hxxps://email[.]ec1[.]msgsndr[.]org/c/eJxsU09zqk4Q_DTLLRYsIHDggFEUYoRojMaLtf-AlWWXWhCVT_-rmHf41at3nKmpnu6ZbnLmNPTvl9242g7ikdR4xa7rt11m0JBMmYsLg6oGcRkyYk2aruwk1ROlyz_ts7pJpruKt-f-0bKwrMQZX0nNeoOFluc7pmNaztRgDeLi3LCuQyX72blcvD82XXLIUXRb2Rf21mzzP1NPIHwV9flZG0wOXCvZMNmHrVb0SnqupFGFXlE4rllQn5gmJgQR5nnYZq5bBC5kgWfwEJpwanqWYzkOhO7EsZGLTBsVHgkwDizgmH_rEmHV920H7AjAGMC4eRChrnQyMM1HJSdENQDG7RULTgCMuwppBmAsqqxuYfw9HwGMB85uAMaM-T4pAlaYBXMc2_UhprZv04BgDG2IDEF-JZ657JmWSIR7GHd0-VUfLQBneqht9PiINs5Y7l2YvOc3AGdN8p3djlGWSDh6LVwdMXI2ZE3flpGbpvgIF1sAY9v58updYD--83WUP5KZzOaPhV1b8efnx9Y_OntMpl8wijIA4yUGcNaVh6S8EbUdCmsOZ6kprNfYdfM6KrMTvhE4FZT2p82ttfH79jQUV5wV3bRbvqpoVdnLIv0cTmuVoz2AMwfAOIGiHw_v_sdiRdLTkuV14Byn64vZwFocqtemXb0t7sv5qfFS-Mmtdy9No9zf-cnQzraX8SBoHFfuDzeEbW--ksnvSy6r-oKhmrJN8R0rIQCc7eyR5Oi4P7iY7rLu5_iL9Xj300VH85LcKdf3JjPZNDi12df11VMAxl93FKB7u6XrhyOLZivKRpgSwLgG9twQ6hmO8SPdlPv2O7PhctzovE4z32hYXykaopYbSvOSy6dfX3792mo1cMp0KBiiREnJSK-0ocNeI8InLUO6UxI4Juo1Rx2TXGnBBy7LH3MZnbpqwsIn1gvvhpeb0jXTRh_-MPonnT4kqjn_M8Z9yPrz_8I0hPC_AAAA__9_g1QB

Resubmissions

14/07/2026, 15:16

260714-sne2ssh13s3

14/07/2026, 15:04

260714-sftvzsft4q3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/07/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://email.ec1.msgsndr.org/c/eJxsU09zqk4Q_DTLLRYsIHDggFEUYoRojMaLtf-AlWWXWhCVT_-rmHf41at3nKmpnu6ZbnLmNPTvl9242g7ikdR4xa7rt11m0JBMmYsLg6oGcRkyYk2aruwk1ROlyz_ts7pJpruKt-f-0bKwrMQZX0nNeoOFluc7pmNaztRgDeLi3LCuQyX72blcvD82XXLIUXRb2Rf21mzzP1NPIHwV9flZG0wOXCvZMNmHrVb0SnqupFGFXlE4rllQn5gmJgQR5nnYZq5bBC5kgWfwEJpwanqWYzkOhO7EsZGLTBsVHgkwDizgmH_rEmHV920H7AjAGMC4eRChrnQyMM1HJSdENQDG7RULTgCMuwppBmAsqqxuYfw9HwGMB85uAMaM-T4pAlaYBXMc2_UhprZv04BgDG2IDEF-JZ657JmWSIR7GHd0-VUfLQBneqht9PiINs5Y7l2YvOc3AGdN8p3djlGWSDh6LVwdMXI2ZE3flpGbpvgIF1sAY9v58updYD--83WUP5KZzOaPhV1b8efnx9Y_OntMpl8wijIA4yUGcNaVh6S8EbUdCmsOZ6kprNfYdfM6KrMTvhE4FZT2p82ttfH79jQUV5wV3bRbvqpoVdnLIv0cTmuVoz2AMwfAOIGiHw_v_sdiRdLTkuV14Byn64vZwFocqtemXb0t7sv5qfFS-Mmtdy9No9zf-cnQzraX8SBoHFfuDzeEbW--ksnvSy6r-oKhmrJN8R0rIQCc7eyR5Oi4P7iY7rLu5_iL9Xj300VH85LcKdf3JjPZNDi12df11VMAxl93FKB7u6XrhyOLZivKRpgSwLgG9twQ6hmO8SPdlPv2O7PhctzovE4z32hYXykaopYbSvOSy6dfX3792mo1cMp0KBiiREnJSK-0ocNeI8InLUO6UxI4Juo1Rx2TXGnBBy7LH3MZnbpqwsIn1gvvhpeb0jXTRh_-MPonnT4kqjn_M8Z9yPrz_8I0hPC_AAAA__9_g1QB
Sample260714-sne2ssh13s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134285157801392649"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{98E52600-C40B-4360-9F6F-78ADE419572C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1224	3948	msedge.exe	85
PID 3948 wrote to memory of 688	3948	msedge.exe	87
PID 3948 wrote to memory of 2216	3948	msedge.exe	88
PID 3948 wrote to memory of 1384	3948	msedge.exe	89
