a25c75451e36c06f53d88867d48cf0741a92ae1315e01fbc43558b1c16b0b0b1

Analysis

user interaction
yes
max time kernel
89s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/09/2026, 00:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 23KB
Sample260910-a1aczashnb
SHA256 a25c75451e36c06f53d88867d48cf0741a92ae1315e01fbc43558b1c16b0b0b1
MD5 ac13b449f35f08029f14c7b5efe93f02
SHA1 bb946ae75290bf3d11ca02836c6f802ab048ba0c
SHA512 828eed6a792874b027298621506c47ce34740682ab52bf19e63a084f773ad799e779f3047083187a0741e4d3924d31573c7939c779f5b7d3910375df55680cf8
SSDEEP 384:XIqJiePa6No9QjOtJKaKAKRKjcK3SevK2K7+sKMHiku:fJhPavQ6JfLU8c/evDpspi/
TLSH
T13BB2122550F5253311E291C137A56F5AEFE6D607CA1F522872AE0BDA2FE3E83CC53528
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3832	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134334744229530776"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{BAE64CC4-DEAA-475A-8609-597A77486086}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3172	2324	msedge.exe	80
PID 2324 wrote to memory of 3832	2324	msedge.exe	81
PID 2324 wrote to memory of 4008	2324	msedge.exe	82
PID 2324 wrote to memory of 4008	2324	msedge.exe	82
PID 2324 wrote to memory of 4008	2324	msedge.exe	82
PID 2324 wrote to memory of 5204	2324	msedge.exe	83
PID 2324 wrote to memory of 5204	2324	msedge.exe	83
PID 2324 wrote to memory of 3260	2324	msedge.exe	85
PID 2324 wrote to memory of 3260	2324	msedge.exe	85
PID 2324 wrote to memory of 3260	2324	msedge.exe	85
PID 2324 wrote to memory of 2044	2324	msedge.exe	84
PID 2324 wrote to memory of 2044	2324	msedge.exe	84
PID 2324 wrote to memory of 2044	2324	msedge.exe	84
PID 2324 wrote to memory of 3804	2324	msedge.exe	88
PID 2324 wrote to memory of 3804	2324	msedge.exe	88
PID 2324 wrote to memory of 3804	2324	msedge.exe	88
PID 2324 wrote to memory of 3892	2324	msedge.exe	89
PID 2324 wrote to memory of 2696	2324	msedge.exe	90
PID 2324 wrote to memory of 4840	2324	msedge.exe	91
PID 2324 wrote to memory of 3892	2324	msedge.exe	89
PID 2324 wrote to memory of 3892	2324	msedge.exe	89
PID 2324 wrote to memory of 2696	2324	msedge.exe	90
PID 2324 wrote to memory of 2696	2324	msedge.exe	90
PID 2324 wrote to memory of 4840	2324	msedge.exe	91
PID 2324 wrote to memory of 4840	2324	msedge.exe	91
PID 2324 wrote to memory of 5472	2324	msedge.exe	93
PID 2324 wrote to memory of 5492	2324	msedge.exe	94
PID 2324 wrote to memory of 5472	2324	msedge.exe	93
PID 2324 wrote to memory of 5492	2324	msedge.exe	94
PID 2324 wrote to memory of 5744	2324	msedge.exe	95
PID 5744 wrote to memory of 1032	5744	msedge.exe	96
PID 2324 wrote to memory of 1616	2324	msedge.exe	98
PID 2324 wrote to memory of 5244	2324	msedge.exe	99
PID 2324 wrote to memory of 5244	2324	msedge.exe	99
PID 2324 wrote to memory of 5244	2324	msedge.exe	99
PID 2324 wrote to memory of 4108	2324	msedge.exe	100
PID 2324 wrote to memory of 4108	2324	msedge.exe	100
PID 2324 wrote to memory of 4108	2324	msedge.exe	100
PID 2324 wrote to memory of 2724	2324	msedge.exe	101
PID 2324 wrote to memory of 4340	2324	msedge.exe	102
PID 2324 wrote to memory of 5792	2324	msedge.exe	103
PID 2324 wrote to memory of 3888	2324	msedge.exe	104
PID 2324 wrote to memory of 3888	2324	msedge.exe	104
PID 2324 wrote to memory of 3888	2324	msedge.exe	104
PID 2324 wrote to memory of 4604	2324	msedge.exe	105
PID 2324 wrote to memory of 4604	2324	msedge.exe	105
PID 2324 wrote to memory of 4604	2324	msedge.exe	105
PID 2324 wrote to memory of 5556	2324	msedge.exe	106
PID 2324 wrote to memory of 5556	2324	msedge.exe	106
PID 2324 wrote to memory of 5376	2324	msedge.exe	107
PID 2324 wrote to memory of 5376	2324	msedge.exe	107
PID 2324 wrote to memory of 1952	2324	msedge.exe	109
PID 2324 wrote to memory of 1952	2324	msedge.exe	109
PID 2324 wrote to memory of 1952	2324	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb9220c188,0x7ffb9220c194,0x7ffb9220c1a0
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1760,i,14355688638277364349,16209387873584355776,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,7887294363671825222,17255949131364882298,262144 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,9460242546597794997,3758542500926215866,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:13
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,8504768115124667605,12376124525310088562,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,5746196935845891723,11763453453568848765,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,8297610847457064980,9067043011740847600,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,3455644775781730025,5490886058564246350,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4276,i,9840698423103195877,12698809410929264759,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4288,i,4195288550321738779,11627334959416443257,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,14243860696459813861,9961340346969288948,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,10093686454110425593,6289579893494116029,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,15053614923110057101,5710422441155974854,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5744
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6550360186942092065,5338490442567629133,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,6550360186942092065,5338490442567629133,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:14
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6524,i,972568444543153540,15537230483917145438,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3604,i,18270803031227401047,10015752083646963509,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,8043877865769475006,10045967133575518779,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,7815074167843490722,4410753951492013150,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,8458700246158637980,9548919703199329360,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:14
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5756,i,1865597406300061045,2039055791796422847,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=2984 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5092,i,11769714151500177108,16070972170550755152,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,14285641264190811311,16364984605531879377,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:12
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,15317482834890117310,16127344898514481425,524288 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5488,i,15128221771932122445,17084098662990278390,2097152 --field-trial-handle=2028,i,15023528793913618691,13401872118709067292,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:1952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 0526a2a51e51d4fabd0b1d17ef03f5340c42a3dfcb2119ece19ca3fb7900a64d
MD5 844a3eca2c89c5806ce623a8aaa667a4
SHA1 92425b0bd5ebe6baf101dd06c4c2d65b1cabbe97
SHA512 19fb4fa602526e6121d2bbb2984c8130d972906c815cef03a10d6c046e88bc013fabfd2daed35ac6fc10b90eb453c529c4fb4c4b465fb957c45a55ec67aa247f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T1D2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8b98ade942a8747b838525fab33e985cdad967132f18099e1927edd4ddcf705c
MD5 f204288b44f873d17a6ceedad1591584
SHA1 24474f57edf00bb3bed673ea9c6fbba1c2d5706d
SHA512 218a8f5b6756a36d75649cbf0e80cab71506f3cef44c8b62b5d9685a2a249d10ca13547cc8a461116e8dbf2c2b9cddc73426ef41d645a31b93a43585aab2d6c6
TLSH
T169D09B30F7995053D1411131DC915F506655499528AB86815331444CE959094E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 03e25149a30cc80aab4f050217c414b672d24625e6b5638ddb91e627be9cb8d0
MD5 8ed0f21ed31e3b533b07d80c6b299ec3
SHA1 87f15c3d9287007aae40d7000b60b4143dda5237
SHA512 81b99706b3302cbc49744c00524c1b5d018f8381d004869d32bb62f06d84dd24c9194e40b25ffe18930d14320e1944fd9dc2a83f9db10fe54d0a4ce08494a950
TLSH
T142D09B30F7D95453D5411131DC905F506655499528ABC7825331444CD9590D4E3D7146
MD5 SHA1 SHA512 TLSH

Submit Download

5b5b75f7-1cf2-4044-ab95-3cf93ce241e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b5b75f7-1cf2-4044-ab95-3cf93ce241e4.tmp
Size 12KB
SHA256 82b786249a404b77e443513a22cd8a904608ee2383e2ed39c23c6d35dc85c949
MD5 7c7df61c60d85f3f8936783dcaeb4f56
SHA1 4a28f1b2388c34799acc8cca4e6f3faef0bf6d23
SHA512 55f0e62c2ee63884eb89c0ab7d0b3a3eea8c7eedcf8f822d5a7410b4ff23ac059ce3d36ce3f06b0377d396d73a60b2fcb17a82cd3619351b1ef15f9f4ff6ab4a
SSDEEP 192:sxZP/yM/jK1Ml8MbEG/fSsqgsIdpyv/W6+WNGY0o/S+AIg/rJ:sxZP7Dx/fSsqw4/bG5RF
TLSH
T13342D715AA386977CCDBD209FA55BF53D6F91573D2900E44A9FCCA1C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 33KB
SHA256 539628bdc4f3b107aeb78713c741ab9b5f4737532233506d8f1b1fdc4c81040c
MD5 a06c8f49a760752dc8b3ee4f217bf4fe
SHA1 2c159af5b7341c03cbce67afffafbbae2cbb7787
SHA512 af3b5c625bf4c83616c3ae1e2380df3bd35119998ca75cb96cd590c18b9227d18a03a50cf22880ddf41edd99ac7b8b9918c93a7be90d4dd3a8e6602c8e2b519c
SSDEEP 768:f+QHjwElyDV21n98SlMi1MEOV1IyItHdLqO:GOwKyD01n9RlfyTVJYRqO
TLSH
T1F7E2F15B2127014BED8CA143576EFB4FA9E374AC5609A24F547BE0AA7B8938754BD0C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 96KB
SHA256 00b42308115826481315f6a815745f8d445a89d855fa587f627b7b4388810023
MD5 89341da90f4120b2461a9bafeef01775
SHA1 90e281f4ff94fc0eaee2e876234884e16f69894d
SHA512 bb3e8fd234ec764c6450622ff2d5f2e6e777cac6006fa23b9c3e986d79b89911b9a57ebca3bb3f3e15b8437d0b305634eea968e7d8808188efca4840bf4d5112
SSDEEP 3072:OFM4gnEp7667akyq8ez5pqVo0cvK4Dhq/8fQVT:8cIwdq87ouczQR
TLSH
T1F8A312DE415A5AD9711B87D540A18F2E140288FDAE3AC206E3C7493E1D7E1BED2392DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 72KB
SHA256 fc886667b90ffad1b0229b102c340d9c93c8250aee944f4df3f35d8833811b04
MD5 2a55cd14779a918e614e873501c38d05
SHA1 4a59f4c5582092271e6c87e69d06d092d722fb44
SHA512 8c3523bb283d22d6ac7e65811cb0e17eaf879368210c26a20fd553204df2e06cb9cf58d4c19fe3b1dead430907fd186d87bb9c9a7afb09fd389d69cc9b39fecc
SSDEEP 1536:kNS2AXW7axoDItayH1pEPAfFzELcpceTwoX0eskqoMf0PHKi7+XF:JWktnHwAfJEL4ceTV0c1HKG+1
TLSH
T159730227B008563A93A0C78C371A48359FFAA0FA1B1452BFF1DB50DBBFE450635589DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 408KB
SHA256 7a50cff2ba27964e1dc892708f201b97f5513ecfedfc4e7e82ecf6c1246f6132
MD5 42af94577490c2f5dc901ea2d3e2e4a3
SHA1 8c93675968611faf7d148c12c1b2170c22075770
SHA512 273d37acb003a2626c57183301d729164bc310d682f159493c63f51f56ce1424e8367db630cfffdf452451011996a79e492c8f78c0ebe75765e1b1f3a94e5515
SSDEEP 6144:CCPRy65+Rj00vSwG8VeWXC8WSMLJI4U1HWUDjfK7PROSLw10UXiA7fg1wfN4kZiQ:LxUAa1d7MLHpU/MQCwqUXiA7LekM5ZY
TLSH
T1C39423D0B157AE489DD980FC00E12ED0CD16D2AD6A077FB61490FA9ED5AE7AD0C891CF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 75060364ba65f9eb507b83b9dcb1fa2972a274119339bd5215d11b1784b52193
MD5 caa2877b260976d2785ee1fb2d0115b9
SHA1 3e868d9b0d49cbb6c8a310304dc1a93c57892d82
SHA512 14818e86e9dc64e9dd8bdef07e14fe4c515f4d9818907f5689d058275c509d0ef88eaf118360e4193291b9e8fecfa069f151f3cf56f6791aeba81c5979ca41b0
TLSH
T1AF61191401C5491FD3A08EF3ACF15E0074B78E8AD957BE8A95833FB2152D716C714A38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 d7f83fe1a33dc17b4ab58ca83cd4110c053969d79b142014d1163a19ac390725
MD5 6c273c539cfd3672e449adf445e04066
SHA1 31363f898ad864a7b110248171b8a5140d25d148
SHA512 92e0db21d0a5908c0f43d06da9432eca0016f2950b723d9120bb4b886f54444d1480ef40fb2538aeb46cb97cd0496f33dac8a2e9fd12e48d0d3d3cd35afc0b9f
SSDEEP 48:8ro2JJSOqLSZRLG0ghmZCvWYYHvIOIApSds9h8MgxwtQaSfDQac:8k21RLG0gVgPIOIApSqb4qFBac
TLSH
T1A581C40122C4895FE351CEF39CF1AD0234B35E8AE957BE95918BBBB6151D316C326B38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe589ca8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589ca8.TMP
Size 3KB
SHA256 2a8822af7deab21423a348804a40ac0962371aa898fd21c5f6f7ff0432b172cf
MD5 8a259d14f9999f8ae1ea1a8ee67e25bf
SHA1 16963a0178705ed934d322590e460d19a78621d3
SHA512 32fc8eb1f09cc1d86f34ca975ade6442d95008b446eb18fee0b81b4a8a15c86d4b1682d15e8ff9740f002f0929017f4c9e3431f9c762ee99b555b69da0d34fb8
TLSH
T1CE612B1401C54A1FD3608EF3ACF15E0474B78E8AD957FE8A95833FB2152D712C715A38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 cd7e0ba0660ee727aef8070798b2972303495bb727abb2935d873b565a4efc10
MD5 b06249603f8d64e835ea38353b39364a
SHA1 ff5a2290a4c5e3e568862b0a858466ed9b06bd78
SHA512 d355bd6bc03ed4bab4a085500d2bd404da9fe00b7a8eebd194b45f6e433676154739a7f21d2c0a1ef34fa83751ceee191fe9bf14643ba1af5265cefa43ce287f
TLSH
T113318EB397D9866EC91296F4AB296F1FCE0C0915431C3D2985E4AE1B93E24B4E31164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 07da5cacd911942ef79c1eb075d8a91c2e17e11840efa4b7fd1a4a4caf74bfa4
MD5 77358f2b80cfcf0d9998023402696c94
SHA1 5634ca814cbb2ba76b5442fe90edc7e0611b1a4c
SHA512 c66481a236f04c0929315db4e6d6952f69dbb00f0587b6d3cdce38b2b033007500f9071367c76c18a0b45864fda410777ea4af4cc8810fa51d461c82376c0c43
SSDEEP 192:sxZu/yM/jK1Ml8MbEG/fSscZsIdpyO/W6+WNGY0o/S+AIg5vULJ:sxZu7Dx/fSscTJ/bG5R2d
TLSH
T1A242E815AA346977CCDBD309FA45BF53D6F9157292900E44A9FC8A1C00E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ebba9e8b163d59e0f573ccbd829f28e3e0c08cb79b734034bcc33fae5e8b6963
MD5 3581f2b2dbaf7db05315b12f7b506165
SHA1 f3d97075531a79b724a0b84a6fec95566ca00f8b
SHA512 ceda0927dc0519c296001ea0ad0c218c65c65d2304e71552b983438b3a1c2ee497862ac5ddd46254c4930f88fd65c14165e64a304c1dc17ad3460e00d6d3499e
SSDEEP 192:sxZJ/yM/jK1Ml8MbEG/fSsBFsIdphlXDwY/W6+WNcGY0o2C+AIg5VUTJ:sxZJ7Dx/fSsBHz//bL5MwF
TLSH
T17B52C715AA386977CCDBD309BA41BF53D6F9157292900E44ADFC8A1C01E7BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 2ebfe679e86b38f8fe8426aab0c945ebd5c3f8132a5d2388f8fc8a03f0093f53
MD5 a8948962b01b42617ecaddddb9277bf8
SHA1 3a16ffd18b1edb8638fb0fb0d568f27165f21900
SHA512 28da850963e30682f342d94f1e1cc7e0386b3c2bb5242e0e0a84338d138dffa07e28551b829c2f1bbd23db49300d2dd30f99ef72567f4f183d2f4fa59daedf9e
SSDEEP 768:r1c0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0O9Uro20:r1c0s8Ww2YfWRm/JQg1u1jaKBOLpTuOh
TLSH
T171E21A3B284CCB7E4F840E9DEC26AF967AD801CBA6584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index
Size 2KB
SHA256 efbb73bae3e3707053b28511637407c591a72c4e02ffcf13f8353800231fd279
MD5 022cd2bd5f3e80f40d5f3adcaa13b05b
SHA1 b211af59e3a7b84c568c81d42a5233b5a37df071
SHA512 3b7e8b57d178993eaac8a9ab353b67910f07d8fa75c0de479588735ea5a8b1733dd3e8dcfe91f12ede0872c8602530c2831d6307ab6a31cbee064e75940bfeac
TLSH
T1B841854A8E908E6FD858457315B278A8733088CC5781E71328BC12737E537AE1A8B1FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599958.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4468336c-582f-4524-a120-26f9d90c9063\index-dir\the-real-index~RFe599958.TMP
Size 2KB
SHA256 d1dc298ac9abf6ddf7ef2025ef88444c7d42a2657ffe9f02c99b1e109d40f390
MD5 e75dcdb2f66a93117b18001245bd7c6c
SHA1 734bb0d5c5b3c78c83ac553c50d2184dbf3238f5
SHA512 e162ee0c12c2a83448b9ee7e602e4094511829697430a08fcf0f74519b59732e3f8b68e6af7cb8d9243eb4b963c34a435a02d5528a618199bb9888282e6ec7d7
TLSH
T1B441BB854E81CA1FF89440770DA3B4B8733958408711FF4774BC5635A8617AE2E4E0D9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b2f8374da99219e214e87160982e5ce80d9c1db2ca4041f683ed236d436b6fad
MD5 b7611053ab6ab1c4b8cd801300c40dbd
SHA1 e02e990676b5debba669c2f758b385533036054b
SHA512 a01072dede210c8832a344fc2f3e0d6c3eac888a2bf7ea8338cd5eb83c2ff925fea71d6bf041d9337cf64b667314fd9bea25e5917a1c02f8ebaf7bdd6e812698
TLSH
T1D9A0021172945451C14546B0D041069EB75188925102621540EC6054C85164C625F695
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594da9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe594da9.TMP
Size 48B
SHA256 d7c03f0e75c403923090daec3ca6d77e7d27592f7e0812ade082c11dda091e2e
MD5 a93c706d1fc96ca28106e127e04c86cd
SHA1 e10e01d5b5cd706f291957c709da8fdbdb70299d
SHA512 f42accbb3ea3386f274ed0646a25e41a23d48e767fe7bcdc65ca02574e2a0754d416f5777f8995613f84c746fc87c0fcfd2fb0c61822a1ed93853405e615f70c
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2df728e050cb2842e90b68b01c6a495f705e8bf2917391701d44bf8fe6404171
MD5 fc5c2d665b5621131dd7040280009c53
SHA1 2c9ecd67eec8043b2777c33b0adb8c7e5a565571
SHA512 8e75c1dfcd73d2539d3959c16c094a2081c32404c3a7011a84903d9af49a3cb63bc134f338fcd892994c3b173a051b45bacc34585f01830d7ef6a43790b1ac46
SSDEEP 48:KkiIPKTSU7yl1I1KW4ofyxAIfKNWcfZ2dp/n:KkiQKTSKm1WKW4KSAAKNWQZ2dp/n
TLSH
T10291165270FE02023D3D2A1DB754875B265271A335AAA42F37E910B60E6BE214CFEDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5937df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5937df.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 26bac89e24a2a8d47e9ee03495e90f91cce788b58bd437dd935804e62f3216d9
MD5 eac4b3d1ac70becb376378a6f2167dba
SHA1 813d77525b56591730c4de0199c7f817693f9ff9
SHA512 b4db518b0508cbc7daff0aa0284f3b24c1132b20f6c7b020af81cb4271d3d9763ec148022d607d7cd1611529a7ce6b97a84c5aeee69f12f418ff7a69dfa294ed
SSDEEP 384:9ZcIu8NBT21E7Uu8YDusAuDk+2Jasa+VY+og:lua4CD1A5lJahglP
TLSH
T135826C715C78AC7BADB79394FA4736139FF450279AC96E84C5EC6F0D00DA698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2effbb925232711b08621f50ff372cf152b2555a5971b2054c5a07947c6c8802
MD5 8affa8ba3ecaee9971471239ddb4e6de
SHA1 07665c23fd30c7423dc23473b60dd55f3250ef7d
SHA512 0a103cbcad9daf024d8c7c644dbbe0e2b7d1be29f484aa4ec563f98738c16697341665167d014f88f254ba2cc839a722dd3c47665f2fdc655a5507b36b2004be
SSDEEP 384:viFiZcIB8NT8TUNTUlIlo21L82Uu8YDusAuDk+2v8asa+VY+og:6FQBmwgH8/CD1A5lv8ahglP
TLSH
T171C209F248D7983AE9AE5747BB7E2E038EBCC027B5855940B7985A0DCC961BFD306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 887ec37d39be9f75c1cebc9798134037a79cb6bdcad35486f5d390393d50d633
MD5 05b3bd9ae75b4cf0339b2192359e34f3
SHA1 09c032bce505981379fb9eba23eeead3c6307a02
SHA512 76a5c0048189086cecdb57007a7cbe1a65e015f98cf1e46f1deb0300ddcf605a359a8c77a2addd0486b38ec9d7b2256a2771a83aefc999ddd7b2c77c633aadf9
SSDEEP 384:2ZcIu8NBo21E7Uu8YDusAuDk+2Jasa+VY+og:ku94CD1A5lJahglP
TLSH
T18A827D715C78AC77A9B79394FA4736139FF4502796C96E44C5EC6F0E00DA69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1dacdb0021ae9ec1ecac5f9b17da98b1d9fbeadd7a2c4e65f30e31a67c222e43
MD5 0108a2e9d6e8ae7d65a46c703c9af33b
SHA1 d191b96aefb17a29ada3ce8492534df4404526e6
SHA512 96b38c591893b341508c7a9b7b118ad0052c594e58d04bbade04de6be4ddf0fa3f44f24c08cabc745e1f569a43afe16a58d06f9874c64e691fc02669dad6e48d
SSDEEP 192:XGNWEV6jCQmiUybIBf4SufoPxzYdSSus6NRgSnGTRU6:XGNF6qwefju8YDusogRU6
TLSH
T1D002CA756C68787B9EB36E45FA8737139FA4212BD9852F44DAE81F1C00D725C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bcc95b485b97fe6b6aa0b4aaf0f381c0387974d7a68e6b8c97359ccd63b170b7
MD5 102770469e656db30e7817a84c8f35e9
SHA1 03bf44b68503bd186c4048972a48916f2b372e2a
SHA512 bd036bec01618660aa8f8e991eb5c547bf5bcaf359064752cefd38562992c1f3226eb22e24e95f106714449dfccc0ce9de3d404bd99fb120a81f25978bd2e52d
SSDEEP 192:VGN86j8QmiUygBZ4SufoPxzYdSSus6NRrSSu8+k+2+OMxqrU6:VGN86gDZju8YDusAuDk+2EaU6
TLSH
T1DF121B71A86CB827AD936654F98736139FB5112BDE897F44D6EC2F1C01EF55C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5d19b798b3615ccff613389eed7ab918f9fdd3e3cf73912570d5cdf2e6ab2159
MD5 21a4da815f332e1be18cc668ffc27094
SHA1 87e7bfd4b0ac4e6dca573fa1199563569f1e1508
SHA512 3297b14c20af428accccca884627d4b3e844c9ea19c7843650f734da3c0fcd36b97176f3b59393019809f0a3db02c7d0ce2c94908f4e3d446c95a0d3b02daa9d
TLSH
T108E0021223040437C01C0330008B1B14AFA4D00402E243665231415D1C723003930E41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59197a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59197a.TMP
Size 392B
SHA256 0a950e3194735017b482d866804ff61855b2e321cc14f2a45b672574c98d5854
MD5 899b35fa58839cd62a096a264b015ba0
SHA1 fe0b27c031576c2c759b9f6be911c5f5613d9d5a
SHA512 d3e3ca58b9608732133c43f5747d4856528964d1b662fb2cf07d8f697f1af54c9ac5276a23e1a4ab48a5d86b57463e69224aa2ae38712b988335dcca7436fd86
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads