hxxps://docs[.]google[.]com/spreadsheets/d/1B2h94zg9Y7vI1xwX7Tp_Bk_52zefHIY9FZ9zyDbkGzE/edit?gid=0#gid=0

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
28/07/2026, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docs.google.com/spreadsheets/d/1B2h94zg9Y7vI1xwX7Tp_Bk_52zefHIY9FZ9zyDbkGzE/edit?gid=0#gid=0
Sample260728-ejfwmsxfjd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1192	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296846978809961"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A8BF6ABC-4828-4EBB-9E7B-0E83FC94DFC0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 5000	2340	msedge.exe	84
PID 2340 wrote to memory of 1192	2340	msedge.exe	85
PID 2340 wrote to memory of 1104	2340	msedge.exe	86
PID 2340 wrote to memory of 1104	2340	msedge.exe	86
PID 2340 wrote to memory of 1104	2340	msedge.exe	86
PID 2340 wrote to memory of 4024	2340	msedge.exe	87
PID 2340 wrote to memory of 4024	2340	msedge.exe	87
PID 2340 wrote to memory of 4592	2340	msedge.exe	90
PID 2340 wrote to memory of 3796	2340	msedge.exe	89
PID 2340 wrote to memory of 4592	2340	msedge.exe	90
PID 2340 wrote to memory of 4592	2340	msedge.exe	90
PID 2340 wrote to memory of 3796	2340	msedge.exe	89
PID 2340 wrote to memory of 3796	2340	msedge.exe	89
PID 2340 wrote to memory of 2384	2340	msedge.exe	91
PID 2340 wrote to memory of 4540	2340	msedge.exe	92
PID 2340 wrote to memory of 2384	2340	msedge.exe	91
PID 2340 wrote to memory of 2384	2340	msedge.exe	91
PID 2340 wrote to memory of 4540	2340	msedge.exe	92
PID 2340 wrote to memory of 4540	2340	msedge.exe	92
PID 2340 wrote to memory of 4848	2340	msedge.exe	96
PID 2340 wrote to memory of 4848	2340	msedge.exe	96
PID 2340 wrote to memory of 3868	2340	msedge.exe	97
PID 2340 wrote to memory of 3868	2340	msedge.exe	97
PID 2340 wrote to memory of 2432	2340	msedge.exe	101
PID 2340 wrote to memory of 536	2340	msedge.exe	110
PID 2340 wrote to memory of 3764	2340	msedge.exe	111
PID 2340 wrote to memory of 380	2340	msedge.exe	112
PID 2340 wrote to memory of 2104	2340	msedge.exe	114
PID 2340 wrote to memory of 2104	2340	msedge.exe	114
PID 2340 wrote to memory of 1400	2340	msedge.exe	116
PID 2340 wrote to memory of 1400	2340	msedge.exe	116
PID 2340 wrote to memory of 5064	2340	msedge.exe	117
PID 2340 wrote to memory of 5064	2340	msedge.exe	117
PID 2340 wrote to memory of 5064	2340	msedge.exe	117
PID 2340 wrote to memory of 3116	2340	msedge.exe	119
PID 2340 wrote to memory of 3116	2340	msedge.exe	119
PID 2340 wrote to memory of 3116	2340	msedge.exe	119
PID 2340 wrote to memory of 4612	2340	msedge.exe	120
PID 2340 wrote to memory of 4612	2340	msedge.exe	120
PID 2340 wrote to memory of 4612	2340	msedge.exe	120
PID 2340 wrote to memory of 1700	2340	msedge.exe	121
PID 2340 wrote to memory of 1700	2340	msedge.exe	121
PID 2340 wrote to memory of 1700	2340	msedge.exe	121
PID 2340 wrote to memory of 4492	2340	msedge.exe	122
