 fffd51335f61c6d37f86f711ea21b126
SHA1 06042693853c1089e3a4b8c5cb98eff8cddddf16
SHA512 4006a7cfbf3f5da3b4d48b389b3d83c391f4c33b6d42dbe113ab81fd14680b830c0483e9ff5c6548a041d95bd4e0c0056d55f2eff61518be8e332e66e0249e9c
SSDEEP 384:sxZxhl/fKsTs66s8qMpRiYnazAW8pZS15posJWeT+6W1oDHbOn/bE:sphl/fJs4Mnc7WeT+6W2HbOI
TLSH
T12AB20805A924C8379EC36D18683D7E33E9EC506222C5DEDE5AECCA1C019E1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a989fb6676a7f457fc4e24b8ba3c954bf30b3520f571bf788ea085e38ebac387
MD5 f34937f3663fbef1ecbc0c1c4705b661
SHA1 f98624c1149026ddb625fa1fc76c044c7ff1f3ed
SHA512 1731ca9e46b355e4a25316fc0010472e954bd4cd3afb1cbab1de1942c1a140033d53eb61efd0e36846a98de1fb0f63471ddb892e188c7d700d012c1a00f014e8
SSDEEP 768:29G2PL5WvR3X/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYsLlCc57dro7nmsh:29G2PL5WvR3X/u1jaJsLks7Wash
TLSH
T1AFC2E93B644CCB7E5FC00E9DDC5A6F966EA802C7A7588D4047FA944C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5947b5f5-aa40-4b5b-9073-87b9c3760be0\index-dir\the-real-index
Size 576B
SHA256 bca8fa5f9fe731458ffc85cdc040d4033cabcc3d9fbe18d32471ec3fc03f7f93
MD5 001032d06b93e58da8f9e454f1b649a4
SHA1 bcd9a3970d2c007fdb3cbc5b904cec9c7c0071c4
SHA512 fc8c34dcf21d1b1ef4eb9b29ec632c0381d95e78faa28ddd0bcdfdfdc4146e95393629625c0e76f63a707a00887004f1f896ffb5dabc0abfe2e4ab4759062ce9
TLSH
T173F0A3DE5F221B0EDD150530743D6599727C11CC9244951BF1FC891A8C56388DD82648
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d62d3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5947b5f5-aa40-4b5b-9073-87b9c3760be0\index-dir\the-real-index~RFe5d62d3.TMP
Size 576B
SHA256 f03ae47cb5b7945386be468f95d9454d05e25692947905278bc2d249800de078
MD5 c3fbb3e4f7bc3e0c8f89b586fc0b0eff
SHA1 82347d72d47f5a66c49984edb81af0ae03c6c67d
SHA512 d67cc8027674828d577839a8a02b3a92a730e902812a334d3d53e63e7941a479d176d1a8488e63e5b16dbe5f94782cb1ce0a5128c1e53ad594a9567c6b323ba7
TLSH
T11FF0F1DC02238B47FC0401B1E53DA6A971765004930CAA0FF3F2587ACC51BC8DD42A6D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 190f72dd282e1e3e4951d9e6c925bde762623704614283e70b42234c26ffba8c
MD5 7f5af51d2a2f8ad4391958af9e38cd8a
SHA1 14760cb1bc73b56b20ef4aa16b174de0aed3cb46
SHA512 06cf2db4cc716db9ddd51aec6dbbf04942af7da61828264d7ad80f5a441069d94bb9c7b3f0371c9002617d63606ec9b6870b57e85b409f4a663b9df581faee04
TLSH
T18CE068BB2AE21C20F86F97C264704874820179948546AD8F841E62C710A1261B85BD67
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 613239955cb1f35411a5358960036afed74f647d3653a8a55a505399882bfdd8
MD5 86c122d093480d2681cab02792d0c166
SHA1 c2755d32b213600b9a610c11daad1d6dae5e7236
SHA512 8c3544de0b0ec8eeb66f89d29e0d1b30195df54e18bc7e04f83ef08ec47dcfc9b7de3520c635583288376295434faaa52cb3ea85c3ea4bd07c275164e5c5e59e
SSDEEP 24:KLIttW9kiL0k2C0mI9Ihq2KsVhkI21uSmSw8WFGKnyXW5qlUhI3KFh61uSo/vyXD:KgzIhKIQUry5GI3KD6IjyJwIXKRe8VY
TLSH
T1B191ED1070BB0685387D2D1D81658B1A964731E33029F72A7FBC44A66E6BE0C0FFE9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e2b7950-76de-4d15-bb65-180deb5506a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0e2b7950-76de-4d15-bb65-180deb5506a0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 61e4af7dd1c4f9e8ff71d8f28f834334304e5ba61798aa7f041102da20cd0746
MD5 5030db8b248afb47de14a4b39e49675b
SHA1 32495b2618e3dece11267efac14529e9d7d0ad90
SHA512 861d45fea9ecb3501e26dd03f3d38d1b86e3162619fd7bb24be624d942fc6640ef91b54519ee0dc8ca1d0eca5639f53c7ceeff3a17cf8128f70332dd75fdc08a
SSDEEP 384:KiFiZcIwzsNW8TUNTUlIlkoMuIHLVSzCaXpiprdXnNUCa6wKvzwyrqYn05Bi:BFQsvwgbIxtCpUtnNUCRLvzwJ00Li
TLSH
T198C23AF248E7983AD9AE9747A77D3E138EBCC063B584AA50B398461DCC9617FC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 52b8b617c8feab696a7d7683731610dc9751203ae00ecd78b9a58c2f0e117e44
MD5 4e6777bc6997b6898a609b84970c3867
SHA1 cf36f87c8d73d9606627bc7477e6d901499a56c2
SHA512 35cab271c33e376c185040a5179433670491ba1158806483831c3ac8e6e3612d8bfb1477d001ec6466766339864775282fc8648636b00e65f08ff8be8367de29
SSDEEP 384:GZcIhsNWkoMuIHL5SzCaXpiprdXnNuCa6wKvzwyrqYn05Bi:UhrI1tCpUtnNuCRLvzwJ00Li
TLSH
T190828E729C74AC374DE3B244F44A3A139EF89027A6C86F50D7ED9B2E01DAA5C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 95a31825397ac8101ae48d6d58bc11e8f604cb3adb56682b35106d35a82e3dbb
MD5 df645d38733bd4ef6051a48bf3fa661b
SHA1 e0a57a0d722e2559ed334a7ecb82a19e1d12bb79
SHA512 3d6f37f5b9381e6e24efd6b990c83d013f55a9c88797c562f4c70c41f336e1b79c92f15d1aa3950e170cc1e07098366fb79975c9ca440d293eadf8dc4a904889
SSDEEP 384:IZcIhsNWktMuIHL5SzCaXpiprdXnNuCa6wKvzwyrqYn05Bi:2huI1tCpUtnNuCRLvzwJ00Li
TLSH
T146828E728CB4AC3B0DE3B244F44A3A139EF89027A7C46F50D7ED9B2E01DA658130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5063bee073a2fbe9c8f9be57b447bc90eb54be0318f39b2bb6069e42dcb1e49b
MD5 902ce8e056b829ceb9508e82a22e7b6c
SHA1 4dbb4315911a4cd91891291e3bdc70b2d66d134b
SHA512 4c606890b74f20e98c4971156f2104e49859040e54f210a676709cabc5641afb7d2bea7a751a5981807ec61e0d410e6b77e34fb87a5c3fa4de10d712c68caa45
SSDEEP 192:SON968+7QmiUywI1GCaX/h+jzoIm0LJjU6:SON96Btm1GCaXpipLRU6
TLSH
T17502CA38AD787C7B4EE3BE45B58A3B139FD5112BAA945F44DAE81A2C00D764C2346C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dda2498586d9ada1ab4675d5fff965a19aebba9ff943610742095cffe679192e
MD5 b4ed013c1c5e58eedb9a485b6a459b04
SHA1 bb260a5e1efd42255dc6dddde82d92fc76391004
SHA512 d4b18e72bdb74166965d86c5d4bc163f047886cf4c4c41a460c32f70e5e6c24592993fd51955aff54337513a2a5d8a1814e775b0b96612c5cb81867e6e7f584c
SSDEEP 192:SONP68+ZQmiUyHIOGCaX/h+jzoIrdXkENqQYk/va6U6:SONP6B3vOGCaXpiprdXnNwCa6U6
TLSH
T16812FB36AC78BC6B1ED3B645B48B36139EE54117AAC46F44E6DC1B2C01DF65C234AC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e775b3a-7163-4fd9-b012-b574a4e6567a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e775b3a-7163-4fd9-b012-b574a4e6567a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dfff62b0bdde5ec6c7bb825b674a39c1b96af2e3a5a7e4f24d520784b4af436d
MD5 29093d68854a189c558f77cab7deee5a
SHA1 0d41e092d81e73fe87183cdb1d03e302f67dd414
SHA512 1d7040a1acb8d46d08bf9421379cec37a36d00ed1e9868977b49a0661a681fa9ffcbc11d399029e54cb87ac370361c4d9c4597f85dd3345d0cc9ebcf5ae32565
TLSH
T163414758AAED1148B3B76E569BF6A86D443BB8332F0AD45E50110E4F0A32F40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download