hxxp://mcfinder[.]pl

Analysis

user interaction
yes
max time kernel
899s
max time network
738s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://mcfinder.pl
Sample260802-pgvbcsam3y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5908	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301467237003072"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{22B62B35-BFB1-4767-A56A-9EE264D8943D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3700	msedge.exe
3700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 3096	4680	msedge.exe	80
PID 4680 wrote to memory of 5908	4680	msedge.exe	81
PID 4680 wrote to memory of 3784	4680	msedge.exe	82
PID 4680 wrote to memory of 3784	4680	msedge.exe	82
PID 4680 wrote to memory of 3784	4680	msedge.exe	82
PID 4680 wrote to memory of 4208	4680	msedge.exe	83
PID 4680 wrote to memory of 4208	4680	msedge.exe	83
PID 4680 wrote to memory of 5188	4680	msedge.exe	85
PID 4680 wrote to memory of 3904	4680	msedge.exe	86
PID 4680 wrote to memory of 5188	4680	msedge.exe	85
PID 4680 wrote to memory of 5188	4680	msedge.exe	85
PID 4680 wrote to memory of 3904	4680	msedge.exe	86
PID 4680 wrote to memory of 3904	4680	msedge.exe	86
PID 4680 wrote to memory of 3900	4680	msedge.exe	88
PID 4680 wrote to memory of 3900	4680	msedge.exe	88
PID 4680 wrote to memory of 2500	4680	msedge.exe	89
PID 4680 wrote to memory of 2500	4680	msedge.exe	89
PID 4680 wrote to memory of 5604	4680	msedge.exe	91
PID 4680 wrote to memory of 844	4680	msedge.exe	92
PID 844 wrote to memory of 5600	844	msedge.exe	93
PID 4680 wrote to memory of 3564	4680	msedge.exe	96
PID 4680 wrote to memory of 3564	4680	msedge.exe	96
PID 4680 wrote to memory of 3564	4680	msedge.exe	96
PID 4680 wrote to memory of 1016	4680	msedge.exe	97
PID 4680 wrote to memory of 1016	4680	msedge.exe	97
PID 4680 wrote to memory of 1016	4680	msedge.exe	97
PID 4680 wrote to memory of 1928	4680	msedge.exe	98
PID 4680 wrote to memory of 1928	4680	msedge.exe	98
PID 4680 wrote to memory of 1928	4680	msedge.exe	98
PID 4680 wrote to memory of 5504	4680	msedge.exe	99
PID 4680 wrote to memory of 5504	4680	msedge.exe	99
PID 4680 wrote to memory of 5504	4680	msedge.exe	99
PID 4680 wrote to memory of 4932	4680	msedge.exe	100
PID 4680 wrote to memory of 3452	4680	msedge.exe	101
PID 4680 wrote to memory of 1692	4680	msedge.exe	102
PID 4680 wrote to memory of 1668	4680	msedge.exe	103
PID 4680 wrote to memory of 1668	4680	msedge.exe	103
PID 4680 wrote to memory of 3700	4680	msedge.exe	105
PID 4680 wrote to memory of 1428	4680	msedge.exe	106
PID 4680 wrote to memory of 1428	4680	msedge.exe	106
PID 4680 wrote to memory of 4888	4680	msedge.exe	107
PID 4680 wrote to memory of 4888	4680	msedge.exe	107
PID 4680 wrote to memory of 2080	4680	msedge.exe	108
PID 4680 wrote to memory of 2080	4680	msedge.exe	108
PID 4680 wrote to memory of 3560	4680	msedge.exe	109
PID 4680 wrote to memory of 3560	4680	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mcfinder.pl
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2ac,0x7fffe740c188,0x7fffe740c194,0x7fffe740c1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,17640420250267529900,5437137568210849585,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,4479928021886769824,98974599962173749,262144 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,11134999497372105912,2502560232530935944,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:13
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,8697020336712394498,3254496680241103365,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,9768496675488708621,17467892805484226396,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,17433010829737301169,1103722594599499491,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:14
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,9089495904355226929,797525650871498636,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5657788010686701762,326264655164633933,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,5657788010686701762,326264655164633933,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:14
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,5524215596519786944,4332487761855977952,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:844
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1144
    3⤵
    PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6172,i,5630742511130588954,8522295427219358763,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6404,i,11012602072465918988,6438610930867521760,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7112,i,574815758650973439,18281931685249347319,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=7108 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3716,i,17260622820205405816,10535096401800248328,2097152 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,8609882710924872181,4873851823336490107,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:14
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,4864663432602817355,4759956116611752535,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:14
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,10043204041588358869,7398953436619358206,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:14
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,5159383599626310761,5201692817065124506,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=4944 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6300,i,8597298805392115361,4523671055072414433,262144 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,13717970682634479023,494639046644751691,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:14
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,982548214038147524,15798476168981506764,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=7004 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,14145848040205850839,16206165795060299071,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5920,i,3444699162127767379,7496008652120699940,524288 --field-trial-handle=2240,i,2436847669350580912,5320047212001858171,262144 --variations-seed-version --mojo-platform-channel-handle=5688 /prefetch:14
  2⤵
  PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:488

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5cdf6881e52891c9b9e0a3dba5afebb04a1f60a251a69cbe4748150151a2e855
MD5 55412128a750383589462e25170600ac
SHA1 11571b9d2795b2ed99f3a1b8e6b2bee46a8bc593
SHA512 714cfc26df0586a2a28ea80ad2c8da9b70ca3ed9d68578b306c42bab6d55cbb2ac11d0638a4e656741fe78e80ffea03bc398c7daa72bd44aa7c6df3ed7653558
TLSH
T162E086DD45DEC66F9606744B61AC930CC6D0361F9BC8A98EDF048888724A584B2DAEA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 13a6a5434ee312c5ebb33ce80f6d7bdbaa26d648f986c6d107d862e8214eb3f7
MD5 ad35296e504bbaf22097e8cf2da13132
SHA1 8be8ead5a96da38b57e6d105f6f04cc61031322e
SHA512 a012634505080f5bd027b570debfe3152b4930ec056fbae416196fa8d88b4fc4832e762caf509afe5a81f56b861937f71d7e732d5c0150e2da2efc83912773a0
TLSH
T1DAE0269804DBC31EAAC5744B626CD30CC3C0364A9AD8BD4E1704C8DD3006080A3D39A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 9533f9310459efd024777b9c1ff327de7688733c6f525ff494c03cd59054aa51
MD5 bfea2be3b9552f61aaa20d90a28e738d
SHA1 5519b20e7ce691fe4367a9808df9e2ae1e350ed1
SHA512 bf97dd5dc76660a26e995d2a4fc1c256c57944e41659f461ed48ec0d81f3ed076ca9d9bf61a917db0e8e2b807574e11cdb60eaf5684ecb8cc5744f881a7db82a
TLSH
T1D3E02BA6CD21BC3B0AFD2B1950A05786E744179B2F42591F3A3CD1098FF163E4645C6C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 28d500b4ded824c34c77ba1a25e1692aee15a63e0b20b61ce7698b12afa4c878
MD5 f74e9b919169951fdcd2c1fa4bc38021
SHA1 95fd17419a8986cfcec8860e5d64ca62e58328aa
SHA512 a43950e44db98988924efc8b81adccc14da82dea2753be9c0c63cc6a288afd830ac88468b94090179c1cf75f736ebaabf0591f83c1992469a8bac3749672d82c
SSDEEP 96:WXF8maJiPW0UlHPc4ltAvOM5nO8qaZ6xwF:wRTWdlHPpmvOM5FqaZ3F
TLSH
T19DB15F03819135E8FBA503F1F1E92F6838B0BCD6158F0E2B39D458FCE93AB426155709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5920cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5920cd.TMP
Size 3KB
SHA256 a53a6a5af33496a499e00e56dae766812abafb928500d38a8a7d5fc99b631bdb
MD5 54b414ce5c44d872339f38313948b202
SHA1 bc9fcb5594288279aca90e629e6b0a66c847f44f
SHA512 94acef6d218cfff96829b5935b47ea95241cc6f8001fe0d7d4c552d0d847179eb5d62b426d8980a94a6ea92c777a0632164d13760358763aac1ce014f150bfb0
TLSH
T1B471A507416A34E9F39607F0F0E93F5530B1BDD64A9F6D6B31E898BC9A32F142621708
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 8b3e8d96dd09797156269da92fd65b7865d63ee74b6d8fe87489eee13c8f3703
MD5 b0dbefb9fb80e73b9611f1298e59ca59
SHA1 e07e52ee9fa1abcb0ae066bd411477597f246318
SHA512 a3d096fc5ecdc6f94af69bcc6c13d9c5b54d3b1e0564fbdf3648e7e8104a0b7af3ec42ab9793f218dae5cc770951b7077848043510bcffbf14f0a1ee7411d0eb
TLSH
T1BA819BF743B1826DDA1196F0EA04AE1FCF1D0062436C79A985E46E57A3B2472E042B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 76671bf4dd1f1cf7808b7ab9ab1c90f340b3fa0f9836a3fbaee52d82c03cd3ce
MD5 04c36c225e7fbbaeb61c276fe78735e0
SHA1 ac3159fb883762fd93c1e2dcbd1585a42c8ded57
SHA512 d8b16b4a6905b384e5d11de6419dbc235524d523a4225bc9eb405392ec6474654dde276bfc0b810a45bb7b59d090a06638d0cb312a478c68e15e9d4e16659cab
SSDEEP 96:D1gOGUqflaaij6VzGGjGO5Ht7Vy4Xto2GtwQ:D17GUqflaaij6V6Gj75NJy2to2GtT
TLSH
T16191EEF783F5822DCA1192F0AA14BE1BCE1D0556436C3D6A85E4AF5BA3F2471E141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 cb3e667da2fffc58ab0d0d7cdd52f9fe131952055a5fd60ad5f323dfdd7e8d82
MD5 e86475e179688f4d22f0f96c29dd3dcf
SHA1 a7e126605895cc44febe75bba175daa5ad949a8b
SHA512 0fedb237b2ec2da1ebd2f031661c7f830109e1bcf175754e6f278cc090730200e1e08361d1287692f604ed2e00c9849c420e35fa8a6df3104c42ed3f7c099ccb
SSDEEP 192:sxZyRJyMqZjK1Ml8MF9/f8srv7HKTGJwabbModp9Q/sdN6+WNB+9/Y0hbiNzIg5g:sxZyqd9/f8srTHU2Je/PG/5UI+I
TLSH
T1597208026A24597B8DDBD319F945BFA3E6F91163D6904E48A5FCCA0C04E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 33904a9a74b6a85bd346962ae3cd47f2311c2d3735103965a53243fe6e9a2fa7
MD5 d5714aeacb6dd03fed3cabe53b79ef32
SHA1 a4a15c7d55833a23387b1906ee0afbae1b0e5bde
SHA512 cd558903afa9961f2b8263e771507175589b1b1bfbd55db60e6d06143f6d46df436d42b4c2bbf8de7d3f1db1c86a61a17d026c95f4c91c09084aa703959501e4
SSDEEP 192:sxZ/RJyMqZjK1Ml8UQvF9/f8srv71KTGmwm4RbbVodp9ROz/sdl6+WNKr2+lK+9h:sxZ/qqt9/f8srT1Ukxq8/PQ1/5QI+I
TLSH
T12082F8026634597B8CD7D619F945BB53E3F90563DA904E44A5FCCA0C14E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index
Size 72B
SHA256 62904ed6e65e66221f8f6d9549c1c041fea823c47feb5af98f82d5848d9eac3b
MD5 659dd4c5da3439656aff07d386b9ae4a
SHA1 6d1fa911f555a819fe5c04e9f04e2f315b26e41d
SHA512 ae7d1adb810df8718f9d14aae32d89c006e3b2e0ba54c6a789d4108fe6a3645c6518d381c7e3a45f29e6740c7a8de162d1ad80952146b1404744542d13c0042c
TLSH
T1D8A0021542803005F52332F2A5D7516223118AA0220627254190008CCCE4785494500D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fc2e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2c60ff2a-c337-4df0-aaba-fe27b78528c8\index-dir\the-real-index~RFe58fc2e.TMP
Size 72B
SHA256 35377e5656c920aac583da47631f491138cef28a4b4a1bb9fa3b4fe099586e0f
MD5 442f8c4795d1b82bc3eb90e922d8c71c
SHA1 d68ce367870d4a60426b0918e8e91d97bdec4e47
SHA512 b45d82d6c658d9aea66c86a24cd11285c1ae56a6a2304515db5b2931133f2523c5139b2f02e22a286c1c2bc38f7c9dc95403f1f94bb9fac1d60e6b6187596f89
TLSH
T1A5A00250CBC08105D12263B2569387411B10D8902210371780D14088CC909404D4600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\63c018b7-273c-422a-a877-1bf434e7f160\index-dir\the-real-index
Size 72B
SHA256 3acd517ac4eb2eac51d5b581e3445d7e494b0fc3753b95a7c6e12fdbb1d49de1
MD5 ff73313c0dc06edc9849b296f5ac89ae
SHA1 18f74a5218f8fba63ad8ab9137faba77e5f06ad7
SHA512 8cca18e1cc2f086430cfdefc331831b8e35c585542f051c366db4f8a9635aae64d90ba15fd679228105d361327866cd9d3ab73a286fdf6eccf584a5344939e07
TLSH
T1C0A00215D68184D5F1440779604B47802B3C6C20023557516EE0B2A8ACB5246E14111C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59162e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\63c018b7-273c-422a-a877-1bf434e7f160\index-dir\the-real-index~RFe59162e.TMP
Size 48B
SHA256 87223b0dddc4c14e3e56c6b359e10bde4eee314f2ee16abcb3a8efdb5e12a415
MD5 6fec13a21a32d49e23559f5d46d35f3e
SHA1 6d3190ec5a4204a28ba9e9a1b54ae75c945e3461
SHA512 341bd92bca42a5ec5e8a7f60c0f323f3f277496e44569b9cc34d12d0cdcf9d76c37f027d3555c844f1f3c4c0435ecb300170b52d7994cd72be92622a9d464ed1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\673ba0b2-ba38-4e02-b05c-f1c84ab818bc\index-dir\the-real-index
Size 72B
SHA256 bc5e9d7a96d44a40d4c9a13f6f03a1cb57d0aa5f1859f016c32814fd44991ef5
MD5 39a075d874f6a9460409f294ea76b365
SHA1 31f03118d5dcc9f3214c945202a6dde40e2f18c4
SHA512 ea4a2e1dfaa8f68a9477dba02067a9941b9b30cdef1dbc719a18ce7ebdd6b4cde756ed6dae6dbd1d770d0613d52fe87524f5afb56a2fc8bd9c7dedb80ec875ca
TLSH
T133A002370194408AC01507B156470251A316DD1D4105930545D08559CCF21994D31684
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index
Size 3KB
SHA256 ec93abe5e30cd02648b394c31307672d2c681baef5de73cd96a99790854fddd7
MD5 e49556f843e0b6fe627b791b97da340d
SHA1 5375f378b0723f5e1686e1aab76c969cce1eedf0
SHA512 e4873cda16d1097a35ad244b61683b5230e6478fadd4ca82df76409163d17c6ebc0c4cbd4b7979967268705f87972c8ab399dea093ef8523a20b594da218a118
TLSH
T19851B50F4E426A6AC99C02732CF71894373694DE5685DE5BA0ECA471ACC77252E19217
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590bae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\84929e18-7031-4aed-9651-196b2ec11ecb\index-dir\the-real-index~RFe590bae.TMP
Size 2KB
SHA256 bee3b9f6a8822e87667a4b4fb2e2ae7625930bd92aec75e704771ca99912f26a
MD5 6480ab11555d769030c75de369f9f0b3
SHA1 c810924b038beb491fc5decbc60b2208dcf49b38
SHA512 a97d3fe78e07b645b02fd7109af350a5ed9ec04ae6aeb950a874edf93b1f90cf2e7768bd046b94fa69d268cd7c84db5298ac0f5e8cdc1cd37b1253019b08d6d8
TLSH
T13A51974A4D424A39E8C841B709E3A8B4373929008719BF5334FC9636ACD379E3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 481B
SHA256 cd5296f4598b203c8d2439af18516d4a0c7e4aab979b5c8b650baa912647f640
MD5 f457e63253ed82dbeba7232bca724621
SHA1 e39b56e3072a4a86438f93f345287bcaa6647b8f
SHA512 561078af6864405a4a21ad2eb78ddb4dd372d5a90bb0412207330ef03e6eb554d6a4e3ce71a4b605d3550fcb75e6689ec009175a3587c2ced3df3c0fbbdc8036
TLSH
T118F027BB2EF72924F86BD3E32431906601117C94D545FC9F245BB99390B1325269CC65
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 476B
SHA256 0afae7f3b17b51df8ccfe021eb0ddf0e0629a9f6b1abc4e1af9615bde60a2cf3
MD5 ad909c72be9a214b0c0fab5c5441bc17
SHA1 daf29fe811e5180f8a38df761fa7d7eda478a0da
SHA512 72130c6c538340971381f658880eb142c0f104e159ee08f541d53bbc79ddcf8ae4f0001405053f4c95e402f7fdaa3a5720ab523e21a5adb18fc31d9c57bdfa2f
TLSH
T140F027BB2EF72924F86BD3E22431906601027C54D554FC9F245BB9D750B1225259CC65
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 e3796bfec31abcc9728df2e68245ad7467a80fcdccad6f30bb89f7d8827dd22a
MD5 25cc19d89d1146d1132f646247b70304
SHA1 314d2c72f962ca38e5a2dc102d225c479a23fe34
SHA512 909768988c387d7dcc0705bac50808886b516d0521989d4de1a23b76888c6d28ae03eaacedfd0b6e3978c1e6aa8804cbee6d4c1f828e16d9fbba458f9483059a
TLSH
T131A00231CD5DC4C9D095127095611584A214DC98660B231189EF4254D87819445EF218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fc9b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58fc9b.TMP
Size 48B
SHA256 3a89b9c2b2ec4d2973430b0e7a80f823a274608c2141234af25f91e04fe8fa62
MD5 2e6d857b56cd7ce7d728b849e036eece
SHA1 40f6a50c98b18033219847684868a442304a5f34
SHA512 3788f032b16593365a66498194c5c406e398d53c36e72751303bb65929167b8b5fc34d61ceb04125b1922ec0763f347914797cf5916f4bb25961e3f4f777fd38
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 aee1c2199160a240fbadfa1259f91dd4e9fd89cc50d2eeaed47201f14605ea9c
MD5 0201efc74f1b0088df3e532c3bc53e2b
SHA1 2aa44beda06d9125ad9a19795d7503e9811bd189
SHA512 ceb689cbff11e5ff1de6237e078b0f63e896f595798b3d00d81110f3b2901ea3d6fc56ac92ffe08cd800040766a5fd0a4d8a2ac59eb049406bdfc77cf8a565f7
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5A:GZLVDJjEDPV0/ZdsLH
TLSH
T1BCA25A0232BA02423C7E390C939797674A42F1633469AD7F7BA900B64E67E125DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a3a8a40c-847f-48a0-9132-de83939b481a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3a8a40c-847f-48a0-9132-de83939b481a.tmp
Size 17KB
SHA256 0b128989e3c5940c5f3473cfff43dcd3b4636fb256947e431d740ae4ad04efcf
MD5 1184c19f1fac275bdbec56dece094140
SHA1 e3e8dba89a9b84b015ab059d7ba0c166f8ffe6bd
SHA512 8f079ecc39d3fa7f9a68c39ddaacdfe3ff47902c14985938907735e44eae52c7a1142afc85d6d2618becb7567a0742d1b293c65cbc94fc908a3ecc60285ef90b
SSDEEP 192:sxZ/RJyMqZjK1Ml8MF9/f8srv71KTGmwm4RbbVodp9ROz/sdl6+WNKr2+lK+9/YM:sxZ/qd9/f8srT1Ukxq8/PQ1/5YI+I
TLSH
T1F08208066A34597B8DD7D619F945BB63E2F90163D6904E48AAFCCA0C14E67ED2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0314664-cc94-4715-886a-75a87f86ee37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0314664-cc94-4715-886a-75a87f86ee37.tmp
Size 14KB
SHA256 d897213338be3ef7adf5e60932d02724e30193c1ce726b193c1833ac109c4c46
MD5 97a379613867fa2a1b9cff6a7903ddc4
SHA1 7fd275c56c3cadd54455dbbdd0d2cefeb3642780
SHA512 d93071847de1efac72fc20ef3e97035f39b144960dc7d14afc7ac6aa955fd78071145436ef6d5797c9703e59d34456b0908b46c8aad925c107772ceb40c8ef84
SSDEEP 192:sxZyRJyMqZjK1Ml8MF9/f8sk7HKTG0w7zodpW/sd96+WNGY0hbiNzIgj+EJ:sxZyCd9/f8smHUVW//G5oj+I
TLSH
T16862E8066A74597BCCDBD319FA55BF53D6F9156392904E44A9FCCA1C00E6AEC220383F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 980a56f70cb1ed7fbc1d7bd91858d285e2603a1e51a7ac30734c33ef7230e001
MD5 3f63fb59904e6f3f88f79c0f5a5634e5
SHA1 766f012c2e17df3d6ada2d34a037c611569fb883
SHA512 d339d7efc4472c9d0b2d6e9951033e969ca9feecb9297cc4a4c2d31a0e04ca6fc737f87bd7a89790ef72f007ced1a4f0a849dc788d3045f5c01650b9ac104edf
SSDEEP 768:3FQS3SwglKekmVJmGyRLeRaJnewBKZOrk:SS3ikcsJnevZOk
TLSH
T162D25B71E864CAB7EDEA4F99B70E7603EEE04163D98C5AE8E5DD6D1C10A709D130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 3bb0ce467eb8209d4a42bcd2631c32b505316425a94c5734619a96bca7708ebb
MD5 a0f1acd566404f8d370d81442714a213
SHA1 cc7d8239e4841aa3c156f15f6dc1f1dbbea07c46
SHA512 234363a5548dad2088783cbfa0378c0057dd2b130f62bed1d9ec226e36255e79cb3d148f80b4541b9455e7e6c02ad86f25ec37449f7733b723fc07a7b26d2cde
SSDEEP 768:EFQS3SwglKekmVJmGyRLeRaJnewBKZOrk:9S3ikcsJnevZOk
TLSH
T164D25B71E864CAB7EDEA4F99A70E7603EEE04163D98C59E8E9DD6D1C10A709D130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 68fd819e0e12904c127fc7c2fd5560314207dc9dd8d398d09f3fb89f0e9e1490
MD5 3ad506e8208b615163ae7fe0dd07eea6
SHA1 9ff1796cd0bbd087ffab35b179277314cc568e43
SHA512 bec828c42c1b37473c1edc83075b9a7189ca2d3b04c73e8074d9df8b57c6b60b63b6a6b9e92603da18d3b609fef05d2f0a353decde69469e670ec7c96e4949af
SSDEEP 384:nTiF9CcmyWCs38NJ8TUNTUlIxBPm3ek32nn9RGV4Jfb8GgFRLCaGBISDaJe4KV8P:+Fccps3iwgPKekmu3GyRLeHaJI8p0yt
TLSH
T175C25C31E854CABBECE64F99B74E7A03DEE04263868C99E4DADC1D1D10AB0DD570B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 50ff43722761f693ca2016b25763a9ff282ad7bd0c2fbfffc65f1d26ccde1d05
MD5 4cfe85879a99a98751ccf422eac6f251
SHA1 0a1f03ab2d038201a4ad8515b956c90af0aa6f77
SHA512 ed27b96188d959fd04e7ad65fa986bfe15d13c43c95fa548826843315c8161de1d7ba66c4e569b469ebee8ff842fdcdd2f9dad144c149e313d2dc60036825bc7
SSDEEP 768:SFQL3SwglKekmIJmGyRLeraJnewBKZOrk:/L3ikrWJnevZOk
TLSH
T17AF2D4F198D78977D9AE4B87A73D6D029AFCC123B9881994B7C91D1CCC960BFD306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 d2ede97c3535adaf4ce6a9cafbeda99196790bbc5c8b44502479e41f86ebc302
MD5 8cfe5ebf6cd968d4bf1805eb9daa5a92
SHA1 f6a567bf7f0080dd0be494f93a3cdfc2b4ade3a2
SHA512 d5a0415769bc9a37157de752d584d7983dd6df8ffb571af44666967f74dadcfb897d476d9326548afa32ee236560adc069a10ac84cb831cbb1ae48a208899d08
SSDEEP 384:n+iF9CcmyWCs38Nu8TUNTUlIxBPm3ek32nn9BvQzs4Jfb8GgFRLCaGByaOUe4KVm:VFccps39wgPKekmXwwGyRLeQaTI8p0yt
TLSH
T113B26C31EC68CABBECE64F99B70E7A02DEE05163858C59E8DADC5D0D109719D170BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f148e0a07de52ac3f51f1bc314dc1fe2155d6e47bfb37ad17b312e1ef95b6707
MD5 17bbda63da50ab5097059cebc832e816
SHA1 744af93f81a821f781c1bab832ec5ec8cbc0d959
SHA512 3e74c1b646e948b96d4e6700e477af454f3debad9a38f2ccf15ec61215b7a0b9e8047231bcc71a06b1cbd3afcda0041404bc2c65658b9fc89a987611c5b20fcf
SSDEEP 384:nMiF9CcmyWC438Nt8TUNTUlIRAfPm3ek32nn9I844Jfb8GgFRLCaGBISXaJe4KV7:3Fccp43SwgWXKekm/UGyRLeraJI8p0yc
TLSH
T147C24B31E864CABBECE64F99B70E7A03EEE041238A8C59E4DADD1D1D109B0DD530B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download