hxxps://pressbooks[.]pub/app/uploads/sites/32176/2026/08/0cc92d32-aaf4-4935-8f08-1cff75153bc1[.]pdf

Analysis

user interaction
yes
max time kernel
109s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 00:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pressbooks.pub/app/uploads/sites/32176/2026/08/0cc92d32-aaf4-4935-8f08-1cff75153bc1.pdf
Sample260809-ansnsaxbph

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5868	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307085355280005"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{F4D2C918-293B-4A66-A6BB-2740E8F58011}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe
3376	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 5960	3376	msedge.exe	88
PID 3376 wrote to memory of 5456	3376	msedge.exe	90
PID 3376 wrote to memory of 5868	3376	msedge.exe	91
PID 3376 wrote to memory of 5456	3376	msedge.exe	90
PID 3376 wrote to memory of 5456	3376	msedge.exe	90
PID 3376 wrote to memory of 2948	3376	msedge.exe	92
PID 3376 wrote to memory of 2948	3376	msedge.exe	92
PID 3376 wrote to memory of 3364	3376	msedge.exe	93
PID 3376 wrote to memory of 3516	3376	msedge.exe	94
PID 3376 wrote to memory of 3364	3376	msedge.exe	93
PID 3376 wrote to memory of 3364	3376	msedge.exe	93
PID 3376 wrote to memory of 3516	3376	msedge.exe	94
PID 3376 wrote to memory of 3516	3376	msedge.exe	94
PID 3376 wrote to memory of 3996	3376	msedge.exe	96
PID 3376 wrote to memory of 4288	3376	msedge.exe	97
PID 3376 wrote to memory of 3996	3376	msedge.exe	96
PID 3376 wrote to memory of 3996	3376	msedge.exe	96
PID 3376 wrote to memory of 4288	3376	msedge.exe	97
PID 3376 wrote to memory of 4288	3376	msedge.exe	97
PID 3376 wrote to memory of 1080	3376	msedge.exe	99
PID 3376 wrote to memory of 1080	3376	msedge.exe	99
PID 3376 wrote to memory of 1080	3376	msedge.exe	99
PID 3376 wrote to memory of 4792	3376	msedge.exe	100
PID 3376 wrote to memory of 4792	3376	msedge.exe	100
PID 3376 wrote to memory of 4792	3376	msedge.exe	100
PID 3376 wrote to memory of 3928	3376	msedge.exe	101
PID 3376 wrote to memory of 3928	3376	msedge.exe	101
PID 3376 wrote to memory of 1944	3376	msedge.exe	102
PID 3376 wrote to memory of 1944	3376	msedge.exe	102
PID 3376 wrote to memory of 5064	3376	msedge.exe	104
PID 3376 wrote to memory of 1556	3376	msedge.exe	105
PID 3376 wrote to memory of 1556	3376	msedge.exe	105
PID 3376 wrote to memory of 1556	3376	msedge.exe	105
PID 3376 wrote to memory of 5920	3376	msedge.exe	108
PID 3376 wrote to memory of 5920	3376	msedge.exe	108
PID 3376 wrote to memory of 5920	3376	msedge.exe	108
PID 3376 wrote to memory of 4244	3376	msedge.exe	109
PID 3376 wrote to memory of 4244	3376	msedge.exe	109
PID 3376 wrote to memory of 4244	3376	msedge.exe	109
PID 3376 wrote to memory of 2504	3376	msedge.exe	110
PID 3376 wrote to memory of 2504	3376	msedge.exe	110
PID 3376 wrote to memory of 3656	3376	msedge.exe	111
PID 3376 wrote to memory of 980	3376	msedge.exe	112
PID 3376 wrote to memory of 5556	3376	msedge.exe	113
PID 3376 wrote to memory of 2128	3376	msedge.exe	114
PID 3376 wrote to memory of 3656	3376	msedge.exe	111
PID 3376 wrote to memory of 3656	3376	msedge.exe	111
PID 3376 wrote to memory of 4352	3376	msedge.exe	116
PID 3376 wrote to memory of 4352	3376	msedge.exe	116
PID 3376 wrote to memory of 4352	3376	msedge.exe	116
PID 3376 wrote to memory of 980	3376	msedge.exe	117
PID 3376 wrote to memory of 980	3376	msedge.exe	117
PID 3376 wrote to memory of 980	3376	msedge.exe	117
PID 3376 wrote to memory of 2172	3376	msedge.exe	118
PID 3376 wrote to memory of 2172	3376	msedge.exe	118
PID 3376 wrote to memory of 2172	3376	msedge.exe	118
PID 3376 wrote to memory of 4836	3376	msedge.exe	119
PID 3376 wrote to memory of 4836	3376	msedge.exe	119
PID 3376 wrote to memory of 4584	3376	msedge.exe	120
PID 3376 wrote to memory of 4584	3376	msedge.exe	120
PID 3376 wrote to memory of 244	3376	msedge.exe	122
PID 3376 wrote to memory of 244	3376	msedge.exe	122
PID 3376 wrote to memory of 244	3376	msedge.exe	122
PID 3376 wrote to memory of 1708	3376	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pressbooks.pub/app/uploads/sites/32176/2026/08/0cc92d32-aaf4-4935-8f08-1cff75153bc1.pdf
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffcd606c188,0x7ffcd606c194,0x7ffcd606c1a0
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1544,i,11550414986106084466,949530672036127403,262144 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,15799265338275185333,3553033199365144150,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,14355346089267696218,13402322113388388320,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:13
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,13444341417911698149,3712822843502184206,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,1953219440098051953,16115568324590686225,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,5971374338916242865,10316720284284149822,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,12465060659165254216,12792861702066997209,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:9
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --init-isolate-as-foreground --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5308,i,12781872503069876113,16707922147511005306,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:9
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --renderer-sub-type=pdf-renderer --pdf-renderer --pdf-shared-library --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags="--ms-user-locale= --jitless" --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5516,i,435324574202943450,1869171775811075820,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:15
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,18257487776089574130,3118275251501228171,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:14
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,17895046463426091953,5070019364328852844,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:14
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6482346958806667714,5281308925063250716,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,6482346958806667714,5281308925063250716,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:14
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6656,i,12179093731934794995,15893675947134842162,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3684,i,14883348776194731943,17231851700734230440,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4800,i,15832965313760322103,7896394159401201180,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,16644995312017262218,11210504719676838371,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6496,i,6152226001395711459,812897569498546689,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,7246190722532085040,10729178736918669092,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:14
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,7074146144007137911,11752880231591215121,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,18337790103052326327,7134811422695274234,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:14
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7276,i,2071854643216152527,12160075548146412039,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3616,i,3936219576559805499,16528605370115831588,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=4092,i,18175221667440774538,7483756360828411801,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7356,i,4470239534563226970,5481040507594554132,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=7360 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,10637135241494220502,3799321646148641501,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=7476 /prefetch:14
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6280,i,11494394866593733616,6938928707615993284,2097152 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7816,i,1378891108647157778,3791547786114599391,524288 --field-trial-handle=2124,i,8237422656632231269,12062051531631574049,262144 --variations-seed-version --mojo-platform-channel-handle=6680 /prefetch:12
  2⤵
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0413267b-e478-4515-bef7-f8855dea179a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0413267b-e478-4515-bef7-f8855dea179a.tmp
Size 392B
SHA256 43ea5d48281c67b09c999b8ac9cffc8c58a2587f2fa4b2bf18451e77d18e5ddf
MD5 37c43e2504e5e20c9f670784e2939018
SHA1 5abdf4a8d4cd59156d0abc5eb5ed3922d62b83b8
SHA512 74f0514b89ab030b7f7e430dfea27d525a1197917d24b08824b3545b885da5b64e496f782ec80243dad0cf3ae15bde1087c6d67718d01f76ffe4eb04974841d5
TLSH
T1B3E00113D30414BDC03C4230984B1B322A96D02111D143064A6002593E26A002F30DC2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 16KB
SHA256 dd1b1bc1b12378c3f2d5257e13fce269351f7205c0b1d9a353bb6519020cd4dd
MD5 1828eec30395f0667811a9b55c744f2c
SHA1 62389846e8e32746da94a1cd5874918bc6f61cbc
SHA512 a5baf8d674ec9368cc53cf6074f6734dd5c01a7372bac636df0b064617759485d480b6dbc4036edbfaf5e54da5c44363fd51d76897fad1e959033897b377510c
