ccc0ea530955ad16ae438fec81ecca76e72c71524a31c0609a9d85ab218da033

Resubmissions

19/07/2026, 01:06

260719-bf3z8abv8t

19/07/2026, 01:02

260719-bea8tabv5z3

Analysis

user interaction
yes
max time kernel
136s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
19/07/2026, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8137097611958.html
Size 968KB
Sample260719-bea8tabv5z
SHA256 ccc0ea530955ad16ae438fec81ecca76e72c71524a31c0609a9d85ab218da033
MD5 6987d0479aa5a755330a24cce8c34c26
SHA1 adc7c7fddda2af3e56c48b350f3e19290fb0e2f3
SHA512 3386aafa3e09aff59a01cf3c7e65c278b4a8cc88f0f9d7b42b22904e987cbeee09449152f9dc9cf1255cd9e5083372e5aba76f6eeee96df1f7548f0e98bde75b
SSDEEP 12288:IciqrdpipNCOG7MiSyczPQ6cZNzA6BrLOQKkOu208f02UfPdOwOyfPdOw9tazzXu:IWNC5kOu208f02wWmF34EYNjxjkZ0b8
TLSH
T1722562B094F7C5BE421F7086DD20AF9414A3C35B578237FBB156F668229D6858E0B38E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134288965998730653"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{54CFBC55-754D-4910-8B0E-D5A716603547}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5272	msedge.exe
5272	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe
3788	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 4396	3788	msedge.exe	85
PID 3788 wrote to memory of 3308	3788	msedge.exe	86
PID 3788 wrote to memory of 4164	3788	msedge.exe	87
PID 3788 wrote to memory of 4164	3788	msedge.exe	87
PID 3788 wrote to memory of 4164	3788	msedge.exe	87
PID 3788 wrote to memory of 4596	3788	msedge.exe	89
PID 3788 wrote to memory of 4596	3788	msedge.exe	89
PID 3788 wrote to memory of 2276	3788	msedge.exe	90
PID 3788 wrote to memory of 2276	3788	msedge.exe	90
PID 3788 wrote to memory of 2276	3788	msedge.exe	90
PID 3788 wrote to memory of 1036	3788	msedge.exe	91
PID 3788 wrote to memory of 1036	3788	msedge.exe	91
PID 3788 wrote to memory of 1036	3788	msedge.exe	91
PID 3788 wrote to memory of 1112	3788	msedge.exe	92
PID 3788 wrote to memory of 1112	3788	msedge.exe	92
PID 3788 wrote to memory of 1112	3788	msedge.exe	92
PID 3788 wrote to memory of 4496	3788	msedge.exe	93
PID 3788 wrote to memory of 4496	3788	msedge.exe	93
PID 3788 wrote to memory of 4496	3788	msedge.exe	93
PID 3788 wrote to memory of 4384	3788	msedge.exe	98
PID 3788 wrote to memory of 3184	3788	msedge.exe	99
PID 3788 wrote to memory of 4384	3788	msedge.exe	98
PID 3788 wrote to memory of 3184	3788	msedge.exe	99
PID 3788 wrote to memory of 1176	3788	msedge.exe	101
PID 3788 wrote to memory of 2748	3788	msedge.exe	104
PID 3788 wrote to memory of 2748	3788	msedge.exe	104
PID 3788 wrote to memory of 2748	3788	msedge.exe	104
PID 3788 wrote to memory of 3612	3788	msedge.exe	107
PID 3788 wrote to memory of 2268	3788	msedge.exe	108
PID 3788 wrote to memory of 4992	3788	msedge.exe	109
PID 3788 wrote to memory of 5828	3788	msedge.exe	126
PID 3788 wrote to memory of 5828	3788	msedge.exe	126
PID 3788 wrote to memory of 1396	3788	msedge.exe	128
PID 3788 wrote to memory of 1396	3788	msedge.exe	128
PID 3788 wrote to memory of 1396	3788	msedge.exe	128
PID 3788 wrote to memory of 840	3788	msedge.exe	129
PID 3788 wrote to memory of 840	3788	msedge.exe	129
PID 3788 wrote to memory of 840	3788	msedge.exe	129
PID 3788 wrote to memory of 2076	3788	msedge.exe	130
