hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=CSv8l6SxLap3dK7KG2OMPve3m6QGZ9cnRhwHcpvmg8BVkEAEgAGDJ1vaGyKOQGYIBF2NhLXB1Yi02MjE5ODExNzQ3MDQ5MzcxoAGz2JqfQakCgHX_L-McgT6oAwTIAwqqBLEBT9DvM5W436bZvxX7NAdRgqtFDZpGtMr9pdm1atr8SwoSQ82cLuXZogXIhXjNjZurl3BpCtl-c2rwh1onpdh8ZD4UHGmPItCfG4fb7zVrgmwrzBWyDXvBC39cBRbPYMk66v1k6pWU3kv1L2Ys_0rerVHuf0XNGx-Nd1DReOdHDH_zv9jJL56pbVGBZpKj0D9wCedebOXipbhLN9V0z2bZqwcXvmAr5J1FVRbjkhK9Z1cWiAWwr5rlWKAGoQGAB7OQ6_4biAcBkAcCqAfywLECqAe4xLECqAfhtrECqAelz7ECqAfnnbECqAfonbECqAfvtbECqAfwtbECqAf507ECqAfJ2rECqAep4LECqAeECKgHptSxAqgHqNIbqAe2B6gHsdwbqAeBw7ECqAf4v7ECqAewm7ECqAeusbECqAf9srECqAfIz7ECqAfJz7ECqAfNx7ECqAfx0bECqAf81bECqAf71bECqAeM1rECqAeL1rECqAea4rECqAeb4rECqAed17ECqAf0mbECqAf4v7ECqAed1LECqAeBxhuoB_yvsQKoB77ZsQKoB6vFG6gHnNwbqAe3obECqAfVqbECqAfn2rECqAfetbECqAfqsbECqAe-t7ECqAeZtbECqAeFwbECqAfrpbECqAfKqbECkggLWWlWNnIxVGxIM1WoCAGwCAzSCDwIgICAgAQQAhhaMgiAhICAgICAIDoUj9CAgICABIDAgICAgIGAAqqAiBBI2aDSNVAUWNDixLCZvZUDYAGaCRxodHRwczovL2ExMy44ZmF0LmNvbS9yYi9sYW5ksQkTvLYeY7OuBcgJjwHICcIByAnkAZgLAboLXwgEEAUYBCAQKAEwEUABSABYLGAAaABwAYgBAJgBAaIBKgofCAAgAygD2rgEFTITOhEKDygwSL3j1KPdG5gZAbggAdABAagCBcACAqgBAdgBAYACAYgCBroDBXZpZGxz0AsS0gwECAEQAdoMJQoKEKDhn-qPwc6dVhICAQMaDRiwr5rlWCDrtv7Y8AVAAUoCEB-aDQESqg0CVVPIDQHSDasBaHR0cHM6Ly9hMTMuOGZhdC5jb20vcmIvbGFuZD9nYWRfc291cmNlPTImZ2FkX2NhbXBhaWduaWQ9MjM4MzQ1NjQ1Mjgmd2JyYWlkPUNrVUtDUWp3Z2FqU0JoQ29BUkkwQUxWampaZkxfcHdETE1jX3JiMHlnZ2tsbnpNbnUyVjhKNWQwSnIxZkdpT3UxWVduUmZ0akxfSFo4TlNLcHRIYVRvaXpLUm9DVE1vuBP___________8BsBQEwBXJgIBA0BUB2BUB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpF_gWRgqFORd4uhcKEAEoADABOAFIAdAYAfAYAYAZA8IZAggB&ase=2&gclid=CjwKCAjwgajSBhBEEiwASicJU3kB2pWkGz7zwcGUNhkYOOrN9QK_DCOCKloMjXprkFYRze0WmIQbHRoCO3cQAvD_BwE&num=1&cid=CAESvAHg9sfhZZuHmc4oAIkygqtsdxD3F0DuFfKE2-J7Uu5Xi2wJyDNsVwCPrqRlOTeFi_vId9vibmDapUwP7omEchAOD1OPUkeoauM4Jic1eEyLfjAhoOzlnrhK5x3ncOmAT8OZOQYjtIMf8z5vOozzb9HDL9c2PDts6U3l94N0zNi1xAdzEs9X78TcJvvGbH-gakRSynMUpWOYQj0FDCDNWxwtwRdG96qKRHZeTvoY_qyAPx2Ap8HgAIq0kWHS_Q&ad_cpn=%5BCPN%5D&sig=AOD64_1kGT673kBVpEIWm2V39QvA9cdJWQ&label=video_click_to_advertiser_site&ctype=110&ms=%5BCLICK_MS%5D&adclksrc=3

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
899s
max time network
899s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/07/2026, 04:24

Sharing

Behavioral task

behavioral1

Sample

https://www.googleadservices.com/pagead/aclk?sa=L&ai=CSv8l6SxLap3dK7KG2OMPve3m6QGZ9cnRhwHcpvmg8BVkEAEgAGDJ1vaGyKOQGYIBF2NhLXB1Yi02MjE5ODExNzQ3MDQ5MzcxoAGz2JqfQakCgHX_L-McgT6oAwTIAwqqBLEBT9DvM5W436bZvxX7NAdRgqtFDZpGtMr9pdm1atr8SwoSQ82cLuXZogXIhXjNjZurl3BpCtl-c2rwh1onpdh8ZD4UHGmPItCfG4fb7zVrgmwrzBWyDXvBC39cBRbPYMk66v1k6pWU3kv1L2Ys_0rerVHuf0XNGx-Nd1DReOdHDH_zv9jJL56pbVGBZpKj0D9wCedebOXipbhLN9V0z2bZqwcXvmAr5J1FVRbjkhK9Z1cWiAWwr5rlWKAGoQGAB7OQ6_4biAcBkAcCqAfywLECqAe4xLECqAfhtrECqAelz7ECqAfnnbECqAfonbECqAfvtbECqAfwtbECqAf507ECqAfJ2rECqAep4LECqAeECKgHptSxAqgHqNIbqAe2B6gHsdwbqAeBw7ECqAf4v7ECqAewm7ECqAeusbECqAf9srECqAfIz7ECqAfJz7ECqAfNx7ECqAfx0bECqAf81bECqAf71bECqAeM1rECqAeL1rECqAea4rECqAeb4rECqAed17ECqAf0mbECqAf4v7ECqAed1LECqAeBxhuoB_yvsQKoB77ZsQKoB6vFG6gHnNwbqAe3obECqAfVqbECqAfn2rECqAfetbECqAfqsbECqAe-t7ECqAeZtbECqAeFwbECqAfrpbECqAfKqbECkggLWWlWNnIxVGxIM1WoCAGwCAzSCDwIgICAgAQQAhhaMgiAhICAgICAIDoUj9CAgICABIDAgICAgIGAAqqAiBBI2aDSNVAUWNDixLCZvZUDYAGaCRxodHRwczovL2ExMy44ZmF0LmNvbS9yYi9sYW5ksQkTvLYeY7OuBcgJjwHICcIByAnkAZgLAboLXwgEEAUYBCAQKAEwEUABSABYLGAAaABwAYgBAJgBAaIBKgofCAAgAygD2rgEFTITOhEKDygwSL3j1KPdG5gZAbggAdABAagCBcACAqgBAdgBAYACAYgCBroDBXZpZGxz0AsS0gwECAEQAdoMJQoKEKDhn-qPwc6dVhICAQMaDRiwr5rlWCDrtv7Y8AVAAUoCEB-aDQESqg0CVVPIDQHSDasBaHR0cHM6Ly9hMTMuOGZhdC5jb20vcmIvbGFuZD9nYWRfc291cmNlPTImZ2FkX2NhbXBhaWduaWQ9MjM4MzQ1NjQ1Mjgmd2JyYWlkPUNrVUtDUWp3Z2FqU0JoQ29BUkkwQUxWampaZkxfcHdETE1jX3JiMHlnZ2tsbnpNbnUyVjhKNWQwSnIxZkdpT3UxWVduUmZ0akxfSFo4TlNLcHRIYVRvaXpLUm9DVE1vuBP___________8BsBQEwBXJgIBA0BUB2BUB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpF_gWRgqFORd4uhcKEAEoADABOAFIAdAYAfAYAYAZA8IZAggB&ase=2&gclid=CjwKCAjwgajSBhBEEiwASicJU3kB2pWkGz7zwcGUNhkYOOrN9QK_DCOCKloMjXprkFYRze0WmIQbHRoCO3cQAvD_BwE&num=1&cid=CAESvAHg9sfhZZuHmc4oAIkygqtsdxD3F0DuFfKE2-J7Uu5Xi2wJyDNsVwCPrqRlOTeFi_vId9vibmDapUwP7omEchAOD1OPUkeoauM4Jic1eEyLfjAhoOzlnrhK5x3ncOmAT8OZOQYjtIMf8z5vOozzb9HDL9c2PDts6U3l94N0zNi1xAdzEs9X78TcJvvGbH-gakRSynMUpWOYQj0FDCDNWxwtwRdG96qKRHZeTvoY_qyAPx2Ap8HgAIq0kWHS_Q&ad_cpn=%5BCPN%5D&sig=AOD64_1kGT673kBVpEIWm2V39QvA9cdJWQ&label=video_click_to_advertiser_site&ctype=110&ms=%5BCLICK_MS%5D&adclksrc=3

Resource

win11-20260513-en

windows11-21h2-x64

14 signatures

900 seconds

discovery

Report Analysis Logs

General

Target
https://www.googleadservices.com/pagead/aclk?sa=L&ai=CSv8l6SxLap3dK7KG2OMPve3m6QGZ9cnRhwHcpvmg8BVkEAEgAGDJ1vaGyKOQGYIBF2NhLXB1Yi02MjE5ODExNzQ3MDQ5MzcxoAGz2JqfQakCgHX_L-McgT6oAwTIAwqqBLEBT9DvM5W436bZvxX7NAdRgqtFDZpGtMr9pdm1atr8SwoSQ82cLuXZogXIhXjNjZurl3BpCtl-c2rwh1onpdh8ZD4UHGmPItCfG4fb7zVrgmwrzBWyDXvBC39cBRbPYMk66v1k6pWU3kv1L2Ys_0rerVHuf0XNGx-Nd1DReOdHDH_zv9jJL56pbVGBZpKj0D9wCedebOXipbhLN9V0z2bZqwcXvmAr5J1FVRbjkhK9Z1cWiAWwr5rlWKAGoQGAB7OQ6_4biAcBkAcCqAfywLECqAe4xLECqAfhtrECqAelz7ECqAfnnbECqAfonbECqAfvtbECqAfwtbECqAf507ECqAfJ2rECqAep4LECqAeECKgHptSxAqgHqNIbqAe2B6gHsdwbqAeBw7ECqAf4v7ECqAewm7ECqAeusbECqAf9srECqAfIz7ECqAfJz7ECqAfNx7ECqAfx0bECqAf81bECqAf71bECqAeM1rECqAeL1rECqAea4rECqAeb4rECqAed17ECqAf0mbECqAf4v7ECqAed1LECqAeBxhuoB_yvsQKoB77ZsQKoB6vFG6gHnNwbqAe3obECqAfVqbECqAfn2rECqAfetbECqAfqsbECqAe-t7ECqAeZtbECqAeFwbECqAfrpbECqAfKqbECkggLWWlWNnIxVGxIM1WoCAGwCAzSCDwIgICAgAQQAhhaMgiAhICAgICAIDoUj9CAgICABIDAgICAgIGAAqqAiBBI2aDSNVAUWNDixLCZvZUDYAGaCRxodHRwczovL2ExMy44ZmF0LmNvbS9yYi9sYW5ksQkTvLYeY7OuBcgJjwHICcIByAnkAZgLAboLXwgEEAUYBCAQKAEwEUABSABYLGAAaABwAYgBAJgBAaIBKgofCAAgAygD2rgEFTITOhEKDygwSL3j1KPdG5gZAbggAdABAagCBcACAqgBAdgBAYACAYgCBroDBXZpZGxz0AsS0gwECAEQAdoMJQoKEKDhn-qPwc6dVhICAQMaDRiwr5rlWCDrtv7Y8AVAAUoCEB-aDQESqg0CVVPIDQHSDasBaHR0cHM6Ly9hMTMuOGZhdC5jb20vcmIvbGFuZD9nYWRfc291cmNlPTImZ2FkX2NhbXBhaWduaWQ9MjM4MzQ1NjQ1Mjgmd2JyYWlkPUNrVUtDUWp3Z2FqU0JoQ29BUkkwQUxWampaZkxfcHdETE1jX3JiMHlnZ2tsbnpNbnUyVjhKNWQwSnIxZkdpT3UxWVduUmZ0akxfSFo4TlNLcHRIYVRvaXpLUm9DVE1vuBP___________8BsBQEwBXJgIBA0BUB2BUB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpF_gWRgqFORd4uhcKEAEoADABOAFIAdAYAfAYAYAZA8IZAggB&ase=2&gclid=CjwKCAjwgajSBhBEEiwASicJU3kB2pWkGz7zwcGUNhkYOOrN9QK_DCOCKloMjXprkFYRze0WmIQbHRoCO3cQAvD_BwE&num=1&cid=CAESvAHg9sfhZZuHmc4oAIkygqtsdxD3F0DuFfKE2-J7Uu5Xi2wJyDNsVwCPrqRlOTeFi_vId9vibmDapUwP7omEchAOD1OPUkeoauM4Jic1eEyLfjAhoOzlnrhK5x3ncOmAT8OZOQYjtIMf8z5vOozzb9HDL9c2PDts6U3l94N0zNi1xAdzEs9X78TcJvvGbH-gakRSynMUpWOYQj0FDCDNWxwtwRdG96qKRHZeTvoY_qyAPx2Ap8HgAIq0kWHS_Q&ad_cpn=%5BCPN%5D&sig=AOD64_1kGT673kBVpEIWm2V39QvA9cdJWQ&label=video_click_to_advertiser_site&ctype=110&ms=%5BCLICK_MS%5D&adclksrc=3
Sample260706-e1vq5adv4k

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 7 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16bf31a9c18cd1a	75
HTTP URL	26	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16bdfcb8c1be008	7
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16be2d7cb8ccd1a	5
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16be5e9fc6bcd1a	19
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16be914abeccd1a	33
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16bec6c3e4ecd1a	47
HTTP URL	100	https://a13.8fat.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a16befc2882acd1a	61

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
780	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134277858297846620"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{17ADE1F4-B36D-438B-B535-937DE6480B02}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5296	msedge.exe
5296	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
676	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe
5988	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 5988 wrote to memory of 5316	5988	msedge.exe	80
PID 5988 wrote to memory of 780	5988	msedge.exe	81
PID 5988 wrote to memory of 4844	5988	msedge.exe	82
PID 5988 wrote to memory of 4844	5988	msedge.exe	82
PID 5988 wrote to memory of 4844	5988	msedge.exe	82
PID 5988 wrote to memory of 5712	5988	msedge.exe	84
PID 5988 wrote to memory of 5712	5988	msedge.exe	84
PID 5988 wrote to memory of 3420	5988	msedge.exe	86
PID 5988 wrote to memory of 3420	5988	msedge.exe	86
PID 5988 wrote to memory of 3420	5988	msedge.exe	86
PID 5988 wrote to memory of 4348	5988	msedge.exe	85
PID 5988 wrote to memory of 4348	5988	msedge.exe	85
PID 5988 wrote to memory of 4348	5988	msedge.exe	85
PID 5988 wrote to memory of 3448	5988	msedge.exe	88
PID 5988 wrote to memory of 3448	5988	msedge.exe	88
PID 5988 wrote to memory of 3448	5988	msedge.exe	88
PID 5988 wrote to memory of 3128	5988	msedge.exe	89
PID 5988 wrote to memory of 3128	5988	msedge.exe	89
PID 5988 wrote to memory of 3128	5988	msedge.exe	89
PID 5988 wrote to memory of 2388	5988	msedge.exe	90
PID 5988 wrote to memory of 2388	5988	msedge.exe	90
PID 5988 wrote to memory of 2388	5988	msedge.exe	90
PID 5988 wrote to memory of 5184	5988	msedge.exe	91
PID 5988 wrote to memory of 1868	5988	msedge.exe	92
PID 5988 wrote to memory of 5184	5988	msedge.exe	91
PID 5988 wrote to memory of 1868	5988	msedge.exe	92
PID 5988 wrote to memory of 1836	5988	msedge.exe	94
PID 5988 wrote to memory of 5464	5988	msedge.exe	95
PID 1836 wrote to memory of 5072	1836	msedge.exe	96
PID 5988 wrote to memory of 4712	5988	msedge.exe	99
PID 5988 wrote to memory of 1760	5988	msedge.exe	100
PID 5988 wrote to memory of 4480	5988	msedge.exe	101
PID 5988 wrote to memory of 2448	5988	msedge.exe	102
PID 5988 wrote to memory of 2448	5988	msedge.exe	102
PID 5988 wrote to memory of 5296	5988	msedge.exe	104
PID 5988 wrote to memory of 604	5988	msedge.exe	105
PID 5988 wrote to memory of 604	5988	msedge.exe	105
PID 5988 wrote to memory of 604	5988	msedge.exe	105
PID 5988 wrote to memory of 2824	5988	msedge.exe	106
PID 5988 wrote to memory of 2824	5988	msedge.exe	106
PID 5988 wrote to memory of 1112	5988	msedge.exe	107
PID 5988 wrote to memory of 1112	5988	msedge.exe	107
PID 5988 wrote to memory of 1112	5988	msedge.exe	107
PID 5988 wrote to memory of 4120	5988	msedge.exe	108
PID 5988 wrote to memory of 4120	5988	msedge.exe	108
PID 5988 wrote to memory of 5812	5988	msedge.exe	109
PID 5988 wrote to memory of 5812	5988	msedge.exe	109
PID 5988 wrote to memory of 5812	5988	msedge.exe	109
PID 5988 wrote to memory of 3188	5988	msedge.exe	110
PID 5988 wrote to memory of 3188	5988	msedge.exe	110
PID 5988 wrote to memory of 3188	5988	msedge.exe	110
PID 5988 wrote to memory of 240	5988	msedge.exe	111
PID 5988 wrote to memory of 240	5988	msedge.exe	111
PID 5988 wrote to memory of 244	5988	msedge.exe	112
PID 5988 wrote to memory of 244	5988	msedge.exe	112
PID 5988 wrote to memory of 244	5988	msedge.exe	112
PID 5988 wrote to memory of 4600	5988	msedge.exe	113
PID 5988 wrote to memory of 4600	5988	msedge.exe	113
PID 5988 wrote to memory of 4600	5988	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.googleadservices.com/pagead/aclk?sa=L&ai=CSv8l6SxLap3dK7KG2OMPve3m6QGZ9cnRhwHcpvmg8BVkEAEgAGDJ1vaGyKOQGYIBF2NhLXB1Yi02MjE5ODExNzQ3MDQ5MzcxoAGz2JqfQakCgHX_L-McgT6oAwTIAwqqBLEBT9DvM5W436bZvxX7NAdRgqtFDZpGtMr9pdm1atr8SwoSQ82cLuXZogXIhXjNjZurl3BpCtl-c2rwh1onpdh8ZD4UHGmPItCfG4fb7zVrgmwrzBWyDXvBC39cBRbPYMk66v1k6pWU3kv1L2Ys_0rerVHuf0XNGx-Nd1DReOdHDH_zv9jJL56pbVGBZpKj0D9wCedebOXipbhLN9V0z2bZqwcXvmAr5J1FVRbjkhK9Z1cWiAWwr5rlWKAGoQGAB7OQ6_4biAcBkAcCqAfywLECqAe4xLECqAfhtrECqAelz7ECqAfnnbECqAfonbECqAfvtbECqAfwtbECqAf507ECqAfJ2rECqAep4LECqAeECKgHptSxAqgHqNIbqAe2B6gHsdwbqAeBw7ECqAf4v7ECqAewm7ECqAeusbECqAf9srECqAfIz7ECqAfJz7ECqAfNx7ECqAfx0bECqAf81bECqAf71bECqAeM1rECqAeL1rECqAea4rECqAeb4rECqAed17ECqAf0mbECqAf4v7ECqAed1LECqAeBxhuoB_yvsQKoB77ZsQKoB6vFG6gHnNwbqAe3obECqAfVqbECqAfn2rECqAfetbECqAfqsbECqAe-t7ECqAeZtbECqAeFwbECqAfrpbECqAfKqbECkggLWWlWNnIxVGxIM1WoCAGwCAzSCDwIgICAgAQQAhhaMgiAhICAgICAIDoUj9CAgICABIDAgICAgIGAAqqAiBBI2aDSNVAUWNDixLCZvZUDYAGaCRxodHRwczovL2ExMy44ZmF0LmNvbS9yYi9sYW5ksQkTvLYeY7OuBcgJjwHICcIByAnkAZgLAboLXwgEEAUYBCAQKAEwEUABSABYLGAAaABwAYgBAJgBAaIBKgofCAAgAygD2rgEFTITOhEKDygwSL3j1KPdG5gZAbggAdABAagCBcACAqgBAdgBAYACAYgCBroDBXZpZGxz0AsS0gwECAEQAdoMJQoKEKDhn-qPwc6dVhICAQMaDRiwr5rlWCDrtv7Y8AVAAUoCEB-aDQESqg0CVVPIDQHSDasBaHR0cHM6Ly9hMTMuOGZhdC5jb20vcmIvbGFuZD9nYWRfc291cmNlPTImZ2FkX2NhbXBhaWduaWQ9MjM4MzQ1NjQ1Mjgmd2JyYWlkPUNrVUtDUWp3Z2FqU0JoQ29BUkkwQUxWampaZkxfcHdETE1jX3JiMHlnZ2tsbnpNbnUyVjhKNWQwSnIxZkdpT3UxWVduUmZ0akxfSFo4TlNLcHRIYVRvaXpLUm9DVE1vuBP___________8BsBQEwBXJgIBA0BUB2BUB4hYCCAGAFwGKFxgIAxgBIAEoATABOAFAAUgBUAFYAWACaAGgFwGpF_gWRgqFORd4uhcKEAEoADABOAFIAdAYAfAYAYAZA8IZAggB&ase=2&gclid=CjwKCAjwgajSBhBEEiwASicJU3kB2pWkGz7zwcGUNhkYOOrN9QK_DCOCKloMjXprkFYRze0WmIQbHRoCO3cQAvD_BwE&num=1&cid=CAESvAHg9sfhZZuHmc4oAIkygqtsdxD3F0DuFfKE2-J7Uu5Xi2wJyDNsVwCPrqRlOTeFi_vId9vibmDapUwP7omEchAOD1OPUkeoauM4Jic1eEyLfjAhoOzlnrhK5x3ncOmAT8OZOQYjtIMf8z5vOozzb9HDL9c2PDts6U3l94N0zNi1xAdzEs9X78TcJvvGbH-gakRSynMUpWOYQj0FDCDNWxwtwRdG96qKRHZeTvoY_qyAPx2Ap8HgAIq0kWHS_Q&ad_cpn=%5BCPN%5D&sig=AOD64_1kGT673kBVpEIWm2V39QvA9cdJWQ&label=video_click_to_advertiser_site&ctype=110&ms=%5BCLICK_MS%5D&adclksrc=3
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x260,0x7ffa3944c188,0x7ffa3944c194,0x7ffa3944c1a0
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,8629292303681676652,15728696991193436272,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
  2⤵
  - System Time Discovery
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,17152507409581883173,8254792476208051038,262144 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,9399977669261235237,2391614926408311297,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:13
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,13204811999730535590,6843467553866617344,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,12523222870187514333,11798501356492665997,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,16350050375195098279,2372088455451796085,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3488,i,3727748341182875419,10206122009625036071,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,6916944887093762757,16524031585124216835,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,15436331294929297919,17545630938470797560,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:14
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,3683111943422227414,11080308468110225354,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5707755953738125468,3687298860318337696,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,11116966592371981791,3365680340891379876,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,5707755953738125468,3687298860318337696,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,4667688408788661722,5849810784903993346,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:14
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7256301136397646311,1284757288690357520,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,10295741794279730884,3154628311449843242,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:14
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,1712690014859701561,14196100047213510388,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,11016619814018663731,612312270647832820,262144 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4924,i,9066894588316179101,5511850498217210794,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,14364725000328157207,13922007074586582849,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5168,i,7802521088587467411,1728859655433937540,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,12377247269694239199,7671619877850586803,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6912 /prefetch:14
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3632,i,9116400664012601764,1579823047868252355,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4292,i,16781519441925054657,6187291549969138379,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,15454734000987091146,13610171070589104361,524288 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=3488,i,3687405842160194375,9101591930008140162,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6844,i,16490865499114224578,3410314313370911041,2097152 --field-trial-handle=2216,i,12996196184808915584,15320826694634527374,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2208

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b24846f4bb01e57dd47994ee8ca33e14a6a356938971c33205ed76a4fe3c7b61
MD5 2415c177850265ec333bf407bedd2c4b
SHA1 2ccfbe660996437603bf4e0b70309310c3095994
SHA512 1a616d299248ea7424c92347e2568121b74d992540a7c2809c47f5e8113710d7965935a30c55d53ceef337cee1ae1bdbacfc42ed7e68109e206d0f729f22be4f
TLSH
T1E4D012663B4AB001E7698230E4C2C311267650E038864A01B254C81D99E41D86693186
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 871b7d452aa2cc4111daa133441b3002e52d0d8c119de6b273e4ffb4c80ac2de
MD5 89a1c191a5b83fc38b28a0929f313b80
SHA1 09dce94872678558f622e7e57430fc655bf4ca8d
SHA512 cffd2909d05b8588106124069f5fb84b2807c1cf9640c242aefa27fef58d0189d26c551cc67e3721672a9ebf1e9ead74fd0c25ca4225d8f593b7b0268ef78784
TLSH
T1CFE020850DC8C21D6720644BC398530CD2D07B2B97C49E8D2B0888C870010D0BBD79F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ae3f13a816a83ce96081a73b0460a2b8c5dc4d82f754c056f1a0b65bd9dfa240
MD5 1eb7ec98bfa755667538e04e97567700
SHA1 61606be6baff101e0e85196ff2e671a3a070d844
SHA512 4f815f329326b86e4262c880e01b80eff036334271a889871610748cfd8c9b3317b9bbbba529a0ad64040237f968a45340f1577c0d514a35882c641659f6e0ad
TLSH
T1F8E026840ADAC39EE3506447836D431C82E0FB1FD7C8AD4E27008C89B042090A7F39F4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 85246701a1e3ba5fdac3aef44f2a8c2d2f31538fa883f0e265864eddceba993f
MD5 958e639b9bf973ca27350ea68910f6b5
SHA1 eb6760c6c3df647708ce21793d3cb3521cf9a0e8
SHA512 2edc506edac2f902359408c2762b1b9b0479c31ee2703ebdb9055f6af573fb64c7c0f1c9cbfdac4dd95bdeea613344477d8ab50ba3a37f35f9edd52e72d4cc42
TLSH
T184E020740DC8C25D6320648BE375430C61C07B1BA7C4994D2B00C4D87101450BBD3DF4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 a62d636f66b7a75930e4e74999825cf787002610be1fd3ee3356b0e5a9b36ec4
MD5 9bc802d00238bb6751d775b071e9b483
SHA1 eda100a4d407d8e225afed53f8e3b4344e6177b4
SHA512 dd146f3ca1bc19d52be2025072cd1ba8e0f4c9b1477b3c9094b020aeda96c458e2a6f0cb4d55644666468d579e6058195cc00c270cd4e760559b7c0035ab03c2
TLSH
T1F1E02BA6C8229C2B09FD071C74544742D71617362A80494F373C860CCFB567B169AD1C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c528dd8662ecf758fc6331e2e9984ba9fdacdf8f4c7af9027247cf4aa71f2125
MD5 2fd760bba4f449793f46b8970e17c74f
SHA1 b06009eae6cdfb2a818553ea7285b574c7caa424
SHA512 33d9e8f8c1e638edf29969f39ff9739644168cd54f9b087f4f74988e991cbe7fdc5407810f8c641b901cd0f8a2ccc7b20a404c812cbb78a94c56f1bc6bc9773f
TLSH
T14B71C5170271C941F3260D72B7C0924CF5B0724F394B9F961EDC983169DA7E2C0E25D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0393096b167e8dfc6d9e870aed1719b228f2d11a108f59df6c941df4394552a0
MD5 eaba5278f4edba17783c25395c32b9c8
SHA1 b9c5385fe940856fa7c6af9e8e7bc2d476471654
SHA512 8ef7adfc7f5d09dbd95ea6a0fefce06776c650aaf56b0f1578422592de50fb07288f6a5e23409fcb57d7170742a27c0e69ce35d08ea82052041735d4bb95e355
TLSH
T19C71C4270271C941F7660D71B7C0824CF4B0A24F394B9FA61ED8A93169DABE2C0E25D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 32e8fcbea2999cd0df3daac97f1f2f03c91056fd31f1c74a74e4dfddfc695328
MD5 b26f1163cdb055ea8e075a565529e60e
SHA1 09d34adcc359d0063eb45e797a1303c503086fc6
SHA512 7956b113308848af0bb494e029221bb120ee1484de8402d4559a6f5a04bee1accb020bfb7026f16f53340371b16ddc608bd24ac3c0bc6d1741f427f7adbbd361
TLSH
T1D571C4270275C941F7660DB1B3C0824CF4B1A24F39479FA61EDC99316AEABE2C0D28D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 496637ac80d8acb3fbbed892da20b2713e4f8251bbd9b644da2daa4fd62a17e0
MD5 dfec6d69e38b5a530ba8cc40ed1d9023
SHA1 4bc766d9808e6b87179cb304e6d413a99726fdfc
SHA512 4c351f55060f1f6b69d3b6b18e0c32bff3aed581d9fd4b08394a73d883f98716ceada0db6b6f2729a8b6d252c47c5223008de21f0cad659ab288774e53849597
TLSH
T18F71B4270271C941F7660D72B7C0924CF5B0B34F394B9FA61ED899316AEABE2C0D65D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2fe638e5e4777ff80e38f71aa7b0e887ee41f7c40049f70cbd56217a81c8a592
MD5 c25e1bd3f3d2d83b8628527e68d38fe6
SHA1 a62d94af0934291b9dae9c878dbca52513d550ca
SHA512 8967732f35b962ad572883bc639584043bcc855748a2eba0ca0a5183d7065d8710798d5c635b5fe5f7725ba6fc0dbfca19e3f5fdfb8977d8b192291340e6e7cd
TLSH
T17F71E6270271C941F7660D72B7C0824CF4B0B24F39479FA61EDC983169D6BE2C0D29D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 878a8b57ea17365ddbfdc763a77aa9a40d59c48722c963333eda05af2fa7f9de
MD5 c2c05ce2025d1745c85dee0039761490
SHA1 1aaf30841057321d437885f70737efef4e5698c1
SHA512 845af7ebdcadf129a3cf075a0e6ba3f8a70b478ddd44176026994e762afe1b660f6a5f594d2f63d6948211c5f21de996e80d09423e7964ad7ea803d49b5d9ea5
TLSH
T16471A21702B6C941F3660E72B7C0924CF5B0724F394B9FA21EDC953269DABE2C0E65D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e5b2373165437a3d9d27b5b0b6a2bf37c187fe836e0282d6d1d46387a118c14b
MD5 804d9b867ef727f26febb501a7b1b86a
SHA1 3191464ce59dbff355d621d3dbd5da408c7f1456
SHA512 ef3783f0fe65372f42ffbe07fa061382542bb2593c3d1d0cd80ce6c01b8ff0410b1f50fbe6a64b339c5d729b6b1899b851039185e9561b0d8b023decfabfea51
TLSH
T16771C5270275C941F7660D72B7C0824CF5B0A24F39479FA61EDC993169EABE2C0D69D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b949.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b949.TMP
Size 3KB
SHA256 52e281e02d0b025c173b18c967a33e8e58affc264f010a8f5ca38f6883cec67e
MD5 7c344a0f0577690c45c2b76c13023280
SHA1 1122f11c2cf9d7c301c92503e631b8da28435625
SHA512 ddae16c622ecededb36347b6222556a86bbe8b93ca0931fae5b2df96fc8cf1d8085c9c1fa042696d12d7b891164c4e363dbabdc8076c4da90bc320e4dbab4e39
TLSH
T1AC71A1170276C941F3660E72B7C0824CF5B0A24F394BAFA21ED8983169DA7E2C0E65D9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 29bace58fd8e5bf708b41f20c14d5fa778ed3e84846b9c55d2f2b3090ecad5c1
MD5 aa6042c342f39b32146dfa9ab3361837
SHA1 54b9ff5d42707666bb5810eaab4018a0b99e5552
SHA512 ad499ef94b42b85a78cbebff3852aed17677a9db49b83dfea6cec7deb36535c0260dee9823aceb1cdcdfce1922277fc02416fa44ef139c158d147718849dab82
TLSH
T1BF619EF787F4836ED92196F0EA146E2BCE6D0554432C3C6A85E5EF1B93E2071E141B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9adb6eb3caed21f03bd777d7b84f43ec16b116d13c251078428872533907434b
MD5 ca7612ce0dc86b8d4af8b94afc042d12
SHA1 bd7df88b135b76069039235dbcc50553b6410e7b
SHA512 fe23cc571a1f930c767b533c12f5440e9cd6d57077ae1a2b5a6afaa83ceebe7c7d32fad7246c5a2cab031a3f29cdcfcc916dc7d91be7312d8bee7276f8e7fd9e
TLSH
T17E71ACF787F4826ED82196F0AA147E2BCE6D0554432C3C6A89E5EF1B93E2471E141B4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a7a5e24ee135e34e14a352e2c5890615900a6c7f3821d5bd9ba1767d9901f789
MD5 72aa7d8ff43ac29e2c1c0f699db03c02
SHA1 1f048a195060cd0a918961aded82f61caa0a3fb9
SHA512 66064f34923130b962e027bebcc8b38a4931f0e63e2a067c293b711088588391b59389b647a463ea274d9dc795a996945a17348149385804a291627eb9fb549a
TLSH
T179719DF3C7F4826ED82156F0AA146E2BCE2D0555432C3D5A85E9EF1BA3E2471E141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\TransportSecurity
Size 188B
SHA256 48f07e1797d8411a5258edade6d77da151d2a17bb15960920c51df098f891239
MD5 e338651e8eda8ce3ecc1118606d8d4e8
SHA1 4a88ec43fe63044816c0d90c8bd7a09f7d58ae13
SHA512 cfd101bc22631c40699df1fa7b0f4269ff24242644377343fe660c778e989f974286132714bfc030580a073d70115061cd362bc1ddf17390d64cbcd3be560044
TLSH
T1C3C0222380BAF8360035453D0D84B8CAAA38E035016080A0C9D7C33EE0908BB6F1502A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 7c6ed05f45588e43e0b6cb60e74d9a960281f66af4068580eba105e4c30e5dde
MD5 ec486a811ba7d665e17a0c55ddd37ae7
SHA1 d929c2e8cb35e28e4b52479247b798cdb2d6fd19
SHA512 1dbb098d9cf8b90eac9912f3c325478adb968416782f297a0cfa8a7f34d2d53dc37e1ceb9139300010e1ff459baf7ca4cfbb8fe05da4244d7224c521cdaaf836
SSDEEP 384:sxZ6Pqe2/fhsBYdoV7k0fb/b74/5KLgJt:siye2/fkYdoVj/b7q5KI
TLSH
T15372E8166A385977CDDBD219F945BB93D6F9156392900E44AAFCCE0C01E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 15490bc4819d275897af0d1dcff1a9d8e97fad2473f940722d559c4784601545
MD5 c093ea2cc136fdbd560533d57abd05bb
SHA1 ecb963a7e3a2c488ec7fdde35a2729f2ca010221
SHA512 295b05264bba1eda141413de2a8d8161a080c300acc3099d9efb51758eb6623f267471bae1215e84b325d89b5b2d13a64b0155672cbbbcbee70faaf221c30c65
SSDEEP 192:sxZ6RKyMqZjK1Ml8MF2/fhsOdiTKQ7PD08zodpHk83/W6+WNzyc4/Y0Zk3c+oIgb:sxZ6Pd2/fhsOdkV770fx/b74/5XLjJt
TLSH
T10E62F8166A385977CDDAD209FA45BB53D2F9156392D04E44AAFCCF0C05E7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
MD5 d51792b63ed3ba1de7e48851e2ecbcb9
SHA1 441158678a38e65a5837887ae322829c74aa752d
SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
TLSH
T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index
Size 2KB
SHA256 0a93444ac1d0a5c0655026da787208a5f71d3ce08edad7c2a4bd163813c2b887
MD5 a28ed5c1347cccc11ebbe468f50fc63b
SHA1 119f839a14d40c3d78ac142b917f8279bb558cee
SHA512 5a7916c718c06753e59bcd682dba7495cbc650522e7754e3bbf94a71b3103cc33773cd1ff75fbf2b9c53556da028be8021e81c34c737a4008f0b95af836c9903
TLSH
T15341D80D8D549B2FE868407215F2189837B089EC17549B239CFC1235BD4BB5D0D1B3AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf8a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2261811e-db42-4052-9775-ba1c4bcc9e08\index-dir\the-real-index~RFe5cf8a0.TMP
Size 2KB
SHA256 81dca3edd05bf8cf7465aa2d031e34a2cda0447a2f87a6a3dcd0ef8bc9186990
MD5 830e9534bd68bda0f7574e9139219870
SHA1 fba08c521ee278e0823e510c60a9bc8acfbe9039
SHA512 64ec9c85c206fe36fc9ec3a6ac93f3d2777638f2dbc5dc15e1c2e764d4f33d1ea234cc731d593c65abcf5553f78f02684190e3241b3cec49331abb06fdd03b76
TLSH
T15E41B79A4E81873AE89440770DE278B47335590087557F4378BCA236ACD27AD3E5D2E9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 cb75596da7a5aef6a007eb7c30593860801adaeeb18be0bdde321ad4cfe7881b
MD5 593c6128dfcf363df695bc99082c529b
SHA1 3e4ab01e9a45f313f20d1e1f4b30b0f3701de841
SHA512 ccdad1f5f5e7db1fbc2751ae463b8f87505c8260ee29a6f4d44e6c5dbb92690849d3b999a0df2bfbf1bacd59b682f8a0e8025f8b39bf949d18d1b2a16e6ba535
TLSH
T14FE068FB18D22D14EE6FC7D1103245B408003965C944AC4E001EA2C3A061B752459C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3ff36a75940f45a32ab4541ba3903cf3f14a6b934367e104e06a9b5f24000fe0
MD5 bf885d5d61b27e53b2cc9f1e6b377fe9
SHA1 5e903a7c657dcfc00d9e1be015ec73128f718342
SHA512 ca5e0b164c5945ba0370e0eb6c2450feb1a871068fe0056b3680259f0c236ddaafdbe593523d8dbfb58ee8166f10d3a7551630e7f011c9d3d7e23a1a477a9f30
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlFpHgT8ZNc:ctGj+BCNC5qFVpKxFZ6
TLSH
T1C4B27A1632BA02033C3D791D87A59B375A82B1633418E93B7BE854B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c851e167f557167622ea09fd746ffc3d1625ff3f6d60b3cc6a8e48653e533ecf
MD5 3aa38f4b352c66f87bafbcd251e63acf
SHA1 c7ac23005f0b07f909649f1a64dae34b304178cc
SHA512 2380e53deed8d893b191491ae92e05b99dd28454d60ef3232351b10606f50c3d9f032be9d62f795bb22f4b835c638fa0fe59101f3d0df1daf43c5741fb777970
SSDEEP 384:nZiF9CcmyWCs38Nt8TUNTUlIxBrk66Hz21zCfbLo/4AXfQRie4KV8p0Ajty/7Igj:wFccps3Gwg4lz8Oo/PoRiI8p07
TLSH
T12DC25B32EC98CAA7ECD64FA5F74E3903DEE05267868C9AD4D9D81E4D009B19D530FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b1ce649b13629033c3e7ee0493ff936d545d8102cc6e809c4b0cdf0c9b4db74f
MD5 957061448eadb046c34c1788bb05f4d2
SHA1 fdce4396cb488148f4357e5ee9088d947d85cade
SHA512 6bff53d85f19e0e109c730f7f53e5e616c470402821962914428bbd9ebebcd1bf1fcd52c2420dbe207304b2b208a45b6efead44a4308be272638c4cab90de48d
SSDEEP 384:nxjDiF1tNn/s3n9SH38N58TUNTUlIR1rk6nB11zCfbLo/4AXfQbiOObjI9G6w7WF:xaF1j+9O32wg8SDOo/Pobi29Mm
TLSH
T1D9D25B32EC58CAA7EDD78E95B34A3A03DEF0426786CC5AC8D9D81E4C009B1AD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 37c092068187c8030c8f6ed91112c85ffe33c4f5bd3451f1d749a0f01cfa1f6d
MD5 f851d33b8ff836f0d30727f5c5d19578
SHA1 546db1d9fda4939e0029e8be555886d6ed0fa75c
SHA512 562e70fe1c22c0f910b0f89361d6f2386179e3568742f5edc1e6cbe8d2e4396cf6cdadfaa5450b8fd5c35a0b507517399c864d5a6ffbbd7027d40d3506540278
SSDEEP 384:nxjDiFttNn/s3n9SR38N58TUNTUlIRJrk6fB11zCfbLo/4AXfQbiOObjI9G6w7WF:xaFtj+9U32wg80DOo/Pobi29Mm
TLSH
T11FD25A32EC59CAA7EDD78ED5F34A3A43DEF04267868C5AC8D9D81E4D009B1AD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 0c57f404efdedf0604149741faeebe140a29d1c1b6362d195c48b32ebb6a65fb
MD5 9aacbae1d26890eda5a69d554b81deb7
SHA1 ccaab5ae5b4fb28ef94b702b46b3a6655f6a1840
SHA512 d6b2500ff436818169b12b3a251ebaa79082387af69b83b332fe654f9273f9be8ff5d63f873a93c2e20b81b34bf364fb65f46e063613e78d07f886447a371aee
SSDEEP 384:ntjDiFttNn/s3n9SR38N58TUNTUlIRJrk6fB11zCfbLo/4AXfQbiOObjI9G6w7WF:taFtj+9U32wg80DOo/Pobi29Mm
TLSH
T124D25A32EC59CAA7EDD78ED5F34A3A43DEF04267868C5AC8D9D81E4D009B1AD430BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 d257b410b12db37afc3695bc52b34e37784dada8f00a17fcda7f1bfc371c923e
MD5 73bbcd12504f8720b0dfebdfa1b87164
SHA1 2f3c50e756ae0150cf4f789b8a7ac5e2a1a5790d
SHA512 185cc55d4ec29a3594798ec911f947e859956ce656e4a244a8c9780f6b69847d971d56bd970bbf1ca3708d615aa0f1028839cad852d252674a50fb608d3d8930
SSDEEP 384:ntjB1iFttNn/s3n9S+38N58TUNTUlIRJrk6fl11zCfbLo/4AXfByniOObjI9G6wq:tqFtj+9t32wg8kDOo/P5yni29Mm
TLSH
T17BF2C4F298D78A77D99E4B97A37E2D0299FCC153B5884A84F7D81D4CCC861BFC206816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 9556867073222508577649e2898795dd868460a908cb48b8aed7f326f1a0b349
MD5 1c2b71b7f1a3154ccfc8599eefcbe969
SHA1 88e2d57877646446608d48506e9b3258a0f29575
SHA512 74370f152323f6452de6663b3c4f324bbff69e02111cd59bf289674a09ae0b5fe8881c6a5e8fea1cc866592a718462ef11f1e36406a053a70cb352b36f8d14e8
SSDEEP 384:nbiF9CcmyWCs38NA8TUNTUlIxBrk6ospF1zCfbLo/qSme4KV8p0Ajty/7Igj:2Fccps3bwg4ApzOo/qSmI8p07
TLSH
T154B25C32EC98CAF7EDD64F99E74E7A03DEE0626786888AD4D9D81D4D008719D170B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5464-205-0x0000016D80000000-0x0000016D81000000-memory.dmp

Download