056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd

Resubmissions

12/08/2026, 00:35

260812-axn2yssvbx6

12/08/2026, 00:32

260812-avl5kswajb6

Analysis

user interaction
yes
max time kernel
711s
max time network
902s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/08/2026, 00:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0x21 viewbot.exe
Size 9.5MB
Sample260812-axn2yssvbx
SHA256 056411a3ef1c584491bca1cc670b0218a91b1312676f2931f8d10532141cfdcd
MD5 e9f16db0958b3ebbbfa466a40e0446ee
SHA1 137d68857cc0d4cc6aa16e83660c9f472d70cf55
SHA512 c1d40d988fa54c4748855a79dd8dfd470245e24fe10dd09d165ec3184b6c076fb8851bce8b57c88590197c96ae34fa73f2a9e3acc89cafe622e9741d0e59a4e7
SSDEEP 98304:PIv05w/L4VC1hdb0EXrJ2WGILcdYJCZxFie3q47c3byuZ:PfS1h712tILcd5NieB7Ub
TLSH
T174A67B03EC6514E9C1AEA2748AB39262BB757C480B3227D32B90F6347E77BD06D79354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery execution

Malware Config

Signatures

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4568	cmd.exe
2892	cmd.exe
2028	cmd.exe
3564	cmd.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309685886369539"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{8C57356B-48DD-41A6-8813-DE151F595625}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5016 wrote to memory of 2892	5016	0x21 viewbot.exe	87
PID 5016 wrote to memory of 2028	5016	0x21 viewbot.exe	88
PID 5016 wrote to memory of 3564	5016	0x21 viewbot.exe	93
PID 5016 wrote to memory of 4568	5016	0x21 viewbot.exe	95
PID 2152 wrote to memory of 2864	2152	msedge.exe	100
PID 2864 wrote to memory of 4280	2864	msedge.exe	101
PID 2864 wrote to memory of 980	2864	msedge.exe	102
PID 2864 wrote to memory of 3656	2864	msedge.exe	103
PID 2864 wrote to memory of 3656	2864	msedge.exe	103
PID 2864 wrote to memory of 3656	2864	msedge.exe	103
PID 2864 wrote to memory of 2184	2864	msedge.exe	104
PID 2864 wrote to memory of 2184	2864	msedge.exe	104
PID 2864 wrote to memory of 5028	2864	msedge.exe	105
PID 2864 wrote to memory of 5028	2864	msedge.exe	105
PID 2864 wrote to memory of 5028	2864	msedge.exe	105
PID 2864 wrote to memory of 2296	2864	msedge.exe	106
PID 2864 wrote to memory of 2296	2864	msedge.exe	106
PID 2864 wrote to memory of 2296	2864	msedge.exe	106
PID 2864 wrote to memory of 2112	2864	msedge.exe	108
PID 2864 wrote to memory of 2112	2864	msedge.exe	108
PID 2864 wrote to memory of 2112	2864	msedge.exe	108
PID 2864 wrote to memory of 4004	2864	msedge.exe	109
PID 2864 wrote to memory of 4004	2864	msedge.exe	109
PID 2864 wrote to memory of 4004	2864	msedge.exe	109
PID 2864 wrote to memory of 1708	2864	msedge.exe	111
PID 2864 wrote to memory of 1708	2864	msedge.exe	111
PID 2864 wrote to memory of 2412	2864	msedge.exe	112
PID 2864 wrote to memory of 2412	2864	msedge.exe	112
PID 2864 wrote to memory of 220	2864	msedge.exe	114
PID 2864 wrote to memory of 2924	2864	msedge.exe	115
PID 2864 wrote to memory of 220	2864	msedge.exe	114
PID 2864 wrote to memory of 2924	2864	msedge.exe	115
PID 2864 wrote to memory of 4840	2864	msedge.exe	117
PID 2864 wrote to memory of 4840	2864	msedge.exe	117
PID 2864 wrote to memory of 4840	2864	msedge.exe	117
PID 2864 wrote to memory of 4652	2864	msedge.exe	119
PID 2864 wrote to memory of 4804	2864	msedge.exe	120
PID 2864 wrote to memory of 4804	2864	msedge.exe	120
PID 2864 wrote to memory of 2904	2864	msedge.exe	121
PID 2864 wrote to memory of 2904	2864	msedge.exe	121
PID 2864 wrote to memory of 4100	2864	msedge.exe	122
PID 2864 wrote to memory of 4100	2864	msedge.exe	122
PID 2864 wrote to memory of 4100	2864	msedge.exe	122
PID 2864 wrote to memory of 1680	2864	msedge.exe	123
PID 2864 wrote to memory of 1680	2864	msedge.exe	123
PID 2864 wrote to memory of 5376	2864	msedge.exe	125
PID 2864 wrote to memory of 5376	2864	msedge.exe	125
PID 2864 wrote to memory of 5392	2864	msedge.exe	126
PID 2864 wrote to memory of 5392	2864	msedge.exe	126
PID 2864 wrote to memory of 5852	2864	msedge.exe	127
PID 2864 wrote to memory of 5852	2864	msedge.exe	127

C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe
"C:\Users\Admin\AppData\Local\Temp\0x21 viewbot.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2892
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:2028
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:3564
- C:\Windows\system32\cmd.exe
  cmd /c cls
  2⤵
  - Executes a command shell one-liner
  PID:4568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x230,0x7ffa3fe4c188,0x7ffa3fe4c194,0x7ffa3fe4c1a0
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1844,i,996987365823302923,13635423052283469225,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:3
    3⤵
    - System Time Discovery
    PID:980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,801900319472408213,2424689683749107538,262144 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:2
    3⤵
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,16161828340865665338,2942760530226149310,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
    3⤵
    PID:2184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,17629788949746283130,15631598824245094656,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,11219106366888624301,11248385295439856977,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4104,i,176914752633490822,13469764250723900663,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:2112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4124,i,11755955919122780163,8155220677619576619,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,1985635473964047010,8692449840868411268,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:8
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,8157576898251478499,12642701695153392847,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,14553211358889573002,15699073105884448533,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,5211225350786584420,12504202330780501403,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5160,i,8518931273499550583,395747789639974853,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:1
    3⤵
    PID:4840
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13321965523967316685,15968196187160701465,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:464
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,13321965523967316685,15968196187160701465,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
    3⤵
    PID:4652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,5624961972074159800,15544196560211420617,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,11857063380412255399,142427362324577252,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
    3⤵
    PID:2904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5240,i,3239814016291412953,325027804598474527,2097152 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,15968225343365169761,1810864067858971399,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
    3⤵
    PID:1680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7488,i,11446145054481998623,13771911005805283609,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
    3⤵
    PID:5376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7432,i,10814310787482700863,10214097537148327793,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:8
    3⤵
    PID:5392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,8220987262017901346,7394242516878043876,524288 --field-trial-handle=2572,i,4720593192738861403,6886180212475170114,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
    3⤵
    PID:5852

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b207a449613a78c4c7398e326b1087cd184e2b7f7a35685e24ebd43594187cfa
MD5 41d912b38f3ea36ef553e2fb42286e1a
SHA1 555837dfab2e9db8052bbfee3c93dfe4fb3dbfd1
SHA512 e15f48599e09e1e992ebbe15d905a6e70aff8726f255b40e0143eb86e24c16aea641f9b6d98b60e94e4d41dbe92c83d8bfe93e1a850ac9e6498b853853b6c01c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T199B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c107d5cf33a714a068be0aded9bac4225385ecd3f59f1705fa681e4010125f6c
MD5 aa4214cdd355dd491d7e78f2dc15f214
SHA1 60b5b7a0e0c833918c018f11fa7354bbb8735685
SHA512 aaaa9dc5718e77344760f3ebe4d3dbfe1578d67071ac4752c2addfa29e2e562b6da4ab466d0cef8231f31f45568e99edbac8c445454402bcf9b5c4cbebeb232e
TLSH
T10BD02372BE91D3D0D019303D502002403B26023123CF832310A8480CDC7404082DEECB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000125

