d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/06/2026, 14:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alogml.html
Size 11KB
Sample260623-rcndcsdt5l
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2752	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266970099944741"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3226024100-3888324339-2736661264-1000\{4B954B9C-9850-430A-95E1-E4A7BD6A3FF1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe
5360	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 1464	5360	msedge.exe	88
PID 5360 wrote to memory of 2752	5360	msedge.exe	90
PID 5360 wrote to memory of 4860	5360	msedge.exe	91
PID 5360 wrote to memory of 4860	5360	msedge.exe	91
PID 5360 wrote to memory of 4860	5360	msedge.exe	91
PID 5360 wrote to memory of 4528	5360	msedge.exe	92
PID 5360 wrote to memory of 4528	5360	msedge.exe	92
PID 5360 wrote to memory of 1256	5360	msedge.exe	94
PID 5360 wrote to memory of 2480	5360	msedge.exe	93
PID 5360 wrote to memory of 1256	5360	msedge.exe	94
PID 5360 wrote to memory of 1256	5360	msedge.exe	94
PID 5360 wrote to memory of 2480	5360	msedge.exe	93
PID 5360 wrote to memory of 2480	5360	msedge.exe	93
PID 5360 wrote to memory of 2568	5360	msedge.exe	95
PID 5360 wrote to memory of 2568	5360	msedge.exe	95
PID 5360 wrote to memory of 2568	5360	msedge.exe	95
PID 5360 wrote to memory of 2068	5360	msedge.exe	96
PID 5360 wrote to memory of 2068	5360	msedge.exe	96
PID 5360 wrote to memory of 2068	5360	msedge.exe	96
PID 5360 wrote to memory of 1168	5360	msedge.exe	98
PID 5360 wrote to memory of 1168	5360	msedge.exe	98
PID 5360 wrote to memory of 2984	5360	msedge.exe	99
PID 5360 wrote to memory of 2984	5360	msedge.exe	99
PID 5360 wrote to memory of 1228	5360	msedge.exe	101
PID 5360 wrote to memory of 5088	5360	msedge.exe	105
PID 5360 wrote to memory of 1432	5360	msedge.exe	106
PID 5360 wrote to memory of 6140	5360	msedge.exe	107
PID 5360 wrote to memory of 3788	5360	msedge.exe	108
PID 5360 wrote to memory of 3788	5360	msedge.exe	108
PID 5360 wrote to memory of 836	5360	msedge.exe	110
PID 5360 wrote to memory of 836	5360	msedge.exe	110
PID 5360 wrote to memory of 836	5360	msedge.exe	110
PID 5360 wrote to memory of 3520	5360	msedge.exe	111
PID 5360 wrote to memory of 3520	5360	msedge.exe	111
PID 5360 wrote to memory of 5884	5360	msedge.exe	112
PID 5360 wrote to memory of 5884	5360	msedge.exe	112
PID 5360 wrote to memory of 5884	5360	msedge.exe	112
PID 5360 wrote to memory of 2856	5360	msedge.exe	113
PID 5360 wrote to memory of 2856	5360	msedge.exe	113
PID 5360 wrote to memory of 2856	5360	msedge.exe	113
PID 5360 wrote to memory of 2572	5360	msedge.exe	114
PID 5360 wrote to memory of 2572	5360	msedge.exe	114
PID 5360 wrote to memory of 2572	5360	msedge.exe	114
PID 5360 wrote to memory of 1904	5360	msedge.exe	116
PID 5360 wrote to memory of 1904	5360	msedge.exe	116
PID 5360 wrote to memory of 1904	5360	msedge.exe	116
PID 5360 wrote to memory of 4072	5360	msedge.exe	117
PID 5360 wrote to memory of 3356	5360	msedge.exe	118
PID 5360 wrote to memory of 3356	5360	msedge.exe	118
PID 5360 wrote to memory of 3356	5360	msedge.exe	118
PID 5360 wrote to memory of 2712	5360	msedge.exe	119
PID 5360 wrote to memory of 2712	5360	msedge.exe	119
PID 5360 wrote to memory of 2712	5360	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\alogml.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7fff6d82c188,0x7fff6d82c194,0x7fff6d82c1a0
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2132,i,16076233475503700696,16570177633986945730,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=2788 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2016,i,14161511540437155590,3319984908824858938,262144 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=2756 /prefetch:2
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,17448638555242639173,6550165678875370215,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=2796 /prefetch:13
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,582009776089176543,7770768381119155376,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3628,i,9922660559639807652,3051718998910262305,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4324,i,1196465969778595095,9802552495082192622,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,6442924048193856280,10744827275805966309,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:9
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,17523651163923803579,13697017311293428235,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3908,i,7072720868687634445,9310989839289911837,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4634676359994116015,14256335904717287861,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4634676359994116015,14256335904717287861,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,10450126294879236175,551309361219354989,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=1240 /prefetch:14
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1384,i,2866691439265453753,12366509846352994109,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,8661275804296194830,8857033757319100165,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:14
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,18171499981790644935,4685753203173845092,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6560,i,13746263620053076116,4938450302207317524,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,14540879897901660684,8660614352727621008,524288 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:14
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6760,i,2762003889730923748,769538292413511660,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7092,i,2283677463747780037,16459044609352542011,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6136,i,16626376971402415039,9530347212628710077,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7252,i,16149424071892596196,18335341406496496533,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5124,i,4317789890388520075,7689101766037435539,262144 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6132,i,17526562429290744464,12348222714079131626,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7156,i,11581244546517493222,11811060959177582800,2097152 --field-trial-handle=2760,i,3452756822589063226,15149310297985640936,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

522a9a89-ffd7-421f-b73e-c2a45b8b5c57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\522a9a89-ffd7-421f-b73e-c2a45b8b5c57.tmp
Size 38KB
SHA256 fc1e9a0ca56ba981ecb802db47cb720f9994684225770f4a6c66ff14ac26255c
MD5 3509bfc51efe534fb9f0a30e7cfa24d0
SHA1 89782681e2f3037da0329949d016dd2d5c48e533
SHA512 d8149857684d5bd31dfccc7b9c603d467d2eeed29c564b5194d3e4644cbc96060afa0bf3b0a7bef00dfdeac93b6041f3cb51a5c1173d96ad1e9b0f1482108019
SSDEEP 768:EjaeqD4MlshiLdMma3LpPfcO7fFV5R4HTytYYqgHvPg6yjWtxjTo:EqcjhIdMh3hfnfFWTwJTyj2y
TLSH
T1DB03CF7AECB85CBB8CB29585770277976EB842A3C3C12B64D9DC5A0D019B6CF130781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25e3094666b1652de0c19f09d2c5a36315ff1f2b6bf4618230987e4527d887d6
MD5 6c5c69ea7db1f14597429c11acb086da
SHA1 20d287e42d0eef2300c162f279f6c1a5bef2e00b
SHA512 4670a8f1b1ff14ef0094b5f0e97add9f3a5efcd9cbac0df76bfa0fcb59e20e8d2587834ddc7e3c72278d6925836d06584fd79fb3286a9e087f9322e2b6f4b220
TLSH
T11BD080753F467511D54514F0B414926153378C5339C2D50A7135C01EAD604D0E3C55F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ca5d57edbd599d2f326c973f9ea78899a33bc93603d04f5c5fc3060bb6069335
MD5 b40813b6d7a845a0e75e73df45573d20
SHA1 065e9256016c1ff5d12e5f09a43522ff134705ed
SHA512 04620591f96093c5be9d4fb65f9b83ca4d994ab596d5bba483af6363751c3afe0d9d550d0a079f304e51196ff781189761c77ec1ccc9ade982cc5d24efdfac3e
TLSH
T197D080713F567511D54514F4B414926153378C5335C2D50A7135C01EAD604D0E3C55E7
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a64ea1f64d7a1bfe6db6b730ab077f8d115909be34154adcf1815183765c0cce
MD5 60dba293cd7f86eb6b2e31ad59dc99c5
SHA1 ee665bb2354067fe4bb29ad590921508a61141df
SHA512 e743fe265e9078b45b4773614cd6b9fd32dbc3cb4eb322d5ad56f81edceaeeed5f21997f44c5b114e98b45a115694c645186e5512ea88ed1aacd27e7ceb59046
TLSH
T139610921406D4BFAFB3D593292DA54CAB3F4D7E51A0B7F20C1B270BB8A41F8568894D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 5c6463e40ecd3fb490d77dbd9200867a4d7f5ae783437cfe7a193418b35e24e5
MD5 b1719ad2d20690e55974eadbd2454e06
SHA1 0adbaffaf6f4e8e0d836e45f316b9a73050f8990
SHA512 39206779b5ea6c87a80fa449db770a5a67d70b0f110899d30fa03356919bc73de33a4177e6a2ff7dad33f887627d40a95ee6aca443c08d33042119918bffd7f7
SSDEEP 192:Wc2hHFcYA+ydkQdWLHmQJg0T2NqLrIgnhAdRURllYLTi3dN88qRkvOgFnFLR1t5m:R2hHFcYA+ydkOWLGQJ9T2NqLrnh4RURw
TLSH
T1FED1A428E1BFC6EEEF781E3D93FA594473B3DD8005432F1A9120E076D94ABC54989C81
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59838e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59838e.TMP
Size 3KB
SHA256 975f196fd13417fbb72ec3e14517c56af524b250e695ebf02a2cf269ae888111
MD5 2e32e1117057e9dacff71a18bf22fcd3
SHA1 c44d9f1043fd633d942606d5ccdb72328a29bae2
SHA512 258eb8044837d44a360d45fac98e7e6b8f79c7ab46c94592d59e10e72b30f89ddb50a53a1c8fb819677cfc7e9ada14aae0f29a35106b47e771f9a6110ab66621
TLSH
T13C61FA21016D4BFAFB3D593291DA50CAB3F4D7E51A0B7F20C0B630BB8A41F8568894D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5e2c1a2d0b63c3372d696ce4a84b38400ab6891fd9c0a07af83b69e7fa32934f
MD5 a0ccd839148fb8e5047b3658c8e9b557
SHA1 a910a9aaff7dc189387fa8cd70076bcd37388880
SHA512 fbf64762a3981e8e08567d420cfe190ec078e0a091977dd1101e55d60a35fb3367e788a1e41c35900461c6c284390fc1c6e330a5ab85fec2174e540e41b04821
TLSH
T1D24167F3C3E8856D891156F4BE146E2BCE2E0914932C3D5A89E4AF1B93E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 2e2c2cddfb807272d0c4dce25c1e1a8bf61f04cdcdf26296b4920d91183189c7
MD5 44fb68f77aec2e17ab00e5985f205507
SHA1 cbe926afd45632a0b4069a94df7b77947afbf336
SHA512 4a8d3631470a48b814b96462278d27476bc66059df94d0a1728bd8b14f73fe0a6f55baea14387fa1ede8cd93680b47e75c385824e65553a43e2a636af27c2a72
