613ab5adba879cb8aff02adf8ebfee8c9514004d713f23513a6888be45cd0439

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/09/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 65KB
Sample260910-t587msvvfz
SHA256 613ab5adba879cb8aff02adf8ebfee8c9514004d713f23513a6888be45cd0439
MD5 45b416a68844b0e55ba490a568f8af4e
SHA1 75366ce92fc3ebe6e95c1e044893df38c2d9fa65
SHA512 ccf83b2f9c434568120b7bfbd42e256a268a5a5d1f576b41050f3cf331b33e121fc621e6a09c7bdc277d0a73a2c82dee416e017ea7c742b99157203955a6e27a
SSDEEP 1536:07BmOTcdOTRgauUDWP3FvqbLMj/n6QN2CE+4ArYj0rYOvZMJmeHb+C6fkUeqZdSv:EBVga6P3FibIj/n6QN2CE+4ArYwc6MEy
TLSH
T102636317E7C10D1E993F1874B4636B7C777861CB5FA24DB4B88F6B3B2709CA241A2648
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4124	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134335319878966091"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{774F0C78-FB22-4EAA-9B8D-262986191839}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5140	msedge.exe
5140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe
1260	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1260 wrote to memory of 4312	1260	msedge.exe	86
PID 1260 wrote to memory of 4124	1260	msedge.exe	87
PID 1260 wrote to memory of 812	1260	msedge.exe	88
PID 1260 wrote to memory of 3644	1260	msedge.exe	89
PID 1260 wrote to memory of 812	1260	msedge.exe	88
PID 1260 wrote to memory of 812	1260	msedge.exe	88
PID 1260 wrote to memory of 3644	1260	msedge.exe	89
PID 1260 wrote to memory of 840	1260	msedge.exe	90
PID 1260 wrote to memory of 1388	1260	msedge.exe	91
PID 1260 wrote to memory of 840	1260	msedge.exe	90
PID 1260 wrote to memory of 840	1260	msedge.exe	90
PID 1260 wrote to memory of 1388	1260	msedge.exe	91
PID 1260 wrote to memory of 1388	1260	msedge.exe	91
PID 1260 wrote to memory of 3616	1260	msedge.exe	93
PID 1260 wrote to memory of 3244	1260	msedge.exe	94
PID 1260 wrote to memory of 3616	1260	msedge.exe	93
PID 1260 wrote to memory of 3616	1260	msedge.exe	93
PID 1260 wrote to memory of 3244	1260	msedge.exe	94
PID 1260 wrote to memory of 3244	1260	msedge.exe	94
PID 1260 wrote to memory of 4428	1260	msedge.exe	97
PID 1260 wrote to memory of 4180	1260	msedge.exe	98
PID 1260 wrote to memory of 4428	1260	msedge.exe	97
PID 1260 wrote to memory of 4180	1260	msedge.exe	98
PID 1260 wrote to memory of 3096	1260	msedge.exe	100
PID 1260 wrote to memory of 2660	1260	msedge.exe	102
PID 1260 wrote to memory of 2660	1260	msedge.exe	102
PID 1260 wrote to memory of 2660	1260	msedge.exe	102
PID 1260 wrote to memory of 2584	1260	msedge.exe	107
PID 1260 wrote to memory of 2584	1260	msedge.exe	107
PID 1260 wrote to memory of 2584	1260	msedge.exe	107
PID 1260 wrote to memory of 4856	1260	msedge.exe	109
PID 1260 wrote to memory of 4856	1260	msedge.exe	109
PID 1260 wrote to memory of 4856	1260	msedge.exe	109
PID 1260 wrote to memory of 4172	1260	msedge.exe	112
PID 1260 wrote to memory of 4172	1260	msedge.exe	112
PID 1260 wrote to memory of 4172	1260	msedge.exe	112
PID 1260 wrote to memory of 4636	1260	msedge.exe	113
PID 1260 wrote to memory of 4636	1260	msedge.exe	113
PID 1260 wrote to memory of 1104	1260	msedge.exe	114
PID 1260 wrote to memory of 1268	1260	msedge.exe	115
PID 1260 wrote to memory of 1084	1260	msedge.exe	116
PID 1260 wrote to memory of 5620	1260	msedge.exe	119
PID 1260 wrote to memory of 5620	1260	msedge.exe	119
PID 1260 wrote to memory of 5140	1260	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff95724c188,0x7ff95724c194,0x7ff95724c1a0
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,2584723800038259586,17795830325376575486,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,15700287692343234191,3701790572034288215,262144 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:2
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,2409428916323703505,2975210588408799660,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,12713209747809578486,1178448536645256787,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,5239768910932225590,8196362143018329695,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,11642545192440766815,5940811118327023830,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,4324685139546680146,15155548363132906129,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4352,i,11379374946956949107,9970443075539779606,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,1228575817455398142,15403512790083681727,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8900406118703620498,4942226141929786324,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,8900406118703620498,4942226141929786324,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6300,i,16346079431923208037,5333056709906656592,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6588,i,1190636285269591224,15150115303465222981,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6008,i,11833527057795849069,3731207423675798601,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6956,i,1028725118212327141,16884030689855897335,2097152 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6376,i,10512065842102642979,10190038749558077203,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,2017134980030225932,11682864488960144514,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,11730304920503653539,16922331403795402594,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,10178085768851955501,15055574495202546662,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,3042445187950425837,17128823138698001112,524288 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=3012 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,913027693636178007,17318152491139975197,262144 --field-trial-handle=2408,i,13711892481097948638,7378904889329846781,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c3
Size 1024KB
SHA256 85beed71e05d276158c876162a2a1aff4863e3179ac382e051d9bd05645d5c2c
MD5 651200081a4ad24519f5d38480a82231
SHA1 a3a1d51350aefa3169f69c3a1a05834170c8bc90
SHA512 db12978c6f6957be106897aa51755d36281f1acb32692305a0932ef5e12831a83d284b8b87ff4d131b7107d6ace689e676e4ca65f37ccb6902c52364393aacf1
SSDEEP 24576:wKLv9mZ9/Sf4Cn0aOb5emj5KVDpciMfXalPI:wScu0x9eRpciyXay
TLSH
T127252397FAA9FDE93324AAC4FE7445C258834A00EF2AFCF7DD1D9AD05090BEA5510C91
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d9
Size 1024KB
SHA256 6305ec41efa851ed0be40bc356d255d84fb29e3ba4e2445642f0329aeeaba11d
MD5 2ffd2851c65fb1e25008f37e5c763461
SHA1 0a0bb094bba0184a2baf2f351116411809c9c339
SHA512 df5de8746b2ec9565dbc414fbb05d9ea4d35504bc48fa154311282cf3e67f2728db08d18623ebd75f0092a7b309c2403a27cc24ef803c5cea27bfcc411ec5bae
SSDEEP 24576:fJMlH+g2yBlkY2RFASrWWJnsL5qYb+kItX0sswcNLw:fJ0e3ikY2RFASrPRslqhtEM
TLSH
T1D525338D7C80360BF786D8BE71E6F84FAF93A949CD1C725234C148D6D22C560BA27267
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000da

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000da
Size 1024KB
SHA256 ad97943c889e7bd005dfbb3e294a72e1549216f1fc7ed70d27275cc3aa624166
MD5 e88085e47dc9d3aa5cf08303d830957d
SHA1 bf396dce04a683d2f2a8c2b05349c2c28f54d370
SHA512 859ee960ccb55818518849446aca146581393a20a88c074373362317d8ff416f96a3be43b7c7cea8148a8d4c421f45fc23c69e7dd296172c622dea12c68f520f
SSDEEP 24576:E/bi7zqtuDC5XKQc6bxuOgvGpHy58EAAlx0Gwzvu:EDi7WACsr61uWwLAmCH2
TLSH
T1AC253338B442348EEE5E86BD7A55578E72322967481F38F797B09CC9888129D30D73DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000db

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000db
Size 1024KB
SHA256 0ce8e4db5fa0037295c3fa79592d10487e07ed33ab724f7de4f720848c73f58c
MD5 80a8d3c6bc69a2a0ba95a918144dfaf5
SHA1 ae79f4d9e36e71c27aa28cbf370e7ff9e2b3a661
SHA512 1e12c9d7eef99ca0bd5154d2b3c2a6729d0470c46b089968272752c542d73062e1a6c7be98dab1764ab21614ae500e02b3b909d6ed5465a07a093100005db9ef
SSDEEP 24576:TWzcbFpHONk5tU8XfYVJ6SGV3fJfOD/v3xUypk1nugPf:MoHwmU8Q/6z3WXi31uQ
TLSH
T14D25330CB48C6689EF6606B5BDBD520CEFAF78F807DA53413DAF80739261B1B1552E18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000de

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000de
Size 1024KB
SHA256 42e9ed36052b9ee6d42d84070e221f65c28478ba2d4fc42043162ca0c538b623
MD5 ebf7754b62978d4e8a5cc2eea9402720
SHA1 274259d2ee1d640b76d910c8d61420a35998c5e3
SHA512 c3b741b968e71edb28fb97dbeabb58b372895ddf1fa254c5c5757c107bf32dfb88befbdf98f427a9c627458bae4247091f0690b8ddc4305faecb4bc2e7dcefdd
SSDEEP 24576:2modS3Fi6Od3ZkHgcc1ZuIBjM02gVS/2P3VAob6JFPWgWrP6GDY:2mz3Sdmc1ZdBjFXI/2P3SDW6
TLSH
T186253318B838430DC08932F8C3E6558751F635F51A86B0E6F39EA83FD46BE5F566282D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 1024KB
SHA256 f23c5220ba20999dcc08d65be38e8396893097554592a4563b8134b65645befe
MD5 8a6007d5a2957495afcc6e0ebc80a72b
SHA1 84f759fe8611dd94fb8a6f629b2c9aa9416379bb
SHA512 54ef0966ce673517c17df4b99d954645cc656bad86b40fd51b341c8e2943625e0f3bec4c6d7e6535642a3704c2311e4d914a8f8e840c3329b73cebfcf08fad07
SSDEEP 24576:U8tfnPy4w3tS0j1TPbiUdKR1BhnX7j+GJrb2w:JK4w3T1TPcsw
TLSH
T1B42523C24AF2186BC345ACB38E9072BDF6A345245281AB55B8A3619F3330E7F51D87F4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e1
Size 639KB
SHA256 9f070abee7789686e1ae056d8c85c5a2df28afd37574f93fce5ba01c17878b3f
MD5 09cd4342ea53f90923b447be844fbf2c
SHA1 5d7cef7d92da7c412c72b52f128c697851497c33
SHA512 a5c5622d4c06a83e6a89b4998e74fa64c992e8f4d4203c144f4463f1847883e1b0d28ee9a5eabfda65d71c8afbdaef3f118e433ed9e2ee132abc5eb7adb00599
SSDEEP 12288:eCrOzhhgHy9fgb39d549+cUTtJM7PVTupgMv62QKHkRE9S0I55:eCYDgHUCz549+cUoEpgMzQaS0I55
TLSH
T1B5D423EE9E7C509810CFB081E077B9A33F1D8B9970984C9D66F889D285B5F1C63E7948
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000ea

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ea
Size 152KB
SHA256 f037e1ed0760cb6a43ae5e6d6ea72d9c4227c44b7938c9b2ce5b1cd0138e698c
MD5 76099580792a3a33ac66a094ea4c5170
SHA1 a46ce2f3d790e8f1451c6e9acb6b293c7bcbebe3
SHA512 01c34684b4cb31c2499be38fe6be85adcc8bb80a63d8ef80a8f1cd816f645d93d4f0d0272e6a5513f42b453a47436b6845fb29c78440e1b63a7bd8af86c3569b
SSDEEP 192:tLgrmTUm6szvqo2A95xFvJnHSERGNsOaO6IFLMQtZ2tH9:tLRF6sNtdFJy0GNsONF/H2td
TLSH
T148E35EBD7B8AA925E18080F534919339DBF0D85A7901CF2B3747134DFE692D06F901CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 f4b05cdd34b9191494c159ba045423082a40c662b168e17107225b10d58cc3bc
MD5 fc648c676309d5cc30c1666bc8942952
SHA1 ee65236b30d47e0533b95c0092c4854634697ccb
SHA512 652b5e0067af0acd0078be995792d7863b82a9408b84d11304d9c375187a0142185d877ad41df740338e6fe6294e718f6f652b5857e3db829c64e885fa9464de
SSDEEP 96:6FR/23EZ+kpYbt2n2DmVUkQWm6f8GboZl/DqOYC2+Xs:WpYbg2aGkeDKCm
TLSH
T17DE12BBAC2E1C072EB594433D0F63B21657297C9F80B2E572A70EE766563BCDE14002D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.whitehouse.gov_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.whitehouse.gov_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 a16b128113ce8a4f7d9e77898c6be9c37cfc8b4875182d79e4d6fa5477b5a89a
MD5 b54e51e73a56caf28edf3f858e98d0a7
SHA1 95b8ed6dce2d552379ad6ead032ed419c7e36ca3
SHA512 46049c76a9a7d4283ca2a2eec425cbd64fd9d3ec53c13cd30163a4a44ff512ee1f0c1f4655d2120afdabfcadfc86c06f69549d3a2210d7a2057c4c1f3c726c19
SSDEEP 192:DUGE56Ae60GU1i6o/Hfc57xiHrWrYxjpNBYUt/LJxJ/LyoktJ:DU756Ae60GU1novfc57cHrWrYxjpNBYt
TLSH
T103E1CFF3C7E48B2DD91191F0AB156E1BCE190955436C395688D4EF4B63E24B2F21278F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7ce6b69f5f897a47cc52a6737cc9ec2d2e738047e23ae98600f887e689780ea4
MD5 bcc65010b797ac50c8225022b4557fc2
SHA1 1a9d683319e99840871d3d9b7a10645458ae823f
SHA512 8ed814af43ad59a18727c5bc3e731fdd0a7aac43b48b3b665c2552dbff0f3524d7f45e4f27adfffca0dac06658a6b909618709404a0e16af1abbfb06c494960c
SSDEEP 192:sxZgR2yM/jK1Ml8MWq/f8srmdIdpdMHW6+WNGYIko/RIgrJ:sxZgUuq/f8srmeuHbGh9
TLSH
T11B42E8126A34697BCCDBD20DB9457F93D6F95472A2940E44A9FCDA1C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 97564f358e86f10c31c175a7481560ec1921915f237c09560fe464a1112ceb76
MD5 51ea5052ae603dfcbc0ab1f251e638a5
SHA1 b5d7ff1882a086879b136bbc1e4da60c5961fe4b
SHA512 7e6f22ca6b5cd136d989373aabc804a01c5f9b7973c260aa3002ff329b5160cdb2335da42dff7e833424ba6ed60061ac8fdec404283304c9fff2a859d1594d83
SSDEEP 192:sxZgR2yM/jK1Ml8UQDWq/f8s2dCLbMbddpFk746QHW6+WNmctarMaxYIfL/RIg5s:sxZgUqiq/f8s2dC0tPHbKdxfW
TLSH
T14B72F81265345977CCE7D219F905BB93E6F89462A5940E48A9FCDE0C04E7BED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 77fc356c1bbdd57b4c8570ce4df650987cf4077b20e3f6273b4016ebd8ee3e63
MD5 dfd429a316022b004a18c8e43bf808ac
SHA1 e8a2957769a97a6c5e6e547cf839d9e430b63f62
SHA512 56e6c088c58b267a2f317afbd0a01e976a89b8286c4fdd56179cf0253c99da3e66e233dbfba4ea22f9c63b34b9e4dccbeab30a4cb126cc33958c4ae0e626e279
SSDEEP 192:sxZgR2yM/jK1Ml8MMOq/f8s2mRbMsddpmc4XHW6+WNBta/YIJY/RIg5iJ:sxZgU0Oq/f8s2m+WkHb+/Kc
TLSH
T11762F702AA34597BCCDBD219F905BB93D6F8547292940E48A5FCDA1C04F6AED3217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 b9f0274cfe5a010443861c848b3e3b628ef0f193b8a6b19046eae03dbfc12af0
MD5 3eaa27f08ef898963d7f94ce5fdee9d5
SHA1 de5129450063818718f1f26c4b560ee3715cb9df
SHA512 b9bc15447192445eb9ddedd62e9e49ae6c16054450147a18ca50236bb5d1c32e090459e283b835f2f0257a019e84103e418893c19521171c22be542b65d716ab
SSDEEP 192:sxZgR2yM/jK1Ml8MWq/f8s2dCLbMbddpLk746QHW6+WNmctarNy/YIKY/RIg5IJ:sxZgUuq/f8s2dC0tpHbK4/JW
TLSH
T16B72E8166A34597BDCD7D219B905BB93E2F88462D5940E48A9FCDE0C04EABED2213C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 efc8a380f474654f8b46d8b582d8ef9d599af02b1374bb43515471932c462684
MD5 0c4c91ccd3f3db745ce471e26f87aa6f
SHA1 7b7e82ec0209405b9b2f2ced89288e088ba7a05a
SHA512 416429e1359cd1fe8370c7813afa4ae8cae20a5de6118d64a7667780dc0f3542671f2ac7baa937c25fa831d5117ff5b5daa7a64d594933a42a5361e338a839d5
SSDEEP 768:U+sqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR97roMx5:U+sqxXlWvJD6Tu1ja54LAs9IMD
TLSH
T158D21C3B694CC77E4F840E6CEC266FD76ED801CBA6988D5447FA884C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 7f11786302a3c5c1776b3bf8ce3d634703c81a3199840aaa47bfe22012497ca7
MD5 37d6d393a319410ec7c697e65fb22f7f
SHA1 1df75a43700f91bcc9e4bbb3642d68b488f52f5f
SHA512 ac336256f9ea14fa0d5128c662d9488b089ddd0a07546800e3808e801be2f3d8a3ad1b6a2aa4185b08b77907c3834d0f24964786d6f702839b8e9dc3effc472e
TLSH
T1C7A00230DF800147C51629B2156713911301CC907504270750A21149CD618944DA140C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\783ff0be-338c-40ad-8053-33ee09a8d709\index-dir\the-real-index
Size 72B
SHA256 5dd23abdb9908b87c654abe5c4dffd48cf9ee92bb4d2dd1fc177ad000e687ba2
MD5 2112716e0c75f082c4f5f80733413282
SHA1 f0973ea28249f66cbf6ce22e415a69cd69dff321
SHA512 ff2c899d1a6f4cffe872ad2b0c458a860344c8140dec9aefe6b2c432f212ecd685e88edabd87f91cff72130fed483f8c5e3552a2e7e47e20daeaffd0f1ed3ead
TLSH
T1FBA002141AC2C061E50257B039E623716390DE104732131B45D34584CD7354F9D5200C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 632e9d7279497cae06eb10f3c6fe37af58666634df8e5d048bd05e2fbb7c2a35
MD5 5a26ed96219cd2c3467b9683707f2ecc
SHA1 84647517f67243c734c5c80d2b2bdcf9efb2bac7
SHA512 0572acebe3f33d565e2768d1fcd8d155facc920660190c3b4f9673013ffd0c9e65d1d27ee352a6b3bbcde058e7a01442d86e52ad22b6bba75432672a048e64f3
TLSH
T1A53112CD4EA0991FF86484B31172A4A07370C9CCA711E7235D2C31721D2178D39471DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 3KB
SHA256 e9055b4f608c931399fefefabe2ccb926ecf817d34f9ef3a8e12bdf7aefbd430
MD5 65e88a853d2446ed962fd2109d933072
SHA1 622cb9482801c12f75d23a60a097fce5c234fc76
SHA512 ed8376e347ca2e60f412bded263977147f64907ccc9cd14fe75481dec2193206bdfdce21a6922f1b37105a6b1b9a96f46ecf4cd7140201a23a1f1e398ac6f172
TLSH
T1E351C54E4E474F6EDDA8227514B50491337456CC1378190BA6FEC138FC87A682C99BA9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5886fe.TMP
Size 1KB
SHA256 a9105bcd7aafd3401cc7c488cde65ebc774817fb66641ecfb214abacf41ea674
MD5 e8d02b00b99c1ebf64ce34dd0da96892
SHA1 52772d982216d06cebf31da2c9b288b379f138c9
SHA512 248e62c249edf9cc3411e3a6431a0bc0d55f4efb73c3cb41c34ed355ccebfed066ddcaa86868ad2fe04e6bdea2f26380acfa466277c883870288d1b38ec3e20e
TLSH
T19631258546E5890BF89455770A97A4F47330C8005333B793693C263A4D35B8D190B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ce4e9e28f251e975120a9e2f9624ea8f8a69839ff9eb18dfe0f091664c29a804
MD5 f2d84cece5ecc1b7bd3c18da2d2f15ea
SHA1 ac91377844e36e1b59e9c6dc0e508ef6bd4eda70
SHA512 f326bba0deda3bde440cd4cd636ef961c6302aa53b791fef4bee416987470cffb3206b5643f30454d6879c9d63ae617b1d5d0ba939c06a1aa84eeccd29edaba9
TLSH
T144E068B76AE70800ECEBD3DE087244960401F428C861EC4F0129928310622702821C27
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 07c94181fc5168967c41a7b1fcb8c92ae1ff13beae7279ec5e3488b73933384b
MD5 585c6e569e73d003718958850efcb844
SHA1 8c5e9bcc97e55de6c8ce3227ea7dd6dc6f3fe89f
SHA512 547ed0ac1925165bac5c76dc3a37a6d332a18af314be82a4ca8950e1cc530877f499efe348c034b499d8b081dc8bee82d25c988e555d7eb48bd23b091a17ba23
TLSH
T18EA00262CA4BD409D50106F9E0A56F4073A069A901873752C8DCF4B8DD96140D5C1145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dcce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58dcce.TMP
Size 48B
SHA256 80e71b4a20836ffffff269c7c3324e55e618275c9f67039bea7d895c333e6118
MD5 7f822ecda779a16e3c959b5c6346b8a5
SHA1 8e55cc34f4bd45046c43bcc408e2ae6017382cfc
SHA512 fb56f7c0cc79819f76b224094177ab4e00bdddf5b8eeb4ac1efd7f8d88f14adaab943cb3949c74c1ae7646fb56781c8cee55b86b7cbd5a9d50a21f0b0d113698
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 aa6a713991cc32dff2b7d218f2f753839045c102a2c5bd54b9886274e8af56ae
MD5 be679e5ed839e8ec56e83902e0443f55
SHA1 d8688273a01f2cbacd05f1fa73355ba51a820a57
SHA512 2a48f063aad26a52f737f694a79f3dcebb402d1789fae3630a578ed1e0bde9c4b29402acec72452248d3c081ce81fdc5493944d5f06079bffd1d8c2506ab0823
SSDEEP 96:KYbaKYIK6m0Knq6+HuKYYj5uKiYCiE4KxCd:ExX/l9Zfi
TLSH
T1B8E10412717F02033ABD7908A3AA8A374E4276A37418A4BF3B7954614EB7E111CFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dd2d3fd-71e6-4a4f-9824-e41b2c4bc199.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6dd2d3fd-71e6-4a4f-9824-e41b2c4bc199.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5f2c8655edd657716863ab8d684ad4cbbc417edd81d99564007d8210bccb7bc7
MD5 d7006b5c0bc9c9d68e997efd8b7f120b
SHA1 4d660d8e6fd4f31355c7ab513ff051ee059607c2
SHA512 7ea4775df36c5860f4d29ede04056844eb027370dee5747de45e8f6b84fd08a51bb72899af8b8577845c87424af9a2759ef88c3528eb9f688378d6da3f3847e2
SSDEEP 384:kZcIhsNfQudkbkbCE4VRNwOWG9JHFssa+VY7oZ:ChI8EuHwOp9Z6hgg2
TLSH
T10A826C726D345C7659F7A655F94B36078EF88067A6CC6E8081DDAF1D00DFA9C230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 71d67da215689d54a7741b121187ee6173ee21b8a66da15e30307c9d43476edd
MD5 110cf661d92ba7a8f57ec0bf11b193c8
SHA1 d2ac2997b4803f032fca16665636fdda09036392
SHA512 596e917a6291e2496bdcd788d4f4d251952aad2310144b9248c487037560b1377d872625f92a7af113e7797746d28330bc6e791bf67c881aee99afeabc6e2c4c
SSDEEP 384:iZcIhsNf1TJdkbkopEkVRNwOWG9JHFssa+VY7oZ:QhCeE6HwOp9Z6hgg2
TLSH
T178826C726D345C7659F7A665F94736078EF88067A6CC6E8081DDAF0D00DFA9C230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 3b4dcaec67aa70d2e1f16c4b19387f3aa32bd328c4e0837bc66bc03ef64b1551
MD5 a8cd1b5c7e182deb11e6397bc9d97a5a
SHA1 caa94966fa3bbee899e5fbdd9e30afdc6fd891bc
SHA512 7872e095e98344b6a113ccc142ad1f857f2f69b7355ce01de6968a261d512add09c4f7baee337007de7986c2184e86a1f1a491dd6926b1df63bcb4deb31817ae
SSDEEP 384:QiFiZcIqsNB8TUNTUlIl1TJdkbkoGEkVRNwOWG9JGFssa+VY7oZ:rFQqowgrJE6HwOp9Y6hgg2
TLSH
T15BC229F219D7487AD9AE5757E77E2E034EBCC067B5886940B3885A0CCC9A1BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3c239cff7afd0c355bb293a5fc1e2715fe7604ff0792b52a99fd1e0ab88b1d1f
MD5 63299372ff16e48efcdd7e06138ada41
SHA1 340bc09a2cc61fc93c2f7f512dffdb8cf53b7f79
SHA512 b6c9fbb19dd50f0855158ca1387f2671cf75647bacdb7706d15ffcd01b1335d4f00e3eca7be0d6978777980024c102fefe01f4f24fab39238717b31c51b7a5d1
SSDEEP 192:tONg6JkRtQmiUy+/W+RNwOmhOmQh3FDRQU6:tONg6Ur5W+RNwOW0FyU6
TLSH
T1F602D835A8382C779EF36E4AB58B27135FA4206BFA852F80DAD81E1C01D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7ccac9ac6b7b9470efbf7efe778b62b811fe7275d43f0ee18c88e4a6efdc88e4
MD5 2e33dded690a7deedf45d5b216eee60a
SHA1 648e202361daa618343e4007ae31b4140ad1a5c1
SHA512 fb688bef4ad5eed087282883833241245c07945db29c2422bc948014e64e88d98b90e76b085920249033e9d610ec003474cb243102df56aac0c7f66ba66c13c1
SSDEEP 192:4ONC6JkRRQmiUyC/f+RNwOmhOmVU9DFmVcFHqwAU6:4ONC6Uvzf+RNwOWG9JBFsU6
TLSH
T1B5122B3168385C775EE3A455F58B36034EA5416BEE893FC0D5DC2E1C01EFA9C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1fe6e26306fefd211e38336b77a750bba98c6ccf383a389fc5a9b7f4d833a8f1
MD5 e05b37e7773852f061cbe21022a74944
SHA1 45cff82afa62f600e1277a029f2dd083eac9844b
SHA512 2ffa3d2d7485cac983048176a0ad624bf47accb3c230e130d7be9d9faedc71cc67530c35ce373f249cfa7731117fb87ab30c0103b6a350a286ef9612186d4f68
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 549c807696ac0f75e225ac911cc8c8213abf4592e073d76c8115b1f4312aa613
MD5 8da540b7c3dad1d1cb2c5e613d9d44a4
SHA1 774ae1a2d6b560e2b4e101ab2705f30d16569ad6
SHA512 b930387e34d471ac505ac42474b9cc30bb0b3c3f4c3494a4155c7253e633201ffbd403c11fde71a21becc3a7bc20b5988882024ef625bd31f164bb1428d0aa36
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe589630.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589630.TMP
Size 392B
SHA256 31ecedceb6031cf3c55c1197a681c1f527191d879428cc624a9ccb117a69a861
MD5 1cea6b85c4c6024814ea6b60cdece47e
SHA1 2e7a199fe8c7ed3d388b9ee07fba0329c528ff17
SHA512 60da5ee0d87883bfd4dd3309e44c4756d8c04ab6f01b8604160a0d9231744496f27e45f127e238ccd49c4978b52ffda90d5788879f5b0336a06549bde4a02e90
MD5 SHA1 SHA512

Submit Download

deb111eb-f54a-42b7-9fe7-17491f73006c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\deb111eb-f54a-42b7-9fe7-17491f73006c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 63f83754ac56ff2e202ed98e09e996ca8d87ab8e938e6fce8e8e98d4ac3e2579
MD5 573f995ae007c3b5e26ebfaf91b3681e
SHA1 be9878216508dddfb0c3b54f0f38a42eec4e95d9
SHA512 a705a6d215ecb740c23dde15f390d360ed153e67ac44640388ab2815805c0163ab593a4bfd1cc51f60913fd047dbedbf380503beeb0b38e6749e7c2c36fb2c4d
TLSH
T1A9414858A6F91144B3B76F5A9FF2A87E487EBD772F06D06D10110E4E0627A00C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download