PID 3788 wrote to memory of 2076	3788	msedge.exe	130
PID 3788 wrote to memory of 2076	3788	msedge.exe	130
PID 3788 wrote to memory of 4796	3788	msedge.exe	131
PID 3788 wrote to memory of 4796	3788	msedge.exe	131
PID 3788 wrote to memory of 4796	3788	msedge.exe	131
PID 3788 wrote to memory of 5948	3788	msedge.exe	132
PID 3788 wrote to memory of 5948	3788	msedge.exe	132
PID 3788 wrote to memory of 5272	3788	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\8137097611958.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffeca6ac188,0x7ffeca6ac194,0x7ffeca6ac1a0
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,14479778055673930071,1284405628212511199,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3066366885356541374,4648222308648909988,262144 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2608,i,2794114437011008492,8257185764039233045,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,15572962456025052754,18409047861919058874,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3496,i,7761773043832567774,12045822866091151165,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,14402991926297232425,116180982155456986,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,2684320211836307572,7586885251821603982,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,10400738168892677999,17133883417123112906,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2865308193495256474,17867606160674705317,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3970583808541946076,17180983839404250769,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,3970583808541946076,17180983839404250769,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4900,i,9288272186410708245,7772142162301655659,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,7068923630560956009,8362045366501729440,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,8127650054055594181,5735940090443545943,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,1692058213134965038,1817143964838069601,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,10658551155838063219,4450722379563606171,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:5828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6904,i,17275994495883620518,8233441688128780385,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6940,i,2669306952979673462,16288806997118599896,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7496,i,2566662374362614432,10270217950583311225,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7508,i,7617293306957969543,14604808970208188140,2097152 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:2
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,16329953862118874032,13634936514945988438,524288 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6392,i,17656824675601110386,15844548034200199155,262144 --field-trial-handle=2180,i,11560692732216047486,4551354415949993130,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 59KB
SHA256 ab6ce8ff54d1f01c22dddf7dc492329d8ee36fda895288fcf5d111847f95b6fb
MD5 aa060b8f7eac87b383d031c5e0fcf85a
SHA1 622b5c4479702b776c879b4e837e45c1aba0bb2f
SHA512 13a7ae181bc7a20d8bcd0749af9283099ec4e203185fe226bc349b7ea8f60a35d7c6dc52c75bea86a94468c4f3677c89b48472a3ed0f4764a6f899b44163d84a
SSDEEP 1536:Cku8cjkJcFRVdtrDBg/IMAlV1W4609HlHxtk6v3LVV+4:CpxTtrDBwAlHW46CP207X+4
TLSH
T1D853F20BE27CC9639D18546797146BFF3972B2221A1BB46ACCB877DC0C451E14FDAA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 3452b1161de4ab7831e176e235865c3e34acfac706b7ad0192595e6848d972a0
MD5 4201845d4ce8d5912d4249abfc821dab
SHA1 db08628d2fcd7394203af69e6b84019af3cb4230
SHA512 ada4f125160fa6d4b06430cf56b5bec101e83b796e2bf4e57b6af1e749873a844da2494994f827013a6178769150fbc5b5ea462f39a477b0241bb561ded970d7
SSDEEP 96:p/iDq0FgisV3/ChZTY+moA00tFKXrSTKjLMLK:p/iDq0g0hZTYqAlGrSTKvMO
TLSH
T197C1ED6603991923DB9E63B5D0963C17F0B2C246B9671FB3607886BC2EB7FE4831D418
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a80398a54f14a0d605739e7c9e075245057aa0718dd29ced881fda39bad6e9ae
MD5 a55691f98ea9d516b406811bb8a67f3a
SHA1 37aa9edf335ac999786eb08d8b9226ace65fed34
SHA512 fe56e0290c8de969977fd48fc407365d56af68c795e89cdf63249f23777276b96325caef464253c9ca0a24b254faf8e23322d9ff9c5918cd1e81a172320a630d
TLSH
T14D614127174D0563E3693372E0EB3A16F0B1C64BBD770D721508DA7D660ABE1C21D80C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 91e1c90f3e6ee7e4eb49186705cbd123f47e3b8e5c34004801bb9898ea315807
MD5 7bb81f92a945bc14aa9fb2f89c02cb61
SHA1 bc099f529490381f894f233fe0e0ec5dc7624e70
SHA512 6a5a53be723784b14a91e9e9cf9ae0548dcfb0a91d3610e510215b70c00d850a1b34c9ee6d41d6642615dc42d30830ec3d7a1758e7ca041b6153e059157388fb
SSDEEP 96:e5iDq0UGgisV3/CzZTL0+moA00nDFKXBy5KjPpFm:e5iDq0U/0zZTL0qAlkBy5Kzpc
TLSH
T1DAC1FD6603D91923EB9E62B5E0963C17F071C19AB9671FB3607886BC1EB7FE4831C419
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586ee2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586ee2.TMP
Size 3KB
SHA256 a4cc1c1d762b3d2afafa97c56b7efed88681319d0a4c5487a90a4d2a74b0066b
MD5 a44f1692712e3d5f0e67defd7abf6f02
SHA1 8146ef01b34346860e11943a5a05ba0b9de63d3e
SHA512 b1f83d82424613fc64337f09d59371427de1e93c25c7f7105e1af30025498d86137fd28033dbd43582c0a15bdb4f5a5c70bf2361d5cffd4d68f2628cc45086aa
TLSH
T1A16141271B4D0963E3693372E0EB3A16F0B1C64BBD774D721548DA7D660ABE1C21D80C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Local Extension Settings\jdiccldimpdaibmpdkjnbmckianbfold\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 0dc0155a0afdc2b563ae7c58f169468125d57f9902f230344e0d9ea5d7d7c84e
MD5 353c341cc99d4372eb53e42eb25aa7e8
SHA1 9f8dbe2f156616ab69fa880eb864e7be4d0c45d8
SHA512 bc948e703ff1cdc5c240855ebaf63e148dcd4a46cc755cf2e1a5aaefa14df554d23e413f3bd8b1826a3325f813a1473477ab0b870c39ba55eb039805ba0f9548
SSDEEP 96:DvOH4u38ZWvvxxzcGGO5jHzmdfcKCXGwBtxS:DGH4u38ZWvvPoG75jTmxcKUGktxS
TLSH
T13D919CF7C3E5866DD91196F0AA146E1BCE190557436C3C5989E4BF0BA3F28B1E102B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bf6b72eda0bf90f00f5d258c3ca13da068d6a4240f2b25f6d4e37a98a58bad67
MD5 d848cbb028fe7c5fa4acbf433ae652aa
SHA1 c3ef025016b02e002c71f698ce9778d5329fd61c
SHA512 cdd146c66fc1fd954258c4d67c1564911495b4444cb7e01e82dfdac9fae60a8a54a21b06adf7f1c6198166304ca869654ec4680826bbf66b71f6b201feb33e19
SSDEEP 192:sxZiRvyM/jK1Ml8Mkw/fzsgnZij0D1IdpdyHW6+WNGY4wRwUIgrJ:sxZi/Mw/fzsWZijKGcHbGu9
TLSH
T1EE42E9126A349977CCDBD209FA517F53D6F91473A2940E44AAFCCA0C05E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a546b24a1d935cd79bb928432e95284424e9207d0e8ef06f9463c8996210244a
MD5 2019444131613ea7044344fb1c515b05
SHA1 8cd32eef23ddde0d462fcb88e47b6e20286094ae
SHA512 5cbb36f893de062862fda498a1531614e84c6ac77a0a33dc22722141181db837905c6d14a9db317f1f4373f0f909f69a2c27363f6654186e2811acc97fd5d111
SSDEEP 192:sxZiRvyMojK1Ml8Mkw/fzspnZij9DGMbIwddp45yHW6+WNk73U/Y4CnwUIg5mJ:sxZi0Mw/fzsVZijRGRyBHbH/ws
TLSH
T1BD62E812A624597BDCE7C219F951BBA3D6F81463D6900E44AAFCDE0C04E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 500d5f33949bbdc2a1f3faa05855012296f3e240bd245098f533a537e27cf2a9
MD5 45db2f9c2908ba8beab8c7ae439276ff
SHA1 f2dc0b40bad3264de018a683e07534d0ea13a78a
SHA512 a3d138599db42c29e5352cc335e5202f20d102c90a997b4f5504b4d62acb94e78637f1f6450d84ee41bff1c38d41248073d72db743ee83fdcc5465b28e6899fc
SSDEEP 192:sxZiRvyM/jK1Ml8Mkw/fzspnZij9D7MbIwddpm5yHW6+WNk73U/Y4UZwUIg5mJ:sxZiZMw/fzsVZijR7RyrHbH/os
TLSH
T1FF6209126A2459B7DCE7C219FA41BB93D6F85463D6940E44AAFCDE0C04E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8cd5d35c123ffbf1990af2d9b158e0928d4506f3877eb42ad50acee181b417b2
MD5 e8de047b3d9031d8ed32f8650a8ea54a
SHA1 494729594f50a9778da324cfa22d3ffaae7eedcc
SHA512 685c109d0533383ca021666506b6518570d2609758f1e9f462302cc9737193414e280e0440f4dc692047e00afb42db9f2d7fe38b40744a05c25b52a845a2af6e
SSDEEP 192:sxZiRvyM/jK1Ml8Myw/fzspnZij9D7MbIwddp45yHW6+WNk73U/Y4CnwUIg5mJ:sxZiZaw/fzsVZijR7RyBHbH/ws
TLSH
T1C8620912A6245977DCE7D219FA51BB93D6F81463D6900E44AAFCDE0C04E6BDD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fb87db7ab8e78160aab3f440a0898d9a10256361b1f5e8ada0ed1ee147a33c95
MD5 9173dc601d362db1cd428728b9355b31
SHA1 05147cc0d6783851d6fa1c34278749140e62429e
SHA512 efb6dee7bb47c9917fcddee0b0df1825927ab229fb0c06a2d7ccb209f9c853ecebed857eb0ecc28144fa39a07db64a52ac78c828c397953c4c0c2602b8ac1b00
SSDEEP 192:sxZiRvyMojK1Ml8UQTkw/fzspnZij9DGMbIwddp45yHW6+WNk73U/Y4CawUIg5mJ:sxZi0q4w/fzsVZijRGRyBHbH/Fs
TLSH
T11872F912A634897BDCE7C219F951BBA3D6F81463D6941E44A6FCDE0C04E6ADD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 a32ae639cba140e39356e509914481b2fc1fcc5eda9bf151ce78e7a9c2c0e48e
MD5 85989045b0c31a327c6ed7eb524e16f9
SHA1 5094472ec4a244b3898e818326b5c1e7b93dafc6
SHA512 442d394a63d8d00a6f8b3462fd962c800511c8d27e400489149a9157db4d7f8a40c148deec9fb337779499e038e54a8bbff3e92cb990eb6d34d78508db86f21f
SSDEEP 768:td8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdOroTkPaUnf:td8iJPNWvx76ru1jahALocdFiaUf
TLSH
T107D2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 2KB
SHA256 213c83a0d75ba8492b002a3db294f36b9b9247db549ef9976e78d364a006d865
MD5 a22b1c90ec82d31097c86bdca85bfb9a
SHA1 710d5535d8d5b54054b7e66439b66fd40598526a
SHA512 1b3aad97dac3d3b13e1196e90890858cc34a8e862490452dc2024861d03b1f7ff168c27131032f0b26227d087aee5ee84545389af61abfc76ee0744bd146cf5c
TLSH
T12251DA8E8CCA1ADBDC3C217368B718C0373524DD16848B27A9AC6534BCC322D7D1A658
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 5d72ae8e036f76c22f6d05410bfaccb454ce6cb91a35ed7d51a024245f72598d
MD5 a118a40fef36eed294be5cbddc19675b
SHA1 425f47ae6fa9be8c8f388f8d55979c0ff8e213fd
SHA512 c1f1b0bc518358563de09457ac25f5e84955ac1a31887c46856392977980c2502d780396015f54fb29cb3ce97d9717b47102979fa9f7f470615f5530b8822f22
TLSH
