hxxps://indiansmartsystems[.]com/viewings

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://indiansmartsystems.com/viewings
Sample260729-zn3lessdrd

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
24	https://amaipka.s3.us-east-1.amazonaws.com/BC.html	3096	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3096	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298319710020039"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{6342FA85-1FFA-4806-8C4D-65B624A75939}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe
2792	msedge.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 1084	2792	msedge.exe	88
PID 2792 wrote to memory of 3096	2792	msedge.exe	90
PID 2792 wrote to memory of 744	2792	msedge.exe	91
PID 2792 wrote to memory of 744	2792	msedge.exe	91
PID 2792 wrote to memory of 744	2792	msedge.exe	91
PID 2792 wrote to memory of 1184	2792	msedge.exe	94
PID 2792 wrote to memory of 1184	2792	msedge.exe	94
PID 2792 wrote to memory of 1184	2792	msedge.exe	94
PID 2792 wrote to memory of 3820	2792	msedge.exe	92
PID 2792 wrote to memory of 3820	2792	msedge.exe	92
PID 2792 wrote to memory of 3904	2792	msedge.exe	93
PID 2792 wrote to memory of 3904	2792	msedge.exe	93
PID 2792 wrote to memory of 3904	2792	msedge.exe	93
PID 2792 wrote to memory of 3428	2792	msedge.exe	95
PID 2792 wrote to memory of 3428	2792	msedge.exe	95
PID 2792 wrote to memory of 3428	2792	msedge.exe	95
PID 2792 wrote to memory of 696	2792	msedge.exe	96
PID 2792 wrote to memory of 696	2792	msedge.exe	96
PID 2792 wrote to memory of 696	2792	msedge.exe	96
PID 2792 wrote to memory of 444	2792	msedge.exe	100
PID 2792 wrote to memory of 444	2792	msedge.exe	100
PID 2792 wrote to memory of 632	2792	msedge.exe	99
PID 2792 wrote to memory of 632	2792	msedge.exe	99
PID 2792 wrote to memory of 4880	2792	msedge.exe	104
PID 2792 wrote to memory of 4488	2792	msedge.exe	108
PID 2792 wrote to memory of 4488	2792	msedge.exe	108
PID 2792 wrote to memory of 4488	2792	msedge.exe	108
PID 2792 wrote to memory of 1472	2792	msedge.exe	113
PID 2792 wrote to memory of 4564	2792	msedge.exe	114
PID 2792 wrote to memory of 3896	2792	msedge.exe	115
PID 2792 wrote to memory of 412	2792	msedge.exe	116
PID 2792 wrote to memory of 412	2792	msedge.exe	116
PID 2792 wrote to memory of 412	2792	msedge.exe	116
PID 2792 wrote to memory of 4256	2792	msedge.exe	117
PID 2792 wrote to memory of 4256	2792	msedge.exe	117
PID 2792 wrote to memory of 4256	2792	msedge.exe	117
PID 2792 wrote to memory of 3936	2792	msedge.exe	118
PID 2792 wrote to memory of 3936	2792	msedge.exe	118
PID 2792 wrote to memory of 3936	2792	msedge.exe	118
PID 2792 wrote to memory of 1652	2792	msedge.exe	119
PID 2792 wrote to memory of 1652	2792	msedge.exe	119
PID 2792 wrote to memory of 3628	2792	msedge.exe	120
PID 2792 wrote to memory of 3628	2792	msedge.exe	120
PID 2792 wrote to memory of 3628	2792	msedge.exe	120
PID 2792 wrote to memory of 2304	2792	msedge.exe	121
PID 2792 wrote to memory of 2304	2792	msedge.exe	121
PID 2792 wrote to memory of 4152	2792	msedge.exe	123
PID 2792 wrote to memory of 4152	2792	msedge.exe	123
PID 2792 wrote to memory of 4152	2792	msedge.exe	123
PID 2792 wrote to memory of 3412	2792	msedge.exe	124
PID 2792 wrote to memory of 3412	2792	msedge.exe	124
PID 2792 wrote to memory of 3412	2792	msedge.exe	124
PID 2792 wrote to memory of 936	2792	msedge.exe	125
PID 2792 wrote to memory of 936	2792	msedge.exe	125
PID 2792 wrote to memory of 936	2792	msedge.exe	125
PID 2792 wrote to memory of 4264	2792	msedge.exe	126
PID 2792 wrote to memory of 4264	2792	msedge.exe	126
PID 2792 wrote to memory of 4264	2792	msedge.exe	126
PID 2792 wrote to memory of 5968	2792	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://indiansmartsystems.com/viewings
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffabfaec188,0x7ffabfaec194,0x7ffabfaec1a0
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,17031201941753406415,6918198574090631807,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,15957451619411953047,7724550690352765777,262144 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,10415627468022603508,195404238883743096,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,9344045341198189119,12734557122402370810,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3332,i,6629750314993332563,9255673476276647281,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,3924277840871880560,6831730035888870256,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,5859565152154595160,16747819800424024974,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:2
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,13967251679058375939,13691216151658267220,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,3155459727635236681,18286312233372038742,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2654725681378368962,16731354385924056215,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,2654725681378368962,16731354385924056215,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6216,i,10260047129182698161,1737768796395211024,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4644,i,15944557533252287978,8521889024959406534,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,10520183912675429393,3464413966924307307,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6444,i,4621653617866176600,3226727175483728534,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4644,i,1698414935626081323,8366434586670130298,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4692,i,14914473740067286868,8469370228414459721,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6296,i,10932884970033889983,9251862702227619381,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,12923830189799759128,2018354560176413396,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6152,i,11430136880955318277,1369212902892644170,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,4973739254033076921,4063671814729629478,524288 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7212,i,15859183928155265599,16779528886875710497,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7220 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7408,i,12940080958992790493,10486974908108210182,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7376 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5916,i,7465019153964798814,17267962548543747834,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7592 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7576,i,1862651384958511828,17988322974380845599,2097152 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7588 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8020,i,14997738079479196271,17211680770238180627,262144 --field-trial-handle=2328,i,10311571082105436181,1858930616212860905,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 35ea9ac539caab29ff1469c60f88c8843d6a0ca45bc0447dd0c87224e362a0a0
MD5 3c444ccf9963cfa395a2c98051ce38fa
SHA1 a173d35cc63a422cda1a8556f8c43dbd3cb62ba4
SHA512 31f0b431b539869a4756f22c62916278554a95bfe025cceeb06d2701e7e6064e02bcaead18688bb1c3eafc329912f382663f1a87375ce7dfc762ae71f7cabb61
TLSH
T1C4614B35016AA9ACD730123154E2116E70BDCFECFA37DE95287388F4EA06F7986D91C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 cb94dbc8ea344e77136d0a85cc3bdebd31f72df3391302fe3187ee6f40dea5f0
MD5 57b5258fd381fe1f35d8dc561fda7d95
SHA1 557ac4b775445914b60200988920356efbae4925
SHA512 2200ea188a7063089db993bf29401a62c18c429e517769cc551ae53a64e8e1de9350144f0cb17a2fd29f74eda9080acfe5bab4357f6c45a6f32af6faa1b70b15
SSDEEP 96:qKtIQ2YpyxBQW68T8rmfzoQuCWIulBTCp0wxFV9qgzHZtnEatVISqYCzODCTwlko:qKtIQ2YcxBQz8T8rmfzohCWIul5CpTx9
TLSH
T17BC1C7301E99B548DBB0827E04E12C4E70B9DAECF963EE83583385F8B54BBB545853C4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe584d7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe584d7f.TMP
Size 3KB
SHA256 2e42e9e5b5f77d5ac9414cd5d81740b548078e824e98fbe906270d9d49ef04d1
MD5 63c4a43e036c347242500ecc766d6c7c
SHA1 024b7b49f8939d4f5d760bcee7344ef1868e50e8
SHA512 5f4c82a4377d84ac0f646d86d4bc5ed0724b267d02670a4d466545c139a13e8177fdabd1a56bf7f446422e807287a0d3027d8b45ac501fbba0afa57eeec6aa90
TLSH
T11B614B35016AA9ACD730013154E2125E70BDCFECF937DE95287388F4DA06F3986D91C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0a9e03e3982245290c2a4dd7881dc54e3148bae0a825a2b28196b043242b9f55
MD5 4caca283ec8963a657c41db34ddf74ba
SHA1 0c6d9e2f018620eed5915a9b00a5ee8a48a776e6
SHA512 3126e38692bfec92155065c8cd1e6fa8002dc82301279c2ee0ae2a32c20b3269ad747cef20dd0baccb71ca8018c4ea884cb92aafcf72ff3af8466ce2b754e5c2
TLSH
T1D351BDF3C2E58A1DC90123F06B246D1ADE6D0945432C3D1ACAD8EF5F97F2471E21294E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 f3f79fb8a8e3c34abbde4145c453ecb38cac21bb34e449b339e442710f1d4bdb
MD5 8245fd4463f8f869682ef298f589a70e
SHA1 78cb63b16635a142561a736bcc97bc65ec2c0d78
SHA512 c991a1120838f7c35d852a1cf77eb530fa48710746eb05fedbe4ddd8194f0e49cbe31ebb15adcf1367e5a92497cc5bd2d4898e669ba777fe75a5a477cdd94c1a
SSDEEP 192:Desg6aIreRO4n4rOUe45HbWifGO9CO5ljNR/jY9pRqxXHy3dGt3qc:Desg6aIreRO4n4rfe45Hb7fGO9CO5ljf
TLSH
T14212CDF7C7E9461DCE1152F4AA143E1FCE1D095543683D2AC9DAAF4FA3E2470E201A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 86767490cb27f68851938898e5de19cf5e683d09014d561c5542592b83c190c5
MD5 28a12639abe886e21e71da330f06e493
SHA1 3967bc8fa6f3655647be2ca46bc43c68002a99ab
SHA512 e82566dbcebdc42e5fe33a0a8df8d9c8ddcdf0f15e12cf8c567e6e4c89f8f4ee4fa33e7ce7585ff42d2043aec0a8d3cba03a4a906f24164b227f61ab82cb5487
SSDEEP 192:sxZGRZyM/jK1Ml8Mkx/fUsa2DUIdpYOHHW6+WNxol/YCczrTOIgrJ:sxZGjMx/fUszDNVHbi/s69
TLSH
T1BD52D8166B345977CCDBD209FA51BF53E6F51476E2940E489AFC8A0C04E6AEC231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b526c089c3013b76c30082b10eb19efdfd18334ab3b907070485b1171064d1ab
MD5 bf5990544228975d81d72c4acc8242b9
SHA1 2f5d7ec9aa80b709ba3f4ee2b673344436c306d9
SHA512 158ac3fc4754e56ae89a4f80756ee6763b6b70d0200028593a28deb5faff6417a6e291c61c029edf29d84a7d66b9f214d8d658a2dc65493194c04c485273458b
SSDEEP 192:sxZQRZyM/jK1Ml8UQykx/fUsB2ovfCbCoddp4AvlLpoHW6+WN421yppEeC4SYgVh:sxZQjqxx/fUsUoXJauHbtOo4yK/F6Z
TLSH
T1D772E6566634497B8CD7D219F901BB67E6F81467C6944F48AAFC8E0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 f103c29c8788ea6be885ade0f7f1efe22c2da80d2193563d21ea2230db06050f
MD5 52fecaa5537a6cddfb8c7f52d4331afb
SHA1 e7328e95ddcf78f7067b170b77c8359a5b6d78db
SHA512 4a8859b0fee5788ec40e7bf4c255cb1f336c1e13047522f24a023fd43ab7779e1d98735c1c015c0f8b90ae8cb1421bc310e3671f27a26bb1f3ac9f011bee2c5c
SSDEEP 192:sxZGRZyM/jK1Ml8MWOx/fUsB2ovObCpdp4OOpoHW6+WN4eeC4SYgVS5/YCP4rTOZ:sxZGjuOx/fUsUodNjHb74yK/e6Z
TLSH
T16D62E846A6344A778CDBD209F911BF57E6F41477D6944F48AAFC8A0C04E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ad874610680f841cd22bf4ed1b396022d4587afd878aec068e70fff623ba0853
MD5 e239922af8af833588c47d42f7007bce
SHA1 97d7150b81677152912e7d24da9967ab1c77d862
SHA512 df9070737b3504d94e12381765c6176b8729648159cac2feeee6e0b14ec5a8fbdf71d4d62a5d51732a7b1c91f30a4b1174247696f649f0d1b10602ce3c3aade6
SSDEEP 192:sxZQRZyM/jK1Ml8Mkx/fUsB2ovBbCZ7ddp4OvlLpoHW6+WN421yppEeC4SYgVS5g:sxZQjMx/fUsUoUHcHbtOo4yK/F6Z
TLSH
T11372E64666344A778CD7D219F911BB67E6F81463D6944F48AAFC8E0C04E2BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f4de37e8e6e83b19e154fcb0bcfa0c3f70f716de903fa821b3ecfc1f0a29f91e
MD5 b26a30e53e813991a0d55a26d73369a8
SHA1 6d5106c4bfa4cc2bbdaccacf799e21badf5493ba
SHA512 5ceace5ac374504cc23b289e4d76fc96e78c779356ecadf8484d8586f74767b9ff359981b414db4fb20c0ee91ddea7df3567c4d9deb56b61889baac6bdbd2148
SSDEEP 768:j88bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV0roR:j88bqn+WvSCt6u1jaCZLbWVfR
TLSH
T12FD2FA3B280CCB7E4F845E5DEC266F962ED801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bf79336-8d30-4f5d-bfa2-4e49a8ae403c\index-dir\the-real-index
Size 72B
SHA256 04caf0cf20e60fa7a628c32db4c7599246d9282032bf49798742b5bc00dc8008
MD5 394dab4dc7f01b3a30b7f41030d3702c
SHA1 0c240081aa6e4dd4e78ade77951e9af43140cc10
SHA512 2080e839edbbf3492c96a1f7bd22fa36e3f0965a2b17e3dfb834a3ab007e690b55bcb395a93c6f853d9ee30992eb8076fd34e59bf538a4d99332936af1f29ebb
TLSH
T15EA002306174415DCDC447F918BB519073118B501701061956D2E074E9949416101F01
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59af32.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\5bf79336-8d30-4f5d-bfa2-4e49a8ae403c\index-dir\the-real-index~RFe59af32.TMP
Size 48B
SHA256 4d605339a04ab262834afde2114c512200488c1b21448060c6e05b379733d73f
MD5 817c8dfff0a3f0897f037485b94ad10f
SHA1 cdb70cf053b9283361e0ee552d2d69200cd96329
SHA512 bc259a36e1d3c5326b96c3c0ef79c2c4834ecaa1ef5898c13d8109b91ce05f1799432c5c3b6ad865dbd93a307a8678a023f64047fb37ac56eca5d430bd92233d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8210ceeb-345c-4f71-8a03-ccbc41551587\index-dir\the-real-index
Size 72B
SHA256 c45ffd82f5c22a271d189bddc7d8f60fbb7b9b3d90fbd6990b345e2711146b6f
MD5 79d170d021b8ea9e8e61021342e8ba93
SHA1 730d4b0dfb573b7289d7bae3f43037473b716f73
SHA512 0d6a4a33ff5b342527d653114d79324b8e9ea9b94c3f86963510b51a95819b45fa57dc4906fb707942fb74c0f6e789f22756370cab34c4793d5e7cf8799fe8df
TLSH
T103A0027402644091D4418EFA5593215133146C161103430544D05559AB625B847115E5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 3d86f185b34566966eda5bc3fcfa517ee2f1f4202dda449df6fea828ece3c7aa
MD5 e72e93e059104f16b5768786314e951b
SHA1 29cad1fabce68237fe9f49384bfff9c34ef63173
SHA512 762c62c7f32fcdefef37b0d258667be2fb537f7c72cbce1e2c8f68be5566bc808fdbf6f00fcc9be9b845a7386ef152afc6d5e574332d73cb87f586383c202594
TLSH
T180A0025F46940409C12312B469D752413212DD1C0203230655918054C9909855D6154D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 f7a57074ea52964e4e280e93d470a98005ad82826ef63083f0d01e337fcdf019
MD5 d7386bf04329191d69ffbca87ed8fbb8
SHA1 ff8eec8d0d689f3a8d00f7ad198ff12d33b36037
SHA512 b04790a8bb2e06da4e98547519de66240c15c15711081925ba3a332f00fdddb4ddb391f432740c58ac1937032756c199f1903b762d46a5d91dad9c12c298894d
TLSH
T1F8A0021103950405CC2693B115B246451741EA512100A30740E14044DC565E08DC100D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 2KB
SHA256 616f3f07ca98eb5c67a583861f603af902800afa35587a9343380e5cbb702019
MD5 b7f97a3e34d08254d46a553e01d71896
SHA1 4b7266023c39c1e3ebfa95167ecbad27ba4fa3b9
SHA512 cb8543969a8ceee533321e6d1120f7cc6f48bdbbff80f288c1943376b32214c321ee76daebb869e32a0b222aaa55740dd221790b353c135879cec17777eb102a
TLSH
T1BF51B84E4C4A7FB6CD5D20F324FB1882333124FF8A848B07659CA53478C33141D69959
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 816B
SHA256 391397111817a3efd715359ce71fd514008f7841ec7e8225cc9df76ce2223864
MD5 846e4412f27a7bb416c2c4a138cc3703
SHA1 040ba9e8913d21d07606b90bbbda775a7951324f
SHA512 d94d3ddce8e3d64a744dfed3024e5f5018e96b5348b9bbc779a83897db2cc1d2185fa1d126bddc3c656e493b7f8d9884afdb91894a0b031d911767b6597dd68e
TLSH
T116010C865EA68C2FED950AB324B530F473B08ADCA721E213643C22372C3A34965161C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5926d7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5926d7.TMP
Size 816B
SHA256 22bbe3d81c6ab155a0a19012e6612aaad826930f3d687f95bf7600051b29be47
MD5 02a97452a7eb994524ed60e793257dcb
SHA1 abd66df5313a7b43bc7e6b5db02f05ee7d5c9ce2
SHA512 9fbb46aaa20ff448a3fd86bbbf038180f454954df3c412886dad00e4f5f6cc6a199b18de90eb0bd53ab316ac35be8039a20b65d66c219b836774d5e7b9bfab45
TLSH
T1120126878B974D2FEC5405B7088560F47371CD006332F7A3947E653E1C7A38969070C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 1abdd2b9461109e995ac1ecac861c8f692af6a46946c768fb6c6502b70f8407e
MD5 23182a26808346b69afeec920a52d9dc
SHA1 aa3a8c8b203e8da2fb323a2a6b14d4f96fc1471f
SHA512 5cfc26d44012c9fc3c191d43cd52428db72c3bd496eb8c42ba5a0d9652d49a92d42dacd62398f5a7e79c973d69d83ac19ca0db7111432d3fc2e4644483a085eb
TLSH
T1F1F097BB2FF72814B8BBE3E2243018A005587C84C886ED9F0566B19790B2329344CCB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 90f8ca0de830838ee1c51d6e5ce362908f73bfe9ec1851d798c6a57431783f9f
MD5 b15c9060e39b53724486614ef7d42243
SHA1 9ec4a6a40cbce7e5cc4e123cfe5219d9813d79eb
SHA512 903444e563ffa51ef08a8fd79c5b624d3e5e5b4c2a9babdc47f0ca763f1515bae1bc186795a69c2dce91efd32ed8ea37c70f776311137f0c9147b301caec7b89
TLSH
T150F09EB72FF71814B8BBD3E2143018A001457884C845ECAF0566B19750B2328344CCA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 f586ca6d86da674b68588af18930fda2330c2fa0bcb5b8087a92d2d740b65fcf
MD5 dee4d253207a5667721cd97ed4dc67ab
SHA1 e30f65662e2e89e5115d49f915985156d4b66d89
SHA512 49787039055503a33eb5dc78e9bd5718849e368c6fe0a1369175c33cf0f81d539cdf9f46be9d8a89b15fe7bbc1cd4640fef6ae8adb4ba50fb1bddaf70497edd1
TLSH
T18BA00221CD5998C1E24143BC9AA10294AE90CCBDEA05231283AD00548C681408993604
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597cf6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe597cf6.TMP
Size 48B
SHA256 e91b95011fdf087255dbb1e346b195aec2af88c57785b7903ed38b63ce1e603c
MD5 a0d5239aed5062f5e8cdb1785fcebaf9
SHA1 f0250e427d0c2899ab1c26fd6dc361993b949854
SHA512 5b87047c5a452dec9a78ece1072cd8e3bee949e3a6efb101551df2278e9de0fdfaab73d474371c2b83c44c289e99a95aeebaa62d07c213956b5c56ae297c118e
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2b0cd73fe8c2c208611f8af679ed1e6388b64c31f99368e2a3f49b540c4555c7
MD5 4025a797d7cb1ceaa5036e234d3a3320
SHA1 63875462bd0459a526ea83cf519c94b160d20b5d
SHA512 54123613d86d8b665010675eef02919ac8e70c9d9f96f869c94ed83baa286cd840eeaffd3054100307b7e7226ee68af4f3b0046387ceff8d42a6df80fdda56b3
SSDEEP 96:KAVqKG0CWxS1RTL72JLk97R2KjT7X2nZxsHxni8YKhu4:wd3/7D
TLSH
T16691534A35BA0212283D258DF2D3953B5F4239A37154E5AF3FB850A14F6AE121CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a0d93369-2c57-4ef3-9276-40b620326f54.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a0d93369-2c57-4ef3-9276-40b620326f54.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 693a0749b05bb040df4481a7f7c8217351484efc6f5a61d30ccb19689942bfa0
MD5 3392474d16aa3c456be7ea704b42f228
SHA1 7555fe5e309f4aa779a50064823ee0be6b2c45fd
SHA512 b7849ea458400f7b52912634caa49e24831d9ff499c287d6156a63e281dae29c85b376e91c36a7ed656c25f2630b3d8ffc21a69fe182582d89ece22aec85ae5c
SSDEEP 192:u8m+xasuheOwQxMGsNDtQObi/mAQmiU1JPf4Ea+jWOmBwR+QmZyamgrq1ScjmqY3:uZcIhsNDtILnQEa+SOOqmUjScjmwS
TLSH
T199927D336D789C3699A6A145F88732179EB89073DBC85B84D9EDAF0C00D65AC131BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00b16d80bdcb5885f7ee30c0e8de0129f6665c60b2aa32c5ab746ea113ae9d5b
MD5 7ce0b11e6a9710c439b0e50a686b03b6
SHA1 61a099c522b2f93cd108f9882fd670efe3fb4b04
SHA512 ee12da8ebeb3f1ca69e9b2e38fd31f6db3b1b062ad2a9832b524310ff7521a10696f9e88bff3f4ef0671ac733d6282214fcd17c53a4ba89acad78758d5725c24
SSDEEP 192:vONy6Db6QmiUyrDHBa+jWOmBwR+sRgG7vU6:vONy6uqHBa+SOOpwU6
TLSH
T1C002D835696C6CBB9EB26E49F88727275FD4103BDA966F44DAD81F0C00D764C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2f280edac4448ab55a85491dbc6d6ea6cc64eb58428b523fadecce8a0c4c2156
MD5 a3ba1ef5187923222cdfe724388d13bc
SHA1 da84ccd6f61268f03fae85c2354b2a1951ead767
SHA512 472d69518929228ea26bfabfef15ec820897475af7dc7f39e082dde19d016193fb1b533dbe449f100df2a299d8ef852a60ce7ebba139e580fdcdf7f835d82e68
SSDEEP 192:uEm+xasuheOwQxMGsNDMQObi/mAQmiU1JPf4Ea+jWOmBwR+QmZyamgrq1ScjmqY3:iZcIhsNDMILnQEa+SOOqmUjScjmwS
TLSH
T150928E336D785C3699A6A145F88732179EF89073DBC85B84D5EDAF0C00D65AC131BD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 96f763f84a4fb6cdcd3d8a70288476a6fbf72d6dc8f0c69228189978de9bd653
MD5 b5db5ef4d978513061e44fe6e4cb2888
SHA1 e58685abb048cfe8b08a81349142239a2b29013b
SHA512 e763496803e58a900ac62fc643c1981c398961c343148974d6669ed7541b95f28dbaaf65740bfdf6bfbd332cd2803889224277711713e5a9f213e83ee2a7da33
SSDEEP 384:viFiZcIHzsNd8TUNTUlIlMILRXQEa+SOOqmbjScjmwS:6FQTcwghjanOOqmbj1jG
TLSH
T1FFD23AF259D78836D9AD5747EB7E2E129EBCC063F5849640B7D85A0CCC960BFC306825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a5a1d5113bb200d0b7c23250ba3b47fa89fbc09714ef4aceabcfb0246831ff25
MD5 e5916da6e86c2761807c9b2d8d5128d8
SHA1 1ae1efaf59b5592f14a9f0cb0f2cadc12ed15bf8
SHA512 231381b8b5d767bf0f02c8addb7a4423ce883d6d1620a677d498117a1d8c507fbe9812876b1f2034fa386f3978bb8b00e926b64b7707b1ee59ad8548f0f648aa
SSDEEP 192:gONW6DbLQmiUyEDQBa+jWOmBwR+QmZHNzgrq1U6:gONW6FfQBa+SOOqmnjU6
TLSH
T16212093679689C775DE26554F88732179EE8412BDB8ABB90D6DC1F0C00DF69C234A83A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d5145822aa8351b65050d9748fac1994d74a9cf584ca2f1f332013af948c54a4
MD5 325334a22fc7d8fbf6ac83927b368bcd
SHA1 61b33992de8fe19f56c0d6c20642b282f12b963c
SHA512 55eda4b5c206ab0c9bc7db7c2e1f7adee8bc22a9491fa00a867321ff03daa2682a78a4deb76bc3d8c6e758fab97f464d6175b7b33d4988082748df252a85ea3d
TLSH
T184E00142930109B8C4680A7005432B222F92C11100A1231A5A2001686C276002D34E80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c6368a60a495afb0f6be9b2ebba5bf909cc684d2e64b776db8f11a7f421d382f
MD5 b4a50003bdbff7403252907c5c9f9e99
SHA1 802fe904ce17312df38cee5ad1e4830189aed6f8
SHA512 a44221fa02635cd6139e325230e53a368f54fe2c80973965d9f3fcadd0c8990bf71ac7c4dea15a812711246f089bc8de7e9c9703d2c748d831f06e9a4b6aaeb0
TLSH
T1FDE0010293010AF9C47C0B700A832B263EE3D22501F2122A5E2041682D273002E34FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5930ca.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5930ca.TMP
Size 392B
SHA256 1468a6c6570a491115e193c9fa232d6a4459c0828c050d72ac045bdbd5d57bf9
MD5 68b2293abc33115422c4d487a1b75cb8
SHA1 3e348c401e71e194c468f5bb78ed79a5f225294e
SHA512 5f839c926faa37488dd50667512eb0126bbdb9cf441fbec8d56d11db7215a89cad7def2ae8b7b99e021d5eaae81877c5854e2a888369cdf7cbe0b9f5e36c29fb
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aa148c2a54a9093eb13cf9ebb2ab2ac699f31b92c0ae85224212723f9cfaf315
MD5 be891f0d3386fac15ac06f5201d508bd
SHA1 27f36270e30712ef863d5744ff06ba006e4d9012
SHA512 3e2a6a7678b5fe014f4f22f76021f1cb968eef65ddf791a7a661a9e9e0c757cec70154865cbefbc3688a0b274881851d615f930af0778c122888e8b73bfef4d6
TLSH
T17E412858B6FA1158B3766F26ABF6A56D487FB8372F07D45D00010E4E0A67A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download