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000125
Size 55KB
SHA256 c0b1c3c6995c24eabd1a6fcc4f00523e022b546cf1fa4fce6c30d04763244d1b
MD5 cfd886e1ca849a7f8e2600763f236d78
SHA1 c1fc2b10d20c529c01b465a1edc0ed2fe04f0bd5
SHA512 254e37e3650b2c87b524c96f517586b690094abf7c8e0539b050ecdc4c56c2593bedab7b1a830b827ddc19f1c3e05ff4096ebdf4cc969b5bc5fd33cb34e94fd8
SSDEEP 1536:WJG/KL/shmr0SyKV2i0Qz0j72A2+0G+gSRLBeFDP3:liL/8mV2i0ac6A25G+1LBehf
TLSH
T1444302EC6A22F9ADAB11E5E847349AC2F140D6DE34156293509EDB98200F24ECDCB75D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 10KB
SHA256 af2f897175c72a16295fe9bcd46711ab6cd36a91f949d57b5bd563e936144ad4
MD5 940fe4c42ee1b0f751f44875544b66b1
SHA1 e1071dda3b66a55b939ebd02c3e750e93d79ae22
SHA512 082d72299f11468c3cd0942685a56f460b89f569538101058587337f3f0dae8255a4e2ec5bb5db364a0fd7f996dd6a5333b07b62eb764bef775822ebb50e31fd
SSDEEP 96:YCK3ypfrvGubPVOUYsCdU9qJGWhplbiCFjGT89GnI1ZsrA6ptv+t7:dRrvFPFY69unbvFiTEGq4A6ptGd
TLSH
T19C32A626C896FB6CEF587CB0EB751D1F213A086A457E1F83940D5C2CB4067ECE395998
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58c5eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c5eb.TMP
Size 3KB
SHA256 6210fe58b8f9792b6e41095384013e983385e05c0a6685fdd10b67ef361ecc37
MD5 81323b5c415c9f0b6111d7ae4473f675
SHA1 1e4a88325a7172decf43995802efaa20e8cbaa2d
SHA512 def2612b3a6df42862779f155f7126a1653529195f759da6e617e9cc29ff0b50d7e1d9b70bea3fd28fce53ecf92421cc96bd7c2281af4ac5213a875b7a87df58
TLSH
T1A6614D08015F6D6EE32CADF2F7E1525F747D818A89AB0ECB201088BC1906BDDC679DD8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 076ae06aecbb065e7e717cc374785dd7b5644da819bae5fdd56fdd3db4b901b9
MD5 5a836ea7fffb2d58bed687b2e3bc6b43
SHA1 5e599d2031f9655698347fd59c0e29427cb9cbd5
SHA512 c4e82bb2890d23aa3fd711da5a2584b5ee31d5d2fdebb48678187ce3dc27c98088b989e6bd136e69f9d4ceccfa01c16d6f78303ee50ac32234eb9008370df10d
SSDEEP 192:Dvev+NIcTNac7T7FFNGk4jHOEOv0Sv4kFbvSoiVhty5:Dvev+NIcTNac7T7FFNGk4jHOEOv0Sv46
TLSH
T1BAD1BDF783E6C22D9A0199F4AA15AE1BCF580560436C3D6A85E47F2BA7F3471E10178F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 e520218b78f2e186c9a2b72c6ba83ec57b8c89a7e6847523b3f37c74a63b5041
MD5 6ab1e3d8c739b5eff5cdf43157071a21
SHA1 a8d41b78804c8917252ef1d0ce7e6b146ad7b94d
SHA512 9159c2d0fe89f6cbb4ef5cd827cd96f2b8f5b2c7404c742926d3dbfda680a0f5e55b01271e6daf489360a6e6a55a86e3dada73d8e5f53701df4582b767de4b72
SSDEEP 192:sxZ7QUn3RVyM/jK1Ml8MjL/fMsPTXXg8/bgkQdpmuBHW6+WNSQZGHSp/YQcVD7X/:sxZPn3n7L/fMsPTA8kN7HbSw/uB/
TLSH
T1527209426A341D77DCD7D219F901BB63D6F84162A5904E58BAFCDA1C04F6BED2223C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 6875d79944ca23c7081679666ae38e4661e39617fbef022d9e178946d7effefb
MD5 2741f431fcfbe0c8126e5eb829781b24