TLSH
T13BD02223128630B5A9AC3F91806AEC8FD36B10A00983EEE514D0E8AD2A3587E071F540
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a733ab3fc3a9cd0785220d73814bd17947609c0b9d3484efdfd5d9f46e35a8e7
MD5 24caaf5e825b57099fa87eab669b7572
SHA1 1d1f4328e7e3cf857684243396246fbc3addade8
SHA512 1fc5dc94680460ff03fc2c76a0439ffab655c2286957ab5468c4505f9fbd5334b3661351ed9dd1f284b9bc700bc1ddf7b19fb08c7bdaece05a4326f33b61ee9d
SSDEEP 192:sxRFRnyM/jK1Ml8wF5/f9snzPANkUoUzoA8p4Z/g6+WNIYZjkGjIgIJ:sxRF3b5/f9snzPA7IY/5IGs
TLSH
T1F952EA166A349977CCDBD619FA517F53D6F81533B2940E44AAFCCA0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 5e72b76a94c0b5c0f344a7a0741674077694d1105cf4d66442f3975db5aa1327
MD5 a794fdf35bff430c45424f50ffd3b4af
SHA1 c5877c0c83f3afca2fb425652a762cbeb0137d4b
SHA512 31d51b2a1ff255be31c78f2e1d05f46ab3094987319787715a49a66b70a1708bf43575e8e5ead6be31c184121196185f11e6df85540f341e163d45ab2c4c0ea2
SSDEEP 384:sxRkhqRm15/f9s9z8A7QvTr/5SI/S/zsR/mVzsRU:sgoRm15/fMz8A8f/5rmzspIzsC
TLSH
T1B9A2B6565520C9778CC7DA18BE317F62D7F804739A955E4CAAFCCA0C10EEAFD221681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 53c262aedeaf816aaede25034124267b3e9954c13232943cdeecef19d4517697
MD5 7c7832520fa71f5f65e8f50a187d042c
SHA1 4d7f7ae5b3b016de2c0905d70a583da6cc797462
SHA512 7048e9be5d93e9ba3ad9ba50e4464ad3fc544fed75f471b4189fed018e7729d1550e3b6853a1c137dbd346da25e51ffa0b533eac6712bbffda5329f0b75f831a
SSDEEP 192:sxRKRnyM/jK1Ml8wF5/f9s9zPANkUoUzoA8p4Z/g6+WNIYZjkGjIgDtJ:sxRK3b5/f9s9zPA7IY/5IGr
TLSH
T13D52E9166A345977CCDBD619FA517F53D6F81473B2940E44AAFCCA0C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 1004dbbef09707ab666f92a471d70e8c61efa67b57bfd0591fbfca9659b14b4b
MD5 3aa8238242d4856a91e20d11c4162a31
SHA1 d4767b7305c9ffc7ff5dc2691eb6da89bdeba411
SHA512 3299e861489bec39acbc6a22f7bf685ffc07f89c10ade1169ac6af61227390a59c3807a338e10e9c6680632adc331bbc7f14cda1c401101eec619598fe9a4f05
SSDEEP 192:sxRkRnyM/jK1Ml8w8O5/f9s9z8ANkUoXVIKrbK9oA8pXCZ/g6+WNPnl/YZ3+kGjI:sxRkhGO5/f9s9z8A7BvUG/5t/Z/zsRT
TLSH
T1EC82F85655248977CCD7DA18BA617F63D6F80473EA900E4CA6FCCA0C00EAAFD221781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ab1db5082b35be466ae9b11932bc5c092e64459a7c94df83e63477daa0d7c724
MD5 906bee4df32d981d0576ea8c1a6a32a4
SHA1 a4fb205fae80a0ec3edea8d5f7453b296cc05285
SHA512 2248edc080732c395d08025c1c4484d4b9aad3f2803b6433caec8978422c3ebbae2ad59a1ab50900f37425571bfc0721c1d627f0ec24277197b377e184572d54
SSDEEP 384:sxRkhqim15/f9s9z8A7QvTd/5SI/T/zsR/mVzsRU:sgoim15/fMz8A8p/5rLzspIzsC
TLSH
T19BA2B5565520C9778CC7DA18BE317F62D7F804739A955E4CAAFCCA0C10EEAFD221681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 683f70ba70a98c012f967d5653164bcc7b14cd3438934c3f08fc104f32fb3be0
MD5 40c51516e1a3295f1ddc2859e52dac3f
SHA1 0e6d332f54abba9c27a6d281891ca84e841778af
SHA512 e9c0eab119fbbea6512926ca131c71aa9b190eab126bd8d7cbc9ddc5ff014640360a2e24f77ec4dc94308b36b5215db75f028ab902b87a45f11451a1049cfd9d
SSDEEP 768:eOEt7IWgKgf168F1+UoAYDCx9Tuqh0VfUC9xbog/OV3EkTqQKro7ov8nNwR:eOEt7IWgKgf16u1jaZ/Qh88NwR
TLSH
T1D1C2FB2B240CC77E4F844E6CEC2A6E976DD801CB9B988D5447EA890C03C77EB521A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\837e7d7c-13fb-4433-b877-6f203b6253e0\index-dir\the-real-index
Size 72B
SHA256 87824858bd93900c302a821ec12eb2d8ff775956a1779cf48d74099197f5b4e3
MD5 0a4de00dafb0a81c685d0c5f7cef8990
SHA1 4c29b680c86e1be68a30079e62472dac486d87af
SHA512 99a3ff9f9eb5a6fd962c6de6fdf6e5f9047c036b6398bb1ee0cdc6d48190fc8250e7ae65e48200fe5f41db6f597289271b518b7ed26f0a938915b191b1df6f32
TLSH
T1B4A00250A3C40135D01319B955D602D25600C81471085A9648914894CC584E0465163C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\837e7d7c-13fb-4433-b877-6f203b6253e0\index-dir\the-real-index
Size 72B
SHA256 28b2f931f676a37f6bceb09b067789bdf2cde93451ee1e11f1602ad73a644162
MD5 7cb68301ec6350393ef8e34d70f798eb
SHA1 250a26a2789c807f1e0c237880c42ccd8fa98591
SHA512 972ddcdc5f004851a0853e7b756b678be6d3b3ef19ac8fbb359cd7696ee1f09ce206ad05a35b1b12637be36699a5356a786866555bfec9e9496df57854e0cd9a
TLSH
T164A0021403C43051C8C257B625EB4265225349A40202132582D0844DCDE1745865110D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index
Size 552B
SHA256 513799928159a29ac2291405abf2421893230a57df50c975acfeb0c13e429de0
MD5 4d0c70b590a8aeb907406c0d6fe6cb88
SHA1 fe8a614006b674b758f698e49d4ee2306208f1e0
SHA512 2d0c85040c72c041085d203e854a965b87bb86527bd69aa8577169bbd9c47783251a267a23c94a440f191ecfa1270ac8dbdd4558a61c45fe8edda8c87bb781ac
TLSH
T1F5F0F1B37CF02566CF11203E2932749F323781FC224C8D17516C703D8D227194640289
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index
Size 3KB
SHA256 cd4e17d16ca28aeba43ed38021b10b8a7472fc2ec8807326ed3f37c3dac308f2
MD5 cb0f11615db2b7a2bbe015574eb68cfb
SHA1 4f5df1f0298944c1ca432353c87d9954310b2b23
SHA512 c2baf537db7b7063439ce9c92735895cb9f51ee59e59f938dda7bd1d418dda8aad4313b2ff7fc21ec6cb4d08edbde84d2d6922dedf46d78093a1d7ca65715564
TLSH
T18E51F85E5C472B07EDB8127321B204883BB5A5DC2A48CE0729FC6138FCC3B6D2C69758
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ab9cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8f9fd82d-b210-4109-b489-f797ed71bcad\index-dir\the-real-index~RFe5ab9cc.TMP
Size 552B
SHA256 407cb4f4385411902849d53b4186819d70a7d033dbe7b5df4cf518521ba6e9ca
MD5 33bd26df835913633c592879337b6b75
SHA1 aa98b4b452b6734b0f7394c14c35d456cb1435a1
SHA512 83e9bd7716c76d505140c5c64edb25fab48a8f47d5fda44895709f0322ffe81d829820c82d111779740f8e86ea6ff0cf1f2e7449591575a335213651a0a2b26a
TLSH
T1F5F06AF339E12DD1CD0221B91821911D327BCC60210C8D1FF0D0707C4C5371527D41C6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 18535a81f2943d9d18145008b40357b51d5d95ccea2ddea57d41fcff7844b2dd
MD5 2d625b85742929816a18a3362b984b7f
SHA1 1617fd3d6170171843bffcaf36b2c7431158c1ab
SHA512 fdd2b678465d0b16d7b581e02e9140eaebae3f863d3402871da4d33c465b31a60ec279ec4e3dec416f44434d440047ef29d3db5649f72695f9173e7ea642af1f
TLSH
T119E0C0F7BEE71C04AC7BA3D91471E4500002BC68C704ECCF202EE4D3A4B13112846CA6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 3a0e3db6b5ec12c8059c2fafe201ccfbe7f96af96fc51443dbc525f87da02373
MD5 5d750d7d799ee8101c62aa01f572a1a5
SHA1 bab5424d3c17cdeedf3304f0a4e3a4bbeeaedcc5
SHA512 a83945eb7d00363dba8b4782e1d013076325845ad362703c13532077dcba5cf7f9817b56c4eb098589a4f228e03ea0e0b0e20974c228693e56ab22ff17ba2565
TLSH
T109A002B296964887E0450A74B14101C52625D9508705331352A45165A87A141453291B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5b10b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5b10b6.TMP
Size 48B
SHA256 fac172eaf1f48e19115f9eb591bd5d90e804593293102494486c0cf4cc806591
MD5 adcb020ea935e76ff7ed3e34872a6a27
SHA1 50c168db10f07db99a8235e68edd037373c853ff
SHA512 30b77ff24bae121978cd1a41723dba02f8eb786820d7b6e106bd0abab8b8c350fd1314d94607591b368be5cffcf426cec89aeac8a028ba58fb1d5cf9f6828e50
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

5c7d43f4-4e75-4bd3-93c8-2832e6207f59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5c7d43f4-4e75-4bd3-93c8-2832e6207f59.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 95759fb895de86074f0303b137565c66252694393c668f21f418b3573942d628
MD5 fa053bf3e400d939b7dad6e1eb619e72
SHA1 e530fc02696af41fc4ec957414f57dff75a66f30
SHA512 8e7ee14cc90c6a51f2c2a7f61e56238017399b65ed4e0256a76e55ca1de34feb574ed003c506322c922bf20de2f7c1e7bdc291a299cad9fd5759a62903a9da9d
SSDEEP 768:rj+9+3FZPfcO7fofN6V5R4HTytYYqgHvPw/KAYkvo:+9+3ffnfofiWTwJyKATvo
TLSH
T12EF2AF71D9B88C675DD2CAD4750236477EF88233E3C42B949ADC6A0D05CFAEE170B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9994109872b27d7d7ea5df7be7cb23923a23065dbf61156b811eb67b8d50a2ad
MD5 765d9c05271cea68ed2d490ca30b8025
SHA1 8b451f08b50a1801be8630889f9ba9209978c25a
SHA512 cca717ffda43acf2ff9fbab28594ffd66d9e0a562cc809d5a13fbeb5a3f0386d855ed4940885fdeadcb2734bc193872ce79bc21f38923adccd5bb95a3b8a250b
SSDEEP 768:Qj+9+3gZPfcO7fofN6V5R4HTytYYqgHvPw/KAYkvo:v9+3SfnfofiWTwJyKATvo
TLSH
T16CF2AF71D9B88C675DD2CAD4710236477EF88233E2C42B949ADC6B0D05CFAEE170B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 f90bcd28dc61db901dcd8bb32d3a0f70f4c505f1ea7c19e952f5bf06c779348a
MD5 65ac22c01a63a79ad384c5b84ddab88a
SHA1 97f66e8fee66de765c19bb4f9e8c7dd3769dc51e
SHA512 c20ba71436486085d2d40831c85b8cdc9e149e22325b8ea5c34c9fc25e986e51ee7249e2412d91ad2fff1c2c9d7538666f23e2c3eb3aa75d447f497c1fac9aac
SSDEEP 768:PF1j+9F3qwgXZPfcO7fofNdV5R4HTytYYqgHvPw/KAYkvo:m9F3UfnfofzWTwJyKATvo
TLSH
T15703AF72DDA8CC6B5EE68FC4B5063647AEF44273D2C166A0D7DC6A0C018BADD134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 35f5c8238c180aeae8ae4a0e10f8a0ceaaba42784740bb5724c4dec74b2668bd
MD5 552d844677a3235f2b5b7f01c094133b
SHA1 0373515c798481a44cfb4d4b139dd7a84772e0a4
SHA512 7f3c0e25a50e78b67a0bc38d232b93bbcbb5baf5159320fe3de3fe8f125b1d9cfa711439f9871a554ebfff800594ae0ad649a3fabac5da7170ccd602bef0a2ca
SSDEEP 768:PFlj+9U3DwgRdPfcO7fofNEV5R4HTytYYqgHvPw/KAYkvo:K9U31fnfofgWTwJyKATvo
TLSH
T1F9039E72DDE8CC6B5DE68F84B5163647AEF44273D2C06AA0D7DC6A0C018BADD134BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7d7d3aee72688d6323d8bd67c1f405c20d072220ecf22a1e23b1119ed6406128
MD5 7a7bd91e56074002e76cdd78502f8b73
SHA1 69f706f469ea9bcd688ca457f8a8db3320ab2bde
SHA512 e14aa64faa43adaf8b770ef1c0e84d07f633438602d6a49c130648172874c45dd8bee5a68c556f7ad3f2ec2731507d303ad696a77677442fc8552231212afcb4
TLSH
T1C5E002025745C1BEC17A433000471B3462D3C12452B102160AAD06516C233006F31FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5b0aba.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b0aba.TMP
Size 392B
SHA256 3bb66b1a04864cd0db8f7a2fe83f3bfe620d652b2b0f9b60b1d00aac00f1ae76
MD5 fe3559ddd73b76fb4c930caf2ccaf7a1
SHA1 14f15ea9ca4946591eeff26948b6f7e4f520ff22
SHA512 616c5b2776f1b461fbf26bc6fd684d2a06f52a53a0bb35a08f1c006f13f6fd88c9faf1b65dfe1943391f114154dc179d776cf505e5d8ec428913ef3b7c4c8e7e
MD5 SHA1 SHA512

Submit Download

d6e8d7b2-003c-4afa-9edc-d84b08c218b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d6e8d7b2-003c-4afa-9edc-d84b08c218b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download