Overview

overview

8

Static

static

1

URLScan

urlscan

1

http://example.com

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    1017s
  • max time network
    1013s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260513-en
  • resource tags

    arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    12/08/2026, 02:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    http://example.com
  • Sample260812-clvrgagr21
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 56 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 56 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://example.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4224
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x288,0x7fff767ec188,0x7fff767ec194,0x7fff767ec1a0
      2⤵
        PID:2704
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,1533471287608958877,4300279587399198816,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:11
        2⤵
        • System Time Discovery
        PID:2168
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1600,i,9447278717206103936,4448882539234190208,262144 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
        2⤵
          PID:1940
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,7092897726171236680,16152700795448358496,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:13
          2⤵
            PID:3992
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17820748300254991603,8392953348002390417,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
            2⤵
              PID:4320
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13139871548124119113,3534140673438922629,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
              2⤵
                PID:592
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,17670221238446786717,16127735810503646131,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
                2⤵
                  PID:1900
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4264,i,6310429036520909976,1823007746645207599,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:9
                  2⤵
                    PID:3220
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,6783850028898939283,15935591778641085644,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
                    2⤵
                      PID:1784
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4252,i,8754378084090695599,9974663464708377407,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
                      2⤵
                        PID:1736
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3948,i,820913127521909003,12626014327207055662,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3936 /prefetch:1
                        2⤵
                          PID:4532
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,11329735474240662360,16782598160761221521,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
                          2⤵
                            PID:2660
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,5658094464546082292,11729378864646473778,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:14
                            2⤵
                              PID:2860
                            • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,11740147446000540968,6103639851857303474,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                              2⤵
                                PID:3664
                              • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,11740147446000540968,6103639851857303474,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
                                2⤵
                                  PID:2504
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,4978326847416439002,11836986976012259462,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:4652
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                    cookie_exporter.exe --cookie-json=1140
                                    3⤵
                                      PID:1896
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,7366536814047052469,10409884710368753001,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:14
                                    2⤵
                                      PID:4904
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,8435104414405956395,15867008961689120788,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4608 /prefetch:14
                                      2⤵
                                        PID:1992
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,4735627578795036887,4027614152390154811,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
                                        2⤵
                                          PID:800
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,1885654941619914612,16077046530717101578,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
                                          2⤵
                                            PID:1900
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,534411615815010253,6763290679890455274,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:14
                                            2⤵
                                              PID:2476
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4396,i,9554155356771554284,11731941924068073398,262144 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:10
                                              2⤵
                                              • Suspicious behavior: EnumeratesProcesses
                                              PID:1984
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,13371898654606722342,131929285670532008,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
                                              2⤵
                                                PID:1824
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,16493888773171934345,1098321051110337565,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:14
                                                2⤵
                                                  PID:3788
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,7353410898032906880,15580353644689032978,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:14
                                                  2⤵
                                                    PID:2860
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3088,i,7638822363472791652,6544259096986239770,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
                                                    2⤵
                                                      PID:2104
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,10919053158229866885,12657107575872367805,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:14
                                                      2⤵
                                                        PID:3284
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5956,i,5643707112344721056,14086753084989491206,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
                                                        2⤵
                                                          PID:3148
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6696,i,13491072691825132884,15868331407839879849,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
                                                          2⤵
                                                            PID:4480
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=6756,i,16124488819104676735,9271376713955845214,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:1
                                                            2⤵
                                                              PID:468
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=6732,i,3386537126495851243,11463036155464723127,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:1
                                                              2⤵
                                                                PID:2620
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7320,i,11073770560687767596,15104471296592155321,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:14
                                                                2⤵
                                                                  PID:1508
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=36 --always-read-main-dll --metrics-shmem-handle=7608,i,3895965467571537978,7774577443499033605,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=7640 /prefetch:1
                                                                  2⤵
                                                                    PID:1724
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=35 --always-read-main-dll --metrics-shmem-handle=7024,i,2782288609393352571,7282432631552859646,2097152 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=7488 /prefetch:1
                                                                    2⤵
                                                                      PID:4108
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7664,i,12152243413325590464,18173642170523800263,524288 --field-trial-handle=2164,i,14857327135081795450,5669055377133741618,262144 --variations-seed-version --mojo-platform-channel-handle=7716 /prefetch:14
                                                                      2⤵
                                                                        PID:2284
                                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                      1⤵
                                                                        PID:5048
                                                                      • C:\Windows\system32\sihost.exe
                                                                        sihost.exe
                                                                        1⤵
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of WriteProcessMemory
                                                                        PID:2132
                                                                        • C:\Windows\explorer.exe
                                                                          explorer.exe /LOADSAVEDWINDOWS
                                                                          2⤵
                                                                          • Boot or Logon Autostart Execution: Active Setup
                                                                          • Enumerates connected drives
                                                                          • Checks SCSI registry key(s)
                                                                          • Modifies registry class
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          • Suspicious use of FindShellTrayWindow
                                                                          • Suspicious use of SendNotifyMessage
                                                                          • Suspicious use of SetWindowsHookEx
                                                                          PID:1860
                                                                      • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                        "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                        1⤵
                                                                        • Enumerates system info in registry
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:3124
                                                                      • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                        "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                        1⤵
                                                                        • Modifies registry class
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:2124

                                                                      Network

                                                                            MITRE ATT&CK Enterprise v16

                                                                            Replay Monitor

                                                                            Loading Replay Monitor...

                                                                            Downloads

                                                                            21d0b792-a2b0-4de7-abb3-341e2e25a9d2.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21d0b792-a2b0-4de7-abb3-341e2e25a9d2.tmp
                                                                            • Size 28KB
                                                                            • SHA256 1f7636e991f834d1a79a0e2ffbe4b4cc25a60ea79048229098188eff27439e15
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            blocklist
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
                                                                            • Size 105KB
                                                                            • SHA256 e1a61cf8ec8c094e45bb4e86f9cbc36aca297f52fa265914107ac060ac244abc
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 7da5fd99a0ab66e77a1c7d418475484f3755ec6c2945de3295f2577e789df01a
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            settings.dat
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                            • Size 280B
                                                                            • SHA256 23823794b3b6267e9c083ddaf520ee01fa32d4516798865f1445a1abc4b04bbd
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            LOG.old
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                            • Size 6KB
                                                                            • SHA256 a3a3e301e39e0d3facfedad96c3e8f7cf3733d9d3ebb2e58ddeba5604ec94af4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            LOG.old
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                            • Size 6KB
                                                                            • SHA256 84f6b73df0799206258a7541f35a666f05cd26cf60af0e29262ed0695d4a4b78
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            LOG.old
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                            • Size 6KB
                                                                            • SHA256 f7b439c41a85ccd026212612b93f809cb3b7a2c6aa18528077e94479a7c46a67
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            BookmarkMergedSurfaceOrdering
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                            • Size 6B
                                                                            • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            f_000091
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
                                                                            • Size 32KB
                                                                            • SHA256 eff9dfe4ebe815c15fa6087a8b712ccacea7a59dddcb55a5c819293252d73c32
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000092
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
                                                                            • Size 96KB
                                                                            • SHA256 6c501148aada1207002c4dc6fb8794554897d71abeb97e92d9d15c8cf61a8448
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000093
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
                                                                            • Size 407KB
                                                                            • SHA256 fa9808a087285bc5f05179523960d1455d8b9114e1ce6b51a159dea6a2ee915d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000094
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
                                                                            • Size 68KB
                                                                            • SHA256 d1460cb28ac2b53496223180da3b77a7bac4d98a806bf7cdc1e5e3b794620d60
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_000097
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000097
                                                                            • Size 204KB
                                                                            • SHA256 adf8b067647a8da400c4925d417d6302bc3d2a3f6219b775f60db04ed09c7656
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_00009c
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
                                                                            • Size 256KB
                                                                            • SHA256 e3e4268545e49178c95c3ce577f482d929b4d3d2529002d227e1e4a4a4179020
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_0000a3
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
                                                                            • Size 256KB
                                                                            • SHA256 ef389287b32b215ab2e1831b8baed478f94246cafb0528c444a34008bd45096d
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            f_0000a4
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
                                                                            • Size 256KB
                                                                            • SHA256 542ac655cca6f4835f0752937b8144fa3620dfec1b42b5277470217010a621c0
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 3KB
                                                                            • SHA256 fc913bcf292907e9aab68e353d0ba3a9be825e1746ee3dfb41646f2da64e8847
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 6KB
                                                                            • SHA256 83813a329ff2860ea2dac2c8415b7efb9e7d9e721b37174ac20b51cf28412119
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 8KB
                                                                            • SHA256 cda44752451424b0eddde1a6b9741e6895040babd8955e4b8aa31c131e9b75fb
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                            • Size 7KB
                                                                            • SHA256 a976d87e4aac67ecf5f4cf113a0071536fcdff2c2793f3d5c8e592b3f8053bd8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe589872.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589872.TMP
                                                                            • Size 3KB
                                                                            • SHA256 60d44cbedb44fe242d8263d5e13c5ffe75e5fe684ca7090c1f3936ad19104d0e
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SiteList-Enterprise.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                            • Size 2B
                                                                            • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Edge Profile.ico
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                            • Size 70KB
                                                                            • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            CURRENT
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
                                                                            • Size 16B
                                                                            • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            MANIFEST-000001
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
                                                                            • Size 23B
                                                                            • SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 1KB
                                                                            • SHA256 c45f90c226354c36c9cd1b8245351469a55f54851da031e9f1916a44fa941938
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 4KB
                                                                            • SHA256 a2d045745fc90a05240ee2a308addf2497b2cfd4d2ccb4c878cb50db05ac55d3
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 4KB
                                                                            • SHA256 b8c6db75fa47d0e84c2382f9344da266613877f4c6b7f4220689f70357f726a8
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 1KB
                                                                            • SHA256 ef207224cec62e20e4053d19be677edcdc5e091aa183001d346df2d7841babf3
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Network Persistent State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                            • Size 111B
                                                                            • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            SCT Auditing Pending Reports
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                            • Size 2B
                                                                            • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Sdch Dictionaries
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                            • Size 211B
                                                                            • SHA256 73cdcb076046e6fe9244beb5b427d195112843c88a69dde7780e698001ab7612
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            Sdch Dictionaries~RFe60fec7.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe60fec7.TMP
                                                                            • Size 40B
                                                                            • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 781ea3bb5e66ec585a65a5fc762b6a7dc1e942285b12b937ef32086f0e1d7252
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 13KB
                                                                            • SHA256 9e0b1545c7cb0ab0c7cf6ec11d197748e19d66787ca1baca0e0991342902dd30
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 30KB
                                                                            • SHA256 bf1a8f4d422e2bfd361998393630950b32c3fe5bf322b5515f9b572900f7e51a
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 33KB
                                                                            • SHA256 c165eba641caf07260e7bee2bbeb9192c5220cdf79754cdfb6889435d9410969
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                            • Size 35KB
                                                                            • SHA256 a921ae09f2be80b3018e368723b3664fd50412169bdc2a91268ae12b95f7d45b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Secure Preferences
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                            • Size 31KB
                                                                            • SHA256 15b0fa3c29eb32af22834aee95e782a961bd6eb51d67c628d447b52811b3dbd1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dc208fb-f873-40fe-b955-d7b1fc3c4e22\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 a878fb2b10c05d92f569fb4a40dacf8c934e8bc67d0a46d510451fcaa12caf14
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe61be1f.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6dc208fb-f873-40fe-b955-d7b1fc3c4e22\index-dir\the-real-index~RFe61be1f.TMP
                                                                            • Size 48B
                                                                            • SHA256 51d1273bc2407ef9211e83da6ca4b38d5c3c02494bf5f3e2aa0b73bad1a01049
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index
                                                                            • Size 3KB
                                                                            • SHA256 e6d8a8e54bc8a80649290bcad44af8313de3a632cb6f9cf371feb0349a07cf10
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index
                                                                            • Size 1KB
                                                                            • SHA256 ebbd94e93601092b5e54971eb4b2e864928c9494daa4dd642f68566cdb4892b1
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe5cdfb9.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\83facec9-0843-46c0-8caf-89ceb43fda9f\index-dir\the-real-index~RFe5cdfb9.TMP
                                                                            • Size 1KB
                                                                            • SHA256 4312710ddfda88c337e6f9cd4bfd96933445f5f9c0bdcfe4d56045ce38003d46
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\cb5b9c17-d98c-485e-8d33-0d4b0dcd5b1c\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 c07756ede0bb092bda4c72fe07443d504daadeee3f2b80b57ce606ed0acce9b8
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            623cd082b6202da0_0
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\623cd082b6202da0_0
                                                                            • Size 61KB
                                                                            • SHA256 179d793b5ad3f1b8987d308fa5b476fde87416461289f116e4be16202ce1f36c
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 82b159f152e704c4a9d7a003bad22dc8a9daa6c7f9b056152b094ef6dfbde4b5
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 d319f35c44394dc1818d94cb471e641b1f05aa5ca6385e41db278d28e2368fb7
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fd93df7b-5d4c-401b-a994-7654540e6312\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 89fce14b4972c61c40bf1c434473a6726cc60937755bffef6c13953e1d149c09
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            index.txt
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                            • Size 481B
                                                                            • SHA256 f5f49be77b5418bc2570a4515ff545de306e42970ec93891cd24bbd3adc41025
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            index.txt
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                            • Size 371B
                                                                            • SHA256 7a474ec4cc97c7daa885570fb50f146cea912db5ae3736cdbe8745fcb467ca17
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            index.txt
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                            • Size 476B
                                                                            • SHA256 5f17fe6d42beffc765b6c48034d1a78d89316e6fe99f6ca6de56772e4c6bf28d
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            index.txt
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                            • Size 371B
                                                                            • SHA256 6052097fa463d5e677cf22083ac6e1a6138e2efbfcb9a37ac4b8ad2f9e843f23
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                            • Size 72B
                                                                            • SHA256 30b0ef2d90bce1d313a7b93e6085c6e644299e66116835b21b4943a90cf6989f
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            the-real-index~RFe603675.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe603675.TMP
                                                                            • Size 48B
                                                                            • SHA256 b14742375d37e43ef6b24ede858a29a49694df287b330284f7785fd3fdc62547
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            sync_diagnostic.log
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                            • Size 4KB
                                                                            • SHA256 faa38f4a2d21717c09c9ed7ec5a1df64bcf46eda9adc298cc0aade8de0d9c68e
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            409df65d-28e6-434d-8147-1037a0f9f385.tmp
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\409df65d-28e6-434d-8147-1037a0f9f385.tmp
                                                                            • Size 22KB
                                                                            • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 12KB
                                                                            • SHA256 c51f44145b5e05826f56de3c7b86ffbc1f89d7b42cb4ecd6f10b78f441adbc14
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 28KB
                                                                            • SHA256 97a680591953e374884c9fb76196d910109d39cd9eca078e1ebaa90c47434c12
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 20KB
                                                                            • SHA256 7beafd3082eba77d7ea91130f04e6c583f9134fb6ef5b255e712ec82ed2e1930
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 27KB
                                                                            • SHA256 6123bed681ad8a08ce9203d71869900421d94be9e0c1db938b1048d3fffe568b
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 ae19fd7a093043c75da87613ab362e3adb801cda344ce73aa036c20d42083673
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            Local State
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                            • Size 8KB
                                                                            • SHA256 1adfe19a0ca641e1a72cf24baa9b4070bbdadf85f4432fc50f355994676133e1
                                                                            • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                            Submit Download

                                                                            RevisitationBloomfilter
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                            • Size 392B
                                                                            • SHA256 c58349bf46ccf2e3ad1a5c513f58c7b4a6b75e61eed007a45b65075fcabf4705
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RevisitationBloomfilter
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                            • Size 392B
                                                                            • SHA256 6cfcd0388640818115694374b5ef2c761eeba36f15460680bed7f94f4795ffc0
                                                                            • MD5 SHA1 SHA512 TLSH
                                                                            Submit Download

                                                                            RevisitationBloomfilter~RFe60cb53.TMP
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe60cb53.TMP
                                                                            • Size 392B
                                                                            • SHA256 b437c4af7f45b0bd0c3077760cfc604a77a23a7a3d5c4aef27479c3bea1ec176
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            metadata.json
                                                                            • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
                                                                            • Size 13B
                                                                            • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                            • MD5 SHA1 SHA512
                                                                            Submit Download

                                                                            memory/3124-344-0x0000021276850000-0x0000021276950000-memory.dmp
                                                                            Download

                                                                            memory/3124-343-0x0000021276850000-0x0000021276950000-memory.dmp
                                                                            Download

                                                                            memory/3124-373-0x0000021379840000-0x0000021379860000-memory.dmp
                                                                            Download

                                                                            memory/3124-386-0x0000021379840000-0x0000021379860000-memory.dmp
                                                                            Download

                                                                            memory/3124-466-0x000002137D9F0000-0x000002137DAF0000-memory.dmp
                                                                            Download