SHA1 978f2bba98208c8b905a1b17c565f8f2ffeba8f8
SHA512 e7846b5c8fcd6c81f3b1b14d8496236b16b553adf4387c1e73dfbc76f652b677f96f8adbc83fbf7b8232b365e0b85400abbff2bb69b8265ec82cdc6fc9348ca6
SSDEEP 192:sxZ7QUn3RVyM/jK1Ml8MiL/fMsiT3/bgkMdpmuBHW6+WNSQZGHSp/YQcVD7XIg4J:sxZPn3nqL/fMsiT3kL7HbSw/uBc
TLSH
T14C62E8426A34597BDCD7D219F911BB63D6F84463E9800E58AAFCDA1C04F6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 67bab501855d9b4ba19596fd38ac14c6c9201bc82a604f5b43c7a63780a6627a
MD5 6f32256d07df5197cd74b19feb5e9665
SHA1 465c379cd6f379a6d91ee4d4bbba222544318570
SHA512 4cd3f7e59406b7ad5f73f6525bcdcbc0c9566ff9cca5cee165c0f4c0aef5eb943490330899c49d03c8a76a7f511da3e72812d4a2c12adaa73007f4c6acfed7bb
SSDEEP 192:sxZ7QUn3RVyM/jK1Ml86jL/fMssWpVRTXXgc/bgkQdpmuBHW6+WNSGoZGHSp/YQ6:sxZPn3nLL/fMssWvRTAckN7HbDw/Ixx
TLSH
T19B8219026A345D7BDCE7D219F901BB63D6F84462E6904E58AAFCD91C04F6BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1e915188ad1576486a181fd298ef0b49e33eb2e44b0245351c962dbbfc8825b0
MD5 321925e62db02147465d1b2c5f2a26bd
SHA1 f068010791712b20f5d38ef381cdd22827699df5
SHA512 d8182473d857eb38c036193de72367d616bbf8e0e0600b62661143160c96e9953799fd06f745e5227157cfd2c12d07001c65a457a27f4e3ce69f937accc3f73e
SSDEEP 768:288iJANWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaALl6opd9ro/kdUnI:288iJANWvx76ru1jaJALocd2eUI
TLSH
T183E2FA3B680CCB7E4F845E9CEC266F966DD801CB6A944D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 c6172fa0de298d8d0da7ae9445b61085378f5f5360594524952466ea02907216
MD5 81000d92c7e18400206a983d158a1711
SHA1 97e5a5de8b2c1262cdb428fb897c2445ff83dfb0
SHA512 990276f33c777320723bb16bf510c8fd12622ac2df6a21194ad6c0b63b496e94e5247634e5ef86776424b0d7bfcd72e1ebe0346287168df30b3bc52d77ff38aa
TLSH
T1FBA0025406A46200E442A2B0A7960759524459901586170DC0A103CCD8D9449868124C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2079e03b-da06-4427-af71-e6e1ddbd9ea9\index-dir\the-real-index
Size 72B
SHA256 473acf905ae2afbc795b9835716faf593b65f72fa0d185b1e075fcc3e8f9def9
MD5 3a6786ce8eb1b464f8faf7904b05005d
SHA1 00f8d72b599b4d2aa81fbb08e8c1794a047b8ad7
SHA512 535dc37d1e2bba9827426d9b765bf54b1df7e729963e9d3b632240d7ad325fbb018355ad656ef62cf1088bdeda696a2d4eafc751fedfe9720078d50b5c0e8b5c
TLSH
T11EA0023423C80806C01661F5155282C21200AC101A001746F0E5188ACD50580855110D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 6595a4ef3577510e27f8b7bce0f4f33831b3364ce41f632551e6082c95a48524
MD5 6a460017ade32728ad56267e376adea4
SHA1 ff94715db2a8d3810e125c46d20bd0e2355f75ba
SHA512 2af25cc5d55103f67cadbecc2ba5b0b654216619ccc2cddeb34138863b2364daf9cafce2efd10762638adcf7de858530a545abfecdee0771dc8bdbb6e46ce9c5
TLSH
T1AA2132484EA18D9FFCA089B21272A4B4737089EC1715B753683C32316E2775A664BAEC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 4KB
SHA256 bf4129fe021f7885cf4670758d193f7a9483b69f82664f9fb7e239c9b3c102ec
MD5 caf8efedef16a384ee82e6352654f0d5
SHA1 4a955da98c9f41ad20290a6aa9b0b02753ad5947
SHA512 0a2017c5fa18ca6b339c47738d17a5539cbac821adc1d6764e41a860eafa11f3d9d967fef189fd4a7f9081367b0f560001bf49e1ad9c655a46a700b7426d5073
SSDEEP 96:MGTYFGETmdKmDwrqk260tq2bgJHePgNjOKP:MGT8LmvOj09bSeoVP
TLSH
T1D381F74D4C859C6FECAD05B319F668917371A8EC5785AB036A7C7130ACC332B2D162A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5873c4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5873c4.TMP
Size 1KB
SHA256 47d9d913b2e2bf299a44d5f648bd5ce6a1702e2bfed8e7642f46eabf22fdfd72
MD5 47ef500326c4e767620a25847508edfe
SHA1 2e43656049fd79458f33db0596b10c2b6b9b318f
SHA512 c6a5cdaa69d3d9c35fdf35abab8c5db12c3e26c4408f1c0fdbe4e391b5d403d48480a4706c34e3ca407be0a40af637f0c734954f766aca70e32517959a91f603
TLSH
T1E121E18A4A918A0FF88450BB1963B4B8733599009712B393A47C62795D25B8E6A5F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c8153bf610112594258d6db95944993cc7dab9d29a714b0d9339ac08a28fdb1e
MD5 1a7a6f0bc50ecd3b0b12d47b4be2fe9e
SHA1 840c360a2671f8ed549a550aac2e3726d9a8071a
SHA512 f5dbc02b0f238ea9a9ca4f99716d9a4d4ad36b7b600b908ec648f33f6b90b7cc4f92e5a9c1e649bbdba6aa3616fd22303989861f7f41aaceb6b4b5ca2eaa73f9
TLSH
T1F0E0C0F72EE72C44FEBF63E10571E8A00241B459D544BC8F5416EB8324A1352340AC22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\ec6c50af-5227-436d-a38b-6478666ebaa8\index-dir\the-real-index
Size 72B
SHA256 779b8e9ab6aaaa09edcd77b25c723a83dc771e868d260ade890246d6eb22a836
MD5 a14bdc4153717631d1ca78dbfd2b4bce
SHA1 12348ae7999c037dc5974acb9430bc67a4717c0b
SHA512 1fc8403ac24772d8911e3d6eb6939f9d2be0bbc658a377858eea8112ffa5cb360e2173e1455d5bb27ab5c54bfd0da2d538f2dcc4405bba6f0037c934e273c1a5
TLSH
T1A3A0021C26882500C06E4AF41506014467864D10035C1B46849804559D725584302501
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c5db.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\ec6c50af-5227-436d-a38b-6478666ebaa8\index-dir\the-real-index~RFe58c5db.TMP
Size 48B
SHA256 48bb93c279cf768b9f049a5585d5e797033be24e5978d5e241ac52d6ffdaf43a
MD5 147f18878535ec4a1ffa5bf190e3d62b
SHA1 11aaa42d127f90a8f39d3b5a5d5c37196d6440ab
SHA512 d9f88482eb820e53bc2a8cdb65537f6275b22e2270ad831388c82869df513579fa6cca7b20865ad8e3ab639579078bd79f4e40eb132aa9171dbae4d864d1152e
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt
Size 159B
SHA256 88f34c91187d4fb09a06e6649d148603f33d5b8341a674709dd866a2e2b8cf48
MD5 be6d0911270fbcb526a6982ecc68fcee
SHA1 ed3cff6a0924c25ea6287be2c0ab6f83ce452e74
SHA512 60ca9b47bc8738817b779e98ac90f12734cf059443c25c5e97ca5754b8eb2be74d2d79d9579da8fa1d231221ed7d10a5b733afc5fd8395c641ed3aea344ff64b
TLSH
T1C7C08CABA669C121BF308FD030B962154E231888E8A18ACBA04252DC0A118A12879FB2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58c5eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\4cc699dd486af2551d01b1a74abd5337c6e052e5\index.txt~RFe58c5eb.TMP
Size 165B
SHA256 bb1d329642b2b44879b2fc44dfd49b2f7195303adeb7aa4f58f0eeb41d3c71d2
MD5 d21f91956fc7eb26b7fdfd7dfa4c9066
SHA1 d923fa15fe2c4e6adb3cf5a2475d9272ef0a179f
SHA512 68c5bb2d800367b58eeb5f74dcec6a352606b2aaf11bb8d65a48bdb1da3090dd8f31f1f6ea8787261628af90e8a0d10c67ab0cfd546d562a949c8883fc32a70e
TLSH
T10DC08CABA6698221AF304ED170B862054E231C84E8818ACB608232DC0A318626878FB3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 288B
SHA256 c28f06d39e28495d9b84d8998eca411ad2ef9776eb716c4621292844c6cbb445
MD5 7e7abfc96716f3c6a3fe5e740c43feba
SHA1 273114b0dc0f3fe58ac190bc4b25a3b21f84c3df
SHA512 7f98bbc515d495466032bcc95860b55d3d7d6b31f71a99f97b6492f3dd53d21dae63152a6dbe63f67aeb8ef9a30fbc0106c6e83710a4adf2153137f7f0025216
TLSH
T1CED02228CE80A281C5012278102381D3633E84E8D80C77E6012C364A3BA60100E02618
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c56e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c56e.TMP
Size 48B
SHA256 67d80e7b6b2df81190dc50a61db54f3f1179c1485e19c1aef4b8a73059d39823
MD5 55dbff7295a8d4c8a36f7ba72ad231fd
SHA1 b7bc6eaa0046d2d96adf90d7f4936e8d86d631c0
SHA512 34d2a866bd0930dee4ccb549f67f4bf5d73cffb3e3e3e012b2d4b1ee9102ad779decd9d2b3c70fd18fe8edbec5c13f82aa121b670d6ce8314c9d764aa0c574d1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 84014e08f8283b7d62c2b5e2d13d4f3e611c00de9980cb53ab1c8b30f6c48761
MD5 a91ea3b523f88f546c63698148da92dd
SHA1 9fe4418433e80c75f1db7e5b35ed7a722cc29007
SHA512 1ba3462cfe22731d8fd9d87510cc81746dd098d048a9afb22383b1360ef159c2dbbcb973f7b5bc42c966261fc1ab20b555295c38b8e63233cb7e28561b7a31dc
SSDEEP 24:KdDf6ZQaVdJ5J49Z+EIjFJKiWhaLJ1EDZSmLMO8Z6yXYRfcHuaLdzfn43b++Ij7d:Kc0I7KVScvyBOIXKnqAvyIfKL6Ubys
TLSH
T12291DE2175B742227DBE64289394A71B4743B2937558E82B3BA810B25F66E380CFDCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d23179c13529bb76c5bf2f4e159fac5cfec3b2e23f304ad2642870185991e915
MD5 3189ba83588fea686e1fc731470812ff
SHA1 bc7c1a7d85f2b99f8270cf7ab311bbbc25fd67ae
SHA512 e83a062bfa8b2ac7df09d5df2a028ac96b87712832a74a548eaa39feb282c636b3a1fcfda4847549f429429ec76bef7d4f1cc68f06cd005e521c5005259e25b7
SSDEEP 192:uuDm+xasuheOwQxMGsND/fTpW+2LOUyimQQTmiU1dgr4k03cmxmFW+LI+qnMXcbe:ngZcIhsND/fTydiSc0kmKWTDMsRnlYs4
TLSH
T16B928D729CB43D77ACF7A057F48636134EB4D077A6C82FA8A9EDB71C01DA1980316D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a2ad2ad1a568615776954ac68c413cccb5b994c9b3dd1bca56ac757859b36d5a
MD5 fe2da015d9adb528c181b3acd4d66f72
SHA1 df4095778d29c5a0a61c55ec7089da3f782edec5
SHA512 89e94f57a04adf008c5619d8c54b632d506ed305762f9928992c729c4b9d9b98ee577aded7fa34ada8ba60376e3cee53f80057bee6a6845ab9b7c26f7c6d6611
SSDEEP 384:nrZcI4sND/fTydi780kmKW3fxA3tO+vwdx0cqL437n3MsRnlYs4:z4Wudz63230DqL437n3hn2s4
TLSH
T185C25AB1D8A42CF754A6E0CAA586F6126DB46037DA8C4E5CE6F9B73C304F9F81312D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 256df38774f84bf01b1e04d7e8224e2acf872a9122353cea133ef216a94ae4c6
MD5 c4515eb0d306058bb9c93d4914f95b3c
SHA1 fe73570e056544005417572cc00e1c4476ba4ee4
SHA512 07d6c9b51a1fe484bc9f9ba3cb408eae7595f0784ba13573485ed17635f3e5314569cc1f8212fcd090463f8ed204d9d1e9ca0e387567a68fecba70625536c2e0
SSDEEP 192:uuDm+xasuheOwQxMzsND/fTpW+2LOUyimQrTmiU1R6r4k03cmxmFWqLI+qnMXcbe:ngZcI4sND/fTydi7G0kmKW3DMsRnlYs4
TLSH
T19C928D729CB43D77ACF7A157F48636134EB4D077A6C82FA8A9EDB71C01CA1981316C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 372cbede97f58ab3933977aa8fe91bcde89a63e636312a2e9ee6ddc99de619ce
MD5 1a62bd2bad54139c6fcda55c06a64b1f
SHA1 90850e443be138d17fdf1bc8e910b03328952133
SHA512 90926865d73e0055ecce3b3e03475673f4031bdbee7a282a457c28d8908d8d2c09697db91e45d29c4f183ad93453115edaf2cca3b9b89303a28054a4db235fdb
SSDEEP 96:ZqONkhQsjpfmUTmDK5ih/cIPURHl8h4otop5Q5DqBhPwivh50xy0SFYKHAxEYe3q:gONp6kDfQmiUyy6Z903cmxQijo8U6
TLSH
T16A020A346C787CBB9EA3AE4AF44777275FA5212BEA852F84D9E42B1C04C764C1703836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b9cc4798b90644fcad6455ee362e240345d99e7ea17275abe3d71863b41b20d6
MD5 776243629295a322fbb100a19e9b6f2f
SHA1 c09aa8c93dadbfb48066bed7b1c9dbcd36034075
SHA512 e25d8d18c672b1a91f5864db7d13aac262bafd3b1617fb13da3a393648d7ab4f0ead2369131feb536a183d693a58f3cc2852073e1aa2b2b77cfbb9f0978ff397
SSDEEP 96:FqONk+QsjpfmUTpK5ih/cIPURHl8h4otop5Q7DqByPwivh50xy0SFYKHAxEYe3DX:8ON+6kYQmiUy+6U903cmxmFWRcR+qnU6
TLSH
T1BF123931A878BC7BADE3A491F48336135EA59127EF882F94E5DC3A1C05DB25C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ea9a477dfe542720e17f1180941e8fabe8640bf238f5711fa80ef242062139e6
MD5 0b5275e5b0cfb20e5de7faf1b9dcadd5
SHA1 3ded1ffc568512ba6bd7ffe8c7a8a311049f516c
SHA512 344113aa34ef1a75195ef7d02b120fe2fd4c3a8fedadf9922168c61f14b81b50d9f6e7df66555b2b90fa5746022cceb07f30d1541c4c092a5fb33e5d9d980ccd
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe58af36.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58af36.TMP
Size 392B
SHA256 02f8b7be9cb0b6efe90a90f60a0537c1fcdac761edfd959bb2bb46d59c78f953
MD5 e4d9f6658bc374df644958d0ea0f168b
SHA1 ea624681a390858c5c18d7cf25f51ae3299aff16
SHA512 6f39dc4572a60a4b28f550c161c093b1b451daacb164a7e475a56a0f2372c0bfc0e519f5489f98d3d88f94b3fdd62e81d27d19892d136555ae97a00f485f10a1
MD5 SHA1 SHA512

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

3e1b68fa-21a2-4f42-82b5-a722d91941c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3e1b68fa-21a2-4f42-82b5-a722d91941c4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 997bd80ef649012c71adeb80389363fabe3b144a5707176d211d1c6b213dac05
MD5 6feb1a3326417b2f2ebc843d6e85d06e
SHA1 7b0d461f37f59213ee1cdc0e0481500c147d1ece
SHA512 68d49a5e062d66ffd122231120487f2dc80736d078ecf89215496b32a0609b108a2f37e6ddc854065604be886dd4e7822da6314bb8e4ef1dd71c4677e1d719ad
TLSH
T16741075CA6F9110CB3B7AF5AABF6B96E047FB8372E06D09D00110E4F0A22B40D961737
MD5 SHA1 SHA512 TLSH

Submit Download

3e342c4f-88db-4002-92bf-7baf3b71edcb.tmp

Path C:\Users\Admin\AppData\Local\Temp\3e342c4f-88db-4002-92bf-7baf3b71edcb.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7aeee22a-ad3c-40e8-8722-a38e24896031.tmp

Path C:\Users\Admin\AppData\Local\Temp\7aeee22a-ad3c-40e8-8722-a38e24896031.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_1179722721\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54e42b94-d290-42c7-9031-eef2af3512a2.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2864_1952946108\54e42b94-d290-42c7-9031-eef2af3512a2.tmp
Size 153KB
SHA256 299ff2b88f972402bfeaa0a772d457de7c8a5aa8498cacd924345cb79aac18ce
MD5 c4a20d073fe58488935da829aae6fa17
SHA1 dbd31aa3dcd1abd3d554d29a9bca83bab02709d5
SHA512 61f74480d3471180f14e2171be6f5e33ab0a03a7a4837334695556a9484da1a862cc059969834d4950a038ec97f192805e5e718cd2a280aba675bdc9cee5d976
SSDEEP 3072:C0qfZ9r+hy+exmKhRts8o7SYbyqNDri8EBalnQt9RaBoAkaX2Ns:C0qfZ9r5msvoOGi8QQQbRwxmNs
TLSH
T126F3E02D6EDEC956CC0F61F96F29724BC50A4F0B818B648B624E881958F434E17E29FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads