8965ab3a6e24725f059ab8a3d9a7f14ed02b290b11aadc1cb0f32ebcfadbf60e

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1iAqCqOeIl.html
Size 4KB
Sample260629-rwd9sshv4m
SHA256 8965ab3a6e24725f059ab8a3d9a7f14ed02b290b11aadc1cb0f32ebcfadbf60e
MD5 9ac6cff100aa8337c873d56ffda85215
SHA1 5d13f5ff05393e2e16e204bfcde145df58b82fa7
SHA512 487ea94836b5dd32635a5ea2dc8aed09605f9b5b08b04b2dc6fa18f639e20a230df7a89c26871b2429ff20b5538be1bcb7939b5ab860087d7281694285970fc5
SSDEEP 96:fjFj7jOjEUDK/D5DMFLzLeiO/tjGMoeZNeBuj7RslvaQxvbzM:fjFj7jOjEIK/VoPnOVEeZyuj7qlCejzM
TLSH
T18BB18476F9BD107F10D3517361BDB70A3AA4C047CB9A09903ABCC2755F8AF95AA172C1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1600	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2900715619-172032027-1873877232-1000\{0CEDB707-9EAB-4C0E-AD06-63084926DA26}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
484	msedge.exe
484	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
824	Process not Found
824	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe
5956	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 6480	5956	msedge.exe	89
PID 5956 wrote to memory of 6468	5956	msedge.exe	90
PID 5956 wrote to memory of 1600	5956	msedge.exe	91
PID 5956 wrote to memory of 6468	5956	msedge.exe	90
PID 5956 wrote to memory of 6468	5956	msedge.exe	90
PID 5956 wrote to memory of 3940	5956	msedge.exe	92
PID 5956 wrote to memory of 3940	5956	msedge.exe	92
PID 5956 wrote to memory of 4256	5956	msedge.exe	94
PID 5956 wrote to memory of 4256	5956	msedge.exe	94
PID 5956 wrote to memory of 4272	5956	msedge.exe	95
PID 5956 wrote to memory of 4256	5956	msedge.exe	94
PID 5956 wrote to memory of 4272	5956	msedge.exe	95
PID 5956 wrote to memory of 4272	5956	msedge.exe	95
PID 5956 wrote to memory of 6696	5956	msedge.exe	96
PID 5956 wrote to memory of 6696	5956	msedge.exe	96
PID 5956 wrote to memory of 6696	5956	msedge.exe	96
PID 5956 wrote to memory of 6240	5956	msedge.exe	97
PID 5956 wrote to memory of 6240	5956	msedge.exe	97
PID 5956 wrote to memory of 6240	5956	msedge.exe	97
PID 5956 wrote to memory of 3252	5956	msedge.exe	98
PID 5956 wrote to memory of 3252	5956	msedge.exe	98
PID 5956 wrote to memory of 2740	5956	msedge.exe	99
PID 5956 wrote to memory of 2740	5956	msedge.exe	99
PID 5956 wrote to memory of 3228	5956	msedge.exe	101
PID 5956 wrote to memory of 6000	5956	msedge.exe	104
PID 5956 wrote to memory of 6000	5956	msedge.exe	104
PID 5956 wrote to memory of 6000	5956	msedge.exe	104
PID 5956 wrote to memory of 5564	5956	msedge.exe	105
PID 5956 wrote to memory of 5564	5956	msedge.exe	105
PID 5956 wrote to memory of 5564	5956	msedge.exe	105
PID 5956 wrote to memory of 6192	5956	msedge.exe	106
PID 5956 wrote to memory of 2364	5956	msedge.exe	107
PID 5956 wrote to memory of 6012	5956	msedge.exe	108
PID 5956 wrote to memory of 6216	5956	msedge.exe	109
PID 5956 wrote to memory of 6216	5956	msedge.exe	109
PID 5956 wrote to memory of 6564	5956	msedge.exe	111
PID 5956 wrote to memory of 6564	5956	msedge.exe	111
PID 5956 wrote to memory of 6564	5956	msedge.exe	111
PID 5956 wrote to memory of 3972	5956	msedge.exe	112
PID 5956 wrote to memory of 3972	5956	msedge.exe	112
PID 5956 wrote to memory of 5780	5956	msedge.exe	113
PID 5956 wrote to memory of 5780	5956	msedge.exe	113
PID 5956 wrote to memory of 484	5956	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1iAqCqOeIl.html
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffaed0cc188,0x7ffaed0cc194,0x7ffaed0cc1a0
  2⤵
  PID:6480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,17790083700068799562,10674485946650769617,262144 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  PID:6468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,4553494539719989500,9799728823217293846,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,6378908310204608192,16626691548616479822,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:13
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,4372123219923067688,16027838507583411758,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3644,i,7255560522926199082,2360408930310767859,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4436,i,6934342469993940318,9787924059619496205,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:6696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5144,i,18281241398434827698,12882387986459114236,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:6240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3784,i,13403388637384781644,325020181646635075,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:14
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,11722891585463614483,2574556945247406427,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,15896951903239262455,10054066681642582941,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,15896951903239262455,10054066681642582941,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6380,i,3082472333783273895,2608257170745820013,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=7868,i,8473578551120324068,13127062507646758828,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8016,i,15982180534782573352,11259807800289361078,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8012 /prefetch:14
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8020,i,1539303662824166852,7568176674802085981,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8032 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8024,i,14725203983092373817,16549307136821436887,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8000 /prefetch:14
  2⤵
  PID:6012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7916,i,15483872300329172641,16146908762050920601,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8140 /prefetch:14
  2⤵
  PID:6216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=8048,i,8456363377113203768,2364123939378660886,2097152 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8060 /prefetch:1
  2⤵
  PID:6564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,7610899590805731888,17076953066987403211,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=7796 /prefetch:12
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8412,i,2803596423057075367,719450772137241070,524288 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=8416 /prefetch:14
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5604,i,1300566077744240636,7787345980231824338,262144 --field-trial-handle=2356,i,14363569390607520999,15545871879019988556,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da3763f60ede3fa709aa0345487a9c5f026859c06ed1a1549de777571c438d2d
MD5 2ebd0330bb082497ebc47348c4ecee38
SHA1 f164cfe0a87fae91d8a0b0b31f0178ebf3aadd02
SHA512 294595e3213375937c97fffd24323394a2b90fd0b46d24771fcf9359e2edbe425b26aefe714432eaccd7516ab0d793eaa33eb35fa55b9df13c535af5d9da8f67
TLSH
T1FFD080F0B7197582D5653471B521971171B1409D391BD5D19090850C4C778D55745187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b363f693690aa479b03b10f13d837c7277e1cd8d6c10d7150235a6d4eee0f34
MD5 ddf8b13fdf9db751ce6cc3328e266fa7
SHA1 1cd0cf7ab6698157c24338d81d076859d18cfba7
SHA512 e7b35b46a0f47d516568817a1f6db4f2445e353959197912eea8a7ab8f6a257b9bc5ba855ad99faa8b859e7ac8c3141a43c223c051fe9bd656f75b6384e18fc8
TLSH
T1E8D08CF0BB297982D26534B2B5229711B2B140AA3A2BD6D1A4A0C50C8C3B8D9A786183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3838e0c9b97b740997025cc20f9894a4fb2fc1d09513fd3de779b19d7f969df9
MD5 339ab2331fb3aae4a95fd88c7e816532
SHA1 6574ff6ed98e60945fa77f8a7d8ad1edb5290a0d
SHA512 5703e993048ce770ae38db5cd87e9d20ad636253535d52856c3755705dc6df3c453a6d3e0d99cf03becd2767b8b650787c5242fb56cd30f29d5089d3da98f0d9
TLSH
T14DE02BEAC961EC3B08FC0F2C74924749EB50132B2B41494F3B3C920C4FB5276819187C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 4e18d1aa56af86ccfe1ecf4040cceb7b6d8a7d9627940139086edd00dd9a469c
MD5 deaec3ff588286c57079c0e1fbafa0fc
SHA1 dce1d333516a49e7d5318b26576765079ded0b03
SHA512 a0a41a46a4f7aeb2ccf2c8aead284b99570bc981dfd4fa6fbbb6dc0c7e8f6d415dbecffb2f886e77493736f9d15f1e2d2e89267416755da6c7b8c13cc6aee5f7
SSDEEP 96:2u/56MYTvruc1yls38TIX2CI0+8F6X4M6DD1fY6sXRH0nHhjVg/QWhKeHpCM5P5C:2u/56MYTvrucsls38TIX2p0+88X4M6Dd
TLSH
T164A160F623B445ABEBE94D7E72EC2A753374D88394274FA650BCBCB69C0378985010B4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe59f35f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59f35f.TMP
Size 3KB
SHA256 5b0ba2ccc9558d0f7982ff383a04f88e549d09a01b4f7c21379c24b871a00a49
MD5 5561c0fec4d013e9d1bd99a765e368c2
SHA1 8348257c9b21293439ac2f5ce80d40402a5dd2c7
SHA512 091daba8b5ef4e1f69afc35b92873070f68ed3378eab12e2e954dba1fb47ebff45d8a9557a63641095ec46bac7d86134c154281787ad8db244dda5d6ff941eaa
TLSH
T13F6196E7797549EBCB6A40B75BE230B83BB0ADD6E8676F314095F1FADC0BB006085494
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 94038f443cead1859a06e54d66c058410c56c36aa38328ce88290a7b7a136584
MD5 e000e743c9b396f50b8674c8e14d1b9f
SHA1 abe9ec400f9155c9dcfb68e66043859bcbb9f365
SHA512 07ff9ea5bccf40ecfa770d565aba1406d6f030ac01eb46a66ae0685fd78104d1b052836839cbf03cfb46377f6d63f155ea3923b43177b45e5d9d4d0e1f645ab6
SSDEEP 96:D/O1QBWiYySWaZVzBij60dVwQl6ucvfEQHsG5Hz/a86RE6LGk:DW1QBWiYySWaZV1ij60dVXl6ucvfTHsF
TLSH
T18FC1BDF3C3E5826DD91191F0AA187F1BCE1D0556836C3C5A89E4AF0BA3F2471E142B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 4ee949146564fe7818a746c39c0e2c2b9648a63b83db5677b0df19fa41ce1f94
MD5 a536b156e4018e7450472d4ba8bde2a6
SHA1 cc1c0240e3653d4a230335270709c5dff26cfd20
SHA512 2baf376452f3168d13e93f133b144660c553ac41f96c7febd324a24b17fbbb79bd8a02305cdcc9120e268861f5657fcd78615d21595079e37ddedf51d329f6e7
TLSH
T115D02223120570B6B56D3EA6606AECCFC32600641E43DDD930F0D89C25334EF860B1C1
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1b7c3bb3ba0088d4d87a3f690a0b07f2e37a241b7b8cd5da53e72d57e869dfa0
MD5 0be83d14036291ea51e5e595dab93423
SHA1 ceee258444997b8b9024fb83f90ae92267ad73fc
SHA512 aa6b7ca4d1f1cf798afb0e3f51a728bd5c105e4d593498a78aa5a17cc63ebbf35ec278144fb8b6165ce688ad4660d0ec0c5a5fc15829fd283c55215e66f8d15c
SSDEEP 192:sxRKRDyMqZjK1Ml8wFM/f6stULpZsGJlsrzoA8pe4/g6+WNIYmsiG7IgjeJ:sxRKobM/f6siLnsGrnP/5IEjq
TLSH
T10062EA166A34993BCCCBD219FA557F63D6F91133A2905E44AAFC8A0C05E76DC221383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 a98d46dfe5ff860faf4212078b2f878d8ca0862758d40812d8b1b936cd043e6f
MD5 4470799ae1a8bc8c7fca50b20cc2a8d7
SHA1 0854c152d60067739b03044e824d36220210db80
SHA512 81983feeb7d11b123b269ccb6322b1a5a4e8e43871adfa0fc4e8d368117133a3b38de804495a8adc5126102551d8f840925cd7cfad6b193db07ce6cf02781666
SSDEEP 384:sxRKoqwm4M/f6siLnsGruo2+/54TXG92mm:smvwm4M/foLsGru4/5mim
TLSH
T1C592F8165524997BCCDBC519FE617F63D6F80523DA904E4CAAFCCA1C04EB6ED221283B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 84c5245ee2321d8837524fe598fa37ecd7ace0b20d4ce9ea66cee5b820393cec
MD5 ea1e832530d8c5b3e3ee03a166b119fb
SHA1 721b77ad9450ccb194ef933fdf3cee8b4f95dbf1
SHA512 cd05035032ad7ff54f4a1ce15b41a8cc8a97958117c864f53cbee83f796607e506a16252bd1527783faba0b1ac04454f0ff35d9b8266c26df49a27a4a2b62857
SSDEEP 384:sxRKowm4M/f6siLnsGruo2+/54TXG92mm:smDm4M/foLsGru4/5mim
TLSH
T13C92F8065524997BCCDBC519FE617F63D6F805239A914E4CAAFCCA1C04EB6ED2212C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c9e0efc78091694a6298f429c3b19aa47142de3824e2604799a25b5dbffaf805
MD5 f10f4ee559d6fcfb514805ac8ba57613
SHA1 1358997e1db1e27eef9fb8d0aa32f4fada375b62
SHA512 dc5bca401cab587e3ca15f105ede3673f5833ccd5e17b1c774f9088449d3a114692f66864d50aa9d5792e13c5ccec053d95ac9230035da20aefa727337e9ce85
SSDEEP 768:RGqOArWgzvfsX8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5z9wQroPw3/:RGqOArWgzvfsXu1jaEpw7Pw3/
TLSH
T1C0C20B3B640CC77E4F844A6DAC29AE976D9802CB97984D544BEF884C03C77FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3770c407-ceca-43f2-bccb-fd404ca5cf3a\index-dir\the-real-index
Size 72B
SHA256 90a13eada125f8454e1f45de58b4d66aab21935b3c32456c376f73a2096f92c8
MD5 b2b2771046a48fb19214194f314e8993
SHA1 1aae8d8153ca922eeced4a5737669368d85c3e07
SHA512 848bf40dcfb0b9ff55f167157ef7bcd23129adb572e9f06eb5c471ba00ca2b709547e11b2be8dbf18fdad0b51488630074c2f7647802674e8aecd874d494b90c
TLSH
T1ECA0022013B43009C013E1B51B921251120088902103160EC8D117E9CC6444095C124D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3770c407-ceca-43f2-bccb-fd404ca5cf3a\index-dir\the-real-index
Size 72B
SHA256 2a716dfa3bd54b4cbdc97398e45003cc8f378131f50aa7550e1c2bfd18acee12
MD5 8efe3ece1d4877127cf3d5523569fc10
SHA1 e52248670e8eb4a21ba5b67c15a4130d2adcb451
SHA512 50c776ac06fa1c9ea6bc22ca726823337e379e6047a718c96fdab9f0f32f6d76a94b4d3746a96732dadba61eb1821fb2e1bb033fcefa9cf1cad2f5c0c1a2a566
TLSH
T1E9A0022542C0000BC15612B46BE6316333114954A209230585904249D854D7BD75F01C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c516c90-c48a-4767-9305-a2f88b4b98fe\index-dir\temp-index
Size 2KB
SHA256 b5dd564f8d5321db02fa3c45734327e6d3bc85ace76ac42bc6e24ece4bf86a63
MD5 5c09f3ede17768751a513322278a2cf2
SHA1 638f2ab305270567d6402187a669f0005dcfbce4
SHA512 97613c5fe6bc78aa4c841c9209d71c5e1412e2a9fbaa4eb4a68c69ece79fc5d02c6caddb68fb05eb3f97b000cd8d59ee477ed5bda94ca9712e93b9a827e5bf26
TLSH
T17E5174698C865B17DD3849B328B6184C337675EC1BC84B0369AC7438BDC76691D64618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c516c90-c48a-4767-9305-a2f88b4b98fe\index-dir\the-real-index
Size 3KB
SHA256 e9948cbf15957e26f6ff06f115494fd5071cceaaaa936306b34a4bb762011ed8
MD5 d7d631e8e728590609ce3c273fef11ca
SHA1 f4e9d9261704c9ac3be7b6bf4bf23b2a359a1688
SHA512 b1c90ec8f89c14f6b36f0440b881bd52a2cf6a797032415542382f49a80a8014be1eca9794c1ffd858e33c9095a38d50e3efc2cc67186a45b9bb7a2c8bee941b
TLSH
T11951A75D8C871B17DD7C56B328B6144C237636EC17884A0369AC65387C872391C75759
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592001.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8c516c90-c48a-4767-9305-a2f88b4b98fe\index-dir\the-real-index~RFe592001.TMP
Size 2KB
SHA256 a3f25187983979348c0ffb1bd528c1547f6e8ef350511c496632bf29fc2ecc00
MD5 e0bb81898fc10e76fd6b3dfec1124d8b
SHA1 1b2bd58d63253d37128668ae70a833826c0dc1ec
SHA512 dec944119cda3aabd940c943d96109e9e1ade0e77bb976b0b109cb20ef4b475ad7fc85c37b19808ce3d8f6c1b6b536dc55f4da23e6d2694465c30dda91cc9e76
TLSH
T1F15195268D829A27ED2444B34A96149C373BB56057889F0B30FCF1392CD363C7D682AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d603a2f6-c123-4d8a-9a1a-1d4938f0c6a5\index-dir\the-real-index
Size 72B
SHA256 56e5ead25050379fef64d361147a4e61b8f06c5d8d8bea1eaafd183d996bf556
MD5 78a9202bca33cf38415cd81c38e58f84
SHA1 3e96a9b28687ac77f41e149d75c8034290599655
SHA512 d3c58e39c8e755a01f58dc4265c4bb5c722dff02ccd8e7ffadc3ffb0a8f6571486f31b0605416ab81f6e562149dae081974818852471b9b8cf7fbea6e62e7e1d
TLSH
T184A00238C182C256D06D5378628641957311491029662A5641F01058F8F0686930341C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e65f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d603a2f6-c123-4d8a-9a1a-1d4938f0c6a5\index-dir\the-real-index~RFe59e65f.TMP
Size 48B
SHA256 b6c48aab7babdbd191c82c01d0690d4db63d8ace32e4f276163c7cf2b44c1bfb
MD5 1a3601327a3257080a846b7a17a1bdba
SHA1 b7ecf8db95c589eea9b903f9368033ab477d52bf
SHA512 bff6e0adaaff1d12879ae81ee743b3390553a3c20cde98e55fe73290ae7bfcd4edfd6dc2836e58f0bfe3277c2f1afb557adcbf8fe4f3d4349176b8235159d5c2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\f21b867f-c388-47c9-bc59-c93a977ef0c1\index-dir\the-real-index
Size 72B
SHA256 be09c238a3f2ac22f3b78bee41bc89d79e3252859f38eafd30c6ea5a7ebe76d4
MD5 e1af9b6117cd93e0ff2dfd282762d26c
SHA1 1f3436683f2ceb6842fa18eb9c5323c249675898
SHA512 fd71e08e8cfdeb702c69279db46f992a54be1a5fdb44798f90c035189d0cf84e4338b5f751dea5f837dfe703259890f08dab8e0059983ff0377c8169658b014c
TLSH
T11EA00230419534C2D00106F6D1C20675F3649DA50151D72955A4045DDDD53689525494
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 fcf8d1ca7e9a38e6f2082713f3f86f26dfd8361c2f33c5146d668bbc60ca82ba
MD5 a4fc17be75dd3f3736ffaf6aad9bec8f
SHA1 b492f1f6d0d0c6a661886855d1a4a229436b357f
SHA512 a4896633152485ab137bd9a5e401e35934fa5a08a3542b37855e858660749ebfed59e7d9363998fafed5d2f38644087d9ad7cb1ec0a24b967d01fd757afbfe9c
TLSH
T15EE020BF1DF71D24ED5FD3D1643184A401497C64C440FD4F509B65975171711385AC66
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 327b7d95aa80386a85d2a364809ba80aad797835ce6191d5c5656b379d71c3c0
MD5 603c339b586c8d39106a0d3971da8768
SHA1 7c1114c3e0cdc0b30bd27c30269a8d54cb1b4902
SHA512 15abf964ab056e755cb90eec5eabd46eefad635ebb62aab47ff9eb48120dacd5b7d1b6bfdd5e82498e2c099c986bb37bf30af2fc72728c93777862daeac313cd
TLSH
T132F05CBB2FF71C24FC9FD3D1647140A005497CA0C481FE4F5067B6969172315785DCA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 f9e50a826ef86e80676db352f245f1b4e75544c1d233a0b789a62c7532ac22c2
MD5 7b3e3ffbaecfdda964594c21c5720da5
SHA1 5d03b6248aaf9965a08c00789f2531665695242b
SHA512 07f531ed765aff392a53acd3b9ac6bda01d115ffa1a3148572b0a733aee5a3dd040aadbc7ad241ab35f70bee84a5340b66bfae8051cf5ec0da65bae9905b3c3f
TLSH
T18FF05CBB2FF71C24FCDFD3D1247140A001497CA0C080FD4F5066B6965172314385EC62
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4d03aef66a66749570db737aa90039f49cd272a58097b9e78a948c3bd51104d5
MD5 17472fa84fa05c0bd154363275551284
SHA1 30438130f31e9230454d896c73a542fd03df3cc1
SHA512 03d1b0f1d374a2c7f258a443737a2c58d0f0ceb340afc9ebd4c20721a93161ee682f3c1f0cae61920d130e8bfc6bec2557df4e1ed83a1fa902c14466b5f522f8
TLSH
T12DA002D0C14B2815F4400671718A91983360D951120622538B9090F9AC93694A181211
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59748a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59748a.TMP
Size 48B
SHA256 21613a8e5090440088b03f3789c7ec0a9a6df2c817f8e643308e93370215e042
MD5 7a4e8fbf3d109996711c82d51ee909da
SHA1 08fcaf7d868300867d4334681c8c11053a875503
SHA512 68218d2432a8a10e85a88efc46742dcc8a777508d1496107067f03556997d25ad95c8f773b25471c4be34f676b69a285baba6383e36894451891da62c883bc0a
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 fe60547605b2ee193d8c1a93945bde471152ffbfa5ba943fc66aa24794e2c154
MD5 38600244fe57a4e3b14d2555b5091679
SHA1 b81112d60b7c42d04838250528fa1f230b39485b
SHA512 09265b6e84ebe0c7f3b9071c18139d4a614083a92f2d0d0b1ceb331595e9063d4b9f13923f51be43ef91ba4975c3e08098ab6d6ba70a4a8be90e8b83683e099d
SSDEEP 384:9TqfDxl5UVY3bXp3ZUzD4BzSc7eCUG2XatW6AE3k18UFa20TWaseefCFeSo83MtO:aR55IlHnOLRXxxin9xW
TLSH
T10BB28E5171BE2B00387D29099279D42F194630A230DEA87B3B6835E66F67F005FFDAD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bfddcce93f6dc015ec49580c74ec0718b721164f20139b8245a20f391948c0eb
MD5 70376b7c5a4ae3a94ce1ca9381739574
SHA1 45dcb61b12c82d2d2505315aee5e1e4c0b40ae92
SHA512 9943123fdbef697963d2aa9aa6e8dc4205f3b4531ed72102ae8f89cc33ae5a815e3b9b95322858c50dc2a34922ce78cf8dabd24b88210b0469608c8b01719db3
SSDEEP 384:nmiF1tNn/s3n9SU8N98TUNTUlIRrXznNEZHX+fheT22f4LRBBTmn15wbAjEJUyr8:NF1j+9p0wggmer4jTmn12bfJ9Q
TLSH
T184C24936DCA4CA67ADE28BC9B74A7647EEE44263C6C869D4C9CC1D4D02D72DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 157f58123db823cce49d267d2d06cfa8deef46b9639430f183158bf073ccf6ca
MD5 165bc644454d6ea4ba0752708f833f80
SHA1 90f9b655a69ef18c42adbea447f1c3c12a600c47
SHA512 f2fc1c4ee21212dd6c614c45211381e7f0875e12941b891d246ff30762f8518724ef63618bb646125b8e2e63c991de2bb022cb2cb202b15c566a2d17be02db51
SSDEEP 384:nTiF/tNn/s3n9St8N98TUNTUlIRPXT5nN5oI2X+fheT22f4LRB8Tmn15wbAjEJU5:+F/j+9I0wgkIder4mTmn12bfJ9Q
TLSH
T1A4E2D3F698D38937E8AE8787673D2E069ABCC153B5881994B7C81D4CCD971BFC20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 282787501cc3474d15bce25df1143cee130b753972449154e13c6d250b8e012b
MD5 ddc85a36f09bc09fa459378a0ccd5f7e
SHA1 11d0936fe0a95cc67d978a3da4597eb131139714
SHA512 f8232e038b7ac758f16e8eced87e784edda6c9328ed9836535ae3d5f297b9f1bf8868e756740bb59e5c051549182ab92597e0ddcad44dea1dffb81c61b25da68
SSDEEP 384:ndiF1tNn/s3n9SsD8Ns8TUNTUlIRY4fznNVvHX+fheT22f4LgWmn15wbAjEJJyle:UF1j+9R5wgR7merhWmn12bfJw4
TLSH
T163C23836DCA4DA6BEDE38FC9B70A7646AEE4026385D829E4DAD84D4D01D32DD0307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4a23b7892b70b55c93a887532aa53a96c9af7d6fdd06f5775eb6023aad534fd3
MD5 0f451064ad17e11818cb557b351277c4
SHA1 bdc2cbd395281b90766cfdc47cc746dc498dd3f9
SHA512 3e1c4327615b5720c969bcd23c96211d7d8d004b9aeccdf170e7676b4bfc0c997a15b3e7b4580f4f96be47574e7696677fdc23401a67ea3d3ea54b533bd163b9
SSDEEP 384:nmiF/tNn/s3n9St8N98TUNTUlIRPXT5nN5LI2X+fheT22f4LRBBTmn15wbAjEJU5:NF/j+9I0wgvIder4jTmn12bfJ9Q
TLSH
T1FAC24936DCA4CA67ADE38BC9B74A7607EEE44263C68869D4C9DC1D4D02D72DD030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 349e49810153e3c5c4bf8bd93eadff7962cbfd150f217b6b3b8163f572b7a31d
MD5 2db1750a32c1cec02b28f37e9905ba19
SHA1 d9274afe480c51dda49d9a05d0d22a03deaef0eb
SHA512 97a574486c70e21aa4a1b34288df1aabfff1af9ce3b085f8cf04df23ae3b2b69267dfa68611a1e640c739dde8e3cbfcdd1673bfadeb2dfea32ed0b9b1e6bc5fc
TLSH
T1C4E00242D30100F8C0AD56B400471F681E92402204D11544CF34455C7C357407D70C80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4575f08f07963a772ae99c2a68a38fee6040ed84ac57509d5e69ae1443d06171
MD5 0d2b5a0f96f87216993e2f620a0a3e15
SHA1 5ad4636c06aa15b0775e5119b7f4f394e7589565
SHA512 fd9855fb0cedf21adfade62cb88bc3f185a76ed1234958979b8a3b255a88869c19f277f2538d8880d85183816cf1ae2fa79ac56cdeabc50fa164af7eebb6eae6
TLSH
T137E00440D10100FCC07D177400431F343FD0400004D11544C735055C7C357007770CC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe594ba5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe594ba5.TMP
Size 392B
SHA256 9aae5676e4c7589aaeca196a714bbf6bfff8ba91170867b87d8a20b9f22b6df8
MD5 8aa9973fd1b39a07765c7f98602d53e0
SHA1 0e8b5ef916edbcda21021eee8e8f9b06eec67de1
SHA512 cbdf15e732786d423cf622a2e1e69b2a9d5460e85458ce351921e091972f9b05f994a20b6870dd38204967d2ea2bd87f89c33055a29d5d96bac5a274047f5bf6
MD5 SHA1 SHA512

Submit Download