PID 3948 wrote to memory of 2216	3948	msedge.exe	88
PID 3948 wrote to memory of 1384	3948	msedge.exe	89
PID 3948 wrote to memory of 1384	3948	msedge.exe	89
PID 3948 wrote to memory of 4472	3948	msedge.exe	90
PID 3948 wrote to memory of 4472	3948	msedge.exe	90
PID 3948 wrote to memory of 4472	3948	msedge.exe	90
PID 3948 wrote to memory of 1060	3948	msedge.exe	91
PID 3948 wrote to memory of 1060	3948	msedge.exe	91
PID 3948 wrote to memory of 1060	3948	msedge.exe	91
PID 3948 wrote to memory of 3312	3948	msedge.exe	92
PID 3948 wrote to memory of 4344	3948	msedge.exe	93
PID 3948 wrote to memory of 3312	3948	msedge.exe	92
PID 3948 wrote to memory of 3312	3948	msedge.exe	92
PID 3948 wrote to memory of 4344	3948	msedge.exe	93
PID 3948 wrote to memory of 4344	3948	msedge.exe	93
PID 3948 wrote to memory of 3544	3948	msedge.exe	97
PID 3948 wrote to memory of 3544	3948	msedge.exe	97
PID 3948 wrote to memory of 3544	3948	msedge.exe	97
PID 3948 wrote to memory of 1932	3948	msedge.exe	99
PID 3948 wrote to memory of 4656	3948	msedge.exe	98
PID 3948 wrote to memory of 1932	3948	msedge.exe	99
PID 3948 wrote to memory of 4656	3948	msedge.exe	98
PID 3948 wrote to memory of 4748	3948	msedge.exe	101
PID 3948 wrote to memory of 4484	3948	msedge.exe	110
PID 3948 wrote to memory of 4864	3948	msedge.exe	111
PID 3948 wrote to memory of 4280	3948	msedge.exe	112
PID 3948 wrote to memory of 4000	3948	msedge.exe	114
PID 3948 wrote to memory of 4000	3948	msedge.exe	114
PID 3948 wrote to memory of 4368	3948	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.ec1.msgsndr.org/c/eJxsU09zqk4Q_DTLLRYsIHDggFEUYoRojMaLtf-AlWWXWhCVT_-rmHf41at3nKmpnu6ZbnLmNPTvl9242g7ikdR4xa7rt11m0JBMmYsLg6oGcRkyYk2aruwk1ROlyz_ts7pJpruKt-f-0bKwrMQZX0nNeoOFluc7pmNaztRgDeLi3LCuQyX72blcvD82XXLIUXRb2Rf21mzzP1NPIHwV9flZG0wOXCvZMNmHrVb0SnqupFGFXlE4rllQn5gmJgQR5nnYZq5bBC5kgWfwEJpwanqWYzkOhO7EsZGLTBsVHgkwDizgmH_rEmHV920H7AjAGMC4eRChrnQyMM1HJSdENQDG7RULTgCMuwppBmAsqqxuYfw9HwGMB85uAMaM-T4pAlaYBXMc2_UhprZv04BgDG2IDEF-JZ657JmWSIR7GHd0-VUfLQBneqht9PiINs5Y7l2YvOc3AGdN8p3djlGWSDh6LVwdMXI2ZE3flpGbpvgIF1sAY9v58updYD--83WUP5KZzOaPhV1b8efnx9Y_OntMpl8wijIA4yUGcNaVh6S8EbUdCmsOZ6kprNfYdfM6KrMTvhE4FZT2p82ttfH79jQUV5wV3bRbvqpoVdnLIv0cTmuVoz2AMwfAOIGiHw_v_sdiRdLTkuV14Byn64vZwFocqtemXb0t7sv5qfFS-Mmtdy9No9zf-cnQzraX8SBoHFfuDzeEbW--ksnvSy6r-oKhmrJN8R0rIQCc7eyR5Oi4P7iY7rLu5_iL9Xj300VH85LcKdf3JjPZNDi12df11VMAxl93FKB7u6XrhyOLZivKRpgSwLgG9twQ6hmO8SPdlPv2O7PhctzovE4z32hYXykaopYbSvOSy6dfX3792mo1cMp0KBiiREnJSK-0ocNeI8InLUO6UxI4Juo1Rx2TXGnBBy7LH3MZnbpqwsIn1gvvhpeb0jXTRh_-MPonnT4kqjn_M8Z9yPrz_8I0hPC_AAAA__9_g1QB
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffa306cc188,0x7ffa306cc194,0x7ffa306cc1a0
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,16284710072061535070,6228920107401723900,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:3
  2⤵
  - System Time Discovery
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,7089533225065215914,6201460296768157189,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=2440 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,15615056626515952612,3344672937239350093,262144 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8294243550095060786,13158844124130738603,2097152 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,7495966979375639653,1681486673254701919,2097152 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,9536946450496892314,7310767869315353420,2097152 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,2072845891826906511,2332948467780038145,2097152 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:2
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,10249582433417372699,2967548916052681435,2097152 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,17208900942033805340,15995387938357899878,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,7351686192302088544,16037899653576733756,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3443599274438895802,4722865477828477015,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,3443599274438895802,4722865477828477015,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,12411738293979334010,15926810196375738433,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,9503529521127591005,848406605194303518,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,6073794745960957035,11047181164000728615,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,7470919930165833855,12063117325302904561,524288 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5908,i,15437999247861118300,5626809022787140778,262144 --field-trial-handle=2344,i,14117222547706279603,12478221036012061500,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

634ff790-a09e-426f-b871-930e0ffe0e71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\634ff790-a09e-426f-b871-930e0ffe0e71.tmp
Size 19KB
SHA256 808e07d6dddf5cbfe3a94050c6c5f8b062f88d3beafb51bd760962bdc5ccaf94
MD5 5fa0d41114d951ceb6ff3c79b53fc202
SHA1 286495ccd9e08837ff0475178aa98b35e13b9149
SHA512 34a9fdb262abbaaca1494678ec7e1c47a40679d361de44ea7baaa85a020a6b7998eefbd7a2655f4eefc838df49a0936b777e5cd6e481023eb0267c0c8345fe77
SSDEEP 384:WtNn/s3n9SfsN4clL5b01ua91ONMGgzJrHUIXS+6UC3ME7G/IO:Wj+9UsuJPO5EhHUh+G7pO
TLSH
T14D928D3269385D7B59F29584F54736278EB88177DAC62F9086DC6F0D00EF7AC038AD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 aa7f6103a2098cd38bd385b90acdaae601d857f82bda7e3676d004e27918f34f
MD5 011770e532b0fdc1e1b5565e7469830e
SHA1 d7c412536ef5218a985a713dc4b9bfec1693c2c3
SHA512 01a9936bb5afd5b8ff5729b8cd35fccb45611b9545116c7d7d392270452a7f987191b165da744ecd0e225f7805230c6944c45f65c9ef648d13a8fd5d774950bb
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P75:fwUQC5VwBIiElEd2K57P75
TLSH
T1FDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 24KB
SHA256 16f3d37a9da788fcdb644f349d859212aabd6bfa09b6a7091a3c3b34b7d24eca
MD5 f2f5714f517f5b144bbefd97b64ba738
SHA1 881829bc4b74fd7bcaac2fbcc91273bfee1a1642
SHA512 ed8ee9a8c5fc5fd050f86b241a301fc093c55788646f7a45e355502a8f0dbed0fedbe9c31af7e64b3529d313eb92578a8f0a9fa41d76ba89160940327d11997e
SSDEEP 768:WvfJ9uOUhCAVSDDaq2JW5cWgeCIf7iUQ7CGDeAuNnk9+:WvfJwLCAoiXRpm7iUQ7v9+
TLSH
T15BB2E1C3E8EA9481B9BE4E294C364D45BC7BBEB017F3585BAA0B10E15B35011378A5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 51KB
SHA256 74380d13977e8c531b90538a01540b7ed9844481df20aa90979b2a708dc995ea
MD5 603e215e232ecaca375faa2bc7a51d22
SHA1 449d8121599208c11b2c67d8c084fdb4c2f14583
SHA512 53471b9a0b1b2eab73b6fd5f1ab42300c46aae1dfbfe94cb57ac8598559210c16c98bb8cbf8faf9116e86e6106a371d8aac3ef653deeb40e315965dfa1cf0c15
SSDEEP 768:DRJQziwLC5PoPkvUeSYOiW7ePgGBsd5WiXXgSTXbnlZNcbH81Z7JaNyuc7hKvaQu:DRuzHLJ8YDLX/b/q8rL6CX
TLSH
T18933F178FE4941A77AD650FF2FF6281D502714751E1D0E62379A2256BCC43AF82C98F2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 23KB
SHA256 68e6ad4071a55cf3e9e87e429c7ee43d00fc453e57a2618348b52e37578e9c6f
MD5 3395b324f3767c2012580247ed3eb05b
SHA1 7bc75a092c3a293004c6800066d291815ca49430
SHA512 0a5efc3272b17827a25b7ca441e12e5ef088785bae584342c6fd3545e8cff64eb132d72619f60505bfa41290279f60aaf7f3836badc7f3059ee1af3cbcc47d69
SSDEEP 384:42pjXw8UuEKT9iuxt6ZFLMHqnIKAfjuWDiJW3gkGktbordwtjFzEogdhtQO:4KXoLk47iqn5MQkGcEvoIN
TLSH
T1BAB2E14B37315EF058A6FC92896FA357A59D14B9F07307064B2BBB00323A56770A4AFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008a
Size 134KB
SHA256 4881786c9219886d19d90552c7084c258ff49689f433f9e23dc1fc3352a2228b
MD5 a31f2cb7acf6f7d6a4137adb1150eb95
SHA1 ca30af30e1ada2dd6d3b79c65a71b988036ecbf8
SHA512 9e71c28665d7893a8816785721f4ded0e48f4bea73579a5574a506fdcb8e2e38f9511e9e8ae821d2f7e14d39edd12ca9124f661a7cdc0dcb2a3802191420131c
SSDEEP 3072:Zy11ZzOAZEg9KwNCoZpeLIo7TXpJela2UvaCXT:Zyxug9XCXT4DUCCj
TLSH
T191D3129CB3A660C3404B35CC8A061EAF7E316FB9DE411FCBD58850117E68A7FC29A807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 673bbad0b47704ee991543626d50835b343db2b017c291916cf5cad42be95888
MD5 ba3e8476b1e27f866b9219ed377e00af
SHA1 9d9665c845616ed0debaeab1287983bb1e79a769
SHA512 cccb75aa1795bd48ed1ed4d6a162621a16b1809ae56f4e92ddb0a47853af98c74a1d5a60f6fa70fff37d8a65ed6671b5a4740a588f55fad280855e62644ef9a9
SSDEEP 48:KEYMrRM5ElyYmCE7WSrCyeiwaKC4dBwhgZGeIbqOiMc9h8dBmOijhudsprxYH8Ss:82HmCEmldBRZhIuoQ8XIh7lxVcidV
TLSH
T16AA1D7043999AA42FB210433D4E42825307E6DF48D33CE13C184B67D560B7A3AE9A4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588150.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588150.TMP
Size 3KB
SHA256 b6fbf96a1e1952fd1e17a5ec1aa1ee38d72ee0a3e80c8bccb98bc62b51d30677
MD5 04c2f63db4d61ff0a95dfbfabda150b2
SHA1 96abc9667733be5d75fed04f65010e4399fd5c17
SHA512 c41d5d5e88a3afe127d611c6cb7b0a854938d35a82cafbde4a8ebad590650dd41b3187d6ee6b5f4d8ad73ee380cf6fd29cd744cab2f39ce48f60cb8b0abd3295
TLSH
T13561B5183E928B51F3320933E4E91275357C41B88D33DE55C290B47D9A27B21AFE94CB
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mycloud.verizon.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_mycloud.verizon.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fd981ac0fb3c5fc39a358d9ac098c1087ede0ef2582982a1e274ffbb51370169
MD5 3114e47f50514afbde097597a74a880f
SHA1 a369fd8516f2877498dedbd86aafc2250e3fa250
SHA512 ca7c3f380f1e6c7e74d73faf4cdd1a368142ff83d3845d299bb6dbf81ba029a9b796ceaa4245ab9cd9ed24cb4eea19dc72cb45dea96f78991f9ae944823e6d4a
TLSH
T1FA31CEF743B0C67EEA1152F0AA286E2FCE5D0911472C3869C6E5AE1393F3471E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 476a31299e771dae08b69527c9279e70d1ce262983da92695e4703f91595560b
MD5 c7f2b94b3239bf031aaeb60a166ddaf7
SHA1 abcf7c7aea1b4cd3a5bcb78d67dc304033a69ae0
SHA512 d68dc98bc863118342cc20129d85b043c730aac1fba7f670d4b8ea46bec45cfbdb58e668d934f7f6326f6b9f54af70b341ba6a4019c988926baffd61987a4054
SSDEEP 192:sxZgRZyM/jK1Ml8MkH/fyshWl2Idp/O96LHW6+WN0OnE/YLOTnHIgrJ:sxZgDMH/fyskl3/MAHb0p/r9
TLSH
T1A952D9126A34597BCCDBD219F945BB93D6F90463D6940D44AAFCCE1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 013735bb65cd9b813f93653549124256bbb74d2d0f1762daa76c0c6615976288
MD5 8e20b8b1597a82531e9a2980a5e7c941
SHA1 7bfe62f8b8914d76d2286bebc58cb0462a229924
SHA512 28dc13a67db6e7c7076ee32273bfa8d82f19e8881cb047c308a959756459a680e3c700f8153ccd17e4fb5ac282e8ee51ded4041f27ab3fab4d569710315439e3
SSDEEP 192:sxZgRZyM/jK1Ml8UQPkH/fysZWw2IdphO96LHW6+WN0OnE/YLJe3HIg5OJ:sxZgDq8H/fyssw3hMAHb0p/9I
TLSH
T17A52E8126A34597BCCDBD219F945BB93E6F50463D6500E44AAFCCE1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 408ee7801b48ca75474738f2c6aa1b2bfb89b5f213d922655f67e7db88a9be0e
MD5 67ea7391ec3f370d2f79f722b61b00a7
SHA1 8cd3d9aef467a7f9881dfc3f73b54dbff6cd3fa8
SHA512 1a035deb7cda6424feb5a7299d4e17105b6ec81c0302c1dc75318440be819a49d307f01070b0b061efc7c79b1894e5d989ed382c904ccad24153aa4135489d5b
SSDEEP 768:4es6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNJroNF:4es6pD1WvxzWju1jahILIsNiNF
TLSH
T147D2FA3B680CCB7E4F841E5CAC2AAF966DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\4c71ce9c-ade5-4d25-8732-31e8c9022e6c\index-dir\the-real-index
Size 72B
SHA256 577959d814b1d870bfe694b37872a2476ce37396862c653e6ce417f934c38e7e
MD5 01e42ebb025f4c665d93e24811eee723
SHA1 97b477ef50f4f95caa59902554d4fba7a0576104
SHA512 25941a53ff946070765f7f710876f02a89ca565f29d4cd901f5c66d11696f5923d14c8e5d749aafa7469f933cee06a876be965b2cdb5cb212db84d02ab66ee38
TLSH
T11AA002181A940513C494017C3226464CA2205C7418089A1B91E44544FC668558941064
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\4c71ce9c-ade5-4d25-8732-31e8c9022e6c\index-dir\the-real-index
Size 3KB
SHA256 c6aecce973f66ffadf7acdd22973c1a3df1cb28cb06ab31241224f9dec09868d
MD5 da639975088c3810ef963807ff5cf473
SHA1 c2835a688c7c9040c4a628ea4d62f54c4cd69cf9
SHA512 18e3653a9163637dd8d597eca1458a8d2d67e2a0a89a615ea3599540107db34ceb720b0328b0336e83b2cb351b7cd3394ec649f7db6d121f47292da98aa8c4c7
TLSH
T16961D9DCE8065333DEDDA23E8A0D003B72649FBA2843970715D860E11A8390E9F50B3E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582ce7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\4c71ce9c-ade5-4d25-8732-31e8c9022e6c\index-dir\the-real-index~RFe582ce7.TMP
Size 48B
SHA256 3f47718b81fecb69f368fb17c195f810f4115e595b8bd9d31024ace92cd9e206
MD5 fa239a91e2d3afa66945f670e8a3c06c
SHA1 5b4a29ef4093a9944091f730bf730aeaff73f993
SHA512 0db01b9562a0617c46f63793cd932a5650a6449cbaa7d07a2a22a5b9bcc778d5211ea9c85239fc1a577da2f7f6bddd94c9a4def8f0fc03963cb3a331fd00ad5b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\7c200bf4-7439-41b2-a4f6-71da6efb6cc5\index-dir\the-real-index
Size 120B
SHA256 d8496c5caaf6bd63293374457051e51dcaf086f00d98f105a5b7e4fa6b843772
MD5 ff6f830d6a5911a0c4e9737ee9e28fc6
SHA1 05100681229245fc654e5650e07361aad16c01ad
SHA512 b1a95db35325b9d29d47d8228f785afd2b76440d42cfe918ea184f06ed3bd31aca9866da593a91794316d4f0774d3a3374379d7614125063b3240bd86fdf23bb
TLSH
T10FB01218DC850702DA31027015D000883620DCCD02449F47C0DD5835F88F2DD0D60120
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5883e1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\7c200bf4-7439-41b2-a4f6-71da6efb6cc5\index-dir\the-real-index~RFe5883e1.TMP
Size 48B
SHA256 0f317e0e50120b5c4836fbc176bac886caf58e5322ad8a94be8a7998c13661ab
MD5 9cd921e9e5bb903e927a575bbc96bc96
SHA1 3d7f70c9367675d98ccc1e4809254cf113909979
SHA512 b23bf7db9e88ae220cf14bb47bd4ecabff1c9badb455364317e5a21f61051f324c7a77e3f6bc44130beb9a6c44a0673811ba05247b9987edd47ad013535496b8
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\index.txt
Size 248B
SHA256 4470e22b95c23dfc1eea7bc25bee7ea38a4863ed703e3e9a6b7f861ad2a62955
MD5 7f6b27ba96c679e21006053946d45e13
SHA1 1b050bad055b498f8a4a65a025fb0db83235a0f3
SHA512 713590c77129831dd313fe360509c8d1ff7afa8204d1dd299703e469aa5cc40394d8e28d021b05581e6a3dedd0de2d15593c04d08076990a94829e599e4a7993
TLSH
T1FAD0956734504334FDD597D3C004226C591FBE185D794988E5477C02C0757179342E91
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\index.txt
Size 244B
SHA256 1203cb40b302382c2aa22da50dfc8bddb6f9834aa8b5f306dece27c8a858592c
MD5 fc89d4c927ee7dcd08787ed418dfb775
SHA1 e536f23bace7fec104b5d84456979c6caa227efc
SHA512 83e1ab6b7aa002fa3938a9cf0990a660834dbfa6557b5c26ddbc45f4abad5c04fc7799487cc7bbf4cfe007e577a79d33566bab37e0cddf08e0dd082a685b8dd2
TLSH
T1DAD095672440C331FCD5A7D6C004223C5E0F76185D7449CCE1C31C41C0157175142E50
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5830fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\487f170039fcc7b3b8fba88b0b53eb004aa3b335\index.txt~RFe5830fe.TMP
Size 175B
SHA256 eadae4918a65d8a9617a668445d005d66f09a7d6bf650b7a2753a9ae56c17229
MD5 775eb9c0d687f82acb2271e8179097ea
SHA1 dc81c77d0de0bc100eef78ccd384b183f4f27276
SHA512 50008ffd7cafcc428281d86b7735e96b52750a16cf892bfcadf1c909e13c7f383a95de503a8771f05fe1bff0297e0413f237b6c84aa0b2c08c793bc41125e22d
TLSH
T1EBC0126724509330ADC5B3D68115220D5D1B6C04A9640988E1837C1251347276181EA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f0cb434f56dc53454b32ab797f1d4c803387e6bcc529a32f8bcab89a2faabdd3
MD5 22e06650a99774fce46d3377d85c0493
SHA1 ce1147d60260991cf76f0aba9e8ba884825ab35c
SHA512 a47f178185a80a548666ef3a7c036385e58cfd02fd99811c602bd1335ae0c57fe4d4bf44b4577f7e542032ff5474c362d1f08a11cc6680c7a5d3301de78bdcd3
TLSH
T183A0029705501443C09D027A33C7058532395C50DF1592C645A851F4C974741811B191
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587dd6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587dd6.TMP
Size 48B
SHA256 6950f79415dce10bea77bea51b74956d696c9c66714f517344147aea673122ad
MD5 76e2dd4f2c2751b3664a96c1c1a195eb
SHA1 521c5956000738b646d675986a2e1dc099460c49
SHA512 3456fd950553c5be6425f6b9406a61389cfe8ea20b09795afdf09fa58354ebd9faf8bec04f1d2da340cea28f81454f019f9e8e2cef807c6338d2fbc273735876
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 fbc849f87e28822364cd643392f4b1082b5bcced939b9da3249001465f616e69
MD5 ca248735c6253ca8f2312aad6a444338
SHA1 0b958d1db8aade4b06a0d4f57d5987266505028c
SHA512 c903fa62e32b8a7326fa1f6330122e29f79cf1bda4e074743d3dfc954e3877e3093cefb3ae619371cc3a16bb8f2273dcadc795916188daee2d6be956693cae7f
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyFy5IZKakkzyzZ4NJ7nzkDn6PI6BkK1Bk:KUAAKteP+y52KakSa2oKDin
TLSH
T180A1F50632BB12433C3E2958A294C7279746B1B33058B82B7BA851764EE7E344DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe591061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe591061.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 612f46b92c57f137facfdd6f6589e092329cc703c7404e9e6b3a9a6c53fee2e0
MD5 4b95179984c01c9239b88b0bff439883
SHA1 a205ffa91b5f6ba3ef30df9ddc31907747080387
SHA512 2cad21180b39f065d9d81a3c1cc0ad8871e79f37305abce81b7b896dd3486885dc835b31d060d5ae1be701160f9d15c03cbed530949a8e499d99c0e82dbb9391
SSDEEP 384:0tNn/s3n9SfsN4nlL5b01ua91ONMGgzJrHUIXS+6UC3ME7G/IO:0j+9UxuJPO5EhHUh+G7pO
TLSH
T16F928D3269385D7B59F29584F54736178EB88177DAC52E94C5DC6F0D00EF7AC038AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9e681cfb4558ed69cfaba57753f6eee113d821ab6975252b65b6d9cf440b2eae
MD5 7751479429a7cb130fd2dbf672999a74
SHA1 c80e52c6774a72703aea0631def557ac77a4b48a
SHA512 6269b93e2ac81a802f68e40e40bf8b68941ea5df2fc4cdce610b571b21bc7b3062b44581a0ed2f3dc649eb40edd060cb94e3e5e5865a37969421dbe1b1f5fc4b
SSDEEP 384:1iF1tNn/s3n9SBzsNo8TUNTUlIlclL5bD1ua91ONMGgzJr6UIXS+6UC3ME7G/IO:8F1j+92Fwg+FJPO5Eh6Uh+G7pO
TLSH
T163C21AF258D7493AD9EE4B47B77E2D178EBCC067B9812950B388590CCC9A2BFC346815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e26261e50b42731e2bad186bca66ceb479f0ed04b3c53c09f04ae3b3548fe92c
MD5 4f60826063993103edb9de22934223fc
SHA1 d19b4c4811f1a4b166d6473a268a5eba9c3a9ae3
SHA512 8c982c0ac3b632a25723c30ade7dc5267fc84aa07a015e995b1cf5a549b9d5c98e3c54bb8070711a85effc7fb1f059baa29671146f98ee139dad975206c23c10
SSDEEP 192:qON86O7+3hQmiUy4kGttb0oO2bKh2hgG++RU6:qON861gGt91ONMBdRU6
TLSH
T1DE02E9356C286CB79EF2AD05BA8737235FA5112BE9952F44D6E81F1C00D765C2346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 23e9c65938af87d0a1fa9a130b888472b5ee0ef77c85868ef0f07e2c0ccb5795
MD5 c5735dfc26c43dd016b412ea02e3afc9
SHA1 3e123a21d6c2b55addc7ca8baf57a9e1f8195533
SHA512 5995cc73f680b5e7ae82309435afe1553f5622687a4ca36e67a52686b76162feb9f2afe84e8140873193db4b9714ca3d1ae16aaa331c023b04d824a82edaa87f
SSDEEP 192:SONJ6O7+3oQmiUyfkAttb0oO2bKh2GkF0SJrrcNuqqEEU6:SONJ6W1At91ONMGgzJrQUU6
TLSH
T112122B3678289C775DF2B545F98735139EA54127EE8A2F80D1DC2E1C01EFAAC238EC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83253bd7-e9a5-4423-a1d5-743b025131ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\83253bd7-e9a5-4423-a1d5-743b025131ef.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 09a6537f80869e79ea3c6144e81a4f64f56c3813808ce0e46bc1fa9f18aaa2cd
MD5 1f219f4b99b56e8938123c932c625bfc
SHA1 1cdc6db0bdadc523158b584e5e4b153c548e31de
SHA512 4d5121eb0d5ff9a05325363f249252b05beb4f62fdd5a49316514baceeee9267fe535532ed0fcf06cb8b7bb44d65f74da27a59098a60fc632d1b2298ba585861
TLSH
T13D412758B6FA1148B3B77F56ABF6A86D487BBC372E0AD49E10110D4F0A62E00C861733
MD5 SHA1 SHA512 TLSH

Submit Download