hxxps://ctrk[.]klclick[.]com/l/01KZSET5X5DXDCKPPRF0XVKDVG_0

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
12/08/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ctrk.klclick.com/l/01KZSET5X5DXDCKPPRF0XVKDVG_0
Sample260812-eyl17sydkd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134309821009196551"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-226940941-599731907-2645636698-1000\{871403BE-60BE-4FAB-807E-85D43A239F91}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3456	msedge.exe
3456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 5356	4012	msedge.exe	80
PID 4012 wrote to memory of 3884	4012	msedge.exe	81
PID 4012 wrote to memory of 5576	4012	msedge.exe	82
PID 4012 wrote to memory of 5576	4012	msedge.exe	82
PID 4012 wrote to memory of 5576	4012	msedge.exe	82
PID 4012 wrote to memory of 1128	4012	msedge.exe	83
PID 4012 wrote to memory of 1128	4012	msedge.exe	83
PID 4012 wrote to memory of 4924	4012	msedge.exe	85
PID 4012 wrote to memory of 3472	4012	msedge.exe	86
PID 4012 wrote to memory of 4924	4012	msedge.exe	85
PID 4012 wrote to memory of 4924	4012	msedge.exe	85
PID 4012 wrote to memory of 3472	4012	msedge.exe	86
PID 4012 wrote to memory of 3472	4012	msedge.exe	86
PID 4012 wrote to memory of 3016	4012	msedge.exe	88
PID 4012 wrote to memory of 3016	4012	msedge.exe	88
PID 4012 wrote to memory of 3016	4012	msedge.exe	88
PID 4012 wrote to memory of 4088	4012	msedge.exe	89
PID 4012 wrote to memory of 4088	4012	msedge.exe	89
PID 4012 wrote to memory of 4088	4012	msedge.exe	89
PID 4012 wrote to memory of 2360	4012	msedge.exe	90
PID 4012 wrote to memory of 2360	4012	msedge.exe	90
PID 4012 wrote to memory of 2360	4012	msedge.exe	90
PID 4012 wrote to memory of 4932	4012	msedge.exe	91
PID 4012 wrote to memory of 4932	4012	msedge.exe	91
PID 4012 wrote to memory of 4932	4012	msedge.exe	91
PID 4012 wrote to memory of 2328	4012	msedge.exe	92
PID 4012 wrote to memory of 2328	4012	msedge.exe	92
PID 4012 wrote to memory of 2328	4012	msedge.exe	92
PID 4012 wrote to memory of 1408	4012	msedge.exe	93
PID 4012 wrote to memory of 1408	4012	msedge.exe	93
PID 4012 wrote to memory of 1408	4012	msedge.exe	93
PID 4012 wrote to memory of 3276	4012	msedge.exe	94
PID 4012 wrote to memory of 3152	4012	msedge.exe	95
PID 4012 wrote to memory of 3276	4012	msedge.exe	94
PID 4012 wrote to memory of 3152	4012	msedge.exe	95
PID 4012 wrote to memory of 2244	4012	msedge.exe	96
PID 4012 wrote to memory of 4600	4012	msedge.exe	98
PID 2244 wrote to memory of 4836	2244	msedge.exe	99
PID 4012 wrote to memory of 3908	4012	msedge.exe	102
PID 4012 wrote to memory of 6132	4012	msedge.exe	103
PID 4012 wrote to memory of 6112	4012	msedge.exe	104
PID 4012 wrote to memory of 3812	4012	msedge.exe	105
PID 4012 wrote to memory of 3812	4012	msedge.exe	105
PID 4012 wrote to memory of 3456	4012	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ctrk.klclick.com/l/01KZSET5X5DXDCKPPRF0XVKDVG_0
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2a8,0x7ffcc830c188,0x7ffcc830c194,0x7ffcc830c1a0
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1628,i,10531360304621166547,2874902157986239852,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=2144 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1500,i,6017083678886086568,1715432815051569288,262144 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,8667622381545363474,9821959299822814364,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:13
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1861105961340789030,10194735642988259674,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,16172862394439863070,7329079758734671854,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4836,i,13563065359897089265,3440549050938422494,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=1492 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3548,i,16869566736626790197,8739835770022135961,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5176,i,11067612236214428662,15815573167579170121,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5304,i,1935907324424308840,2468909046577010755,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5212,i,11538269213564985446,5151875103329244408,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5352,i,1918899207081918294,7805476153661088096,2097152 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6089623368689740529,13753745838283247289,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:14
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1104076325153566770,14849702155886573980,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:14
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,16128249970105482747,16344083620389353188,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,11342575703313790201,14751288346783446395,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7144,i,11342575703313790201,14751288346783446395,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:14
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,6664513373481490111,6428936277728708181,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:14
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,8150282674533806323,678525413540831752,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,2074279443482396401,16168309508535401756,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:14
  2⤵
  PID:6112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6760,i,6739932517423537042,17621875286941305714,524288 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7032,i,14657116807413707748,8289539983786625447,262144 --field-trial-handle=2092,i,15715899196244342128,3361936760487955186,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b9dac8593d827b7b825086ba5eeec776b808b8429eb90a6b645c319ec8f1435
MD5 c16a98ebe36bda7f5aece00f9ac1d0d0
SHA1 ef2e2a8775d1ebc0124f0ba983b6f20777919000
SHA512 148affd9dbe6aaee9070c22e41bc916df527cec5741753ca2733855f500e4eef0a257445d281d79c2449f8265c41b54dd53ffe57650802594b1211b0db611349
TLSH
T1ADD012273B0DA054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c17dc8315075bb661bddf6b1efa879b9a3c39af13982f986bd287f5bc861cbdf
MD5 9573474710d1de6302a0d98890d2faae
SHA1 618b9f2079a97625be399f6137e46655659ecff9
SHA512 a345b915a4191d30d0da665ea4f78297c0cd671a5767e05c415403efb649110868fb279d22dc496792452c325e19b00f5e579f6e014a4488c9a4d6fac83d1c46
TLSH
T118D012273B0DB054E7A9C2729613C7921BB6646174434B01E315C95C99B54D412D6183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 6b1ad02a2fc2894f4519666d226f5435692a06096ca5cb0d14c4e2ddabe2f0a5
MD5 c2f161f0763e7ba4f29082e74bdcceb5
SHA1 5bcf26a23020ce768542c929c8221cfac6f53343
SHA512 48adf35818cd49aedaf25609f2977aeae6d40f0552cc0d238e8d8a33ba461ed44c0536fc9067ea8944f41405fb09c4b8f64bc8012d00eaac4f616bec2f85ccf1
TLSH
T1ACE02BA5CC61AC3B09FE272990645B46FB4413975F82890F3F3CD0098FF163A4545C5C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 28KB
SHA256 5fc1d2e54f0d9fa4a5b5058fb11833bd54ffdffad2fdb2904ba34b72e1aa0432
MD5 8ca7469613481129462385688e11f18e
SHA1 d7fc908dd97126801a16051c45af554498b84ce2
SHA512 67c9a530a6044301ba4c822a1d47555b9ec87aee71e057ceadb10a6b46bae4865bd8a3a372e6857930a7f66398c958d89ddd7e1eea9ca2f20d432e2ae98d2a73
SSDEEP 768:XmNKsJcw8y70k1iYEpNP0twbnFMDE9+4AI9Fjk:mcwz03pHPcwbnWEQI8
TLSH
T1A5D2F123777FA13E9304ACE174915BB16E9CAB92CD07BFAC50333825347683694954D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c0
Size 29KB
SHA256 9e08485eea9b555cb1916c1747ff7ba99ba16568b0f2ca569ea11c03946cc184
MD5 19c921c2ee38c7b2521f8fad3035b2cf
SHA1 d6fffceecce3656073b6598f5e928bb58398eb42
SHA512 bee289fbac38b9826c321e6638a370de1ed405e42efad756c3bf6fd3ca437477ec8555589fcd6d963231e7d5cdbd2ceeaf6989f3152cebc7fa7168c6a532bb5d
SSDEEP 768:mEWsKc4irgj+bExCkPTbRKC/bEsdSye6Xq+dGbpRoXXVnS:mHsKc9nbE0sEGE+SyeMGbpiXpS
TLSH
T1ADD2F2E8988F3F11C48072EF36FFA1E75EA17BD42535F184486F0C6CA5BA45AC03958A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 5555d2a98c271c307e9273e45dbe2bc97f7c541ca2fc7a31e1c23605763ac1ea
MD5 4437a5155f8d90bf3641b4eb675dfd6c
SHA1 a9417c379b23b651ff4ea1b8c1fb6b712993c05f
SHA512 e5a5e58ec775a5236121172e25e4b4ebc3f68f55d9796a748f97b0166c299978d90d18abb5bfbc705447bd16f8eba3391aeee6cd0ea47a40eaf479b00efbbe25
SSDEEP 48:bqe0tr4ftl5QxKWSvIDbn8esjaWr/mvEYzJsH43PY7HBBxpwqQU8UW+Haf+ibIQN:F0qfZQ1ybRmWr/7jYKxy2ng+k+TA
TLSH
T115C1954B18D22240EF2535BD5CFA8E98B4F0F0EB3D962F53469C6E74BA67FE14891244
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588807.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588807.TMP
Size 2KB
SHA256 b80d7faf5d37ff8a0d3c41e7458a1098326809875bb2498a38370c32e8f37ec9
MD5 4a99fd289997c2f577a464115e236e1c
SHA1 d5e6044ccdf986ed88706c5067c69dc9e275168d
SHA512 cdc5556f6a02c6278953e63d929a7dc98e1616eae3186b7980fdc1154d576b6d143f454854e68b233ee5818e88c67e011012e990ee4d42ea878085d0e84137af
TLSH
T1AF4150E3085277A6F3233AFDA2CD5518F5F0F8513E6B0DC281901BB4AE30F3281A1694
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wanderingbearcoffee.com_0.indexeddb.leveldb\000003.log
Size 13KB
SHA256 88470ee4854e42f488ddada774fd762442db906963c9c52bf0cc24ef0291f465
MD5 5e903974005723802b17a6b4fec7a542
SHA1 6ab379de9b8447c3dba6483fab64fb88400e2fd6
SHA512 c26b4a97b3c3b0b0f33d9c9cbdaec2135df26c689286f981b2e73d1b36e5ee4397ad63e0245c57d65266dbc2f75c579c9228a5782bd568f4727e3a82da7fc752
SSDEEP 384:ftcqmmUGAucu/aDsEXh5X/4X/r/2DgJTDlZVmLDtpLDCj:LmmUGAucu/aXXh5X/4X/r/2DgJTDlZVf
TLSH
T18D52D05F6AD48E27FA6E167519B20FD817777E86BC82C54EE0C4F2BCC971A004D32662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wanderingbearcoffee.com_0.indexeddb.leveldb\LOG
Size 367B
SHA256 b2c61e649c000751ed088802f171bf902407600cd4742d5d513acc3390076e36
MD5 e40ac54e6b118760d2b9d2183d4caf42
SHA1 b3142e5e690990185eed74a55313ecb591cbc64d
SHA512 c9f5a1408fde3507829881ac7aa0c47b9b8e93e187da7920f73937f29f443ac4cd67db92adcfb6b123482801b0bc254964eaa70191c4f2434770de117be46543
TLSH
T1F8E02B38C8C4861B2514D1E755347F0EA193210FD6D8FF8B4F41D404F446848A57E281
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wanderingbearcoffee.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 26KB
SHA256 11962c3838088aec082926fcaa3cb3504fb4fdfac2c3633e2beafdef9ef9d52e
MD5 d310208d1a1116f3c16784c4c6e3d11e
SHA1 b83073c5f3c8489fbf0cfa4e034feadf28a38061
SHA512 988b6a51c47ba77db0f2efa661118e90f673bcf0d3f1dd39776aab55ee354c2f36c55d0fdabeb13fc4f86c0d3ee5101a9afdfa706e8bb76960e2b3aa6982d3b5
SSDEEP 384:D1J52NY3waBqHAgvdIeueh0Ep7s9M2E43e/TPIqaaiGVh++sqzMKJy59yFbiYnxe:goyHew2o9EXP8mR
TLSH
T151C28AB7C6F9822CD90659F4DB142E22CE6D0C65523D38069CE47F0F67E16B2E284A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 2317f19d16058d3b72e880087a822334216d08d1394944d526e419f98a788f3e
MD5 0b0e4ce293b581655d62b78aebfe3b48
SHA1 b627d7d4ec3fde38579ab6365b544c9a15cebdbb
SHA512 b55efe9c74c5455ae4411bc37be242017b009f7f59efd3d5db7976675288f12c5e0be3dea1b84216b36fba43f5f85ad17ff05243bec1e90aeae85a78e81205ea
SSDEEP 192:sxZkRDyMqZjK1Ml8UQLFw/fzsQtUKTGCwoFodpUY/W6+WNyrn/Y0hrJ04RIg5W+7:sxZkgqBw/fzsgUUQd/bY/53Q+7
TLSH
T1486208066A74597BCCEBD219FA45BF93D6F9513391904E44A9FCDA1C00E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 65f0495a2e4387fbdc33aca141024c5d55d47a6fdfdad4914c3e634a8e20ec76
MD5 c4737d26f98af9b20368f9ca9fcced87
SHA1 19cdb3ea3e3767357b43deef41238524cebe4e40
SHA512 93813e1990d8ff1679055f7130d89ee6dc06467052a30550ef92c756da9905c47023fb6998a776ede869942b04f49ba614f7c74d3959ce1ed0f55708ed7d4011
SSDEEP 192:sxZkRDyMqZjK1Ml8MFw/fzs9t4KTG0woFodpUY/W6+WNyrn/Y0hAIRIgj+xJ:sxZkgdw/fzsT4U8d/bY/5vj+7
TLSH
T19462F8126A34597BCCDBD219FA45BF53D6F9557391904E48AAFCDA1C00E6AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 bb38d2843fac1676545fd1dbf46602eafc3617f0c3745aa49a1031db89ab22d5
MD5 c258ab0ffae4e902108528daa451bbb7
SHA1 94e44101cf4854bc8266cb0bf62310392e8e9398
SHA512 3ec692d2f7ea16ccdd85ca60febe9a9af8d14ee54e97dc94bcb3cae8992bb419a44865ee591a8d960ffbbb2f42a725ba3cb82349855708e5bfdcf7a2377fc549
SSDEEP 768:wQAKq8y028bWRmj1QWT8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3L4Ll/f10EMEroSO:wQAKq8y028bWRmj1QWTu1jaKL4LpfiEC
TLSH
T1FFE21B3B284CCB7E4FC44E9CED276E8769D802CBA7588D5447FA494C03CA3EE511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\14792cbb-f2fa-4bcc-8964-67e986cb48e3\index-dir\the-real-index
Size 72B
SHA256 5019905280c3acfb973cf857aa643d06d7a1a442d43e267ced77f237560db567
MD5 393487775d89dd0218c5610d1838d64b
SHA1 b1ad089803eec832125bc10033dced764641e7cd
SHA512 a174481829666ec5611836197751d206e22502670e8826b5d311a4e814376f4db06925f6d51a3580647f7b7b32ef84ee2ecc4bad23b87456a2866d098ae4216e
TLSH
T11EA0022409C04815CD0126B159420158336D5A980341DB97D098108EEC522F8C115845
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582a18.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\14792cbb-f2fa-4bcc-8964-67e986cb48e3\index-dir\the-real-index~RFe582a18.TMP
Size 48B
SHA256 751f5de4cde8a2dbe524c7c559b25a77bc6603cca1d01a24bb3b4c49df140c00
MD5 eea227a81c8983b3cf47a29daba536a5
SHA1 02e188f768b8f2e8660437bbd76e829585cd0bba
SHA512 969f20db70efd2622b7b997e79d74dbd633a08e63d27b34b6e5cf04c7090630bbad56bbea04c35eab26217a5062364f2f1b2aaf80d57e14169c3e05fae4eca93
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\25d91f74-e412-4b2e-9c4b-4e107743267d\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\25d91f74-e412-4b2e-9c4b-4e107743267d\index-dir\the-real-index
Size 72B
SHA256 64903c92242adce00315d10d25ba9f743f123e0419ddaf19a8d14084fd1cadc8
MD5 8b478e7c491c0699842b94b42c459522
SHA1 dd76132be4261248b4f88c9ef1b898fa18e42399
SHA512 0e982b5ac1aaa44fa6041334cdc6e604eceea2dc11005eeb58f4ecc85b4212d29f86acf82a986715088c4706cdd955e3d1575d8314721bc7b4f323b218d4e895
TLSH
T1B3A0026553C54D43CD0112B420C2024227598A504625DB73529040C48C523C8410E114
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5823fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\25d91f74-e412-4b2e-9c4b-4e107743267d\index-dir\the-real-index~RFe5823fe.TMP
Size 48B
SHA256 c09c2cb337140d25771b46ce2b6b10e2306115afee9077f8e6d403a05cbb7153
MD5 4d2adc14d072ff020a0298f59f9d8f4e
SHA1 8a2face2ee199dce46f72ccf3760ff1475ae4382
SHA512 cc85b27238bab89de560b8f34b3598170b31b416a7fc665e8c241f2b9e771fcde7fb1bea385af658b5b1d981fd34df033b9ac094baf9785561dad4689e4c3179
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\33589bb1-e0e1-4b6d-89be-26cf8e369707\index-dir\the-real-index
Size 72B
SHA256 e48675d2c68abd1c79e3f9dd47372677ac5ac9d3707910f8fb7775273e4fcb3e
MD5 05e458b330c7fac4712deec2e5d526dd
SHA1 1dda02632f2ed57654cbf0575a20276165115d01
SHA512 6752c8f363d79fd1186ec8c2acacdbdfd5edd3a9c6afb7c0665e4d37b25330951495c3f1cecf2fde016d1e43012adef9bb2239733a6948ee842e320616facd09
TLSH
T19BA0022006A45013C44AA77429D62552373C89E013030B55D0900465CE503808616E40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5829f9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\33589bb1-e0e1-4b6d-89be-26cf8e369707\index-dir\the-real-index~RFe5829f9.TMP
Size 48B
SHA256 9f39654bd0afe1b7de8f8a1117c1405475b46dfc7de12160ad5e3841ddf067e3
MD5 2491aa6afd49ec035a68671797e0a764
SHA1 88227c4065f8cc16a034711392c504245fa83346
SHA512 170acb7979328a53ece091dc0e25fca30adfdd3b40074967cc153e4b60620ce8395398de350a4b4042d92c4acbb85add6047edca0a417b8fc29c400b41942e52
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\66c32fcd-e039-4a9c-ac55-36877f887f42\index-dir\the-real-index
Size 72B
SHA256 d28711ff55bd3f45c36f33503aede16bab91b4f2a5046b4be9525b21d463eeee
MD5 9b062fa3d80ef34cc46f844421adcb7e
SHA1 6c1f1b4bbbabd30f5b04c8b1e4a9adf7d12bdaa6
SHA512 5a718823aeeaaf7312e22bf1a33d660313778acd814576dca66504109645bfc6663abf49426679969cf905275f8d5e5d6351df8996bd43c33d8f0eaa4260b994
TLSH
T1C9A0025103D51C41CC5153B112418A8033184AD00305972340D240868C676D5ADC10C1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe582277.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\66c32fcd-e039-4a9c-ac55-36877f887f42\index-dir\the-real-index~RFe582277.TMP
Size 48B
SHA256 eba1ef3fd46b15787c18a050331254e7417e1c2912216272ce11d5b25bd5ed9d
MD5 0c79860b44dd5d3a0bd161d723f8614d
SHA1 3d49785fc597384f5851e1f048e23c210cbb08ec
SHA512 89b785eb7faf5315b33faa4c6ed03c36c316874f2d84fe312ae00b5a2298cac39aac4685a3ecc2c66ab72d9ad8d4a7e43ac06c00ead47496aa5ae41578193bed
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\d69474c5-7f2a-4464-8f04-631eac07c8f9\index-dir\the-real-index
Size 48B
SHA256 178f0b0c8e3cca0ce28cb021e4edf269ed12340c6fedfd15f868716528921200
MD5 dd8c4605eac8df00d6b4ca87eb00b6e4
SHA1 dfd014e1e363be9354e44937d9ea752581b72c98
SHA512 6f1319b24ac4470c410d4b3ec50d9eb3e9456dbe5bd86b7e6f4aac1bea1a78429a5291c9d69ad7b2ff45bd3f6ab7ce1aa29f973fb64794da50a13e2711f194f3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\d69474c5-7f2a-4464-8f04-631eac07c8f9\index-dir\the-real-index
Size 72B
SHA256 9acb08c63e70c5bbc78570880e1b27e3c26d69d70d90d8ac2e9dec68df4c61be
MD5 5d0a2ff07d2e9f954529bd287086bd2a
SHA1 288510a4524fefb8c0d2eab3dcd62bf925790730
SHA512 01657c4ca4f6262d3ae168cabf18720cf2facf8b96e4d5aa0fb15c51af781d6dbfecd3a8c6ef15266684db80d7cdcbb99d27aaa50c23d64c9919cd628371498d
TLSH
T1D0A0022441C00995C89192F135AB055027546AA48203D717409000559DA32D58311401
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 211B
SHA256 91761ce0742b7af98aa5ef501ce5fe2ff787e14b1a8325c2710e9a568ff3ef3e
MD5 e38f2e6e7342c0e68663bfe82116a950
SHA1 ecd8bc0e14b115c35a501eb3364a9ccc2ca629de
SHA512 756e663ee36e81b18934d72209591722adb7bb5bf4d6573b6a8c4d3ac067ab0e525a1a9e3c057df20153e57e5176d8518af53f257b9df5e8e713899a52ead603
TLSH
T18BD0A9BB0AC009E27A29C79061B4A85F90467DC3FCA0DECC9810B006DC30C2B422CA71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 513B
SHA256 3cfcfed20870691cc51f734b04172635de257c87ceb894b4f5030299dd86cbe2
MD5 33c0f653a4342879ac75aa982ae6390e
SHA1 c59656cfd600ff6ca2c4a61ffd1dfcb0e8f749b6
SHA512 e17e2aeecce79a9dccce1d8b27ed6707d9e8d5c563d95be6b6fa28a09f68a75836f530b6a83531dca61ccb90ee42e94b672d92581e3d84b47ad4f5b570ffa08e
TLSH
T18EF0596625C00EAABA7DCB9051F4B45EA1427DC7FD90DECC24A4B1198C30E078219EB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 636B
SHA256 6907a725fe048b8b4b6c9d0e5e11c5c4c0edb20c8bc7d41310b7b45b9127a267
MD5 c88243a5123fd2ff1615d9084e9f7429
SHA1 86b402d03b9f64e8e59cc111fe7827a46c366da5
SHA512 cb80adc7c9eee228f2b26b7926f15ba807368c452b7b00e5f41c4e0ca22a2598e0ee5acc641771ac5a4fff142c66de91127d4229baf060a87e07be1c63ff3060
TLSH
T1C1F0786226C54EBABA3E8B5090F4B4AB9542BCC7AC60DECC1894B1095C30A068619AF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 949B
SHA256 d588951097ff82b49a86b447da3d4e0d17f2d22d4c4ad1b2229297b86b02c4b3
MD5 631bfda83102c178c831bc035664a63a
SHA1 764639467fda05806f184603d0a0fc1447c03845
SHA512 3f439322a4465dcc46d20720b2c06025471c660a99ceae867971ec6bfbc592d3f3a63eaec6c267e3a42fb63dac9880f9c3117797507ae5d52213904e73f48a0f
TLSH
T19211005132C25EBA797F8B4164F4B4AB85027DC3ED54DDCC1898B15D4D70E03455AEF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 432B
SHA256 a1754a9cfc90fb0f1a48048da77fcc7ad46b72b67b28eca98ab246bb2658b095
MD5 5af8620d0b3f0ab3d9d2439911763bb8
SHA1 127a33d48a78788cb18286e1ef73d1e99dafdaa9
SHA512 9a613a7c995ca0621bc7d7142e0884eb94038103a6b9e14806a985c0a9fa5ddae834df180e74803fbcf7ca668b09a52ba6e444541c52e4c26580bcbee2d46da7
TLSH
T1D2E0E5A616D01D9A7A6DCB9151F4B45FD1467DC3BC90EFCC6894B1098C3090A462DA71
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 704B
SHA256 812c44f8f6e526c328e0fef72558aaf620711a92371b1d5dba5689afbefd24b8
MD5 952d776ecb4a3d81b1bf1b8c43f0147a
SHA1 aebfc94a1a8e7d41140d96654247374a4ddfbe4f
SHA512 18d633a5e89ec2a89558fc37529d8bb37e0dfd3bf7a24cd14bd3d6b2b08afae5464c06627ea64fd7bb9a3a43942270cc5f5b14dd03103cc6e17ff3e7e0e5f060
TLSH
T1E1017B6225C54EA6BA6ECB5164F4745B9642BCC3AC50EECC1894F1494C74E024519EF1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 871B
SHA256 b8276556954b0bf2d10bb37134ceda605407df74f105e7b4248248e13f6f3760
MD5 3e3ba6d6bafee6fca918450a2f705efa
SHA1 2ddac0f4c2c57ef1bf29b8c261f38cb1ac0f4355
SHA512 aaf5016e8f2329507b2482381f65fa10babc96ccbc6de8f0f95c15c1ff07b514dad760c22d2779e2b079878ffbf0b13b96773e7947477d311a32443c59a26f1f
TLSH
T15911EB5132C64E6A7A7F8B4128F4B8AB86067CC3EC54DDCC1898B11D1C70E07054AEB1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 943B
SHA256 93cdf114a80cce25d8cebbab0559714a32924517f3b19a1815fd6612e30a2f7b
MD5 68fb205ac72d1103dafc22c5461af9a0
SHA1 56d4cb1ff1731fecdb6ae0f0b62fbe35c8c33561
SHA512 e1ceed1e0f524751dde189be6880973e17790b3d1efeedbcea2dcd9129c38269437bbda40712b834bc488ef3b3a0ce4824fb9e39328ceaebe7654a8936fc3474
TLSH
T17611DC5132C24ABA797F8B4124F4B4AB850679C3EC54DD8C1898A15E0D70E030556AF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt
Size 799B
SHA256 cf979acdfbac311c215bb58d2f6cf7cbb6fad778c182c1aacb24dce2ab0108a3
MD5 5cf49f626eac7aaa45407bbd988d8cf0
SHA1 ef28b7bac53cecf982496d16fe6982b6e8304634
SHA512 86314167a49ae864e60d321c6d244135c772969ae169156109dec87702389abf8e599adaff55db01ea6a3c9961768671c671920a389faac2ed8e2fec49a4ea60
TLSH
T1EC01B86126C64EBABA7ECF5064F4A85B96427DC3AD50DECC18A8B10A4C70A03455AEF2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d886735895ac1c240faf4964bb80f1de58de657\index.txt.tmp
Size 291B
SHA256 1c2601dca63a2b37d26686fc6ff594b4dcaee18ccca5b42d260375ccaf156d7b
MD5 a32dcab9901317119827fa6fdaffd479
SHA1 c64927a9797569db111488948c0a783fd1cc3195
SHA512 b9b66186121874f231b2faeb38c4455e364ad16ac15b54195f0efb72a7293dc86b929e04d33f1c13c8713fd56a4700e595b3e727323cfcd4d30baf65799d9d49
TLSH
T1BED0C2A609C009AA792AC7905270B55E91527D83FCA0DBCCA854B20ACC30C2A021DA71
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 2KB
SHA256 4002ec0d47c8ac79ce00d834bfc25d26c4ed7047517d074c7ecf0e150a9c0c6b
MD5 ac485dc7531fd2dabbf85f512e9c0013
SHA1 bc72eb13cf2fa56ac1e1bf7fa9cd646dd009af66
SHA512 b847e6c65f8f5164b35b4d030ecfba8a500624501dd07a87d84d758ee5ecbaa4e89221777c191af797fd2729778eb9452e312e6553e3d5da119786840ae31b79
TLSH
T19D41D80CE46CC343C698627776DB347833386185FB07262858E55D7479976E14B23488
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 e3faf352567969b2e9916c8a2aad55b4a76aa750f205a4a11e934820d5927126
MD5 3e2bce8e0c2cb1b287bdc5b97b36e5fa
SHA1 49970baeef708a89ea4bdac9d08dd194f0f311e0
SHA512 d7ba40ce31c11672b7fc3a9a3c24775b07e2863610d454a7f434a2bb10b681b99d585a919c214865bcaf8d4b8141ba7a7fb1d2c7fc151e4bc67d56a308a30a61
SSDEEP 192:GD9R5VJhn/iVJnZFGVApBPisTE/3oNloNPSF53pVWFQ5xfSsD0PnY9JFlPtv0F5s:GZLVDJjEDPV0/ZdKLT
TLSH
T1A7B2591272BA02023C7D290C9697DB674A42F1633069EC7F7BA940B64E67E125DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2f1d8a93239d8fcc8cff3985a55b507cd741d2663a6cb4eb0b3bfe9e4dae9adc
MD5 12a88d781c9aabeec4e4131db0e3eb31
SHA1 e186f500d9a0b16fb29009ebf04d4d61a9070ca5
SHA512 c67824d1d61d649ff14a15d2651765de07847fff2f5f3c940bb023a5fda90b7c5187c63a8ca03ace3660f3c36186e1d6d90cab08fe141af3c968f2169ebd920f
SSDEEP 384:nIiF9CcmyWCs38No8TUNTUlIxBPm3ek32nn9k53M4Jfb8GvyFqOwykgZete4KV8y:TFccps3HwgPKekm03QGvyratI8p0b
TLSH
T180C25A32EC94CABBECE64F99B74E7603DDE05263858C99E4DACC2D5D009B19D170BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 81426ab2a7b1ebdf029ccc7276144f9b8618551c6c8a4df829a04243c0ae2fc1
MD5 11b69fc6af8449f876de9e8104899834
SHA1 a7e9d5451f09f413451eb97c9fd864ec5ad415a6
SHA512 85fe6d9d345ab7535dfe6a0af096ce87bfa02593c22eee31f4f9252ca208660b8674b0548f1c2b626c8f1e8f08aea54c06c3a72c08f66685325e8ca9693b4c90
SSDEEP 384:nCiFiZcIk38Ns8TUNTUlIRVPm3ek32nn98aoP4Jfb8GvyFqOwykgZltMsRnlYljY:JFQk33wgXKekmTotGvyrRthn2lk
TLSH
T161D25B32ECA4DABBACFB8E96B74E7602DEE0416395CC59D4E5C86D5D00971DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 640b940bd99c87a714617ae404029e0f8f653db2b74b5018e53ffa81e0962b8f
MD5 9505a95d3057a02d6493b4e31f920939
SHA1 dabd424ea43f03597921c26038472b4598cf570d
SHA512 b34f01d88c989bfd08bfb7a145fb1d61749ad969d7727a865b6de51f0b384f9c51f84fa08772f1008c2f6e484431ad7c77be665c73aa91f0912b72c7eefc7fd7
SSDEEP 384:nmiF9CcmyWCs38N88TUNTUlIxBPm3ek32nn9BFQ0s4Jfb8GvyFqOwykKCe4KV8pI:NFccps3PwgPKekm9DwGvyrdCI8p0b
TLSH
T15FB26B32EC98CABBECE64F99FB0E6603DEE01263859C59E4DAC81D0D109719D134BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 939aff25c096b7ca1427bf7472125b273e16cb24b731d0c566690c4b4ffb0118
MD5 aedd76f656f8c8b95b492c4233a9864c
SHA1 01c2d97c15956eb5133a14b3d4eb4e75612167eb
SHA512 b31484424483b8f6703bd2614bba6bc893b114239a095b6532bd219bf7e251c379a396221d8e39291fb751818a7be8e4349c6b9e1a30f520dc3922f95ce336c6
SSDEEP 384:n6iF9CcmyWCs38Ns8TUNTUlIRyPm3ek32nn9uaoP4Jfb8GvyFqOwykgZ6te4KV8T:xFccps33wgAKekmZotGvyrmtI8p0a
TLSH
T13AC24A32E894DABBECE64F99B74E7603DDE05263898C59E4DAC82D5D009B19D130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 db5e63dbed17ef29f9c5c24d65a4105e8513e199e04450ff7df50cf17aa20812
MD5 494fb2f8f2be74937cc5866ed2ce4e33
SHA1 4d6ee8533f540213fa1268907657d22b375e84f4
SHA512 1e176a3154c936edfd323e8ec136eb4ea7864995a02667527bdf289eec8f932fcda0b6a2b466f9996393f704147a5279f4ffdad6ef63abf411db6ba2b4e434c2
SSDEEP 384:njiFiZcIo38Ns8TUNTUlIRVPm3ek32nn98aoP4Jfb8GvyFqOwykgZwtMsRnlYljY:OFQo33wgXKekmTotGvyrcthn2lk
TLSH
T190D25B32EC94DABBACFA8E96B74E7602DEE0416395CC59D4E5D86D5C00971DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 5e4e43ba4bb44c28fab52441bdc5db0116287cd0d8944d233ed3edbaccaa225c
MD5 ac3c0b0a7392de8847e730a1c6ca002e
SHA1 d5c8e2753e3e3d1b6e6a110dbe2f5b9e71bbda2a
SHA512 8dcf1354d67db7389edf1cbfdf7b4e3d38089fe53bf171c718dee1341975cf7accdf957c0482047fc3d4454fd2118ca43a5fff8bad486246b21cd80787b34626
SSDEEP 384:n6iFiZcIo38Ns8TUNTUlIRVPm3ek32nn9uaoP4Jfb8GvyFqOwykgZ6tMsRnlYljY:xFQo33wgXKekmZotGvyrmthn2lk
TLSH
T12AD25B32EC94DABBACFA8E96B74A7602DEE0416399CC59D4E5DC6D5C00971DE030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4600-884-0x000002E167550000-0x000002E168550000-memory.dmp

Download