hxxps://storage[.]googleapis[.]com/rhl3ats1udq4yue1e/all-parcels[.]html#fp227pw9hjc03[.]cs?customer_id=gh853am2fca1c-sl410xchlwa3e-fp227pw9hjc03

Analysis

user interaction
yes
max time kernel
125s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/07/2026, 01:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.googleapis.com/rhl3ats1udq4yue1e/all-parcels.html#fp227pw9hjc03.cs?customer_id=gh853am2fca1c-sl410xchlwa3e-fp227pw9hjc03
Sample260724-b63r5seq9s

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: 758681729565rc7fgq07icj8c9dm2gi34a4cckv235v1@developer.gserviceaccount.com
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4472	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134293311850015116"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{B9F67456-EF92-4EFA-AE07-A2393DCD1647}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4780	1680	msedge.exe	84
PID 1680 wrote to memory of 4472	1680	msedge.exe	86
PID 1680 wrote to memory of 2056	1680	msedge.exe	87
PID 1680 wrote to memory of 2056	1680	msedge.exe	87
PID 1680 wrote to memory of 2056	1680	msedge.exe	87
PID 1680 wrote to memory of 1588	1680	msedge.exe	88
PID 1680 wrote to memory of 1588	1680	msedge.exe	88
PID 1680 wrote to memory of 1860	1680	msedge.exe	89
PID 1680 wrote to memory of 556	1680	msedge.exe	90
PID 1680 wrote to memory of 1860	1680	msedge.exe	89
PID 1680 wrote to memory of 1860	1680	msedge.exe	89
PID 1680 wrote to memory of 556	1680	msedge.exe	90
PID 1680 wrote to memory of 556	1680	msedge.exe	90
PID 1680 wrote to memory of 1708	1680	msedge.exe	91
PID 1680 wrote to memory of 1708	1680	msedge.exe	91
PID 1680 wrote to memory of 1708	1680	msedge.exe	91
PID 1680 wrote to memory of 3868	1680	msedge.exe	92
PID 1680 wrote to memory of 3868	1680	msedge.exe	92
PID 1680 wrote to memory of 3868	1680	msedge.exe	92
PID 1680 wrote to memory of 2400	1680	msedge.exe	95
PID 1680 wrote to memory of 2400	1680	msedge.exe	95
PID 1680 wrote to memory of 2400	1680	msedge.exe	95
PID 1680 wrote to memory of 900	1680	msedge.exe	98
PID 1680 wrote to memory of 2680	1680	msedge.exe	99
PID 1680 wrote to memory of 900	1680	msedge.exe	98
PID 1680 wrote to memory of 2680	1680	msedge.exe	99
PID 1680 wrote to memory of 4048	1680	msedge.exe	101
PID 1680 wrote to memory of 2176	1680	msedge.exe	106
PID 1680 wrote to memory of 2176	1680	msedge.exe	106
PID 1680 wrote to memory of 2176	1680	msedge.exe	106
PID 1680 wrote to memory of 3268	1680	msedge.exe	116
PID 1680 wrote to memory of 4688	1680	msedge.exe	117
PID 1680 wrote to memory of 3912	1680	msedge.exe	118
PID 1680 wrote to memory of 3400	1680	msedge.exe	120
PID 1680 wrote to memory of 3400	1680	msedge.exe	120
PID 1680 wrote to memory of 3400	1680	msedge.exe	120
PID 1680 wrote to memory of 5140	1680	msedge.exe	122
PID 1680 wrote to memory of 5140	1680	msedge.exe	122
PID 1680 wrote to memory of 5412	1680	msedge.exe	126
PID 1680 wrote to memory of 5412	1680	msedge.exe	126
PID 1680 wrote to memory of 5412	1680	msedge.exe	126
PID 1680 wrote to memory of 5392	1680	msedge.exe	127
PID 1680 wrote to memory of 5392	1680	msedge.exe	127
PID 1680 wrote to memory of 5392	1680	msedge.exe	127
PID 1680 wrote to memory of 5356	1680	msedge.exe	128
PID 1680 wrote to memory of 5356	1680	msedge.exe	128
PID 1680 wrote to memory of 5356	1680	msedge.exe	128
PID 1680 wrote to memory of 5724	1680	msedge.exe	129
PID 1680 wrote to memory of 5724	1680	msedge.exe	129
PID 1680 wrote to memory of 5724	1680	msedge.exe	129
PID 1680 wrote to memory of 5176	1680	msedge.exe	132
PID 1680 wrote to memory of 5176	1680	msedge.exe	132
PID 1680 wrote to memory of 5176	1680	msedge.exe	132
PID 1680 wrote to memory of 6072	1680	msedge.exe	135
PID 1680 wrote to memory of 6072	1680	msedge.exe	135
PID 1680 wrote to memory of 4672	1680	msedge.exe	136
PID 1680 wrote to memory of 4672	1680	msedge.exe	136
PID 1680 wrote to memory of 5124	1680	msedge.exe	137
PID 1680 wrote to memory of 5124	1680	msedge.exe	137
PID 1680 wrote to memory of 5600	1680	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/rhl3ats1udq4yue1e/all-parcels.html#fp227pw9hjc03.cs?customer_id=gh853am2fca1c-sl410xchlwa3e-fp227pw9hjc03
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffd39b4c188,0x7ffd39b4c194,0x7ffd39b4c1a0
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,6062988517027939864,8201270857783745112,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,16823497737949533344,11043356077756708508,262144 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,14534793054369228835,18141310437002386171,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,895301210561371598,6753583000271698828,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3256786634094899709,12203810728648801295,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4140,i,8445033493190679987,13639131447615613314,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,9218044800257059115,1107492689606120539,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4996,i,10599218738186547800,15346807523117869375,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,6835968045409298395,7333244881777479437,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,1152812368432137642,1038964949831523936,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,9862633684775464118,8311616404998020415,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,9862633684775464118,8311616404998020415,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6184,i,739847702925523238,11265808939345694324,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,597614811683945207,6090557254715885227,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,15190557612140871837,5291065421413158113,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,14727138465180515103,10629905835381243700,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3608,i,8317834513197995301,13678138709257448557,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,16167907173654816956,7513994348758883082,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6636,i,9018565213971814430,2265446032423420879,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6380,i,1127736612043490751,2573857432523861894,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7012,i,1231305180852703839,3187137851396330919,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7152,i,17599592220197285583,10310901153543148723,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7332,i,8725121469694545661,15279462396386843878,2097152 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=7320 /prefetch:1
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7520,i,6988731211672062224,10666739808249980893,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:8
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,114079372433596837,1600762550879306300,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,17481311840052391626,11275424629913754546,524288 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5212,i,3529287349613728881,8194707362189292528,262144 --field-trial-handle=2428,i,14706540648978140823,14305747336814040193,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 ae60ccdcea5a785204aea7fb98f19a4cdd742a055b37632696c3b9d179ab7554
MD5 21c2734617468e3b9370adcb0375c3aa
SHA1 683325666c9663b9c3d151a8a03c3fdbd9b03190
SHA512 9a148788ebc3b928a8ee3c72dc1a559f5d95e091e0fd57ac47f38d59b365467274a1082af268468c29529b0b0441e482ed1871707fbbf9825f8c91a89489bb84
TLSH
T15BF0248D47D9C76ED20065CF8B78434C81D0BB0EEAC8AA1E270C98D87502492F6E7BD5
MD5 SHA1 SHA512 TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 32KB
SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
MD5 cba69340542e691fa9e4b30334a07507
SHA1 4af443e83868d3a18fc9ad853e58eaf39bb065f7
SHA512 4f8d78c0ae8e04e27dfbcef602d3d46cdefd8f01085cc549edd35805d775065c4f78b75da617adf5f8f699a9edf7fa69db7c267917e5f9cb967e59563f905227
SSDEEP 768:wOsAPzChBrMSp8DxHnpmf3ILP1KpbjtXPgYVkutZ:lsArKDqtO8KZtXPgYXtZ
TLSH
T17AE202DF0C15679A01C371AE6A7C6024EBB3E07B3035CA1B1E764CD250B6660E5DB8BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 96KB
SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
MD5 76c1b9685c996f14f4cc8b585ddfb467
SHA1 e774b883f6b5736a9f0f0f05cfed247fdd8bdf6d
SHA512 d67c98951d327ea38ba3e761a229436782094e823847d989ddda919aa4de613bc7c5bb057968856414ecf2f2fe82e823bf3a04691d62ad7b67f7b6c142a807d1
SSDEEP 3072:rYsgcoaeqVBTILAbL7ABGMeTDm0ZSfKaXH:raU6qL7ABGMMmEFkH
TLSH
T1F7A3127B369F8CD14907CC51321A335688F4D0ADE2BA066B3D102E6A3B0B75F7A86F15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 402KB
SHA256 aa6cc85e6422918c8f28615f5a6229fd95551db4866a953e94db3ede85e74157
MD5 1d14a54ebcbc8ab643de128a275df7ac
SHA1 238af131932ae71c9b5904dbf79312969b686d89
SHA512 7c7ebf7520304f1184b033b4d353a4ba4b13f97a9b25e2ec01bf603581e68d961bd62ac512b523203f21d45a3a10aaf570398cb723ed00dde4b27547a1a1bd3f
SSDEEP 6144:+Hixx+mZCMYrU6Em16QfXqI1DRDextUnQngWg/4dHyA6928F6iuHHLlXcJEOXkeA:TpCMbfkz/Hi/eD/2SAq3ELYvXVGF9
TLSH
T1F79423BDB31924CEB2A5E3388E75CF5A050C7E709A980E2FE7EA5445BC5B790704E358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 67KB
SHA256 083e4b904aedf73603201d5b3c7baa27df72db55b3146d3845f0be8dfb9a1fce
MD5 7834c4d0d73c0c39adea3e576be1f3e4
SHA1 d960d84cc5e517feefdc6b23d99ae406847e603d
SHA512 fc336a69e9e3a13adef75e294688845ed03efe4779d901f67285bb91639e9cecca6bbb06f4e45261bec3f8577c4bb8ae803ad9cf70aef085de92b4fd591d1bdd
SSDEEP 1536:uxppd9LrL8qqSlSdwavN8Un5m98oODLLDHocIXhLA1Xbodcwz4RnF:KpL9LreS8TpA8p/wklb29z45F
TLSH
T1DD6301195338F172A5C066C64C330D91B53DFFA636DC63DD490709B5888A8A93FB39A3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c8
Size 373KB
SHA256 00dcd72487112e44ba2487e5eb363a98d65f14344edef5293c8e9dd52850ee58
MD5 ad6388a08d35f6d67db1213404b7f81d
SHA1 55cb415cfa760fb4beda8422d7c635cd4caf1915
SHA512 1b92070f13725fbe34b18dce86e09ee76536ef7dd7190f2c11d54f71b91acdfd40f03c8972a85099b988fae24eaec038be967cbe7b57783340140481b9362248
SSDEEP 6144:qm2dRYZtgXkt4w9410UKjgGHjMaP8RVkqSRhP58OU5R67u4nORWO7lQ8E9:C8tg599lGDBskZP58B67znOwGQ8E9
TLSH
T1A084232C983F6900BB0252741FD6C76E4FF40988A2C0D4C28254A193F9B7EA7F5A7779
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d85d0523cc4ea979c4f8bcd66e1d0eb98eaf32ab4bd2619a081e85076ec7733
MD5 ed99932393784a1a2f729f4dea52d36f
SHA1 3374c6fdc5c34ac3a25e477c3934f8a449b9ca23
SHA512 f6851df73d57793325a940aa934ec7aadb91edd9446da154dd911db63eb5b7ad87c0e4b0b18408843041b88b52997fedb0006c01c2204e8aedeb206b63677f61
TLSH
T14C515B2883720881E37D1571A3E1133EF07E809A3AE7EE1646500EFD691EB36743F149
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 8KB
SHA256 8c9d0e843f6a982eb1aed6b5a9490ae216bc8fbcb7f03ed9e961356e2a40fed7
MD5 abc141f63a8b7c7e9b5ef8b5ff1d156b
SHA1 f3276d571cdb9b93ffef9c4a57f36dc989f0fe94
SHA512 236021d08311a67117a863e8555f5a067b50fdcfe302594cca2b83405f97e2dfcbd748526eecb6111cd01ec132dc171ed86e3bf7b38320f0f5305eeced79e6d9
SSDEEP 192:xDgRPkQ3qAwSntw/RBICGlLkTI8+fkvRY9VC9DqIz:xcR42eYjLkH0kO2ey
TLSH
T1BE12DA10EAED14A2DFEC0C3442D06A6CF5B982B63DD38F13554CA9F9648E7E022FA605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fba1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fba1.TMP
Size 2KB
SHA256 e0cfa0c875c45c142d9a367c9a6eb07fb238f4386232057fe07003d75a10c96e
MD5 9821d73bf8a54a962fa82f873f01ca13
SHA1 cbb66bb2b81be659afb997aea4c040bf89b8aab9
SHA512 4bb0f8300c6adc302a152685affc4d683fc1b1e9223b6f14c9d6dd3b57a40b2675cbfe2334d1ffe590a6477b535d66aeaf592ef39305179896e697fa451ee2e7
TLSH
T104516C2883720881E37C1571A3E1173DF07E809A3AE7EE1646900DFD691EB36783F159
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 e5f75c74df6bcbd209514e0006724bd11add400647b1ccabbe1c1c0058605e63
MD5 5a674e2f9b70492d5a96adb6e97336a2
SHA1 39614395dfa223e7b7c3b7ee68baae194c6e693d
SHA512 83f3e334a91f1a2e0f93688577f02d198dd32a5d36d20c3e2c027b59f5c5ee9a56c470c587f28cad4f70bc1bbb75a98b13ba3bd7dd22ff297bb488c60dcb2a70
SSDEEP 192:DvUDHT93OZoalKNXE/gXeqHS4GE2jp3fX7xXhViBctGKWmc57KtAG/A68:DMDHT93OZoalKNXE/gXeqHS4GE2jp3fY
TLSH
T19A22ADF3C3D4862DC81272F19F287E1BCE1D096453683D5A89E4EF8B67E1472E25164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 98f0cf8ca0673d3e635915cdc5905cd2108a818998c7542acecd8d518fdce460
MD5 d4b5c156f2421773ab1922160410fd60
SHA1 5e35709e4f3ae92c1c3c13842e2d7beb4f3dd242
SHA512 b4526232727e1c5c66baf7a11b2c7d31ac34f277b4d41255b25b258ecddfec60291cf1c3f4e0e1f413a6e0997e47bacac2a88572fcfeba243c202b08b8025658
TLSH
T1DDD0A923260160B9AAA83EA5906AFC8F8B26006048A2FDA410A0AC990A228A8090B149
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe596141.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe596141.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 191ba389738cebaf8f64f56f142612a92126a6f7a159ceb3098579bad0c7d0bb
MD5 d120100f523aaa12c2d2a99a3d183b1b
SHA1 96e6f086ab33942493baa994dc91a7f7f77f8ef4
SHA512 af74bad5b6ae635e72c85dd9ce6914891af0516e73ac4ff283d52879cfc250793eae7ec096f7b5eed12ecfcdbabab2e95dcb0caae24b1d99876affa9717e2381
SSDEEP 192:sxZbRiyM/jK1Ml8MkV/fNsfvQzIdppGdTHW6+WNnSxsCgm/Y9IQTYQIgrJ:sxZb8MV/fNsfvl4HbSyQ/09
TLSH
T15452D756AA345977CCDBD209F940BF57E6F8047293944E44AAFCCA0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 ad1ff6671530b4c855ee204167c7848cce276f0787d669c7b84cdfd5e234c6f4
MD5 c1b49894b2db65119a07137f8f1cfad2
SHA1 bce79f7ee318c5b96b179f70fa6c1ed23f9db7fb
SHA512 61e02ef5bf9f0f7b241f132cecd42a04814e52b6401e2c02c2e5937a88ef36dc303616261e46531825b33da8ace982546e024ace339bd80546d5c8e1b868ada2
SSDEEP 384:sxZdnu8sm1V/fNs8/o8ufHbg06QM/atL5x3LS:s1uFm1V/f1/oHbgz3iL5tLS
TLSH
T13492D853A52089B7CCDBD619FD35BF16E6F804A2CE954E4CA9FCC90C00DA6FD261681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 20KB
SHA256 8ee1eae35c3defd98df36d958bbff6b8f2434e9e618e06305612833a6fe082e2
MD5 753a09c16a4bd9d7d5cac178788d0d79
SHA1 4a47615f31ca06c1270f4bb8ffa3bb3052566db5
SHA512 b33d846119825220928b0552f805fa24cf3ed10243c10c6ff82dfb1c016e4c5e525b449d9f47778449db0d5b5d73946708a5a0dd50e7ca88c034094e6139d686
SSDEEP 384:sxZdnb8sm1V/fNs8/088B6Hbg06QM/atL5x3LS:s1bFm1V/f1/0oHbgz3iL5tLS
TLSH
T148A2D853A62089B7CCDBC615FD31BF26E6F504A2CE954E4CA9FCC90C00DA6FD261681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3a5e8258cd3d31663d1302b12cbff3afe0c460b7dc936276349b331d90e3fa42
MD5 dabdaeecc52f751521c713aac7573b24
SHA1 8c732bd851557e3879946e50ff0bdebfda6d267e
SHA512 b84db81901472fc4d2ce8a7bc27446214840a59d292e40d87507fd2f4ef9506edd2c88a56237e0ef96f2dd6284b2da917468537804e540bbc080a8e7f207fd72
SSDEEP 768:3Ecv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNEro+rg6P:3Ecv21wWvu+Z+u1jaeFLeRNP+rf
TLSH
T18BD20A2B280CCB7E4F841E9CED2AAF866DD801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9575d9e-8475-40eb-bc98-e2f27dc5c033\index-dir\the-real-index
Size 72B
SHA256 ae8e167bf94e0e535ef8c9c35af91c9770c1af4f8e98c1a06824deab9351e622
MD5 39a20489e9a7d771d6fb874976d5b820
SHA1 076d76366240df39de2c1088e38129fc43260c04
SHA512 17a72fd748dd3fad073b804f3d43948710520b5c74d6d19ae16a12ca92dfa8876136b0f8aa26c06b64aa4574a783abd7fcdcec124f73520f1ce4ccd36551ba50
TLSH
T1BFA0022812E06007C5131AF025D602F136306E10F2411B0981991258CC505B5554305C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5960b4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9575d9e-8475-40eb-bc98-e2f27dc5c033\index-dir\the-real-index~RFe5960b4.TMP
Size 72B
SHA256 42a37acc068b28b223354a2fb9008f96080f7c4d1a67b466f1652338182987eb
MD5 e130bdf3ae567275909e918e4a473638
SHA1 a31aa04ba78a48ac4ff1d0216bb985b2a98aea7d
SHA512 4819b01625ad97c6e87a7462ce8f0d953696f5b458df2ea89457239fc042a0501823688eede13093ee8b8e842b1599f9fdd855d015a71f2c7a63f776ee672932
TLSH
T161A0025413808129C09612B1DD5203467740D99061005357509901C4CC68A804DF254E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8022524-60c5-4fe5-9162-aa67fcc6eaf0\index-dir\temp-index
Size 2KB
SHA256 c2ab9b11a757fbccad4bbf0847872565f4cfb5aa6302af3aca2c0cae95c80666
MD5 ab78e650d5923cd1aff3580c3aef5c0b
SHA1 10709988c382ceac9cd407a86b1771a04ffe96ab
SHA512 4404bc6e982741729fc3b053601a881141972da9eae3a985d5df73653505c6f54218ff880ce7250294b8f4e09cb2e38f4ee6ce92c1ef20a7a4a8ca2c5c65f166
TLSH
T1B651B84D5D4B7F66CDAC14F324B708C2373124FE8A888B07E59CE57468C33152D69619
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8022524-60c5-4fe5-9162-aa67fcc6eaf0\index-dir\the-real-index
Size 504B
SHA256 bdcd42b74b15c06713238cb81fcfe319af124cc84ea1c0d22bff6b5a0df773ba
MD5 d861cd9aabdf309af7ee21ddc2dafe1e
SHA1 aa34daf8b1165c361b3a9df061d48563f1fb21a9
SHA512 a2fb2025efac9d920468c236c26777efe7dacdf014c409081faa4f5d65a83b25ca5b0b7799bebd8e6b3c21efe09170b3c9512b392ad3e5d2f973c1116d358628
TLSH
T190F068254E900C2AE96006BB27F69968A27149DCE224D967582C556A6D24388216A1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590b02.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8022524-60c5-4fe5-9162-aa67fcc6eaf0\index-dir\the-real-index~RFe590b02.TMP
Size 504B
SHA256 97a1975c73a703574593664e6cfa1e67f30417e6d0dc7841a2a6db3aadb1d559
MD5 02bca3766891beaf09a6010a5b1a7d00
SHA1 d38b735f260576699f7de3c46c4c721488e48031
SHA512 8452a6436d674c5b0c493e5e1834901d44f637a3b6738d7464ece3dca33da5aa8a21de24f05dc2e21eca7943f70e3da33532532d07b182c0efc52bebc9e3309c
TLSH
T181F0C05587C10D01E59001BF3EF698ADF2314C40A261F9A3242CA56E6C35AC81A121CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0fbab83dfe60fe28c534ebb0b7b324697d79db5b6121585cfe9e54be45b258b0
MD5 80217f1c97a0a3c5d02f5374433447d8
SHA1 c9de0e958e157d86a7770e1bad79db2a188c53fe
SHA512 afc9fc344259509fa7c455b0cad27111c578379b7b61b3256d0fe903eabc02c01e288e4d97c087bdd090cd105bc917fc943990bd41f6e6dc4773d919e055223f
TLSH
T15BE0C0B73DE32400ECBBC3DA58F15494000038D98104AC8E001AB7C704F237D344ACE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 bce1298d03eb032c9fe13366bb6d57e5c04a04760235a597b4f3f72d38d878d7
MD5 b2353179cca8d6505ceb3c61bd443d36
SHA1 69ae0f979a2ddf14d04c0e78d78f520b4d7b623c
SHA512 1c00de82449b1c700c9de66e8708927bef5112566b602d61507c245c24cc1ae0b6dd263edb75e8a2c0a2833945a24ef12453d858d3c790c953fd236828720033
TLSH
T133B02220822FA08BC028CB30F0C2A0AC32200CB0030A283208FCE8B88C8230828C3203
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59839d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59839d.TMP
Size 48B
SHA256 23b7f4a86cb6cef52b8ff02b9c8975c9a35a2cdeb69331f68f3e65de1027ab44
MD5 2ff73a784c5bbe233ed4571f0ca0420d
SHA1 da422e013d13525b37baadb832d08b1df21404af
SHA512 a46f7bfaa32184048679d36ad9c65cae98a8abfedaf8259ff0e237b643e81615202e46ce369f2cec99377253a42e5954066883524bdd71d3cfe66dda524fadbd
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 367290af72d3f2363576244bc032b1ccab8d76989ad62961efce165469b079dd
MD5 c33bd90ee3044f50218157f96680b8aa
SHA1 91bb34ee7aeee7e553dc32a6120b934a08a2bd33
SHA512 90179fbd56237d6aa71ac9b8383aa38b6e97241ae96c55e930ff6e087e14d6b244bcfac8adf4e79b0299e26108cbfb42c6acb8868bbb7d519b9ec28e0340ec9a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+1eKe0Cq4AK1Oqg:mTJlDjg
TLSH
T15391A315713B8242287E285CBB9196768E8675F3340CB5AF7BF900514E2BE225DFE8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5974e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5974e8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 240128ac4a0dd756124164b8c9ee533c8f1092044ba102b950b1c0a8ec006839
MD5 be3cfffdf201cacb79b6c3642a719ace
SHA1 d5969de3d07107186a37b2c4b292b0ba0547be1e
SHA512 ee005b9268362642d73713e9249f0289fa28195ed660f995dc33fd8b536475144e6e4b2271aef5049745f5954e586edf5d526e595aba1a071ecb7d8e75d46b23
SSDEEP 384:iZcIhsN8CHqdEziQXQIe+CTdIe9Jr22OObjI9G6w76v1:Qh9QAbrV9h2229Mi1
TLSH
T13C929D32AC385D779AA3A141F48739176EF890B7E7C92F84A1EDEF0C02DB9AC0305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d7511c8650e5575548c66491ba0faf71abc9f5bd846ffbcf6a678ef78b472bc1
MD5 af3b0ea6a76bf1b435d30bddc1d65b03
SHA1 21e506d527922106f4644376ab4bbdec02f1aa80
SHA512 979e06f0aff0e8686f6fead35178eace2f61855efe9a0b1bd94d215603a1a884142e20c92184e973b0340d16798c3cdeb7e729c59e9c6d83c996f4cdd21b2e0e
SSDEEP 384:NiFiZcI4zsN08TUNTUlIlWT7qdEziQPH0e+CTdIe9JrJ2OObjI9G6w76v1:EFQEpwgZQv/rV9hJ229Mi1
TLSH
T119D229F25CE7493AD9AE5743E7BE2D165EBCC063B6856A40B3D89A0CCD960BFC305814
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 69c53f49fc49454042b08f8846d0403e52eb88c0b957e78596285567a72307bc
MD5 baa0e97f85af7b1298a1b260472c04c4
SHA1 23e49f15b744c52fa2553e6238af32bd6fbd45a4
SHA512 c971754b65f15d004c0341dd963dbb385efce959aac34e4dc5b423fcf331c2a933f729bfb66a4cd4072492eb4f5973697089368e460ac89c8a608c769bc49116
SSDEEP 384:tZcIhsN8WT7qdEziQPbZ2e+CTdIe9Jr22OObjI9G6w76v1:1hrQjZBrV9h2229Mi1
TLSH
T142928D36AC385D775AA7A141F48739176EF890B7E7C92F84A1EDEF0C02EB9AC0305815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9519decfc99a32800c0fce03d065cec3e4e23775505411e3aadae64662abffcb
MD5 75bd029f00bd8e27080a5f4cf38b2457
SHA1 4da131567795579bfb011979808c6cd1404c8ad0
SHA512 46d509192ede07b71b910825cfdf16e3fb8919c1d98c0daeaaf94f80b28cddff5c290bc044c3ff9e272979cc05973c5383b5f8044127d6670cd3cd6d261fa517
SSDEEP 192:YONV6v+YL2QmiUyc94h+CGN+FdeX9oIHSJrZx/CH/GqiU6:YONV6vzuJ4h+CTdIe9Jr42U6
TLSH
T1E4120A36AD785C6B5EE26581F48735135EA85177EF8A3F80D5EC5F0C01DFAAC1306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bfaa8e62533530efb7ff74f3053caa782b6af76a3e7e79c9e4ef8da61943245
MD5 d85d6df13069bba684997f3b533de414
SHA1 0d0ace29b0efc0da124368328bc100ba0623b65f
SHA512 d361d380462bd485c8a45ec34560bb53226ddb7d8885170e0340e958589ac06c0d27e183388cc9952bd47b59cf5fa06fa60b3b43b52df72a0f91adbe7572f508
SSDEEP 192:JONr6v+YLNQmiUyo9Zh+CGN+FdeX9oEus/tiU6:JONr6vz/PZh+CTdIe6wU6
TLSH
T1CD02DA35AD781CBB9FF26E45F4873A175FA81177EA952F80D9E81F0D01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8e1b2d89a83fd64a0fca60f6d82baf080020c74524ebba9ccb2d720b0d99fd75
MD5 2990fb86fddf59daf0afb14d058eed11
SHA1 37dc1fa4cf75d660c9e3735ddbb0cf24f39e3559
SHA512 87a36f72b25ddf36dadced51a8298c821c913c36e5156eb9763a91b2312ac3cda0641b0e5a02039567921936ece9fc43da038e6ba83f932c08c03b2024c1d46e
TLSH
T138E00183E70001EDC039233000873630A6E3D03002B106568D2451552D532206FB0BE0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 fb4573a2a7af46b0f5b614df1a0332d23d3ba1049208204aadea979b9f15a66d
MD5 45481afb3d159539aa14a889b8da31bb
SHA1 0492e4c7f46cc3618a6b438b173589b13c1d875c
SHA512 2a5d0751e6f0fa5dcb9a1d24c632ea2f24f5070bd7dbf9232cfb9469a6b004c68ff0bc724ed9b58c397f616975b09467af4632e9ef6d7a02d5c9205f48bc001c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b7f735fe85b3c53f1967a69f5bcb8e60d972bbb0c16687cfb351fb950202f61c
MD5 15da9a71fbcdbe9660597023cc7d2c06
SHA1 89239879c896bdf811a882eade9736dfa52e0b1b
SHA512 a007e3d5730cf5501b3425dd68430fd1bb5ac5a3b44c8435576eb38f148f807ec6c05abef28b1bf87d60eef5365e568a9d2c3c2978a30e0016ec9625dfb03670
TLSH
T10AE00243D70001FCC03D23300007263086C3D03000B002564D2451452C531206FB0FD0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5919d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5919d7.TMP
Size 392B
SHA256 18c7d95b493d60f799afc4c39b0532356487193cb118b1fd90704575d6317fa3
MD5 dcfcc8cc7baa9bafa474748e44547963
SHA1 f25ee6cf1e68081edc5d2fa6c9ce614b6582e6dd
SHA512 e5a565a5038351a6380c9648d8702b2f1484a4552ed6c0798c587899d9e903902de2f7842e4dc0bde65a62e008846c6a5d60aa2fc8dc324e81555ca8c619d8aa
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7e094efb681a28b30f2646e8bf4b89960c99bdb880483d9d701eeabc2995ac44
MD5 da880bcd0ad7dbae2494649b352871ff
SHA1 c81a92f7b3e72979a90332d32521f75aff8b3d69
SHA512 7d51eae8b95470cf4379ede7d0350dcb3a2d21c482602ca3ae59c351dff7091b705c794eea11f23c315896fe1e0720fd444fbb18d27b2c7fa7d8ad1d0997eb9b
TLSH
T17E41F75CA6EE1148B3B76F5B9BF6A8AD447EB9772E07D49D10110E4E0622B00DD71733
MD5 SHA1 SHA512 TLSH

Submit Download