PID 2340 wrote to memory of 4492	2340	msedge.exe	122
PID 2340 wrote to memory of 4492	2340	msedge.exe	122
PID 2340 wrote to memory of 1912	2340	msedge.exe	123
PID 2340 wrote to memory of 1912	2340	msedge.exe	123
PID 2340 wrote to memory of 1912	2340	msedge.exe	123
PID 2340 wrote to memory of 4844	2340	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/spreadsheets/d/1B2h94zg9Y7vI1xwX7Tp_Bk_52zefHIY9FZ9zyDbkGzE/edit?gid=0#gid=0
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8bdddc188,0x7ff8bdddc194,0x7ff8bdddc1a0
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,12746630216168063975,13291670443023190501,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,3261805562851074954,2352268219737199860,262144 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,1130446460870075348,576558422769876540,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,16973516253760891386,7904757536467172823,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,11983008515769558124,3226134841554748263,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11531155646450174661,6125051535030066917,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,4119778202266414548,4092539806137642285,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,12412534587417931542,13383815331900958645,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,4657976683280325464,14240697622871998413,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16019848320844384238,11637324501812756926,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,16019848320844384238,11637324501812756926,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5956 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14441613683276545739,10285706723629853830,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,8351997259239779475,17875700302748105450,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6060,i,9395937948464186084,14339461290908750907,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2080,i,4963010255573123715,8564223220275590621,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,2992787938776994564,1184953244108938698,524288 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=6400 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5440,i,13097313536588550676,452142348619394632,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5320,i,10660252586398385486,6492048178569760168,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5428,i,624991929576815502,5736671004103454433,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6568,i,8396314244661196898,3025586481511286758,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5308,i,4522104674545809067,15020175846881812130,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7004,i,4540680152029072615,14099722921432579468,2097152 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6988,i,18241777605180067165,6664661514788771511,262144 --field-trial-handle=2152,i,5869621694408050596,17505863873912868582,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 4f2e896d6103b78a56cc26fc73b43e863b52e79a287bf49f3fbf1394cdd4b485
MD5 f0a8a9d2b62cc2d984d5d5311747f2ca
SHA1 73a913d70da39ed6563c4437087a14f980902599
SHA512 ff2bd8157970299995ba4900a1c365d748aaf0f857ae6f385ec9aa7e75cb98b24f963ba19d42bdcbc5a3bcfef976d5a58febf042daf78e4ceddadc12cae6f2f9
SSDEEP 192:NFsH0r224OPO0AgFHVrd3AXZm7H3fS27tg:zB2mfdL7H36yq
TLSH
T132E1FC33B595E0A3FF1449B188CA08C8366A94E8F5834F4B1337997C360DB94B969F53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 51183425f7c5cb5306344fa0be9fef882596ba974781c81077d62a6f0b4482f9
MD5 6bfa3c2834e87a8c6065587bf7c33907
SHA1 866d3726248161dd3912bbcb81cbb4aac231f8a6
SHA512 ac8c5863f7f6d9c4f355d42c0071852cc095e8e6937d0639ee7bad0c2f2bfa38a76e56a16b259b97b0e72729e998b5b9a29067d13e1a9be9ed806d293c7aa091
SSDEEP 96:t8sN1bKhZ4tIm2cpmW9EUr3DzZ75GEYUAYDE2X+2O:nyAT97DN75/B1O
TLSH
T1FF91A337CA16E463FB6645B2D8CB05E9387E88DCF4574F4A1227583C771CB69E1AA380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f2940f8f89074bde72a047a000f4cb2d8d4a5118dd9bbdef0abc85427fc322fc
MD5 964181b42c185e4129a831536d189126
SHA1 c9e68d14d42881568ac6358a535b8ed30993e588
SHA512 80c23ed76a45ebcd868301a5df37a476c9c7b00935cc047b2b5b9ab07add459eadf2569b9d077ef87fb6b8b96b87ded5cf427b7213b2ff315f70ef3373c5693a
SSDEEP 96:C8sN1bKXZ4tIm2cpmW9EUr3DzZ75GEYUAYDE2X+24:KcAT97DN75/B14
TLSH
T16191A337CA1AE463FB6645B2D8CB05D9387E88DCF4574F4A1227583C771CB69E1AA380
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58841f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58841f.TMP
Size 3KB
SHA256 1a03118dd5435a136dcd29b48e9a83f9d02a7b0ae280cd3ce53cab07c38c95b8
MD5 082bb95f0bf64d94d6b15bd85a763f46
SHA1 64b3304e1f65097c723dc546ebda944686d9e77e
SHA512 445d4d8cf79a3990985118472ec623c68bf92a0e7b28fc17e32186de4e375e7462f55d26043244f954364999c288eda64f84880ca95ce6413ee84dbd85b980af
TLSH
T13B615E3BCA11C463FB6601B298D301DA74BF89ECF4175E8D1117157D3718B29C229384
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EntityExtraction\EntityExtractionAssetStore.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_coringco.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 fa0d9f1e99a73e4cfc46d605d021e3105f29f1c5dd3ad19d6355cca58bb5998a
MD5 16a40bdee4e045da70b269624e69430e
SHA1 dafe2fe94bf55e5d44eb59f7923944262d4d09f1
SHA512 fa1c83be1613531f76910e5bff7084d7ddb0617fe5e3cc6112fdcc755597f8ccd1f4c21813aae3bde3282feff06b8b482ced304370971f33e82f91bbfb4e6ad0
SSDEEP 192:D2DroPBBvfwpFADhkawLHKpGlKUFffSmKWIMK7m:D2DroPBBvfwp6DhkawLHKpGlKUFff5Km
TLSH
T1F2E179F7C7D9852D885556F89B15AF1FCE1E0A18831C3C2AC8D8AE5B93E2431D21935E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 22KB
SHA256 fa3ed68d5eba77649d1b89c773c618a4fe624e6992647bdcbe55acde7cc253de
MD5 4a7dac52839b1321b659c3a76320e9b7
SHA1 8517ebb7826f314977c68922cd47ff5c6f9e3d38
SHA512 79df6d939b6fb03bf8b0a7c4ad767c9d9b0a9963287731311999a28a191149913729109c79888a8f409d6b9ec1ac245296e9fca7e8160a9f3294205023949540
SSDEEP 384:D2DroPBBvfwp6DhPyLCGkRH/S/e5exe/BeW45W47LHKpGlKUFffWKPIQM2IMj9vg:OQQKBk6h+yIyGU
TLSH
T1C1A28EF787E8992D8E2156F4AB152F2FDE1A0918831C382FC5D46F1BE3E24B1E14165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3b69563ea79e876795b660b634b3eb047af5255f020f5026dcb9321ee105ff69
MD5 e2ee18af3fa9e887521faaeae98ec513
SHA1 49bdadd33c27b80ce224f8b96d2f698f55e20dc8
SHA512 6138a7e44bcf45ff2f003a4153bdab2770ddaa9ff95c1d99fcfd4b0b596ddb98bec588bbc50fc9da759e6cbcc985d50b6db398417016b28efdf3c3168f351f51
SSDEEP 192:sxZHRF0k9/flsrrwIdp7BHW6+WNfgO/YCfMrNsIg5sJ:sxZHrP9/flsrrRFHbZ/yae
TLSH
T14B32B5566E3899778CC7E219BB15BF13E6FA503292951E48AAFCC61C04E7BDD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 079cc59590a9120066cd034d51165eb6a60eab3003a3dde918db87618df1d08a
MD5 bd1f8eff98b527f012a22f05904c9232
SHA1 2bc866d14584ee88a32fa97c97f2659ba36ba0e8
SHA512 ba4a0c6a5ea6747b9d4ec21c76b6702c45c128ef79dddfcd183f16434884d62bb84422e2b5c8da8d25c1769be583879e440f93398b8f9b81a58dbf45506355cc
SSDEEP 192:sxZxQUnIRF0WO9/flsrrHbhbHdp43BHW6+WNfgI4bI/YCEfrNsIg5sJ:sxZZnIr9O9/flsrrVP+Hb/L/Oae
TLSH
T17352D6566924597B9CD7D219BA16BF23EAF96032D5941E48E6FCCA0C04F7BDE2303807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c2d8c5b0d55796ecce107cd901b72e1a8834bfa4a9a26d97b704735fb3cf896f
MD5 cf96195a6754191fe12ebd1b5dabd172
SHA1 c26f2c15b0d44da1c17a6d6130c7f8e8cfdbc96d
SHA512 b148e5db648230f7482942e3b6678aef3e8184486bc356ef8eca9b8f0b13f8e390f8a4cf68994bd2f4d33a6f12f854d377747d68298bd7c6b8333e9c13517990
SSDEEP 192:sxZHRF0k9/fls6ewIdp7BHW6+WNfgO/YCwCrNsIgrJ:sxZHrP9/fls6eRFHbZ/Ha9
TLSH
T19A22A6566E38A9774CC7D319BB15BF13E6FA503292951E48EAFC861C04E7ADD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 93696e55c5f3fdc3ac17c70838afcf375485309d824901d75439bbb4737dfc61
MD5 07210c95f3df000b094b6348c98700d5
SHA1 7f3830d186648a06c92147f07609af3e359c1453
SHA512 97b4b9f9cb2ba63ecdc569ea24aac6f95a33ea959d72d2fa2bb9777166270a0a32fe286b729a2067c0e18dbfeeeefe0a25c503dbbf751d46b80fd332cb1a2c49
SSDEEP 192:sxZxQUnQRF0k9/flsrrW4abhEddp4KiBHW6+WNYr5xMgI4bI/YCWfrNsIg5sJ:sxZZnQrP9/flsrrZqemHbSUL/Uae
TLSH
T1AE52E7576924497B9CD7D219BE16BB23E6F96032D9941E48E6FCCA0C04F6BDE2307807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a21e41efac1f4185864b8381595afb4b87bfda2f9ddd5243ac587b0825a0370d
MD5 fe62003055de2e08ec74b9ccb0f88ee7
SHA1 b546ddf4707238fa0686748d6c224a59511da04a
SHA512 df92470ad7985022ece9af27adb5e9652488e60921dee4bb87a421375e0c6eb7f3c76ebe6bdd2fb977f47d2048ed1a6738dd281f3c26127cc01ccfd89712e346
SSDEEP 192:sxZHRF0k9/flsrewIdp7BHW6+WNfgO/YCwCrNsIg5GJ:sxZHrP9/flsreRFHbZ/Ha0
TLSH
T10222A5566E3899778CC7D219BB15BF13E6FA503292951E48EAFC861C04E6BDD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 6065ceb096628bcd5f68eee265b79637f255c84d0321e447fb5e93573130d021
MD5 0eb865ec33eead48444134e77abecc59
SHA1 923bb80fbbcad552289462dfef874e00e6568956
SHA512 707441b4daf120e0ad3162566111ddaaf5d8442ac035607ab12dacd69272ec39dd012e3f4a4f4757d2d255e61e64a906588e0d52fef24a72bd59ed511542eea2
SSDEEP 768:iGqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrlroO:iGqbUj+WvSCs6u1jaaZLbWreO
TLSH
T1F7C2E93B340CCA7E4F801E9DDD5A6F972E9802C7AB588D4447FA994C02C77EA512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73e5b87d-1a5d-42fa-aa1d-c66e184eb9a0\index-dir\the-real-index
Size 72B
SHA256 11765dadd61cd3fde9cb551ec0210bea94b82d3067828cf0070402bc0f028ae7
MD5 df5e688f745022ce9098b2f477c1c77f
SHA1 fd7f2d118e229484d5de41730c2c4d4ffc70fd7c
SHA512 9d79161dee03222fcaf7611ff6e61e66cc3d4f7a9c9d3fb429a0b01b1e4ea09149da1d0713de7b37f840ea55de85f09c09249d76f5d48ac926aeefc7384bf60d
TLSH
T14EA002E121C31897E0108FB0108752D03728D8719241031173F4A07C89E17844611551
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59c99f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\73e5b87d-1a5d-42fa-aa1d-c66e184eb9a0\index-dir\the-real-index~RFe59c99f.TMP
Size 48B
SHA256 11e1c7ff1e2cba8a2cfd8f42cc58071fb8739412769508821bd7a9e09585aee1
MD5 c79ebf59c60c603536a2421399014ac6
SHA1 3675209877af3f0f926f6c386ebad4b36e66ea12
SHA512 179ea0c0d3871662bb3a6634135df24544ebb5e460edeaa2e26db61d2f454d06f47b15a96d22dc0ffa53b8e1f806c3e0b206a1c0b517790e9f4ed59002c1496d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 423d0de03d54f244319e3c7055f8bd68678dc2a59f4dad9050126b82699a0542
MD5 9b6f34721a98bf3e5c211456576100ab
SHA1 e766518d482ec3d672bd2b1bb50f0dd0a9e33b6c
SHA512 69b6b8fcc823e2a7c675ce56c9b4c62adb6bccf4349581f9a311d4d36f45f8e21fefcad2e6bfbaade2b6feeebed91ee2fc8778ed4a28c0f9e0b6f08941d63e11
TLSH
T183A002343AD42065C1114AB9615201922719DC1A019A43454DE01C999C5D1EC46198A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 7678d7200558d471c41d5456cfeee92ce88abf6ee722da1549e89665adf8f0ec
MD5 2d41c885d4f8fda3902bdf0efa7e5a09
SHA1 12d7aaa3ae52567c19fac0000efbd29087e090a5
SHA512 b7b7ea545a3026f623d02364c1cccf992d601fe0e6a72f7267d767c354053a7e5c848db66a3cd1f727c6f3ef53ea9ed94dfa9de7a3ed86f27a9e2bc53dff6b29
TLSH
T115A00234CF801005C06351F5265703417340CAA42140230748E51048CC5C4404D4900C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 dbd6792a2782878957be54a18c46e2118033ec951bf83dd467766f279966c130
MD5 d778e55a8e437d0c94de1ae1867a2113
SHA1 125efffdd0b5754917be0b97860f3d4333b8f7e3
SHA512 b9bbeac897b0b75e3cadb0b86297679dd27c14f80f259017f55fbe14c18a40add2eb9f912fde4167f4e77cb7661e8a97d0cb921b11b35706e177c7702df02306
TLSH
T17BA0027406C07046C06396B625D74961336059904603132641D2454CC8D07969DC144D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\temp-index
Size 2KB
SHA256 89846af3af413ac523acce016b056bf56182a56091365d2f2c49b215656a2162
MD5 ae1daf1683c54cf8d6dcc4e09e73c19e
SHA1 5f8f9087942e14edd51f4c0e0d3abfecc6142d59
SHA512 beee1d98b53382f350a9921c5dbe8081840f6272ce03c3aae34a546e5327be6ffcb383ffb2755dd4720b3bab0896aece821f1b6067eec0b607035cdae93dd685
TLSH
T14551DA8DCC865A97DDAC21F358BB04C5337214EE4AC89F076D9CA534BCC322D1D6A510
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 360B
SHA256 c33a8ed98534ee8b0cd6d2bc92957d1347c89a41ce7d974981eb41842db6a82d
MD5 71e06811c267943f3017084d5fec9383
SHA1 06366166cbb2e694c1ec723c4f6fbabb1262e956
SHA512 48f5d2247f2c9b665f6d4775f7f41fece723d02a524c4399dc9eec2686e352ec9602fecede439c89067ff7240ffd85baf35dbce6aad376d1d811fec2f2ccf63e
TLSH
T1BDE02B154ED1182ADA201E71147250A9B3F04CFCA611984B243DA57F2C1A34C54162CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594694.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe594694.TMP
Size 360B
SHA256 fcf4b0396f3d9aacf513fdee7139d2d97cd8c89dd173670810e82c5c0b53d24f
MD5 2e8fe6c612da36423aaca11806ccc3a2
SHA1 fabcc917b7acf1cbd4498483c065988e12bda09b
SHA512 c18c615ce920725929aca26ebd9ee54a01abc041659c5d0334fda7481e0da2d5a1ce4d8a464ba51001010bdc027f259a3a0ba87ccea20a43e49e18787ccaa93b
TLSH
T1A2E09545C7460531DD101677141154EFF3B48D60B531F98B747CA82E2C2974CE9522CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 93b825e35af613f74545324583835400d21e9ba5fe5fb09ad5a7a2fd75d31cb0
MD5 10b88552595eb3186048461ec6b4efb0
SHA1 f00e8076a756b86f4d63ac76ce6548943d9e7e66
SHA512 fbcdf8c677589bd7e0b7c63295ca860459ec95e55617d09267d4725de26e6e87a04de390e01c24bc36a2c7a85c4a60c90378ee05c88af2454baf98bdc3152642
TLSH
T1C6F097BA2FF72851F8BBE3F2207048B0026A7884C8A1EC5E0029A29741F232134ACC61
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 cd2b40312e61e6e85734e0bcf3be07c829d22f2115fcf0d4a2524a16cd563a71
MD5 fd26d99cddd0ccc9ec5d9da83caf43c6
SHA1 67914e7294f5d3c8839847a094ba4fd9b1f8df48
SHA512 8c7c977a87311befcbbe897e33572b0249b85a91b0bd3be958cc3f18d7895bec09a41c525e0b926a9bde87b956d00f3f5ca5211f6cda1dae65e66d6e401b5dd5
TLSH
T113F097BA2EF72811F8BBA3E2203048E001697C84CC92EC5E002AB19791F232134ACCA1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 0a82e85f0e0946cb3017f534865ecd2a10932cc275a854c4651f4742b2c7b073
MD5 9f7d32a24134eef397062841001875a8
SHA1 76499b50b743fd51a2d783ceed76ef0da99507ea
SHA512 7ea2a711611e60d09104fa539ffafa12c3fed6817f56a9ded49db7c550717365df5e4ca02458fdcd4f030827e17a27a0e17af515a807899b9e47cd158fe926ae
TLSH
T13FB01251980B8086C12002394495148831285CE817053310017E0038952070000D9040
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e7e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe59e7e5.TMP
Size 48B
SHA256 f8dbf5637c2f341f9400b005cadb01020a863ade962b26fded0aa153e9ced783
MD5 dc1c691425fbc7ade0f03bd6760ca489
SHA1 1041345be46d3e3c579ca78dfb390e33678ead98
SHA512 d59b4157977ae823493f7b733619808d55924bf1528c74ab3ceb813bc33e57c25bd67adb3c71fb158b048d8427b3bfc239cd5db0fdd8ff256c663aaf9a0577e3
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58f047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58f047.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6e32ffbc983d9d5221f2f0301ae899f13f26d7b567e96657b7bc874dba357f30
MD5 54004e1af31eaca937c56ef9c099c20c
SHA1 25d5bde70258111886b7304aa54d599cc0dfeb55
SHA512 49d2c5cb284da45d1ea040312415ac4a4440b23193853b968420f30c9408b45376747ed768c6a62c87a2547e929727632688aef7076ad677a0017f76ea88c1b4
SSDEEP 384:UZcIhsNFDyzacZz6TEa+edyjy6bTSOObjI9G6w7w:Shtackoa3026fS29Mw
TLSH
T1AF928D326C785DB799A6A515F88736135EF9A177DBC92B84D1ECDF0C00EAAAC0306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f60ef0dfca526499572c9348f9f98478a05fbf602951ac7ad7bdb1a539bc2322
MD5 e2eab6683e47dd4cdb803e8123d02322
SHA1 493d4a43b7ee5385ff99dd960a919f5f110ebc51
SHA512 16b10e01713cbc8671f8517288c6ea529e9ff8b0ed18850242a64e8d350fa5ac39c1a4f5b5a808494bd4572550a06dd696302a97f4cb11c5a45fd0af4b7bcd8a
SSDEEP 384:QZcIhsNFuyzacZz6TEa+edyjy6bTSOObjI9G6w7w:uhOackoa3026fS29Mw
TLSH
T1F0928D326C785DB799A6A515F88736135EF99077DBCD2B84D1ECDF0C00EAAAC1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be6156f5a6b38b5ad3ce00bee816ba91574db6d2c15f79983bfc3c456db3cdc2
MD5 7b3fd4b32f9d3844a6e669b413a74b45
SHA1 bb13ca100391338cac0b2c4efe64b2052b555eda
SHA512 8af3eaf54df7d6e0ccc400aba7bf1773b264a34b0b9a66dd68cac80046f42d9278645125a2c841f6faf4936c0d0f5607328b53db58a92b2cceb90b650d09b14d
SSDEEP 192:vONu6Db6QmiUy+rHBa+jN+FdCtRg67pU6:vONu6uDHBa+ed76FU6
TLSH
T1B202E63568786CBB9AE26E49F48737275FE4203BDA9A2B50DADC5F0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7a5d87cb54e2b48beff1ec7d4546177a480187b9b301db83d15a36c04b7b0362
MD5 67910390bc6f24dad8f20cd585200168
SHA1 54e09f8d448f203d4e4cd98ce5762ee7e7ebd470
SHA512 55a641e15ce2a429f55b2c4a83bd2d414cccd1e43fb8940a11015d640f5d03c593e8105084ab9e4a369bc9dbe5b7a697c66ce14aa231274dc2f1c40a54ef3c32
SSDEEP 384:qiFiZcILzsNf8TUNTUlIluyzacZzQTEa+edyjR6bTSOObjI9G6w7w:hFQfawgbac6oa30V6fS29Mw
TLSH
T161D239F258E78976D9AE5B03A77E2D024EBDD067F5856640B3D88A0CCC965BFC306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7e983be2028d16600bec0ea9657220443e4a2a44731204bd54a47a13ce8e7986
MD5 d9b7ab60b499dfa761711e9e997260b1
SHA1 fd357e9b50b3e9a250dfa6fe33300b5f091f6cac
SHA512 bf8ef7cd275754fcab1edd9eca1f4b2a814b86addafcafb19a1aa44d791af6cf4bcf4a0ff0c3cc3bba01f3ffeff2698bd5ac573d545cabc7399fa8f3bcdef44c
SSDEEP 192:OONA6DbZQmiUyKrBBa+jN+FdChHtFlNz6bCrqzSU6:OONA6vJBBa+edyjb6bTSU6
TLSH
T1351229366C685CAB9EE27854F88336135EE55137DE8A6B80D6DC5F0C00EBA6C1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f06f644261d20f8a101ee7b22f033d8d80537408515f124b8884b7ee162db8bd
MD5 bf2b1bd5d699faa345682f02e117caf6
SHA1 a64079feff9605e33857fdf1da7f393c7c62bfe1
SHA512 5e058904b1114d52a54d6838971e2d01e101ab9b95061cd007e76597aaf034403df532688a4352d51fce2b4951032a18a13c493eaa7d5b0fbd90b4197479fe91
TLSH
T102412B58BAFA1108B3B76E1AABF6A86D487E7D772E06D49D10110E4F0663A40CC61B37
MD5 SHA1 SHA512 TLSH

Submit Download