SSDEEP 384:WBY2ZpX4PZRjQrzKRr39XXU0AoL6RHYnF+CP9JhBI9V6oB:WBV4PZCKV60AoLaYnY294Vv
TLSH
T1E172C0D059E96EF459DA15C4083D61105F23B520ABD3C7829BE24A72EEC27FC16FB490
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 37KB
SHA256 3b2ed8580badeaa0a72cc2435885d89e8e95d14d662a798fdb30daa14f0b39cc
MD5 a3d35c02bc5e98da4319006448bf7a8c
SHA1 0c93016beed5ce6b98a79b6f50d53b6616e3017e
SHA512 6f57027640e34ed172d6f5bad941c7a86ce0015f23e9fae130dc95fb4884bb1980e016871d0ee411cacd87984f2008f3192db0d770a67d65dca543a722bf6243
SSDEEP 768:a0/oxezMrWj8UT7KkM3loDswetvC5XPK1P9ELxPILst7uBvYrXgX/5t:5QxNruDMloDV/CfEjtaBvcEt
TLSH
T1900301F6DC6B045A86377FC030FF82CA6A0F67141A97E080202B899F719DF5657D5A87
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f0
Size 288KB
SHA256 8d8027cef4aefd730486a5a59cd709aecadd05157d4125b10f3262face4cf73e
MD5 361dafea42362ea46fbf8273c6ab5c4d
SHA1 e03090c9c9aca6e007bae5cf2bde6807c088a658
SHA512 f1170b88194822aab4ab926b4a46d4681850a85d155a7884c4679c6cf3aee04f418e9a8d20c75ccad9d66ae7bdcb9bf87ac65edf4abc66d45cc7676b85adf4b9
SSDEEP 6144:7bhKu0o+2+lUa0xxUFjCYBLdQ5efRB2uKgW9ibzzhXYu7xPLNk:7bvN+IthYBqsBygMib/hIu7xPu
TLSH
T1D85423BF2B478C84FC194930373D512D1E09E1C0AAE38778B48856594CA6DF5FE7A71A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000f3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000f3
Size 273KB
SHA256 700d079ad6f86baa7d874b0610bb8d2bb1a4278b006ff0b84892b73957dc0c5e
MD5 e9bb2f91f04bbfa923a2655948a654b7
SHA1 323286865aa115704fba3bab9da94bc26e3ae6d7
SHA512 9343e5ad3c05f77c61e4e3d68caf5a2a54f755771d88c3f8df1769ba70ec09fdc41d01e33f7e516f1d9aadba0ebc208421e03fe960596289d9df6a20f0626917
SSDEEP 6144:1RSuOMYTnjnxTkxSjKKDXR055DFGkrcJ9Ji2yfZhw3z9j6:HSdMYdkxSeSaGmcJ9Ji2yfZCjk
TLSH
T1695422BDE7F666B3F9102837779069BB9CBD859C4B0322A3EAD10236BDCE7431516211
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000fe

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000fe
Size 49KB
SHA256 32276b92c025b4bca01261aea74f70be21ad73efd66063b8de4497b211bb47bc
MD5 c27afea97d5c24a7451be1581be8e212
SHA1 7bbeae8699203a20539f0abe0fa4e4ebb0d9bae6
SHA512 aa332f80ef107e69c25c807845379d8f9e7cc2c9a5664b564fae9ab00c55cea054d94b1886d24f3ded57866a26fa52634b369956dca79d2a121212796b0cacea
SSDEEP 768:eDI///SkMt+6HSLJPCh1Cfkv6jpRuNQ8JCslFdWM9Bw6JD6XDqN7cKwveOTG5:sAM9IJPCh1CfkiknpPP807cKwv9q5
TLSH
T1B233F25C7DD72593C46DAABE88B548EB14B202F06F4F3E8602A7E87EC470C9FC549808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00010c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00010c
Size 52KB
SHA256 04215dce713e4cafd41c2d02df5a22d49ca5bbdcc730b2c0665fbaf922a1f5b5
MD5 36f73a10c6426caa40adab2c2c7a8a3e
SHA1 58a52ad1c46148e9e8794cc26d4748b58ff1305f
SHA512 6de9a4184650b09bbaccd125516b2b2b68eb36fb589efec0a54c58a0970a89c8ca3f5b553b5a703bac6ce790924720b1f7705823bbdcddfec46d1e41833697ec
SSDEEP 1536:/h0KDlvrPChxJDQCKIGdWB6csUdcKft8O:/hTv7An0CKIGoB6cpqKaO
TLSH
T1AE33D060594F326EEF5FA403A803DF37F9A22331317BD4116CBD9ADB6D511B28592B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 1cee76207956aa98ae3e3df0fdeb8128fde6625002ac4bbfe62d0fcee524b0ca
MD5 981ec1a9afcc2c9953eae7c9e56ba437
SHA1 43a88f500af677db9765199e9934700a1c7a5241
SHA512 78b94261c2b49b445dc6105dbfb5c969f2b41a89a4b85ead1af905ad95e8935fce6e1543656735ba1671f726ac4bb74c8f460461dc26d34a8d4b0e8fc1ffa3fa
SSDEEP 96:hNFwrCtnqetcjQTN2VhPXe2bC/86c4ECD6JnVLeH2LC9SxN8k:DFPqekQ5Qhm2bCE9CydRCaNF
TLSH
T107F1ED8092E8A5D1DF1945729BEFAE3935F9A452408FCF0A8B478E34E153FC45AE301B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a61c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a61c8.TMP
Size 3KB
SHA256 b9b07085038628a1dfeeb42023e9874ae33ca28ef9db5aaed18803b15abf6dfd
MD5 8906b353acadeccdcf08bcbd6427fa2e
SHA1 85fb6a8affcf9b531e28401c013e0dec769fdaa1
SHA512 e9ee8d574133cb71e960008b8f935a79fcb00de50341edca3229cf18bb9bdaa7d6da10e322cd2264d9bb0021bb55ab7ee40d2719eb2923006dd032839982a3ae
TLSH
T170519491632DB9D2DF258C75AAF3548D31F968E9010FDF0280426F34E6A6FA470F106B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 21cb9288350edb3124d63d7ddf1f608788fc94db34c3cc965d65acaa34008d33
MD5 de3a59f327a1d3d11da1302697cab953
SHA1 663e76c3a9d489dcbc9f1e95a79cb20f1189d0d5
SHA512 f005fba1b250f7a52a5e42ca3fc7df59b3c3a639f36de4868fdd05f589cee228e874c31c79c63540bcd0d7203af4400db20cfa03a861f033f5851dbb04a250fd
SSDEEP 384:D9UowZnxjKPeegZvsw5VaaiS1grOfK3pKNo4OigccrN2cbGepVGZ3GVn56JS1Gtd:smejIzk
TLSH
T11742DFF7C3E48A2DD81252F49B146E1BCE5D0924536C3C2AC9E5AF5BA3E24B1E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 209B
SHA256 3bd57c26002e6ce43abfa3f7c39be0e80f0bb8d48463795e8f529fc47619d617
MD5 a5add454a803ef62547a3a804876830d
SHA1 11c4725212fad27e1e36de16566c19c994d1a104
SHA512 29a566266174c94463954879fd0e8f66cc6e228bc928a881be5a46bf7cff083b940fa1d1de7e2272c6b69511c94accc2ad4ee555c4398f69b9d68741e2d36d46
TLSH
T1BDD02223124470B5A96CBE81426AEC8FC32610204843EDED11E49C98253A4AC0A27280
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 24d04a893dc61147c4764ddfa5e053fc73fb720bfd20806628ce609bcb884c67
MD5 d097fdc626505076b40d56504cf4617b
SHA1 7c3ee621711aa979a7228dba1e321ab341d9467b
SHA512 390939ba312a4955a6bfa20d9b326a14d0043ee538aa647e2abed141a534ab60cdc45dfc6e8202c7f03f5d291ac7b7123edcf0e19510c95f40191ec68c6ca896
SSDEEP 192:sxRkRhbG/fcsuqelwGwzoA8pKBe/g6+WNf7MFz/YoamOwTCYMGLIgIJ:sxRkLG/fcsuqIpp9/5Ta/pOR2s
TLSH
T13F4295166928AD3B8CD7E25DFA65BF53D2F91032A1D02E58A7FC961C04E7ADD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 b53cc60665aa940b31975ca4ea6a6003fcedc7608b8b293371fb5d9bde384ec4
MD5 e676616b13c0a004cf04838f89709d50
SHA1 60a3010a8a2cd0a051a5042e09f2e9f63db6c92b
SHA512 25eca7b711c0385652df5cfdf51c5370eb5096708b9b490b90897e130261c90ac18ca36da9a590c54268be141a8e2a75023a886302621657aaa6604dabf5b167
SSDEEP 384:sxRL3m1G/fcsHUIpaEE5e/5YQR2Id/aOR2t+d9:sH3m1G/f3UIpaEJ/5Yc9R9
TLSH
T1B782E65664249D7B8DD6D558FE25FF13E2F9106399805E6CA7FCCA0C04EB6EE2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d71c4782cfdcc60f0b1b3669cfd0cd6b07de38bfb86f8020edef21f11f62ff1e
MD5 664e1bc28faa218cf818515ca43407ed
SHA1 5e683b52cbcd5bb648f429de5667d20bf6b0569e
SHA512 594d05612993e55e7330b3b98697f236047a510c9615f9cc37849d2a99f722f7ce9986edf79f97bb0b5d2e8a72830354722a68770cb7a8867d4cfcf85141e996
SSDEEP 192:sxRLRhbG/fcsHqelwGlzoA8pKBe/g6+WNf7MFzx9K/YoKmOwTCYMGLIgD/J:sxRLLG/fcsHqIpI9/5Ta2/5OR2F
TLSH
T12F42A5166928AD3B8CD7D259FA65BF53D2F91032A1D02E58A7FC961C00E7BDE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 c2488545f53f5a5c10fe95c41fdb0ff6c4e5d3bbdabd8d4a83511a5ede900b1d
MD5 453ffc364f760ad7b07654b9176eed82
SHA1 d6accbcc3622b4f1c9b03026f2b806e6eea8b630
SHA512 b9aa91d71c1c41180aac2ebe1ff6657e23b251cad5e709fb1746102c338830149ac104d51b7beb50aea9a8742cb33a1084c201505f4f9b4fae73a2975401e4cb
SSDEEP 384:sxRL3m1G/fcsHJIpLEE54/5YQR2I/3OR2t+d9:sH3m1G/f3JIpLEv/5Yc0R9
TLSH
T1F572E61665249D7B8DD7D658FE25BF53E2F8102398901E6CA7FCCA0C04EB6EE2207807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 bfd5f656efe950c3eabcb1bd798b246f71e14816c39953044c20be2c5edf705b
MD5 d8d5d2bfe84f56b9922513b16da0c314
SHA1 bdf17b88c8699a0ff61666c9b08c5368f179a465
SHA512 1723b2d407c9e8a2903a646e0ed453266e9cedde4deb3cae1cba32e0a56f83a9bbdb3b239c9c0b1a749433748c911b11033a4ee2a12e6ec63372e87fb0406b37
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRX1ro98a:j26H0RWgs2f028F1+UoAYDCx9Tuqh0V1
TLSH
T180B2DC2B640DCBBE9F800A9DDC196FDB6D9802CB97588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index
Size 360B
SHA256 41a8b03a0708854bbea89d649782c729c45f10fd6bbcf1281f61ee4c489e0081
MD5 9b123226d2e77435d4be39f1d74da420
SHA1 14874dad25d7cf6513e681da935224d6f4846893
SHA512 27e9913c0b6d887d7d5290a441c27b02eac99c20ddcd2643fcfde0161899a6ba5155d7548861f59aa13b4bab1f875d2584aa18dd1405917ab673ba37fe6d5a75
TLSH
T150E02B8E8C679943CE36B87A0673A42E333F06FD1605AF9A50FE141DA65263C8241645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index
Size 3KB
SHA256 7564314a44126c47b0bc60b9a67a1a61682df7bf1575cce3315a01cbb3dfc92e
MD5 7d9def287fdd7b12cf8565149ca47ac3
SHA1 37d9118149f19f1eb56c1fd9f65f143deb035995
SHA512 2d06f5c56e2f90f6d736388f3870ccee41c3ccb6ff6b4431ffb5d498ac9054842ae4f81218a1737b89410a3f5264a00f383db7a1fe21abe30697a7928a84d67a
TLSH
T14551F78E4C476F66CDAD24F318F61852733A74FE96858F079A9CE8387CC33291C6A615
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59ab88.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index~RFe59ab88.TMP
Size 360B
SHA256 802887d34c8febdb6a9b33d309471724f9e2d4c8386510e786fee6a66649cfcc
MD5 59ae19e97a0326b6c1647511439c32ca
SHA1 c9f62c54a85a56e136644bd921d8fb15042053df
SHA512 9474f355961b2aa9b3e5bbe28d44675544d89384b859a0a866f819658aa9405c1f05812c5076b6e1d4a54eb9eda7b96a40d85e8e31b0da21a62b62d48dd2275f
TLSH
T13DE02BDB40D19D52C92669361502553A333F08342505DA1A50AF545E15217BC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 c55055216df4af382dbcb24cda5a5c3be63079a4c01cf6e8fd4765ec475b558a
MD5 332a4c2b254c2da5a0da0cf821c0bec8
SHA1 991474e6016a55fbfba5f0e942d5c9ddc9632329
SHA512 f12084bb928eac5188fd3eef933a92df157e57592ed98cb6a71a5872c846935e1f80bcd31f7f6e5da4e0987045b23f351b330fcbab68cae111c2ce0ea8291227
TLSH
T13FA002242780704AE01226B716D6036192008CE0510052268091004CDCE5E44499105D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e0a1eae2-cf16-490c-8857-199f41dae341\index-dir\the-real-index
Size 72B
SHA256 e51f530629e5cf7c33fc8c0eeafb292e42b4f76951761a05b8c1d59b309147d4
MD5 f880ecca670168f6b38e93bf23cff45c
SHA1 199a393e6bd0ae4cd18f0dd2238eec2df808959c
SHA512 75dc194dcba5c86a48208ba8464b47ba7ea5ed07d64a6b76871199e185d9805931c4fb9c8ffe4eb7df87f1de25c74cabba50ff459073b777cd9d382b6193596b
TLSH
T10DA0021426D5E201D04326B069DBC162339159500B41130DB7D01844C8625C9568F12D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 461dd7f85e00e99ff77509160654b772d58062a15375c84ffcb433a136332794
MD5 2069938c1be1fbeee9377097eaa2f5b8
SHA1 329d7a93f0172b79dcf9bbce152a7a37f73f83ea
SHA512 11b4ad5d7b9d4f900a5e9ec3f4046585f857a14d39e1ab6b6aa7994a0fcf43ce3769bd43404d832742a3686c05e7bdd9a10fc002dca6bd9b8b607cca7269b4ef
TLSH
T166E0D8F22AE72814FCAF97F52435A8A40191B954C948AC8F651A97C650B12167896C25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 6f104ca81f09680660ac57c93597384182bf2a8ddcd658048eb0842364c5f377
MD5 cf3a77ed1f9f266cda767a326d2dca0e
SHA1 c93de91c131cab32a3c6d6857a4cb4cc7b5130c9
SHA512 cdf007c25ac9e738bc713ba7d32baade980518e84abacc687f3b68906f753b0ba748a50396c39fd604e211e2c912a043a68a2054dc54fe95283cd66d52528918
TLSH
T19BA0021D8F5DE445C190467598A5058C3F258EDC064562116AAC005C885214052E3135
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a034d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a034d.TMP
Size 48B
SHA256 b8b3ef8006ba1a4769e4195b5bdb2e306114cfde94846c32fcfc455f7d5e8404
MD5 615a0a79f77f3f96f9655720f931a086
SHA1 be255cfec949c38ff75f0d91f1c064faafb0a6c6
SHA512 fe8970d8a0a8d72ea36d2241e882295f659b39cd833b9dd48c5a322fdd8b02a2a1b35bf962834924608e88f537d6a34a18c2b88baa6852e5871458975a30f8aa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a2ee1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a2ee1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 49KB
SHA256 53c4b6dcd0cf19deb2078fed7cd189e4677594e7b7e2b8a72ba4191c11338878
MD5 d5d868bceb07c7245ecb72e7c2626802
SHA1 c6a5c5a80f12a8dc7b6c914f3c472b0ca7241a47
SHA512 35385c0908f9aff0e50967c666cbb539180a5dcbb88387b5fad9d6c7b31d2b02da07a41f2d8460c54e830e8b9006a2f4f313faeb3b57f1a2df903781619350c4
SSDEEP 768:aF0rv+4UNbdA3ZwgYqp/TBOWQtt2YONXyer1IRCzni9/2ewBKZOJh:rbsbG3BgSIqn02evZ4h
TLSH
T116335AF194DB9937CDAD9797A33E2E026EBCC053B4804660B7D91A5DCD864BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 3fa373ef2a5cd42d987282fb3f358e48f508fa62b062247ff381016f250f83a0
MD5 3b506228a0fcc1b10701e3b988cccfb6
SHA1 43b96f2676eead2631f1f338cf5878ef343d66ce
SHA512 8a5e8f0ab8cd29507dc9682a4b5c9376916584c6080d951403b84a6238a738cf4d0dade3d6a9dbc90110bb3e6c045be72d016e4e1a1e7ac87695a6440c0cc916
SSDEEP 768:Trv+4UNbds3kYF/TBOWQtt2xONXyer1IRCzni9/2ewBKZOJh:Tbsb63FpSIqn02evZ4h
TLSH
T18013BE31E468AE338DE2A2D6B10B7243BFB85053D5C40664EADE2F5D05DB99E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 0cc0c64622b03600e05b0c4c93bb3db76060b87e116902942da1554a9352fba6
MD5 b30eb974af6b3dd9762a35200c8a9e7d
SHA1 3d54bd52b0f6b3b064f0b18254ade44c7215b863
SHA512 a641d681068eaf1ea443c4185a4d96be36639d9664843945ae784ba19c81580be4ab3b373d8cc68d2718bf2f487c2ebb25207ef73cc36274a0d05941cb8ece2a
SSDEEP 768:urv+4UNbds3KEPt/TBOWQtt2nONXyer1IRCzni9/2ewBKZOJh:ubsb63VfSIqn02evZ4h
TLSH
T16C13BE31E468AE338DE2A2D6B1077243BFB85053D5C40A64EADE2F5D05DB99E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 f6b29dc405250f46a778f8d981660bb5615c3d619c5348a277e0d16f76824554
MD5 f60a6c4f6bd73a79af999402d59fbe53
SHA1 88f07c4c81844018dd87297d4464c33c113bca8e
SHA512 796c5ce9925711f55d1dc49b194661dd619394fbff9ff20d0c1f0ef997efd783939058297629bc37f79c81e0159348c38a8a61dfffee768ef37dc31127f69073
SSDEEP 768:2rv+4UNbdz3gb/TBOWQtt2zONXyer1IRCzniw/eVH1SK7:2bsbV3M7SIqnrEH1l
TLSH
T1E103BF3291A89E338DE2A3D6B14776037FB8505796840BA0EDDA2F4E069B59E130F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 86c534592b7524d3b99d6a57f29c63c5f7d2363462137dd9e8ab40d1ee531d30
MD5 57d4b2f54e74d42c069217db87a91491
SHA1 d45b9414ed91c6000e2d977348981ac038eba23a
SHA512 481acb8a2f765e700132023685339e8b997c0c29265687f90a0f0d60b529e026198dcda8918c779c6dad9babfc4feba8c1d5e3164290658932c62cc21afea98a
SSDEEP 768:hrv+4UNbdz3jY/TBOWQttgONXyer1IRCzniBgeVH1SK7:hbsbV3MbSIqn/EH1l
TLSH
T15B03CF32A4A89E338DE2A3C6B14777037FB86057C6840790E9DE2F4E069B99D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f1df8e27c0a2ae87495e459fc1660c92db3c17062f3cecaf4b49976c43c6f0fb
MD5 4f8661a0f5888f15d07f412d82cbd224
SHA1 9cea0d529bd6ce46681b730ce493925b5040f072
SHA512 abad1b44ee10e73a37e66739bf5757d1aa15d046eb61c8586449ab7b0d2eec31fe790081717ce257c1bc13bf623b0d9da6fed1cbc2c926190124955698601a9c
TLSH
T163E002035304147DC03C4330C48317322785D01100D10306462002451F15A001F30DC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2ae503c5332cdb2e6fa0f37c6f75d64d819d87043ed8b8350c4f6e90de4d257d
MD5 4a80619b532429cc677188dc75a49d6c
SHA1 06cdadca5f789f418584acdc0eddfd4475630e38
SHA512 51146eb6f6abb3df45b053c5610f721b5095e34019b84c393733abd6391a1146e7414320ca4b50fab5e12f832a83ba772cb7a4a1d7bfa1ddf5b1999b40267dc5
TLSH
T10DE00203D304147DC03C4330C88717322785D01100D14306462002493F15A001F30DC1
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59e2d4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59e2d4.TMP
Size 392B
SHA256 d283ebeda2f3d77510b22efcc7866e77876b69734b96a21c69cbf58b5cf830c8
MD5 d18cbd04ffbeb9aed2aef65681b1c3fc
SHA1 27b9c1b6b07d5a03d0f8ec065766a6bbc9fe0bcc
SHA512 3bba41edc1bb6fd378a06d1585020a7fdfc6cbc4464687059a6b5d56c5f72ce4fb24bf01916c0fcf8ae05ddfaa30f7b3caf603856e667e787421186212678190
MD5 SHA1 SHA512

Submit Download

4120d033-8019-46c4-8ed2-a3c778df1398.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4120d033-8019-46c4-8ed2-a3c778df1398.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads