25239fd5d977aa10d3332413930c6010327573d62419c2cd8cbd2f0290d6b8a4

Analysis

max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UCOk_qgWaR7b9JmB1sSI3TnA.html
Size 1.3MB
Sample260815-jf7bmsgp2z
SHA256 25239fd5d977aa10d3332413930c6010327573d62419c2cd8cbd2f0290d6b8a4
MD5 8d635b052b25764cb92dd8943f6748ea
SHA1 b7741cca551458db86e72b2a7549781f7adf4147
SHA512 1714683095457d2c1afa4cdabe07bb9760568385bac6e15504f683d6de277207ae221939be830b49b6479fff317b7b7d0ea40f4e41ee6f61f3b26bd36f1f701c
SSDEEP 12288:u8jZHjZajZXjZCjZcjZVjZHjZCjZejZ0jZVjZYRHhn28KJch:uhxhn28KJg
TLSH
T1A555E6141868BCB68D83E503CDB5FE7F59E453294BC89A6DBCB3EB5C01ED6480CAE851
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2796	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312530839221537"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{156B3FA0-2E27-49B9-9480-555B77F221AC}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3184	msedge.exe
3184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4580	3284	msedge.exe	87
PID 3284 wrote to memory of 1824	3284	msedge.exe	88
PID 3284 wrote to memory of 2796	3284	msedge.exe	89
PID 3284 wrote to memory of 1824	3284	msedge.exe	88
PID 3284 wrote to memory of 1824	3284	msedge.exe	88
PID 3284 wrote to memory of 2592	3284	msedge.exe	90
PID 3284 wrote to memory of 2592	3284	msedge.exe	90
PID 3284 wrote to memory of 4724	3284	msedge.exe	93
PID 3284 wrote to memory of 4724	3284	msedge.exe	93
PID 3284 wrote to memory of 4724	3284	msedge.exe	93
PID 3284 wrote to memory of 4264	3284	msedge.exe	92
PID 3284 wrote to memory of 4264	3284	msedge.exe	92
PID 3284 wrote to memory of 4264	3284	msedge.exe	92
PID 3284 wrote to memory of 916	3284	msedge.exe	94
PID 3284 wrote to memory of 916	3284	msedge.exe	94
PID 3284 wrote to memory of 916	3284	msedge.exe	94
PID 3284 wrote to memory of 1680	3284	msedge.exe	95
PID 3284 wrote to memory of 1680	3284	msedge.exe	95
PID 3284 wrote to memory of 1680	3284	msedge.exe	95
PID 3284 wrote to memory of 1052	3284	msedge.exe	98
PID 3284 wrote to memory of 4668	3284	msedge.exe	99
PID 3284 wrote to memory of 1052	3284	msedge.exe	98
PID 3284 wrote to memory of 4668	3284	msedge.exe	99
PID 3284 wrote to memory of 2816	3284	msedge.exe	101
PID 3284 wrote to memory of 2376	3284	msedge.exe	103
PID 3284 wrote to memory of 2376	3284	msedge.exe	103
PID 3284 wrote to memory of 2376	3284	msedge.exe	103
PID 3284 wrote to memory of 3408	3284	msedge.exe	106
PID 3284 wrote to memory of 4744	3284	msedge.exe	107
PID 3284 wrote to memory of 388	3284	msedge.exe	108
PID 3284 wrote to memory of 4692	3284	msedge.exe	109
PID 3284 wrote to memory of 4692	3284	msedge.exe	109
PID 3284 wrote to memory of 3504	3284	msedge.exe	117
PID 3284 wrote to memory of 3504	3284	msedge.exe	117
PID 3284 wrote to memory of 3184	3284	msedge.exe	118
PID 3284 wrote to memory of 4652	3284	msedge.exe	119
PID 3284 wrote to memory of 4652	3284	msedge.exe	119
PID 3284 wrote to memory of 5000	3284	msedge.exe	120
PID 3284 wrote to memory of 5000	3284	msedge.exe	120
PID 3284 wrote to memory of 2240	3284	msedge.exe	121
PID 3284 wrote to memory of 2240	3284	msedge.exe	121
PID 3284 wrote to memory of 4624	3284	msedge.exe	122
PID 3284 wrote to memory of 4624	3284	msedge.exe	122
PID 3284 wrote to memory of 4492	3284	msedge.exe	123
PID 3284 wrote to memory of 4492	3284	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UCOk_qgWaR7b9JmB1sSI3TnA.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7ff807ddc188,0x7ff807ddc194,0x7ff807ddc1a0
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13206628740384395013,3963077468579440714,262144 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,11157341090057258269,4117677181422390687,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2372,i,1893899545390454368,16515155157543847734,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1152338701507821586,12486141433293871664,2097152 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,3633031117962745839,10928308000390274591,2097152 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,7021949296476095872,17113555240628015050,2097152 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,10621888831013121237,13265722360600673633,2097152 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3896,i,11505754960296724308,2075726309643401550,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,3555729054314331363,6482371423527155594,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13868573543425062719,7063503330492429765,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,13868573543425062719,7063503330492429765,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4524,i,10764357158674791749,678744438340428936,2097152 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,5202989358034263741,12600343004844815862,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,1700811024788101685,12067127023340635750,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11922795745405095738,16473101126875695100,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2788,i,18103715138491976101,13495631940172508644,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,15561648071079496122,3181361567211137175,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6060,i,6827635838503617575,6646104344277731856,262144 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,13110145718453329145,1870435410035815388,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,11512568500293821485,12556100649427274076,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,10611271455336401166,10554414325986106619,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5156,i,11202137731395623501,10479826875327720321,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2792,i,9031638524096905481,4645332979691747235,524288 --field-trial-handle=2300,i,8165036160292775497,8866431770150934173,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 78c995b83ed0e6d3b5467e07a3b8932fab72db47ce193ad24acc5f973de6e01e
MD5 e195d384d884590b689a66388b708f9c
SHA1 313896873a7640de254e9b9fedb1762bf958ce7d
SHA512 8df8ec7e1a19b060e18e80d91d29fdf618a02139d31085a6b6049e547f500ca2a16ea3e4cbd9099747227490d772a1f68e3848d9cf0a6a6c4fd3ff924a159102
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7H:fwUQC5VwBIiElEd2K57P7H
TLSH
T143B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 644732bc4024464fcae81356c257957ac00f5f269e7a67afe70984eea2b1bf00
MD5 66d0ea7f502df567cb5587f63b740d60
SHA1 b414606c58e43ef2e0219787c003045a98cb59fe
SHA512 882bcb35f9b1cdf722b9107e53f681fad320c6a166190bee48ec89023444c1baa7eda87a70c4bdffdaf783ed8e8708b8e31c97db51d6cbd0279651c1b21cceed
TLSH
T100E07DA856DECA2EDF88A6C7D17CDB4C82817E8FD2C8FE1E5759C4D87401090A3C3591
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 46e3a75110bf9c7ce222acf7f0412508d2a992c326bc3bec3d6c6b22893de951
MD5 f9703b1c9396afeecc698bdd813ffaea
SHA1 ae80b4fe7686edefce1f6ce7e799cbdaad394c03
SHA512 3b6a6f6775ef7327f1bb88ebc0e89ecf2ae2a7327257f98e2fbf51b0202f2bfc0ba22eab2a2ff4b0efc57e8f4c9eddbc5c999d9a3987f3f3de16096afa264a05
TLSH
T12FE0209406C4C67FDA446647D178870C41403E9F96C4FA0F974484487406090EBC7AEC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5bb21b6ebc169cc0db8bf343f264797a6d93104064b5dedfdcde8a0664941ab3
MD5 4065b495f0b97aa76619d13e6092be1a
SHA1 bac462a93885ef781fdbc27b33e3d7162c424916
SHA512 dad0e9b7b21882b82566641f187395bd2cec94e49a6541b6a428da7cd9ab33f285c8b02e04935a990ad972024bbdade1d7efa8435e1a5a9e15c1d85f6bb49286
TLSH
T10CE026E915CAC22EDA54A68B6274930CC2813FDF92C8FA1B5758C8AA3446940AA83990
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4f2e85831e84e73168142d0c89d1ce7a3383709e7b5822a10c1499357c138179
MD5 af3a4bb627a75fb9b4a1e26cd55fdd2a
SHA1 c1f313caf0e322d39eccc112c230246726c2c7b1
SHA512 ee188f6cbe11fa409ec13c0874812e3a833a2d5de2333ef6201761ec0a77e476c59d0664dcf87acda3aa7f8f133185b20a88323e2a58a067071752c0a874371c
TLSH
T13EE026F406CAC22EDB48A64752A8530CC2C17F9FF3C8F91B2798C4983602440A2D35E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9a106162c6e2cc2cd084cd2376ba8de6296ebf02b1f848934e57cc42ecc5096
MD5 8283f90ecc1e796ece4eb88810bfc39c
SHA1 c32cd46ddcdedf32c88a004b6b36b5d14cd2e46c
SHA512 091b2df65698ca0705f483399b08767d91ea924e80c85f7b1013a4747d464bbf6f32f0fb16f46e10cc206c944c49b3ee8880ab0442f79b042a5480402e3bbc2a
TLSH
T180717209829308B2F3819A3DDDF2151B7878C74A09571F72CD10BF3DFD05B11A61AC05
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58911f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58911f.TMP
Size 3KB
SHA256 834d99f838f40e61cfce7f67f50a4397f985192f1fa7f747c80db2f4dc26087b
MD5 b6bf3160f662eafef025dfd617d4dd3f
SHA1 d0cbee1bfee6233bdb90205585240a1b707b6ce6
SHA512 e5f229192393e6d01630e21c4bf7630706d359fc1ab3b4bd6504d8794a23cc6a1dad2c8a7cda0137365a08801ab151dfe7cdc716397b502cb81d19898c48bb73
TLSH
T1C0716109829304B2F392993DCDF2151B7878C74A095B1F72CC107F3DFD05B11AA5AC05
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 3adcc4d43ff70006d8f2ec7505293e835c16031dc770b53672cbc5456cd47a75
MD5 acd32c36577881f9065c113e54724868
SHA1 224cc642f26d598b834da24611aeae460a8d4803
SHA512 14d182fe42f409b959c4db4d6b95aa827948369a5028f86bcdb8c8251767183d964f071d0eb111771402493283b459e030b862893cc3932bf82bd0da664ab8e9
TLSH
T19F519BB683E4836E881166F09A24AE2ADD2D051B433C3C668DE4AF5F63F2071D10269F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 12d9c285840e699b8fe31bc90bce1ee49445a77ab6f613165c6c9338402533a7
MD5 1e326a63058f5d49cf6c9b679615ab92
SHA1 fd742025f9b156a1fbb82a575bbbd36e3a3415b5
SHA512 5d538518579f3c16b4f32aa9ae119b7bd5f8ad4aaf8c3868c5ea01cbc03b737740b38f9a8ff985aba00d0ea494f6c019932a17e6b9f85e8b23d428fed52a53fa
TLSH
T103619BB6C2E8837E881126F05B25AE2ACD1D155B43383C16C9E8AF5F63F2470D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 40c26be87afb9f0c797883436a8ed380e9cc41da34a7d90e65d6553d0bdae307
MD5 d52821dd2af110c7d8e3be97a08c496f
SHA1 dd3ac3e57b2f30c19e2a1916f8b57f79e6f23306
SHA512 e4811ec9e35f35682f1afbf04b6300d6278c7df39f313548eadc0a61e7cb0d29f8afc1bdd37f09039be2897680eb5a976b86ea436576b00709a118da910bfc24
SSDEEP 192:sxZQREyM/jK1Ml8MkQ/fTss0geIdpdtHW6+WNGYHjnYxIgrJ:sxZQOMQ/fTss0gPrHbGd9
TLSH
T11E42D6116A386977CCCBD209BA45BF53D6F94573A2900E44ADFC9A1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 326ad35ba8fea6529209f49a0185014b4bb9805689f1d2afadd444c0bd9cc7d0
MD5 b99d18bb7d1cc3dafb971e52332c6574
SHA1 f10fb9fc490d4d7d7bc309970c15641b023380e9
SHA512 73d85bf3dca1374c84590317fe6e2421d6975d6c7606def377ead0a68556d44a61b73c42159b889aa798e542e5af76c8add88b43e173cafc8714c8d9d680c0ec
SSDEEP 192:sxZeREyM/jK1Ml8UQ6kQ/fTspGTg3IdpHtHW6+WNGYHRWTxIg5eJ:sxZe2qJQ/fTspGTgYNHbGJk
TLSH
T1E852C6166A385977CCDBD209B981BF53D6F54473A1900E44ADFC9A1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 81594ba8dd0dfb170c45d8bfde0ad17ec8af577a1dc73ae32d99f31061c396fe
MD5 a8b2a4e7a9a9ef14995fe887998539e1
SHA1 944f43be4f646910a9b462a86fa7b482c5d6765f
SHA512 404ac2d8c99f50e7eb63e41c2996b15cdb316bc3b2617aecf529b88cdffd522ad587b6f8a983411743744714cd1162fa7e1a6c38798b69b8e803697796d0f4d5
SSDEEP 192:sxZeREyM/jK1Ml8MkQ/fTspGTg3IdpdtHW6+WNGYH9tYxIg5eJ:sxZe2MQ/fTspGTgYrHbGvk
TLSH
T11952C6116A386977CCCBD209B985BF53D6F54573A2900E44AEFC9A1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cf320b3b8393c4379398d439613f44271497b965b2d596aee2caf437f0a47e17
MD5 fdd9dce03c2dd10e71e6e938b79ef329
SHA1 1962d3df9988c6b00e140b7455e450bfb637d266
SHA512 3ddec23f80388634d211d61300292e3e80da4703652d446ddcd3deb132f6d9f17a353d17cd5af404f238bf46b8a409a2a27bc5499a4d7c5f540be8c18c98f2bf
SSDEEP 192:sxZeREyM/jK1Ml8MkQ/fTspGTg3IdpdtHW6+WNGYH9tYxIg5eJ:sxZeOMQ/fTspGTgYrHbGvk
TLSH
T18352C6116A386977CCCBD209B985BF53D6F54463A2900E44AEFC9A1C04E6BED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 57e480c0ab880f84a981b89025c10ad636f49a018c769fb9f19577aeb415b0ff
MD5 e5514794fa99436048543128d7380fe7
SHA1 59f9dac399a65c2f088d8b8a5957390a04a676f8
SHA512 9c5a87c14ecbe28ad57c418e6468e064b521c303abc0f3df6fd5aed89cd92528917eb482a05e0287aa0ed91d662be4768d996b6bd3126ec123b1c2789485867f
SSDEEP 768:6JUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RZroVI0F:6JUZYTMWvg0Pou1ja7eLZmRSBF
TLSH
T175D20B2B284CCB7E4F844E5DEC2A6F963ED801CB5A984D5447EA894C03C73EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 99912acbdcac64c800e9b4e6d8be473b18a5241192b14d2b7d3034c76e61fb98
MD5 7977ae33af561e056af238f926f14ed9
SHA1 35165d76b06ef478ce7c9d2de77e00c4c6a56ad4
SHA512 731cc21e0597b0182c5eb37a71c238d55cd19e1018a7770b4afdd116b8638bf7c0a08a230bc027c2a955c618ca961280d18d37958f0b6cc50ed5b5e0877b8563
TLSH
T13651D84F0D564B6ADDAC527214B294903B38ECCC4A15AA136CFC2131BD4772D2C5B6ED
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d2f50.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5d2f50.TMP
Size 2KB
SHA256 341ce2214566c3fdc5e0e8dd6508335941fff41b2727bdf6b49daabd97c0b5b2
MD5 0551afd78315dd4c25c2f435aa2dc9fc
SHA1 148cb8837ad66200347af5fc646ca0903f466d97
SHA512 a71a7f933a6dbcdf769cf0f61c2d23380b53fb3b1a68d7635ac913e4cb810af79fe54bb1f8fe16c063aec332513593ede7262601ebd5b66a526dbd14aa04334d
TLSH
T13D51A64A4D824639E884417709E3A8B4373919008609BF5374FC9632AC937AE3D1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0ebaafcacfe9e4f84205a2095f12d11642594792976568a4a648b1fbecc96f76
MD5 8f2c474c69ea81969efda2aa9749aae5
SHA1 35dcb637f601360aa8c8affb47126703ead0a772
SHA512 58ea7efe8e43b1343698f8d0b484dc7941ad897cab82d8279940d69fe84fe4d92c372b4ea375ddf9c90bc947a003bb2ff25f3e448cc08cfefb7841dd71385c4f
TLSH
T1F6E068F76DBB1810AD6FC3D64471A4A4010138A8C64CAD8E00AAA2A310A23412806C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\16c8697a-ca03-4e8c-b32a-81684f190947\index-dir\the-real-index
Size 1KB
SHA256 c32d0b28c865316448560fc4eba4c74aa6ca65c171dabef962fddc9ffc6eccab
MD5 7448ff7e3bf87925ab4fda343a5697db
SHA1 b9c52bd93a8f6697e3742a98c1efe61cb9468a39
SHA512 9a3728e2690e130de9b6f7fecc874fae384e5a4e69bbf08d7333a288d648b05e3159ce35f58c7bd4cc4a87317ca7a62d7312715b75c81a6bbfb4e8983765de89
TLSH
T1A031938CCC8077CED47062F6269804F267B51D24FC1CC28182E4B16634023F45B4B6FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f008.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\16c8697a-ca03-4e8c-b32a-81684f190947\index-dir\the-real-index~RFe58f008.TMP
Size 48B
SHA256 12c541710f262ac5a4d05aeff65e8f51b6ce84439c4fdb2dd20a2e153b0ae61d
MD5 e01057a23941e5b53609d3d83f1ac3cd
SHA1 48d128ae78e25c98655b9bfb78168f88752780cc
SHA512 f48f94432b104a4f2d3150168c85f3658e382638236218497d6ce5f4a1190a2492eb42d3167970ef9b48558abb753877f12f47f28f064e3d9f017f25652d0933
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 98B
SHA256 c9c614a4924ab1bd5df15fbbbe722a8916c7c86504437fd963168f5f0b7ee326
MD5 a28894c0e576b543e8a6c6034cb3411d
SHA1 2b94f634bbaa15418789440244d903903968f3eb
SHA512 1347c56afbfe145628a11bda06cb916f6e47e0e30abf78d508898c81fb7f21f68de6d49515aacd0932857c77db6f89557dc4e5df9fc152b3366608662623766a
TLSH
T189B012A3D7227EDA72785B092108D70B2C6AE104A470688CF54C4003002E4224CE14BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 182B
SHA256 97456d97bb2b71b04295c2d1dc28ce3b309c238eb38bf443f61e46011921a971
MD5 71a5718f33d77b7eb7b965e0daae852d
SHA1 131705233c9b9de7d422d63647c8855fbf8c613d
SHA512 75a16f270de2e11996f48e9584f9fbf9d97e090559717c3634d4ebe6fb4d096ae7b1f57eb42d7fc956d7157920dc615098e20c6750b4f7bb76e4066f5a3c6f93
TLSH
T1DDC02286C2336D8933341B046008E21B1C32EC00AC60A4C8F904B002047D20388910B5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 100B
SHA256 b20b273ae42537c2fd00991deb2f1a78e4c06e51815f058541a0bd0b1dce43cb
MD5 185aea640975b7e21951951858c31b6e
SHA1 9403a4e87f5bff20d024d1f3d8cc2cac1888b848
SHA512 7b136719db253c7434293db74eaa582d72cd1ec4724b6d7b19840dc11909af24324568b11edd8967bcb323338e81673e6bb42685cdc53bf8f7fbcbe9936e8f31
TLSH
T13CB01263DB327ED67278570D1108D7072C6AE408B4B0B88CFD5C4047001D82148E04BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe589d25.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe589d25.TMP
Size 105B
SHA256 86114d7a0d87f88bfc154ec497931da63b51dccc368661bbbd89299520a6ad3b
MD5 1922e9112a9e733e66f6d47b25787a91
SHA1 cd93ca3dbd0575a938f1744bdf5054ce124506c4
SHA512 161169e1591b4c6add865b76529fb761a45743fad5800f80329b2ccadcd7801d34569030b3fa8f35678de9a82c9d524de626b3537ef1267665b036695c95d2db
TLSH
T1A1B01263D7323ED67364170A520897072CBAEC04A87068CCF54D7403103C42288D44BA
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 b3536792b1f8afda9210b541aa154f99b108470a8720715559c94cc12fbc3382
MD5 cbd258679274f53d17cf9117ac53530b
SHA1 88e4c695aea5208a8b46f9a6dde1e4748f13a910
SHA512 91fd21a964eaf3c5578b8f60f8a87aca097993dc04bb9f7a10af9d2dedd609763bec66092e9cb742a5d0a540201ead8c8af71cac8821eda4a3c12044d74a8583
SSDEEP 96:KA1eK2AgHWKIAWSi0KDi0+0KjKWG36K0IzOHcgO6:E0lPUzNuOHcgO6
TLSH
T1C6D1F65272BA02117C7E3B0893D4976FCE52B1633018E52B7BAC01B58D26E269CFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4ddc9ac1-f1d8-4c34-9710-4ca37077918a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4ddc9ac1-f1d8-4c34-9710-4ca37077918a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 7b4af1ac9b7027653f1be2a22717f950d49ea394f1449d09c116f40e6a36cd2e
MD5 5129a115fd36a8988947eb5b3b6186c7
SHA1 7ebb6a8f42638418ce997ec56be7052e377b5a1b
SHA512 27fd2d646cc195a401c87676df95e1ff3cb9c18d8cdb0bcbcac59e7118175bdef17e96c9ac8cf0063cd4520e724b56b7260c6e26cef5caadf7f321724fc64870
SSDEEP 384:3sN3KoDVlezX5od+d8yiXXzqOOPrXLpe8C/wtD:3KlyO1zqOi9PptD
TLSH
T13A725C32A4786D675CE7F685B44B3217AFF44467EB842F84D7EC6B1C01DA19C030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c0c94e27d28f36b7492a3b160f9d3b690ee05df664203566aef52731c2f8b4ce
MD5 4c0dab7b33d2f0874d80c57c2b142793
SHA1 32a4128efc8bd3ca8434132a22ebe191eda852f0
SHA512 50b736a4e0740eea1c2528cc3414f00420f4d5382941abf92af235ad9400b5a47678233ca5504c992d82655c2778a37aa434d0a8aadf4c7e55fd47df84333ca5
SSDEEP 384:4ZcIhsN3+oDVlezX5od+d8yiXXzqOOPrXLpe8C/wt7:GhMlyO1zqOi9Ppt7
TLSH
T1C6928D32A4786D675CF7F945B88B32179FF85067E7C42B8496ECAB1C01DA56C030AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5957981fb4d060a00acc3e4b42153d0a17fc591b9cad79f0b7b0e8946f85c52b
MD5 3879c45d0cb5d292d4006b4d21378f23
SHA1 f61c854dcc7a9fb42a3d6f6d7a9abc52e56f9f3b
SHA512 3ad25846f92e0efdf890759373656cf279e6ea3e3ac3a56cd89971d9beef5bfe37668b60430acb8356c312312308b746112005de347ff683a99f478a0cc41aab
SSDEEP 384:giFiZcIcsNJ8TUNTUlIljoDVlezX5od+d8yiXXJqOOPrXLpe8C/wt7:7FQcwwgclyO1JqOi9Ppt7
TLSH
T199A27E7398A8996BADF7BE85F94A32179FF44067D6C4AB90D7DC9B1C019709C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2e9f8f02327fac017d74f7409fc14fb0a6247681dac7581abec48be3e4144062
MD5 a8df43663d7f8583d6d7e3730c506446
SHA1 5d23ae6d178fb1adfbdfe62b5037c30baf2bda67
SHA512 6d2afd7ebf14c2d04f318e443d564779bf62498f268597c8b5403b47d9463bedac1f8926aa562f020a372716fd3f5c304d72a1e19f6fb1b3bd897c502cd53ff3
SSDEEP 192:yON761VWQmiUyK7gGX5Obd+j1jzoryiyR//aV3EQU6:yON76W/gGX5od+d8yipaQU6
TLSH
T13D02B83669686CBB8EE2BD49B88736135FD5106BEA956F80D6EC1F1C00D765C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 16b99b3a28a9b2e4ebd38271945f8bb54a5cfd2664d798de3dbff9c48f95e4d2
MD5 bd4d2063f60c1af7e0f9dc86da0578fb
SHA1 d9bc0d877f39bd2ccf03d2f4f553bd168bd79cf7
SHA512 d64e840d2d874be3db1487dd63f96a711423f82c097b15632c79b759b78b79bd8626218178e3d4b040df28279e0406c098231737b3ced48bbe5305898cddbe8e
SSDEEP 384:9ZcIhsN3joDVlezX5od+d8yiXXzqOOPrXLpe8C/wt7:lhdlyO1zqOi9Ppt7
TLSH
T132928E72A4786D675CF7F985B88B32179FF85067E7C42B8496ECAB1C01DA56C030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 45bb421317586895d4cc6749a02b854a5add5e7be6d3eef43904ee2ea717a236
MD5 7b6ca43630f40d7efd1601be849158c4
SHA1 ebdbf5a632c58788df70f82863b5e7367696b866
SHA512 a9c9d2bd6c83b131f12594bf1f5957480d4883b94d009ea6af5a649434200a5db141fb69fe1df6152144c35ce6e702514053050e941bace2c5df85695729501f
SSDEEP 192:FONS61zWQmiUy7s7aGX5Obd+j1jzoryiyR+XjTsjJ9qPU6:FONS642caGX5od+d8yiXXcqU6
TLSH
T1B312E936A468AC6B5DD2B555B48B32139FE5512BEB896F80D6EC2F1C00DF59C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4399dbe4-8113-4044-9554-69a7de5e0533.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4399dbe4-8113-4044-9554-69a7de5e0533.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e9e294043feb9594ed4fe2c95e701a87468de1b2f6fa7abd4b09cb74989d566b
MD5 25456554191d3b2002541e63c90a3c3b
SHA1 53e609f241059f8c771d75e7b0ae79880be83115
SHA512 385d61a86f9986495512ec95b78c6e7c976679658b278a070fd133411d71d97a362ffbce6b36610c5b368a6a2d5a7bd5c65960d91f1270c74c268844613afe25
TLSH
T15A412659BAED1148B3B37F5A9BF6A86D497FB8331E06D55E10110E4E0623E40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download