c63a93dbd7970ac2628bc6e22a7920e1cec292366ce1142712a58a97c3709bda

Resubmissions

10/09/2026, 22:57

260910-2xj7jsxbqc7

10/09/2026, 22:56

260910-2wxq9ahp313

Analysis

user interaction
yes
max time kernel
67s
max time network
69s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 22:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 67KB
Sample260910-2xj7jsxbqc
SHA256 c63a93dbd7970ac2628bc6e22a7920e1cec292366ce1142712a58a97c3709bda
MD5 ea5f69bff32ac1e54f9579084e60f4ea
SHA1 fab00752472e159ab796bf2a0a3aba34b300b1d1
SHA512 ef17017f026c6528057a84454ca019b54c251a79b2b23b30c7b0eccc8a4df3738b9651ee59562a08b9796c9124db2aa077bb3ab3826fb3a501773726b558a7a9
SSDEEP 1536:17BmOTcZOTArgqgyvfe02PVbYf5JfVfFCFRwfaY:1/srgqgyvfe02PVbYf5FxFCFRwfaY
TLSH
T165638213F3C01D19D97B88B1A05377BC7A7845CB9B220E74A59A7B3F968DCE35692308
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 1 IoCs

phishing

description	flow	ioc	pid	Process
Email address	127	[email protected]	1760	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1760	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335546695430039"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{43FB6CD9-942F-4B9F-9C5C-AC30A753C2A6}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe
900	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 4856	900	msedge.exe	86
PID 900 wrote to memory of 1760	900	msedge.exe	88
PID 900 wrote to memory of 1348	900	msedge.exe	89
PID 900 wrote to memory of 1348	900	msedge.exe	89
PID 900 wrote to memory of 1348	900	msedge.exe	89
PID 900 wrote to memory of 4908	900	msedge.exe	90
PID 900 wrote to memory of 4908	900	msedge.exe	90
PID 900 wrote to memory of 2932	900	msedge.exe	92
PID 900 wrote to memory of 2032	900	msedge.exe	91
PID 900 wrote to memory of 2932	900	msedge.exe	92
PID 900 wrote to memory of 2932	900	msedge.exe	92
PID 900 wrote to memory of 2032	900	msedge.exe	91
PID 900 wrote to memory of 2032	900	msedge.exe	91
PID 900 wrote to memory of 3964	900	msedge.exe	93
PID 900 wrote to memory of 3964	900	msedge.exe	93
PID 900 wrote to memory of 3964	900	msedge.exe	93
PID 900 wrote to memory of 4188	900	msedge.exe	94
PID 900 wrote to memory of 4188	900	msedge.exe	94
PID 900 wrote to memory of 4188	900	msedge.exe	94
PID 900 wrote to memory of 1200	900	msedge.exe	98
PID 900 wrote to memory of 3344	900	msedge.exe	99
PID 900 wrote to memory of 1200	900	msedge.exe	98
PID 900 wrote to memory of 3344	900	msedge.exe	99
PID 900 wrote to memory of 2596	900	msedge.exe	101
PID 900 wrote to memory of 4844	900	msedge.exe	104
PID 900 wrote to memory of 4844	900	msedge.exe	104
PID 900 wrote to memory of 4844	900	msedge.exe	104
PID 900 wrote to memory of 2764	900	msedge.exe	112
PID 900 wrote to memory of 2764	900	msedge.exe	112
PID 900 wrote to memory of 2764	900	msedge.exe	112
PID 900 wrote to memory of 1120	900	msedge.exe	115
PID 900 wrote to memory of 1120	900	msedge.exe	115
PID 900 wrote to memory of 1120	900	msedge.exe	115
PID 900 wrote to memory of 3788	900	msedge.exe	116
PID 900 wrote to memory of 3788	900	msedge.exe	116
PID 900 wrote to memory of 3788	900	msedge.exe	116
PID 900 wrote to memory of 5248	900	msedge.exe	117
PID 900 wrote to memory of 5248	900	msedge.exe	117
PID 900 wrote to memory of 5248	900	msedge.exe	117
PID 900 wrote to memory of 5488	900	msedge.exe	120
PID 900 wrote to memory of 5496	900	msedge.exe	121
PID 900 wrote to memory of 5504	900	msedge.exe	122
PID 900 wrote to memory of 5696	900	msedge.exe	124
PID 900 wrote to memory of 5696	900	msedge.exe	124
PID 900 wrote to memory of 5696	900	msedge.exe	124
PID 900 wrote to memory of 5876	900	msedge.exe	125
PID 900 wrote to memory of 5876	900	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffd51a5c188,0x7ffd51a5c194,0x7ffd51a5c1a0
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,9933564790835528425,269464052086704835,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,8155737681920150129,8668758758212772873,262144 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2516,i,12647931122949939275,4971485499681896184,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2474245286354243842,3289823636443464249,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13698133066289346859,10740196280632820367,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17196586584810414629,5657631567502113138,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4102073808457172237,8378545201328088321,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,3875673206586014272,12236226547471036174,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3532,i,18298779456868045110,3134885061775712095,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14547652637062973950,5261342896986430072,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,14547652637062973950,5261342896986430072,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6276,i,13322493945715058166,4873463142827297177,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4340,i,13667730116546738966,17006673449003653571,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5944,i,907072868109766537,13264246346059500937,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6392,i,16851190697831590050,13148165809867789979,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6476,i,18313316044215803709,13383445920386490615,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,8577463121190514766,662494978463276432,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,4884233633325081643,4731711095206181435,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,6999823202455445564,10908936517193852756,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4816,i,16719866719579897696,16454952050118484792,2097152 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6812,i,7789738948906261725,36813555229172384,524288 --field-trial-handle=2340,i,7886821809753794301,8692512679705464512,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:5876

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6fa1b02b96b249c932f11a4c4f1eb52f042c98bf33d02c325fd422f437c15214
MD5 dab629217416704f76a79a88ad8104e7
SHA1 7976f0ba766ba9c277031e8bb5fb53af02fda376
SHA512 08718b5a2794b585eb95d2cba2f1738b354033d24a471097fdf4f83b9cfe6ba984c2b3c4dae177b4e601dc47eb8b72225f8677ed39d32449fb3f874f22b26d8d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1C1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 408KB
SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
MD5 42af94577490c2f5dc901ea2d3e2e4a3
SHA1 8c93675968611faf7d148c12c1b2170c22075770
SHA512 273d37acb003a2626c57183301d729164bc310d682f159493c63f51f56ce1424e8367db630cfffdf452451011996a79e492c8f78c0ebe75765e1b1f3a94e5515
SSDEEP 6144:CCPRy65+Rj00vSwG8VeWXC8WSMLJI4U1HWUDjfK7PROSLw10UXiA7fg1wfN4kZiQ:LxUAa1d7MLHpU/MQCwqUXiA7LekM5ZY
TLSH
T1C39423D0B157AE489DD980FC00E12ED0CD16D2AD6A077FB61490FA9ED5AE7AD0C891CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 72KB
SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
MD5 2a55cd14779a918e614e873501c38d05
SHA1 4a59f4c5582092271e6c87e69d06d092d722fb44
SHA512 8c3523bb283d22d6ac7e65811cb0e17eaf879368210c26a20fd553204df2e06cb9cf58d4c19fe3b1dead430907fd186d87bb9c9a7afb09fd389d69cc9b39fecc
SSDEEP 1536:kNS2AXW7axoDItayH1pEPAfFzELcpceTwoX0eskqoMf0PHKi7+XF:JWktnHwAfJEL4ceTV0c1HKG+1
TLSH
T159730227B008563A93A0C78C371A48359FFAA0FA1B1452BFF1DB50DBBFE450635589DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 27KB
SHA256 64e79147a82c808d8a3daae687c53b872bd0f3990445a7d146f16d0a5bcf5148
MD5 f1d6ac69d6247fd7d5a820b1d6b5112a
SHA1 26f6a525b97b7f2a9c008e8e4fa6a193091e071a
SHA512 3a2cb9a7defda2b8d3479cee40457053e50b41974ec090737e3c8a77b3d6b697a3b49f446d02422f6ae9a98c50ebbecb2a739670fbb0bd70825344a5a874458c
SSDEEP 768:itNT5p0OyEHO9J1EMdzwfKgbcNHC1lgET:QNTf0FEYNdY9bcNiIC
TLSH
T107D2E106CA539FE6238354A5473364DE5FBE12211123EC108421672EFADB59B7BCD0F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 77KB
SHA256 bd327a1e13ce02fb13c19ebfd9b6178b3faa3cb5831e2e595c3fc27d3a3c5ac9
MD5 d6f7fb9f6e9370925bdcf782d6d6600e
SHA1 bd0a01298780756556d87c653abd9f05d5bcc8f2
SHA512 8e6bdd08144bba4a0a337dba4e16165c6ed0d6dad83cf946236c00f73bfec3fa6a6ec07aabb86f0f59bc409e7ba701aac45b4fecdd6ee25df3ca1c292ba197d5
SSDEEP 1536:2m6ek/PzC2k4Uc0cLnCgUyQOgjPp9OasORDyRgkAqF:2xek/LC2G9SnCgUyrgj+iR+RJ
TLSH
T1A4731286B7995FEADA42F4158830E32377F8DA735D724C378C04C0466BD0278A969BED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000aa

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000aa
Size 62KB
SHA256 dbd7a510f3f0f430a831acd9b7ff82825cb04b203ba03bcf0097ebab0530c471
MD5 67ee7bf546fd9fb2b0135bc53df15f55
SHA1 2624a86a07e9e0472bcec33f455c5f1eaf366afd
SHA512 fdc04ce6c470084998a4e352a6601374af90809f5cd69d699a60bbc37dbd3251087cb234abebe9b64dbe660857b25b8527027ffc6e2246e5da14f556fbd245ed
SSDEEP 1536:yoWVVn9bug3EeDjRtTDXlaXDPVYzwdcsXSofTF6lehh:eVnxf3pDjXfMXLV9OFMTF6lehh
TLSH
T1A65301E94EDD736B3CCEB089E2DC8911472622A1704D2A13C5B643EF6732E2795B35D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ad

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ad
Size 72KB
SHA256 cafeecde35780fb8540ee8e41d02125fbcc5f7893c112db96ed1e988e33ccb7a
MD5 bdc2a57d5c90c3a6a8aa7e012c729555
SHA1 119985a36f9d3806a7b3e52c8e49375e21599c5d
SHA512 fee3bae424ac84af104431088ebcc4c32d53a79e14ad775b98189213997b2b98079c9aebe5aa6f5a2ee61b50fe1d753b4c70b94438b7f72d01f7951813ab254e
SSDEEP 1536:T14mO9a8Uu9jA/pmQxa2qV0qbRcHaSN3hgSN8NEcpkc+XqhKaCH+Kr:pd8nOm+38bRc64d8NBPCe8
TLSH
T18B7302647A742D7BD6364C6878CF08A73A484603F6147677E4E59FE287C26BCF9A0809
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 c98731ab3d4e870a226c045cfd4eac8b6803a316aa020c8308f38986bf1e791a
MD5 7b03ccc938cdda77869fef0f3d540dfe
SHA1 63584a158276fd09192016af358df615c9cd8663
SHA512 c64ddfbfe1237dd6699658a30a99f3c1ed13473345863023f8d70e8fdc4a5ad14d4a92c130e42c95546070688342dc757409451a90e2413e28f4aeb07b2372dc
SSDEEP 96:qKCuC1TR+7BANMSNUtTA6ED+tiFOLaS8Bvc6rc3Ehh3drMgI:XBA+SS9Aj2pLalEyc3E33FLI
TLSH
T176D1CAF501E900A1EF5D5DB1BAC00D02B7B56ADFFA879EA3A091E9788607BDCC10D906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58de55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58de55.TMP
Size 3KB
SHA256 919005ff1c55c7664213c9e902b2fca57fa4050715c80e5f3205a7594819a1c5
MD5 33bdfb6c3f3b5cd34447a35c6f483387
SHA1 1485598addaabfecd71a5049b713602ce2f4c3d1
SHA512 641c46dc0bdd444f5c1c09083bf2b7353265b8c6e020e9874f5f660e501d2b55e98e08b345b5816c5d64f1db5df29f9b3ba3c345c98ec71b27e9400bf8221ff3
TLSH
T173812F35028E0091C75DA2BAFFC10300F772A2EBFF97AD76C492997C980375C894AC45
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 ccd58f80e97f2462bafb861a33f63ca7d7c7bedf258e1254eb7d031b00db6131
MD5 59a31a8e4b92e3a7a55db64ccfdb85a5
SHA1 d5230c2d245e668fdf0497949a68ebd554fbe1d8
SHA512 fe0571e368f6dfc6bc84cecc3d8532c8ba9037610793180e2f6f76ea19cc64b127b176a4dbb1cba3d9fc0e56ba8895c3a007b7e846b649284aa1e9a3e38d94fa
SSDEEP 192:sxZwRFyM/jK1Ml8MWZ/fosNwzMIdpdy6HW6+WNGYzQcUcCIgrJ:sxZwTuZ/fosNwZbHbG99
TLSH
T1CA42E851AA34A97BCCDBD209FA51BF53D6F5447292900E44A9FCDA1C00E7AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1cf3c9ed959ee8702a9bb7f501917ddf1a408ef2cd73925ed38b1fb7b11353ae
MD5 a09b791cba0fbb50345777848f02ca52
SHA1 f0213b04b4d60a7873ca1c1739fcac51525a356c
SHA512 36d34c0c51a9e5f4ace34843b99437f28f5ff5c8c280d1d6823e7e262bf156c3545925c778e76ca8d4ffe0d33e1fa6d2ac0de4b726483346d8bd91efaccf0a2e
SSDEEP 192:sxZwRFyM/jK1Ml8MMOZ/fosFwzM5dpmky6HD76+WNBt6/YzRMUcCIg5eJ:sxZwT0OZ/fosFwSHHcW/kw
TLSH
T10952E852AA34597BCCDBD209FA41BB53D6F5547292940E44A9FCDA1C00E7BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c114ffe1a85bfd54a39c31ed826328d13f3e49fae0935d080c68dfd3cb67d82c
MD5 95776b8b37c5251905704442b35db42d
SHA1 d9431a022e003988b36c2100d636de1ab9beb688
SHA512 30d94b7336bf471db3a559cedf5c2f72cee7d8df28f1f05e9a6d4060cb7ac6d39547784331bc320d8bb99ef39947bfd64b32ab6460c1797116bc46d227fe112d
SSDEEP 768:cvW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjjroIZiuYd:cvW7kf0Wvqidau1jaa5LA3jQJd
TLSH
T18DD20A3B684CCB7E4F840E5CEC266F966ED801CB66988D5487FA884C03CB6EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 3KB
SHA256 b8505632cef57803e4b1f00f0f1a5332a94cadecee2e2f49974542d505ce75bc
MD5 1f8a2fbddc49376e6ddddb2d287d9714
SHA1 64b4ba4f29e5b71ae4dd40cf0a1e0fadc101e04a
SHA512 480d4d9e26a442462bd11e505d16ea6e1e92d43d968e454008d1eb447feaa6da2e9bd48428e6b6a11308574a5c05e4e16552ed326a3d712dd9188d820e852c73
TLSH
T18F51E74E0E474BAEDCA8127614B50495337426CC13781A0BA6FEC138FC83B282C89FA9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 8b0a51d35cd9f81bfc8823787702f8965c124a23845d37fe1b1a64c8fbbedef8
MD5 d957c9b1865699a0373b265469cd1596
SHA1 c1167c82177c2937678524d1de11f1a2e37fffb4
SHA512 328dfbc44057f3c89f91499664a58b76ae32ae67eb6e75b7d6b4f761c6a810f53b5c1c29c5beedd6e1e9a67baee3368452c682bb1ad604ffcd4ffc0f6321e50e
TLSH
T1A33163488ED0C9AFE9A880B215F7B4E5737089CD5321B7A3983C22717E133592A4F0EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5852ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5852ed.TMP
Size 1KB
SHA256 852b9f6ebe57505d872d00dbf366257fe18548c6bdc9524c9a844ca6d208cc36
MD5 a7460657e3add4a61a9ad7f3829e54e4
SHA1 3297f6e6394ce91aa0cd2940c78339cc28c26bb8
SHA512 8136462669f01ddc5ebd807637bdfd63e65f27ed2aeb1a718f723304ba61ccba5bc062f355e4553b835005c088ec1ec4a30836fc728e2461b1fdaeda5a22ce2d
TLSH
T19931234A4A91491BF48451770AA2B4B873358C409321B793A47C5639AD75B8E2A5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f32a57e7209185e664812b8d74229506e408060f3e312eef2eeb6bc36210a464
MD5 6cde6360010d1b20fbd4e83a5c897182
SHA1 3264cc320e44146f71b2271bd3f5d25e32521cdd
SHA512 45ab281bfd12923e02439bb4eb1e2ab2997ba58b6621e484792d7c1b38ed736b61fda1cb2fd91f461f1f2a20bccae0ea095ea410c93c3a7c1cf9c7f4f7a8af27
TLSH
T162E068BB2DFB1920AD6F87C138B154A081863918C500EC4E3127A28730F2761240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 1eec319d898b710deb865f142419826f81432d91d4179b1bc625b1e7274908fe
MD5 7b73f179c65f9e1151fbba190647811f
SHA1 e93818bc4233226ebd82408620691c4cab481862
SHA512 e24d36ec7215bdeef155f18c0731403b77681ccdc316cf20606a015aaa9027c1d7f46e9b091dca156f1597e2b754eaffbf1d214938a66b32701364dae30cb879
TLSH
T10DA00221899FC189C508227491715D842260AC98D6853271E0EC4066CD545418292407
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58daab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58daab.TMP
Size 48B
SHA256 eefbae7751712c4f16c9dcea24ba6e8277bf30c545f3831beafa788a8133b111
MD5 ee3e36ee5f61c59f40b6dd46223c376f
SHA1 f4188d083dc319bf63815903032aae0131edd59e
SHA512 7b8017f1f3f4496e0451b5317b9149195bd7846de9ad37f9e4b891bbef5ccf3e83004d178eb2fdc785a2dd60b82ff03227cf2d2a02f8b51d4c77ecccef259d01
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f8aa961bcb809981235b22f8cdf2547fbe770f9548bf7c587c98ea5440232c7d
MD5 e718facb514064ed8989798bd2d351e2
SHA1 aeeee7c409f007dfbe6b41684b33f3a727a1ba82
SHA512 0d5ef932af70a8485883e7778a171214d508d3c8d9b1487f310394b7d48b60a65d01b431c06981d6c75190e43fb2b2c9004f627f917355c593eb902da53ae4dc
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbaIfK/qA7yy0TwkaeykCehPIhckK4BQSkME0jBaP4I8:KIbCKcba0K/qmOVGKmcx4wKFf
TLSH
T19A915402753F461238BD2809A5759A268E4231A33469A5FF3BB904621F77F150EFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58ee53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58ee53.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 818f5faf0ae20c2f7d58a9daf858915678f147a7e089a31a98dff7898fd31f9b
MD5 acd644140cb47be9880f4141ce01eefa
SHA1 6af9c4c9112483953dc90ea4b7c14e7ce535bfe8
SHA512 f38a26e0113d0761a9fd2961ad6c760fe79aea2c740d2f2b56e2ee61c56a7b6cfc2e306f687449740272a97a6586a825713519940249d0ef6a97c3ed5845a282
SSDEEP 384:JZcIhsNGkHZlBOVbi/k23dMjCEJrzFDxuvzxV+Mhdppfkow:BhAvOVIkk6hzFD4184ppfk/
TLSH
T143828D716C79AC776DE6A142F84637035EF88137A7C86E40E1ECBB1C01EB769171AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82053eb2e089d939d5365617da5109e81958f671439737f2270f3ccc252629fc
MD5 3714af9e3e1b78198c0253bd4d79a419
SHA1 e00d4c00cddf3f280a8452e385d504be756eea5b
SHA512 c1bb695761349f5783d38cce0f04e84a639360f9a6630fe1c34c95d9f7e1cd7d9f786f8bc9b883ea3c3f443b136c63d046c6922b24214e03bc805d408ad293b4
SSDEEP 192:MONt64BAQmiUyJY1pW5GBPKnn+FdGN9Q1aDPT8U6:MONt6eAZfWMdMRb8U6
TLSH
T1F702F835AC796C7B9EB2AE45F48637176FD8103BE6945B54E6E82B0C00D775C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 304d53228de2ec7d7b2beb649e04d1770257c0f4249c22bcf94e71ffea24b592
MD5 e20129acbea39d5e7de156c46b8fa0e7
SHA1 93962a916215dac7da3560341b058e188ec120ac
SHA512 f6f519668c0802f2ec9798f8e7bbf7aa15f2a3d23d470c9f9a873c651b9d5f81263db0ec69083a68ad167c73bb0a4b5dababba570e5b9d7333d818a68abb768d
SSDEEP 384:WZcIhsNGPTLZlBOVb+L/3dMjCEJrzFDxuvzxV+Mhdppfkow:Eh7vOV4P6hzFD4184ppfk/
TLSH
T1E5827D706C79AC776DE6A142F84637035EF88137A7C86E40E1ECBB1D01EB769271AC19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 80943eedc30c0139370d2bf680c357ea022fb6845479a02e33542dc52cd78700
MD5 bec77dd5096bd51d4bbd9b533ea94928
SHA1 9a195ff58c1533ba1808953be0c7f3d5cf7e9797
SHA512 d1a7c5cc60c6d87ebab5d3a5c4f56d1df4ddc2622ec35c0bc48071d03a7e8e11c832f42e4defb128774d81ef7d9521cb98a02d60dd4b3775f5ec7dcb3dad9079
SSDEEP 192:tON364BOQmiUyJApR5GBPKnn+FdGN9Q8XFC1SJrLWwoqrR1U6:tON36eK1RMdMjCEJrXFDU6
TLSH
T184121A31AC746C3B5EA2A551F48736075EE84137EBC86F90E2EC6B1C01EF6AC2307856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2ad34195838c530d523de7d10ff83bf2d981283a565c2afbba7f6350274d95f1
MD5 325724f9223bb0b530d0a24fc807b897
SHA1 c8f6ba4beadc3ad6e792802cb41f13bb10093d1e
SHA512 8559e02466ce20d10a15ad02a55f86d7afb679b3c637cdc715a6a730b2ef3604e49030a82b3602ddbd17fe0aafd47aeb0411ea487d6118b1142222d7e71d651a
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe585b89.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe585b89.TMP
Size 392B
SHA256 765ce66793857786c0175a12100eae1d779f8ddc8f550b9fa3c85e8062cc5962
MD5 97513af364d6f59e1276bb4996198a49
SHA1 05ee6bffe5e425ee5a9cb09387f0486646c071a4
SHA512 658d323c9721e89db9d095545eed00e28b8ce55e6a7e64d837c5e9ddd1161da1dd6c7720e4cfc4d4a3d6436afe3748653748e0879c4ce5666d3d813f01b6de94
MD5 SHA1 SHA512

Submit Download

5be424e4-2ff8-4a09-a22c-70150c29c709.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5be424e4-2ff8-4a09-a22c-70150c29c709.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fb74b2a97b0dd788928abca934f1fd2b525f8d77a7b73fc09eaf6d4ad7d8477d
MD5 6669c89bf68b1c651306aa6fc9b85403
SHA1 778a0b059ddaf1986f6fcd49d9cbdbaf5f02ba08
SHA512 5e49cf6df3ca3277b0c2499a23fa175fb877013c079f5c4eb2b169f7e6b1aff0e5faa3c962e5a3d7bcb5e27535b79dbae7612ba8f4ac3ad23e84e04b46d6688b
TLSH
T1DD413B5CBAE9114CB3B76E56ABF2B86D487FB9732E46815D10010E4E0B63B41D8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads