hxxps://lnk[.]sk/deirs

Resubmissions

23/07/2026, 14:12

260723-rjckfayvcx10

23/07/2026, 14:06

260723-res2maytfs10

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/07/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lnk.sk/deirs
Sample260723-res2maytfs

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 5 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	ipapi.co
55	ipapi.co
58	ipapi.co
183	ipapi.co
189	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292892175517678"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{E5D8C052-D55C-4BDE-832F-B04F648C6C01}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2060	msedge.exe
2060	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 5044	5092	msedge.exe	85
PID 5092 wrote to memory of 2204	5092	msedge.exe	87
PID 5092 wrote to memory of 1736	5092	msedge.exe	88
PID 5092 wrote to memory of 1736	5092	msedge.exe	88
PID 5092 wrote to memory of 1736	5092	msedge.exe	88
PID 5092 wrote to memory of 1528	5092	msedge.exe	89
PID 5092 wrote to memory of 1528	5092	msedge.exe	89
PID 5092 wrote to memory of 2588	5092	msedge.exe	90
PID 5092 wrote to memory of 2588	5092	msedge.exe	90
PID 5092 wrote to memory of 2588	5092	msedge.exe	90
PID 5092 wrote to memory of 3556	5092	msedge.exe	91
PID 5092 wrote to memory of 3556	5092	msedge.exe	91
PID 5092 wrote to memory of 3556	5092	msedge.exe	91
PID 5092 wrote to memory of 2696	5092	msedge.exe	92
PID 5092 wrote to memory of 4040	5092	msedge.exe	93
PID 5092 wrote to memory of 2696	5092	msedge.exe	92
PID 5092 wrote to memory of 2696	5092	msedge.exe	92
PID 5092 wrote to memory of 4040	5092	msedge.exe	93
PID 5092 wrote to memory of 4040	5092	msedge.exe	93
PID 5092 wrote to memory of 4752	5092	msedge.exe	96
PID 5092 wrote to memory of 2364	5092	msedge.exe	97
PID 5092 wrote to memory of 2364	5092	msedge.exe	97
PID 5092 wrote to memory of 4752	5092	msedge.exe	96
PID 5092 wrote to memory of 3448	5092	msedge.exe	99
PID 5092 wrote to memory of 4812	5092	msedge.exe	102
PID 5092 wrote to memory of 4812	5092	msedge.exe	102
PID 5092 wrote to memory of 4812	5092	msedge.exe	102
PID 5092 wrote to memory of 2104	5092	msedge.exe	103
PID 5092 wrote to memory of 2104	5092	msedge.exe	103
PID 5092 wrote to memory of 2104	5092	msedge.exe	103
PID 5092 wrote to memory of 4808	5092	msedge.exe	104
PID 5092 wrote to memory of 4808	5092	msedge.exe	104
PID 5092 wrote to memory of 4808	5092	msedge.exe	104
PID 5092 wrote to memory of 400	5092	msedge.exe	107
PID 5092 wrote to memory of 4032	5092	msedge.exe	108
PID 5092 wrote to memory of 4704	5092	msedge.exe	109
PID 5092 wrote to memory of 3576	5092	msedge.exe	114
PID 5092 wrote to memory of 3576	5092	msedge.exe	114
PID 5092 wrote to memory of 3576	5092	msedge.exe	114
PID 5092 wrote to memory of 2024	5092	msedge.exe	115
PID 5092 wrote to memory of 2024	5092	msedge.exe	115
PID 5092 wrote to memory of 2132	5092	msedge.exe	117
PID 5092 wrote to memory of 2132	5092	msedge.exe	117
PID 5092 wrote to memory of 2304	5092	msedge.exe	120
PID 5092 wrote to memory of 2304	5092	msedge.exe	120
PID 5092 wrote to memory of 2304	5092	msedge.exe	120
PID 5092 wrote to memory of 4884	5092	msedge.exe	121
PID 5092 wrote to memory of 4884	5092	msedge.exe	121
PID 5092 wrote to memory of 4884	5092	msedge.exe	121
PID 5092 wrote to memory of 3816	5092	msedge.exe	122
PID 5092 wrote to memory of 3816	5092	msedge.exe	122
PID 5092 wrote to memory of 2060	5092	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lnk.sk/deirs
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,13722761881433905011,17631312210817444100,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,11324517970558567885,16437153422514237985,262144 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,18256659392218402775,4101360733524253840,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16059953985279661561,16516475619762978166,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13453250250187814871,9956495228171660515,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,5523376060505712496,17221388441525209502,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,8544739993812166128,11125060195820559841,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8995423889623472173,1797521540976412882,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,16827188762300995203,17776113967198379055,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7956671560498788197,7114804939168503784,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,7956671560498788197,7114804939168503784,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4312,i,2193184788002047249,1398873421971007118,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3560,i,10792860092341045936,8270780827585862399,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=3756 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3596,i,13712833621572390465,342717329348822206,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4360,i,9057673224394683769,17012114905547371611,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,9425125661166306015,14973559017519272269,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,12101243150566873206,8446656757487026063,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5196,i,13337439543923361703,6677985182035001506,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,9797962404682392461,17426877098971794262,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6648,i,7562647200045101425,17960702284553278947,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5848,i,15042044740475716239,5416610951698532515,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6748,i,12462187492595660781,8131429654241542265,2097152 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6920,i,12172465030217429411,14168142866931671226,524288 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4476,i,3659355108888660556,13952513659607631979,262144 --field-trial-handle=2380,i,6394325045544210676,8377349266946236544,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:64

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 67KB
SHA256 6f79744cd3934804fe4c40c4a5d51f1018cea9a94e0ce66f4c4c8783512c5631
MD5 a9f9cc2bfdb6d4578c41556d9634ac00
SHA1 faec8a0119f68be4e25d2e75f72a50b4c442d085
SHA512 7a4b06bc5c74ff0b12af4edb0a511963c7699984a26a45f0e05d0e55059b6ed2e36d3e807e7fcc69e68c2cd4ac84bb3ae681db55a32b5efd3c302ac39f6c0920
SSDEEP 1536:dty2xyfovJfeh0UTLWjze1bkR3M1kWIybeEMnL8nj9SIn:XBdeh0EL6KpkoKjoj
TLSH
T1646302E4F15821687428DBB845DAFE65B1FE33DD15E8B37088AB518C832CC6468FA3D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 402KB
SHA256 3d0d776bd9eb1097fa4a7fbeb2db8bd6b66554ae77aa5e0d80e145cca4197843
MD5 9542d5218d6a9ff7ee879823e3e580fa
SHA1 39189db04e3092c0bdd0152c1819d5c951a1e5ff
SHA512 9b8e7923bba99a23c8c4747c01c6b30a079370b925bc366307c9c05521302879fb094856ebb2be382c8c1630b80552c6c758d5d27fbf9b3db54a7a0a86b7811f
SSDEEP 12288:ebU0joFhGZCSYY37peP74oD8Hvt3w3ded:eLMY37pu7z85c0
TLSH
T12D942373CB19A4DB9182C6CCF3585BDD8C7E8902D9498F9DCE0B1EF79D8521B1A83858
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 346a8d709c0c627bb149a6924b7d2104d19db9e69d0a060167d4fccc6439d6df
MD5 e6fa1d020b12d824d40f18125be976bc
SHA1 6fac05a6bc0e4da5751ff680d12c8cf7383ac2fd
SHA512 14886b539d2af600fb978d6fdf75aa679c2be05d0e1a72b28acaed4a9e3fe378691fd3e711283b977ac6ce7326b523750a83fa72c825bdbc52b5e470bb1c3b4f
TLSH
T177612AE405028993EF2D8DB0D0B11272B471B7B38AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 0835f84abf33821cbf4512925bf61c07f8267b5079a3a2c544b02b71d1c4949d
MD5 1492f412aad54cd4805cb42452ac6626
SHA1 a010c5dc997da9f5a2e2a2daa3471f98733c31ba
SHA512 4f980b1cf890928f64bf3a89b9d1ab9588a1e45b4ead130ef013f7f4b4cf915cf2153d50a81c157f86630491ea70229c773537a70bfc848265378b9a173ea0e1
SSDEEP 96:MCkfa8/jDGelbdYFNOd3GKIqNbthLvI6/HaycGNonZQpM/g3iV:Sb2elb6E3SqNbtO6faQOUM/g3y
TLSH
T180C12CA801965B5BEF5D8C79C0B12B29B862BAB799C61BDE9001267FE4DF3D10C33315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58a350.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a350.TMP
Size 3KB
SHA256 7fe880ed60309cefd0e0ec1035e14f61a972f4ef72a2e7cc68f6dc5ef572394e
MD5 28979a668bbfd450cbfc044e4870e500
SHA1 0580a92fabc4b4eceb1122afaf9d08eca31fb905
SHA512 f1d8247b21bc8390477c4371ac3333da21112e746ab32cc0f56fbbea8464472b9328f322112e41f0abfb783a2ce2367ae47fe7d156632c43187ccf184f4cb8ff
TLSH
T17B612BE405068993EF2D8DB0D0B61272B471B7B78ACB0FCD01941BBFE69A72A4D57718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 bab92f047314cc3585243eeaff09008b3cd8703cbe7995dbd959b880d66a9dab
MD5 1cea4b41a260a185d8507941e1149d75
SHA1 ed51493eda75f54aec79ba06d987578f90567000
SHA512 b889a0110343b7a0c3ba86a886af64240b1657636c897461a2b36dccf38d6f08799004dd35e3822f91b60f81a3bd6203751085ca9c61ff3b33e9897812907eb1
TLSH
T14C416BFB83B1856D8A1192F0AE15AF1F8E5D0512435C7D7989D4AF1793F38B1E10168F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 36eb01979d109c5c1423e904812ca145631f965a6ab2946f5ed4a20f80e81bfa
MD5 a3b3d7a6d2a4eae95cbac8b9ca2dc3f8
SHA1 51ed61d39565e83baf430ea4a843dd999a56ae3d
SHA512 55297be0deb5d5611046daa2c9c41d4f2a9351f38b1cd9240210eb7f4d90ed5fb28cf1c2b2865d1184f4b5984a27ddeb87712d7fee8c0413b7ad68b4037107e1
SSDEEP 96:DZOGwvnXdLJzBNDgGc5H9QtRAc/twBjKUBHhW:DcGwvnXdLJ1NDgGc5atqc/tkjKwHhW
TLSH
T14391ABF7C3E5852DC91191F0AA14AF1BCE1D0452836C3D6989E4AF1BA3F28B1E151B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 266610d574a2cb43b3d98fc8660e6133bbbc9cf2bf0cbcb6e2441ba6d5f191c7
MD5 3ff7ebf1e7d849678dbf45b5da17c00d
SHA1 54e29a84328b9039250f78348acbffbd6e656de4
SHA512 8a21a254964d5fcaf55c4e2b081e12fa3922aae02080c4774dc362887e09b6c4fe00bb1a7a785379cf8018a8c7250785f0241bf02ace6079d1d7392ef30fc616
SSDEEP 192:sxZCROyM/jK1Ml8Mkk/fIsbK2gsIdpJHW6+WNGYLlylitIgrJ:sxZCEMk/fIsbK2yJHbGi9
TLSH
T1FA42D7156A349977CCCBD209FA55BF53D6F91473A2901E44A9FCCA0C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 d96dc5be432dc3d28dd7bf9bb78bf5da4e78417771432a1fefa881c9127e4b9b
MD5 bdc89f3431da51702b20c2e8ca8daca0
SHA1 02959381f75a510c43ef3ae83e36528d577acf59
SHA512 e29c9f768e348b1e5cca4ce50ae505d107106b5c84f9c7395893c4bb8863339bc826974e1fdc65de4dd944e671f065b0508fcd1afea4c6c8537da36b27909326
SSDEEP 192:sxZ9QUn7FROyM/jK1Ml8UQ3kk/fIsFK4vI8Kb3hddp4Q3rHW6+WNrINK6aAdYLiZ:sxZVnZ0q0k/fIsFK4w8O7/HbTodzx0st
TLSH
T1C482E91665208877DCDBD619F925BF53E6F90463DA504E48A9FCCA0C04EABED2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 b9a36c035b584920b24c594c22c159f031d3e0edd11c716342f1f9a483fa9e3e
MD5 e568a57d442bdbe7a12d574ada67cea9
SHA1 061bbe84d1d68154d7a3011a206d7a5b40423416
SHA512 d0982d8114f9f9d4f6ecbe24b1a1c1de3ef66a511987761ac6566000f1282a6c89b887282cc01a598754544b07c027ae598be5553d2960b2e2d08fc07d0f01e6
SSDEEP 192:sxZ9QUn7FROyM/jK1Ml8Mkk/fIsFK4vI8Kb3hddp4Q3rHW6+WNrINK6aAdYLiBIm:sxZVnZ0Mk/fIsFK4w8O7/HbTodzx0st
TLSH
T1C482E81665204877DCDBD619F925BF53D6F90463DA504E48A9FCCA0C04EABED2316C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 8845e0fe9d74074f1c13927320c63b6d733cc9bba104403a878c3b7ac13c0ddf
MD5 0279aea1feb838207be3a69f46355dc8
SHA1 78486107b2144f5e211dfc309bb94b1d48f1bc43
SHA512 ddcbe58fd6bf809ed24db7d533225cb993df9134a37743d7def73fdf46d794df1d0d13f7a8df950f9191c843f803a703097a699ce8e5d61c3405a0049c25cda0
SSDEEP 192:sxZ9QUn7qROyM/jK1Ml8MWOk/fIsFK4vN8Kb3vdp4QXrHW6+WNBNK6omXYLlBIir:sxZVn+0uOk/fIsFK418OLfHbiIXyx0st
TLSH
T15782E816652089779CDBD518F925BF53E6F90463DA504E4CA9FCCA0C04EABED2316C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 88c489d86420009ed46ee32f904a59f3dc6792d590e2da302e7bf28060a40522
MD5 809af73a2118422b493c87e0abc7746e
SHA1 eb370498dfdde61f9f9299e1ffeb0dc9083e3e3e
SHA512 566f8ae2a1690cc3951afac07632589dc53bac401e0ea302cb4ba3ab927ab59fbfbab4ad27257811d8e17142610d9a3e2865d6a5fc27674f64349fbdab64c303
SSDEEP 192:sxZCROyM/jK1Ml8Mkk/fIsFK4vRIdpaXrHW6+WN51L/YL62litIg5YJ:sxZC0Mk/fIsFK4iAHbz/Jy
TLSH
T17152B6166A349977CCDBD209F945BF53E6F5046292901E84AAFCCB0C04E6BED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ef1b6e855ed67ccb1226ad815efae5738ba08bbfef0a25cce849fed7e1cfbd15
MD5 076a3645091df04214f4a01d52feb8df
SHA1 f8b874b794b16cc610ec96cc1796635a6364fddf
SHA512 59bc85346e04b8d22d66fcb2aaf8a6213fcc5a22fb327ec444dee39a98fc415bff6d878e6a1bd44e8bb1f545a2e3ca756bfae504134df8bb4a6f131a4f98140b
SSDEEP 768:vvs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNAroEJ:vvs6pD1WvxzWju1jahILIsNLEJ
TLSH
T16FD2FA3B680CC77E4F841E5CEC2AAF967DD801CBAB98899447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 2KB
SHA256 08419f97119f26502ed7318cae912c6001eca56a0e8c791036ecd2bf92943f9f
MD5 3b286d51f398db6a6c5bbea899b1006b
SHA1 9aa94d47601d9ef04d012fc6c9b4a6e625dab0db
SHA512 f94db67ba67b5ae531e2313affea80bcb874fc115ac0e14d0ea15698532d470c5e451dcb882d11f4aab5a8076b710d18bfd711c820afba6acdd098ed22107618
TLSH
T19251B74E4D4B7F66CD6C10B228FB1C82373938FE4AC85B07A59CA974A8C33256D69619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index
Size 1KB
SHA256 cb24f41a511adcb76417e8fb921d4266b0186a69115a1bf86f99687483c1f33a
MD5 5a5572db1dfb49847920432f7e3e3c43
SHA1 cf8adab10df0160b7bc774f392259604bde8c790
SHA512 ab9ce260ae9be322147bd22b8b314572c51a64b0ed683e1de6863c5ad4ebc2ce8df647d40b04ef92bd13de8667ecc4af38e847bdcbd3b4da48f6cb18ae3fc613
TLSH
T1D23111899EA1C99FE5A480B21176A5A47270D8CD4A26A7135C2C31317E273192D475DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5941a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5941a3.TMP
Size 1KB
SHA256 0b3f0c3c3ad29d5ee4f16f719fddda51de4d302a9a0d9ff2c6df1a17aadccd86
MD5 13367f39e203246a7fd8034a8f98d35d
SHA1 ba354e0db05c1dc29ff511d5de725bc976ccf206
SHA512 f481ba5c79c445520dab99442900c0cfe67aa60fc04344bd18eaab12af0d10492bf02cf022867ac6d97b84ee84e533d78849aa3c8a0a7e23dc27c12ad0c4a1f8
TLSH
T1EE31424A4AC18D1AF8C8507B0A63A4B8B33588408321B793987C62399D31B8E1E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 286f79f4e4f9344b041cc40a163ac7257ece75613788829ad865a6beba9ac8c0
MD5 392ba2089ad8b5a51749b1299664fa81
SHA1 8aa41e4b695b6abdbb6903366e3484255f1a2422
SHA512 85199880ee91d92f54825c606c6a44f470cc1548a6b57e9549328a89d6780d839b5d19f42a1dcc8315d94695ab9e67d2cdecd342a61a55cfc1b6e03e4f4ac158
TLSH
T1ADA0025442C00503C08667B135DF06617320C913E306130552E52248C9705758D5304C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c575eb0c-4021-4370-8d95-03811b891285\index-dir\the-real-index
Size 72B
SHA256 1939415641a4362b3adf7619f8fcc7f30120dee51eb9f77db0a2a018959b7cd6
MD5 c3029ef73f5cc291280dc09b979323cb
SHA1 f21c2aa0a75313dc376e6ee571e9f3eb781ea8f5
SHA512 c2a14fc086b5a1df58d4039d33aa2740f669fd2829e744b0f6bfa6ca1031c000d28da68dc9c566f61afa6f13f1ad46af89c3de0354eccb9c1d9fc0945803fc03
TLSH
T1D3A0045017C30C55C15311F5555307417304CC301100D30FC0D103CCDC715734DC114C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 26d2155469649106da241ea250554658c49feac69dd8d142f4de0725a7f1bbb1
MD5 6a975387e42dbbb1cc36d33d1b85c744
SHA1 0e665dbf78b70a5fcc54b207f34850c17bb61344
SHA512 373cf94225b6adb66fadb0abb1e86cc41d341e993f3484681d33df08199d05e947484475b4fefee71f99ee48ee324dab57466e7e88823ee2ff5557467de4c32b
TLSH
T139E0D8BB6EA76820ED6BE3E7247094750541385C8805FC4F586A96C350B13557856C65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 115208efb1b2bacc1ff8f7d0294d7bbc5a0d8f5f628682d1bd7eed6bf654fe2b
MD5 cf5c2f6ac9d7b99e51647ed8839efabe
SHA1 872e05709c8970f25a68fd20cce66f74209c0535
SHA512 ffebccaa42b30fb3544f05f30f24fedd4b3ef458349ceaa9802c7a6089f82d4138f3c8a661c533588c4174ed1cc2e39968b4ef38aab1a8f46b3a784b0f2aa338
TLSH
T1E1A00221D9D48143C6141374A0A19A9672158CF84A062335D1EC045488691848A93605
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5997f1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5997f1.TMP
Size 48B
SHA256 39ddd5769e5a88d0626b63f9d7b2bb2827d6b1fd890b2e10497c5f468e3e776c
MD5 cb3bab563006146255e97fbabce48ad3
SHA1 1f6d2812a2a64277f76490ee70d9d6e31a9d57b1
SHA512 4cb606fce32ef2edb24e56a55ccd51f2c8b00ce5c059f90aa7ad5f0a08810fcec42ef4be4990b7d5a7afc8553431e5eea494dfa9f401eb0fcae95fe0fb8db001
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 de71f443282b0e99fa456505a9dab681dedd0751d4722775c888ba505e18ed5c
MD5 b45fdcb1d3911e639cbbed37fdbd1f1f
SHA1 366ccc00c8ba0e6a3439cdaf11aee4f31d114781
SHA512 c2c4744eeb7fb2a22aa3a6336df51500a4d12c0d2c00a8439fd4640b818b1977951885b7e490ee28ba10726f23957b030742de5b59269fa329487040306f3a1e
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZiO:iihRJ67g86wQvcpgE24zaBiqREQSnN
TLSH
T1EBD1031672BA12023C7E2A4C93D497678AC272537054A42B3BAD04B6CD67E21CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593e76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593e76.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 7a77c29460a2926cee65ce7e67f311191f1c7bed045869d115a6bbdf499865e2
MD5 8b952d78109fa4d90220d6989bc2de60
SHA1 59c0f235e8ad5ff4f67d0481e7853e0311151efb
SHA512 e9180c10ca5d44d653bbaaf0d2cde170e344eb290dacc01550a011f09013cdee20f5efbd19d6bc17dd905dddf470fd5e56c9d9f1d8c975e21969c5ba35294a81
SSDEEP 192:uRLsNpXu2Q2S7+3vAtQmiU1N8/jB4atb0gO2VogHF0SJrNmLMZ5qqI1I:6sNZHR+mjua9xO7glzJrNZUI
TLSH
T15242283A68288C7359E79185F64B36239FB9406BDA852F80D1ED5F0C02DF6AC134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c1e48553d0818b4172e3c0c809e0acba39b60bcd43e230b4eed531cb3078aa21
MD5 0fc52ca196da88b0b5984905f1f54f9d
SHA1 f8b9f9205868752b96f93e2c1bf9b0ebb10a0350
SHA512 2c425907a82614c547f9c3a5e688ffe71fe6f67f039b772b4d74c169ab2adaeb55326ce417c491eb53cd65d463ab7a59495af8ddddf0ef4cd0f3f5df653addfa
SSDEEP 192:uem+xasuheOwQxMGsNpXGQ2S7+3vAtQmiU1N8/jB4atb0gO2VogHF0SJrNmLMZ5X:MZcIhsNZGR+mjua9xO7glzJrNZUw
TLSH
T136726C3668389C7759F7A145F58A36278FB88027E7D52F80D1ED9F0D01EB6A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fad4f417c814ac43a122b223b58c9bdcb97e20c16f4258ab74216bab6103453e
MD5 efcffb6c62126468ea906cee0c500b5f
SHA1 448b0022220de39a28118a1af6992e68c1901240
SHA512 4d7af18b4e16f048bf5477e7f07caded4d67b26b4aa6c008961ffbc46318db65e64b13e07e5e3bbe898e62751fafb1f951f68fb7a0bad12341fbc81bec16981b
SSDEEP 192:qONx6O7+3hQmiUyN31Gttb0gO2VoIgGZBmU6:qONx61EGt9xO7+ZYU6
TLSH
T12602D7396D686CB75EF29D45F98B37239FA9103BE9912F40D6E81F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ccfc0bc1b62fb99893ca654992919d42ac3e57eb3fb043833517f7ac2edbf876
MD5 f7ece803c2579733f829bd025e86a165
SHA1 8b2afb48762f35b37b99af158cf597a6bec821d5
SHA512 e08d725166a91e9179459a1c082e010d02e08e92fd71a896b51081a7ef13839540e86731c546bdaea834e39e38ae4dd934c95bb2e938a5daabb1ccb236738047
SSDEEP 384:QiFiZcIazsN78TUNTUlIlETd/RljP2a9xO7glzJrcZUw:rFQy2wgor3DO7g9hcZUw
TLSH
T115B2E6F658D78836E9AE9743E77D2D138EBDC067F5916A40B3984A0CCD962BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc46cb81e9259b2396b2b8070122716a5210e4c3f62ade44c60013c90a5987d2
MD5 d4fc312e71ab87e4ea7c912e9dd1e1cb
SHA1 fa8d18e459386585516a2a647aa01f807c869256
SHA512 f446a88eb36f9700b326429a35ca2e920d837e1e45a65d8d16265b6c12f2a24d13c36112c0393249be683fff798e9b7eedbc708b42c3ba5cbb18834b48ce0e20
SSDEEP 192:PONdW6O7+3nQmiUyNR12ttb0gO2VogHF0SJrN5cNZ5qqI1U6:PONE6bM2t9xO7glzJrMZUU6
TLSH
T152120A3578689C775DE2A545F98736178FA9412BEA862F80D1EC1E0C01EF6AC234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b0bd363ef8d53c0ab5f274c92d4f7e7c6a1f90404191ae0009da54278c805ab3
MD5 55e94798e14d9b040270cc709b740cb4
SHA1 299e533eb89da3f692c432251b2a80ff40324970
SHA512 847ba10c24d461f3c55b198982dda04fcae5f959c47e381071c9b819ebf52bf169c78bf9f3a8832929e188274028c1ad009fcf560ff3bdc997902762729461e6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe598ee8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe598ee8.TMP
Size 392B
SHA256 d49805e8037d39af1534fd5c19c7e9625b2106831c786d0608fc8d942600f56b
MD5 831b6320ad3983f2316047a5c8eb069c
SHA1 fdb12f0eb4b73d3afe061430c8215d632324a17c
SHA512 040750832adfe3497f72e29692634e876719ccd408e4a44674633915a4b40b4608ae54754dd8e64bfaa405abaaf432b071feb93a41e69bf6b0998a191ff2265b
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 81dc92088968b6c4b4ab96c505fb3e07410ca809e149d7915697ff764d2100f3
MD5 4bbf5a11a40cbdd04e4eb645dad1e51d
SHA1 6c9f8fde49c7541e521b8039d91ecae814286f18
SHA512 1b0c939913fcd959367e3aec467d32714f9eb0f0ef3936ac56e4f29c1d534da405f330062b240997b08dad408ab8bf0c8c5f7ee05b4c5587c15c568d6c29da6b
TLSH
T19D411898B6FA1108B3B76F5A9BF6A46E487BBD732E06D55D00110D4F0663B01C9B2733
MD5 SHA1 SHA512 TLSH

Submit Download