T1E33133494EA1CEAFECB04572167268A4737184DC1255B723583C31316E2775A2A479EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587a4c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe587a4c.TMP
Size 1KB
SHA256 2e55d21298e0c1c5cd9e19edda30e7e008f80755e7b22202df0a1a2a3d0ddff8
MD5 8255e430ca2126d047464ee61f43d0ae
SHA1 85f30100a7bd540ac3266d184c3694be7911b6ca
SHA512 312e44a163ddf604940f2606a009ee30c1002e6299f0cf2154a85078b9dd08aa804aea853a2025c61c3bdbbe07a908cdeaa6f70162125e60d589e6bfd1ede503
TLSH
T15A31124A4A91895FE8C4507B1E62E8B8733598404311B793947C62799D25B8E1A5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3e747ad7779f2413963c2b82b6b5b60451f6a103cf7b897158fe6ef14335eb77
MD5 61003aa2400b5d46776de5d06a0af757
SHA1 a49091e76e025f90878612d3e5686c98caa08cf5
SHA512 30e7722069544a583bb1192d7ee280837936709f88129b7d92c13c2e6836ff2027cf4028e9a0a903c94ae0b579ea166b24e022b4c66671885a7553c5235c9889
TLSH
T19DE0C0F72EF72840FEBF63E1197098A00285B45AD544BC9F541AEB9324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f6a060404ede41311ec443bb7892222f3d2c4bced17f10a2562f2bc9aa74f943
MD5 c5450d6aefce5d440564fb2ba437739a
SHA1 6da6b41c27899e81e6b25a668d6ca0be82570c70
SHA512 6d4ae9102293cc15f5ed8ae2202559e6a9bcf58911d3161d6bad675bc92aabeaad91ff73eea071dedc067e9e21ae52ecc8a0e88a862e156cde5f0751109fa8c1
TLSH
T1CBA0022FCA548881C0110AF0F061158572E58C9C470D33B9C0BC0454C87C35145B2364
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58d210.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58d210.TMP
Size 48B
SHA256 95ec37fb122cb85ed6eececc610676cd04e8bfdfc9d93959eafb1aee7b8141f0
MD5 a37e2ad1ad5ff882012022a312e28953
SHA1 c4365d946b5943595566b9139b2ec4cf0d50d832
SHA512 85d2cd588e9745324b8968dc1bdcec8d5d6204f0fc3a3829398a97fbaef9656eb2b3e5ee1be99057a1dba8ee84b107e7ee2c5d8a4490c7f03b33fac850fef35d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 62b69687494e1760d997f5152a25340a17a35ddc7be94e80ee07cc38dad5feac
MD5 1da94fbd97838a84d53378d9ced075de
SHA1 3b982f87110f41f903622d306227101522c75890
SHA512 6cdd65d16082ad49f1ec69e284d3233f8257ddeb9880d57971274c1f8f7e691d9817c6c3d2a5428dc69c6d038e884f02a048823ed26f148088015a4e0ef5002c
SSDEEP 96:KAT6KAwieDqKcMMa7OaAgwCmIxxUqCKcnUsC4KipUar2z:0BxXa7OaAgwdIxKqCnUsBKipUarG
TLSH
T115914201727B53462C3E290CA2A59B5B8783B1B33064A47B7BF910714F66E650CBEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dd65804-ecce-4693-980f-337079c57644.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8dd65804-ecce-4693-980f-337079c57644.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 15ea6a0493ca1138e9723e60adbe24de12e5259fc7d6b84d24b8cd2f90647633
MD5 2a2809f5f15c4643a75f5086f8865688
SHA1 5859fa92878ed898fedf75fca29a265f416591fb
SHA512 80c463b441aa44fa502e8bb49a4a354414d5a9570158fb6332e8832f14a57c8190bc518bf33770b8dd8773aec02112fd78bbfd52da4572d5c3ebb2ebec62c45d
SSDEEP 384:btNn/s3n9SfsNIyZU72ck0JJr1sIOObjI9G6w7WY:bj+9UYGhKI29Ml
TLSH
T14892AE315828ADB78D938969F5873A1B9FB0417BD3C82F84DAEDAB0C06CB59C4312919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6f2974156e96d0806a931a457ab11a9c43bc05848d3e09ee07a8947f12db5a8d
MD5 946b3bdede4c7f16df1a6a5832a761bd
SHA1 1c54e44e92cbb305d1c429ebce543fb55e0e2b9a
SHA512 ecf674d6ac8703fd12f84b334f4185f45a8e7691fde59c13ab7960dc9d5c21e12da16e0971102734f4b2f811ef1090fa86d84a3d937195244ec9d6161238c4a7
SSDEEP 384:MtNn/s3n9S0sNIJT7UBot2k0JJr1sIOObjI9G6w7WY:Mj+9PLtYhKI29Ml
TLSH
T17992AE316828AD778DA38869F587365B9FF0417BD3C81F84DAEDAF0D02CB59C431291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1d4e5ded9ed5ba8dd7f844588afbb0dac2c660246812223bc301e866589acc4b
MD5 1f5350eef58c9fd3f41f2d09a86d204b
SHA1 4849726387b780dc58ce05a6a9658dfa1922d6e0
SHA512 c66b42edab8e621f38beafa15d63d9cb7dd937945051d7855ab67bee4a28190d0a4d5d382e12b968481c3e407c2f993e84df9eff7c08551a57292b421da04cea
SSDEEP 384:2iFKtNn/s3n9SQQsN48TUNTUlIlJT7U86t2k0JJr1vIOObjI9G6w7WY:dFKj+98lwg4tYh5I29Ml
TLSH
T1FBA27B334858997BADA38E99F94A36179EB041BBC6C96E94E7DCAF0D02D709C4302D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6a63ec7231bd7a33b845546c0dcd624577bfb21083239e01647a3e9b494b27fc
MD5 43cf05725d347bd8772f9217edc41bed
SHA1 67cdbaf5bce6dd4218eec1d15bdacb23ec703609
SHA512 a19373465744722effa4881214ab597373d879411ff5cf6a2b70968f5a5324bbfae1c17ff1e80127e21ad5202e3f0cac7b3acbc1156906413dd70077d05c580c
SSDEEP 384:PtNn/s3n9SfsNINT7UBot2k0JJr1sIOObjI9G6w7WY:Pj+9UvtYhKI29Ml
TLSH
T1A892AE315828AD778D938969F5873A1B9FF0417BD3C81F84DAEDAF0D02DB59C4312919
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3b3db3265321f48d8f4b93b9aae17f7b46a7339240d3ebefda3a9fe8f5b67862
MD5 08897532619d4dff2293ece5c84cc1f4
SHA1 368b719ffe11a4ebcff2f044bb435536ec45e5c2
SHA512 29a30874cb9cb9a26577a1518fc1baee3e14bfae4b7b76a828e21c21c5b050fff8400e02d12ec5e4f62b46b46112fe37dd14758bef2c5bf560fa085d5584bd42
SSDEEP 96:ZqONkiQsjpfmUTmDK5ih/cIPURHl8h4otop5b5D3BhPwivh50xy0SFYKQAxaY6gV:gON26kDfQmiUy9xZ903LPQisFU6
TLSH
T16E02E7396C786CBB9EE36E09F58677275FA5113BEA952F81DAE81A1C00D764C1302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0bc3a8769d816887c7096b5577295f06829122af4c68237e67a124a9e1237dc4
MD5 26997da80c493e7293579ef7efef01c4
SHA1 8c8e3fb50b880d3bafc6c13b524414e97eab1509
SHA512 dda2f0a0d965a3073b9c1bb7b970c428f5440c3735a8dcdbdf8b66e83d8e7df90dcfc1a9e299f5f43fd00bfa6169021ef2bbf24388cd686b4991c71b57167867
SSDEEP 192:pONh6kZQmiUyIxM903Lx1eYMSJr1WcRQiqxU6:pONh6GhM90JJr1jIU6
TLSH
T1A1122A316878BC7B9DE3A855F48732235EA54127EBC96F91DAEC2B1C01DB59C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 19317e967f31626ff2a8c160ed503d601aa0ecf1e8e90b7242b705ce630e483b
MD5 8200f82335e6fd7d1658bf5d0627a243
SHA1 4ff27444407e932c8a614fb642f7721bbe0a8dfd
SHA512 5d2bee25ba8f16fe16e8abaaa06b569c4beee6029cf31ea0ed8bdb38c26e0a8519d0689d1e804264c9791461500a9f79381f8cf8929bc1754aeb30ec785c6d66
SSDEEP 384:2iFXtNn/s3n9SQAsN48TUNTUlIlJT7U86t2k0JJr1mIOObjI9G6w7WY:dFXj+9Mlwg4tYhUI29Ml
TLSH
T12DA27B334858D97BADA38EA8F54A36179EB041BBC6C96E94E7DCAF0C02D709C0302D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9eca8ea9-585f-47e0-a46b-75346a11ad12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9eca8ea9-585f-47e0-a46b-75346a11ad12.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 76b10d3e4de6faeaaa52e35330d3510ca34389d56d4080543cb1c28e40def5a2
MD5 b38f3e72913ccd799960119b577a29a1
SHA1 84a23af88c08261d10808d82249345042713313a
SHA512 87846d0778de6f08c3604464877e95d1db8fa0104ff41c1bf26a02ab7c9526d06c54afdc545b0027995e8a371a635b9bec0b58b256b9f29d53a92c28eee6fe8c
TLSH
T1E6413758BAEA1148B3B76E56AFF6A85D44BFB8772E06C45D10110D8F0A63E00CDA2733
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download