hxxp://easypanel[.]md7lab[.]com

Analysis

user interaction
yes
max time kernel
74s
max time network
76s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://easypanel.md7lab.com
Sample260922-3ddfbstfre

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134345930237564262"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{F46AD72F-0ED6-4B52-8C9D-00814199E23B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4724 wrote to memory of 4644	4724	msedge.exe	85
PID 4724 wrote to memory of 5536	4724	msedge.exe	86
PID 4724 wrote to memory of 1768	4724	msedge.exe	87
PID 4724 wrote to memory of 1768	4724	msedge.exe	87
PID 4724 wrote to memory of 1768	4724	msedge.exe	87
PID 4724 wrote to memory of 712	4724	msedge.exe	88
PID 4724 wrote to memory of 712	4724	msedge.exe	88
PID 4724 wrote to memory of 5032	4724	msedge.exe	89
PID 4724 wrote to memory of 3972	4724	msedge.exe	90
PID 4724 wrote to memory of 5032	4724	msedge.exe	89
PID 4724 wrote to memory of 5032	4724	msedge.exe	89
PID 4724 wrote to memory of 3972	4724	msedge.exe	90
PID 4724 wrote to memory of 3972	4724	msedge.exe	90
PID 4724 wrote to memory of 384	4724	msedge.exe	96
PID 4724 wrote to memory of 5600	4724	msedge.exe	97
PID 4724 wrote to memory of 384	4724	msedge.exe	96
PID 4724 wrote to memory of 5600	4724	msedge.exe	97
PID 4724 wrote to memory of 6016	4724	msedge.exe	99
PID 4724 wrote to memory of 4088	4724	msedge.exe	105
PID 4724 wrote to memory of 4088	4724	msedge.exe	105
PID 4724 wrote to memory of 4088	4724	msedge.exe	105
PID 4724 wrote to memory of 4972	4724	msedge.exe	106
PID 4724 wrote to memory of 4972	4724	msedge.exe	106
PID 4724 wrote to memory of 4972	4724	msedge.exe	106
PID 4724 wrote to memory of 4732	4724	msedge.exe	112
PID 4724 wrote to memory of 4732	4724	msedge.exe	112
PID 4724 wrote to memory of 4732	4724	msedge.exe	112
PID 4724 wrote to memory of 1164	4724	msedge.exe	114
PID 4724 wrote to memory of 1164	4724	msedge.exe	114
PID 4724 wrote to memory of 1164	4724	msedge.exe	114
PID 4724 wrote to memory of 1776	4724	msedge.exe	116
PID 4724 wrote to memory of 1776	4724	msedge.exe	116
PID 4724 wrote to memory of 872	4724	msedge.exe	117
PID 4724 wrote to memory of 872	4724	msedge.exe	117
PID 4724 wrote to memory of 872	4724	msedge.exe	117
PID 4724 wrote to memory of 5384	4724	msedge.exe	119
PID 4724 wrote to memory of 5384	4724	msedge.exe	119
PID 4724 wrote to memory of 5384	4724	msedge.exe	119
PID 4724 wrote to memory of 4816	4724	msedge.exe	120
PID 4724 wrote to memory of 1448	4724	msedge.exe	121
PID 4724 wrote to memory of 4884	4724	msedge.exe	122
PID 4724 wrote to memory of 416	4724	msedge.exe	130
PID 4724 wrote to memory of 416	4724	msedge.exe	130
PID 4724 wrote to memory of 416	4724	msedge.exe	130
PID 4724 wrote to memory of 4216	4724	msedge.exe	131
PID 4724 wrote to memory of 4216	4724	msedge.exe	131
PID 4724 wrote to memory of 4216	4724	msedge.exe	131
PID 4724 wrote to memory of 884	4724	msedge.exe	132
PID 4724 wrote to memory of 884	4724	msedge.exe	132
PID 4724 wrote to memory of 2412	4724	msedge.exe	133
PID 4724 wrote to memory of 2412	4724	msedge.exe	133
PID 4724 wrote to memory of 2412	4724	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://easypanel.md7lab.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff0891c188,0x7fff0891c194,0x7fff0891c1a0
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,14686440356192772853,8358459065469174448,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,2232715665016181412,15512971057516826661,262144 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2600,i,15228995912700936874,10262791280723551150,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3492,i,16058431177692398362,12832862775959126866,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3496,i,4355880294731486396,8248213714816426654,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4856,i,17730099990998835750,1735499194475530398,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,11988691131697208425,16907146855247628675,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1735299880647923548,5260874376278017865,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1735299880647923548,5260874376278017865,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6092,i,9248728650385361293,8364882689675499407,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3560,i,5297547723669188471,7192958999653374290,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5940,i,16602505455540093360,18229663409614189445,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3548,i,11878416201632141295,5255852577639089199,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6704,i,2493878313758525796,7909260920294025044,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6804,i,7725831710181607423,11599030099316162386,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6828,i,10606012375115435757,5379790300902421380,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:1
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7032,i,7302884738522443589,7648488788101154932,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,10389117337156741120,1976876274570881641,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:8
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,9295028419820775535,18033208500948694626,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=7064 /prefetch:8
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6804,i,2887090982789623366,12596711732742326680,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3544,i,8686676971014880227,14569559990510674778,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,10288614717845890905,2348804028178629363,524288 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5872,i,12463636155567642953,456650056263873660,2097152 --field-trial-handle=2304,i,5069305056798007081,18001340902714119489,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1164

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 41b1cfb286452eea1e034179e575dc9f382a649fe1d64b6b041f483ad47b584c
MD5 15ac65beb865b4e031a199f1e2a09c1c
SHA1 37bd77c0ec71381dc1585db888506e53ff8482d4
SHA512 ce294a125af4e0cf029253cb1a914235dc7789d37bf45e5ad1dc16fcac34aea2d15ae2d2dcc50b99ab2363eec130507511a8cc91f221cb7a07427eead7eb0fe9
TLSH
T1FDF02DF5CC26BC3B08FC5B2810A44B46EB51135B3B80884F3B3D811D8FB163B854696C
MD5 SHA1 SHA512 TLSH

Submit Download

f_00009c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009c
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009d
Size 68KB
SHA256 aa8aa822dcc877a0002877631fd1888141da53bfa4838119a05e25ae6082c3bf
MD5 110c2e941f1ec2d409ba64e9076d05a6
SHA1 3112c99e2bcd5fa11dd1b28410b2c0a1bc76c0fd
SHA512 9ae278820122336eedfbef12aecd0ed14ea9947fb51bd52253c6c72f8b0df58284a38bd3baec36743dcdf026ad8ca383ca7eb2794cebd3886a02a4f405686157
SSDEEP 1536:a8ZGkKYRIqNz2tDACsUf76Z+AGYguWv0KxwhneRy4Y1R9s82yCENwYJoYl:tkVYR7NOAXX9GjuW8Kxwhne04Y1Ds82I
TLSH
T149630267DFF657B536E17808FC6CDA2698DE11684B438A900FBA7CC50F86C6284CD48B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009e
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00009f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00009f
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a0
Size 44KB
SHA256 50ff841b96d52649bc11ddd5c343b30aa63730e48d87b789c24fdfb1c3b80ef3
MD5 92b84614dde1055f02fb1f0a97fc1a3e
SHA1 81ab31e5a987cbcf58bcc7d2926dbcf8cf0893c8
SHA512 4b5b0a5d1232276522d18ae693c170c35d8d3cd1a6ac04ebe6c9ea2434f3b8f09eec8e30a81e8f32edf6b598de1caa976569ba67355509407ced2eaee09d2432
SSDEEP 768:QUj7szFhl0vX4A7hxnBvcxJl5jjNrTeICg12z3BzppFMUsmwwKpBUA7bzC4:QisHl0vIGhxBvEJl5ZTeICBzVraaKpBH
TLSH
T1FC23F27B08BC5B1CA45A2F349FC6A08178B893C1312B7AE93A8643C57D4E81AF155FC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
Size 386B
SHA256 77e90b9e1392198817e4c9185d2c31ce3c5bfb14b434a00ca705dd1342f46671
MD5 d62957c76bf7e21f9958b169c831b2ca
SHA1 d068ff8e95bd79fa261e9b08eefbc983dba33b72
SHA512 40fe88bc84fba41460df4c3f8d8170f4887d715e708441d0bfc6929beb291952b14d0d298ebd39f8a583deb9c7aee9d30262d70fa75fd15839b6cfe08af02c0f
TLSH
T1A8E06DE844FDC25FA26461974538BF4DA2A3B70F978CAF861B089854B1491C0B6AD9A1
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 81157a09deefd84cd529061675a8a3111953c9a65346909cefdf090d298f9503
MD5 9680d85350537cb2be28677896f17794
SHA1 7367d05d0e8dc0d84a2f8b2e8669bdb9befbad48
SHA512 dc92ff2a60feb6f029e99530332e5d1f2d8facac9ba3921d324c43e8e6ef97fc56ec726918631408d0b731ab9bec944c19966a70b49a49861bcad0ee1528c0c4
SSDEEP 96:D1IOrLEtXmFVwa/zBjcGO5HzRk2A1pGtwBEg/AvjIulx:D1zrLEtXmLwa/1jc75T+2ArGtkN/AvjD
TLSH
T1C7B1DDF7C7E6822DD91195F0AA187F1BCE1D0855436C3D5A88D4AF1BA3F24B1E181B8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 bdeee388c42d9c92d9d3a3cf115dad1c2b7ad8fa67ffeb496207fd44e1663c53
MD5 fee85af76b7b5f11399700514d83b820
SHA1 dee704decc9fd04f2855d9d12bae530e7780fbb8
SHA512 dbe650ae228acf2fbcec9fd1a1e10239c84ddc80aaed4ced06b12d7ad94b2f016903321c72ccaedadbd0aed80e36d8081f59ee69e7024e5a33a8964c2df76e09
TLSH
T18BD022E3274930B5BAACAE97916ABCCFCBE600640842DAE822D298AC153646C2567180
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d636cddecae3f7ea31339aae02927265b6d20804f0c87a5914d8c4713073830c
MD5 375c5e3b3c0d8bf1e4e9d73419091edf
SHA1 43bbb75e6ed12d8970a3b75ed57ca3bf750812f3
SHA512 d0214b28e86e2ab643dcf165f8cb7de9e2fec80474f4e82523eb8d54ec809800d285a1f4e28b6889a933b0f859f56e68ef00e857e3a0a39fdc5ae713092b80a1
SSDEEP 192:sxZOR9kZ/fjseQZZPuzodpKlHM86+WNmow/YbI6FYEjeIg5iZEJ:sxZOEZ/fjseOZP1WH6+/FQYFwO
TLSH
T16D42C715BE28A97B8CC7D219FB59BF52D3F9507390951E48AAFC8A1C14EB6CD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9998c6a22122faf9426a756a956f2a1b4db223fb279bfbc86425d4efb3029000
MD5 703b848c1e670345f7e227ada54e5edb
SHA1 d93c4aa0b75144f970539e58f738031ddce95cb9
SHA512 3b5ecad5cb9f71afc391b62b277337701df065a9e5a2329c3e69157e726d6d9023a66b6a0e95f4a13b3bcb0913a315f70c9935764d71580bcc8a0ba52d9e9010
SSDEEP 192:sxZOR9kZ/fjsxQZZPuzodpKlHM46+WNGYbIaFYEjeIgjZEJ:sxZOEZ/fjsxOZP1WHOGFwYFjO
TLSH
T15D32C715AE28A97B8CC7D219FB55BF53D3F95033A0941E48AAFC8A1C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3d676b291441543373cc5d224267974a88df3793a9dc1639df20dc6981bacf01
MD5 5504bebe11d43760cc4e358f68f7f8a8
SHA1 fdeb3c7164c34801e9a8ed1a9ef9d4c59452da11
SHA512 043f645302de939af786131d3c939d2d93e55cb3021591ff34eda44948cbe812a3e6521ce37f8c6b8bde0483b7de7dfe14f741675c4db72e68cb2aac274bf03f
SSDEEP 384:sxZ0UmzZ/fjsYOZRIRu7H6KNB/FZYFwiRz:s8UmzZ/f5kI4H6WFZWz
TLSH
T12F721946AD24997B8CC7D159FE397F62D7F9506388845E4CA6FCCA1C04EE6ED220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ea0e9c9d01e02b647266f0270348d8912c816d1da15d4507243e41ce6c5f4b1e
MD5 101386e1d9ec837a0ab16d6534cf82a3
SHA1 3dfcc2eac9dc97aa395c226e32f9c6b71a32d274
SHA512 d4f2ed4857529e9fa868af1315f1ea51ef20543ceca93d55031309cbd2b3bc58a578ec4626185d33ad401b1e1123ffeed3459925730c98c99f334782028a61fe
SSDEEP 384:sxZ0UmzZ/fjsYOZQIRuZH6+QN5ZF/YFwSez:s8UmzZ/f5XIgH6+WF/pz
TLSH
T138722B46A924997BCCC7D559FE29BF62D7F9506388845E4CA6FCCA1C04EE6ED3203807
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a97fe19-578d-4d93-8ecc-0da8458b728a\index-dir\the-real-index
Size 2KB
SHA256 9c41af742d25037caf80a7d9b625a73481f4360de6d58ab954a6c343ec1c6f53
MD5 bfd429a105251e2d98c4b26f9d34637b
SHA1 7bc88310472d67ccd74ce975ccf0443e8e858879
SHA512 cdd72844cff9fd87efc3515f7cfb00f147c3d43cf15af89c6c1cb2763b2714776a7f827701a125f4ec0e2638cd62a346182b2687328bede9a380e642fbfccc86
TLSH
T17551C84F0D636F37DEA8227104B964493778A4CC23542E17A5FC9139E8C73545C9EB68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a97fe19-578d-4d93-8ecc-0da8458b728a\index-dir\the-real-index
Size 3KB
SHA256 98bb6578003355d8fa832f615c89e55b4fce2bd0230d30165af172d9134e30a7
MD5 5e2da7c1400cb0d84de3c5a0a04b3df2
SHA1 7efb10dfe7a54fc0b860d3184133a6bdb7ed45d3
SHA512 d9712ce4e06a7b0a188a6152659698593a8ff3312302f54b4265257c3cf0e99c25f56fd65d2c9ce78e09dbd9b78c711b07330504d35b09b96018f725c782d01d
TLSH
T1C951B34F4D577F66DEAC61B200B5144A377966CC23540A2B98FE9A34FCC332A189DA68
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f354.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1a97fe19-578d-4d93-8ecc-0da8458b728a\index-dir\the-real-index~RFe58f354.TMP
Size 2KB
SHA256 1dfd3580d9189e9b870622c36dcf66cfc8c6054fe4551eb0f3429de6170bf597
MD5 7a44918a6c19802d7dde37e0228b8de1
SHA1 b6eb4ad6a88c48c12e3e1761096871fa5e1dcf2e
SHA512 ea0e6f82ce3bc05275aba07365114eb4412927a34f4ea5f8d50192f8364513738874bb902085672d141a893fc8de03259e648e3af5a83c647f61ca683d7a0635
TLSH
T11F51845A4D034735DC84027309E968963739A54487483F0F71EDD236ECC279CBD5ABE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe87e87f-909b-4e00-a0b3-ff75044b0264\index-dir\the-real-index
Size 72B
SHA256 1485628620e39ab105a1ff2a1718e57b684bf9164da0069c323714dd77374168
MD5 462eaeaeda782ad5ab385dcab0ccb1a8
SHA1 2e06a81cf6bb5218a824108516399389479a8a4f
SHA512 fc02a8b597592cacf891ec6e83c75da28980fd844b2d70e2d2a74fb13782d72ec743889a34c772443d2f57db3b52fc5fc1c149bd15a73de2d4777234afb9ed57
TLSH
T1F7A002160791000DD012A1F9155B43615312EC223101136744D15584CC615418F6100C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fe87e87f-909b-4e00-a0b3-ff75044b0264\index-dir\the-real-index
Size 72B
SHA256 d9dd1341cbdff21e0f73f6dde6673c57a3bbc395770b4f0688fa6ae403c725a6
MD5 0271be306464eac75657b3f222c3bc81
SHA1 75f3360a671433fa008b31b9509cfa9092857421
SHA512 d6e5cc6247471a0b7687ebbbe66990b66ea0ca6cca3daeda13796a30406a5c4770859464b1fca173d55c50aaa2079eb126b6f11b94d033bbdcb49a03d8e276f4
TLSH
T166A0021C0EC34C41C00213B026D672622310E9140241138BC7D310C4CC72E495E4610F
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d208251d0600a11547b9578fe8aea3918b2f5d01b2e5d1bd5cf3bf0d3bc1516f
MD5 128a8b595eab343f7773175b98c00695
SHA1 d44dad9600d7549715106f865a59868e77176d82
SHA512 8bdd85710627d197d791541404d431caed7535e50398954c9511d21f0787b0478649ff8167d30156e56a0637f1a9c24ee2ab94185a05490cf40fc5905d7ff617
TLSH
T1B0E0C0BB2CB71D10F87FE3D1A07248A000063998810EEC0E601EADD33061764780BC13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5922eeaaacec424677e60ea8a757db0ef6eb769ea090ac86059f64547c7ea8c2
MD5 1e9b1d34490a22356899c408209a3c44
SHA1 8031fdfc411bcf4b5a3259ac7cac2678b4ef77fb
SHA512 0f9d1dbd8f29b7f40cdc8586b714b7ed50a1a3010f848161d0873efeff4d7bb9f71754edfa2773cc30a8b7247c3fc7873733ebd749211bbaa2bad90afae28fc4
TLSH
T152A002318A69D455C80006F5A066614833B4489D0346324546DD94F9CC9624099C760E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5949b1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5949b1.TMP
Size 48B
SHA256 e0e0939ac6ac0ec4d4e85d0fb080ebda7831c225f544c67faa135b53f6808549
MD5 d6eb76fe255868b917bdc4041bd16d2b
SHA1 8a547f16e29b0a01cc598eed218db050454d9e1a
SHA512 7f713255204d0bc69e4474f3bc24f81e89c869151dd73b7d8289f9ccf2056dc781728720a966e580830fb351289f641c6443dafbcc46ed7a4196e6edb796a66b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 4fb524d915ccb9f39b9ed8dc25933177a09ddfa0228223d457685eba1d322adc
MD5 334d3afcb292881f7fe6f3dc0bfe067d
SHA1 7e36c42f6d8760ff4ef18500103f81417ae0c5a8
SHA512 0563befc52d5f40c6120357eb29306f83a23dc37cd82758a3baf9e9a6f7007883d0736b1a0561f35d252859a6752bfc9dfc5f3ed11663c29b4cf6e61132591f0
SSDEEP 384:OtfFvpopPxrB4RhfgFvjUdBjNdwxuN5XQkzj:OtfFvpopPxrB4RhfgFT2
TLSH
T109B2331571BA021038FE690C81B69B2F464232B33159E63B3FBD54A69E67F085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e1fcfc03121a085cc11a52e750ae7cbb1ec4fde793b93db7c39d4dd36e3e200d
MD5 17ecfc73ef0bae44ef786b3ae7aaddc4
SHA1 1768361b0e1e93e32874866b022121612b6ea37f
SHA512 b909e44a46e57d08edb2f6fa16c00552942eab900abd3673bba8ef83d10c7eb8b1011c7c20eed4871e8bd5acc6b025bfc753c0fe2f387a953521ab35ee0abe9c
SSDEEP 384:n0ZiFiZcI63sNR8TUNTUlIm25mg54nK2flBVE+7O6R2FeoKgL/7IzQoJ:0wFQ63IwgSPJBVE+7TRoe
TLSH
T100C24C36EC94C9BBECEB8F9AA74E7A17DEF01163959C8AC4D9D81D1D008759D030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 36796431d4b9978faf25bb6bd03f3b446b1bd93709733c53e4e95dfe6ef4ed69
MD5 bb1ffb308c45e3fd59acecf72866ad3f
SHA1 91ca7fd2e26c30dfd19c5bbb34a94c5c05bf788c
SHA512 03f2d250f6cf48d5723928cc4c495ec5779629fb5ba48f6ecd87b4705abd1e94861dfa352d8b2e6a4de07a9f6ab898e5b32c01df6834aac7e2d194f9ef750d3e
SSDEEP 384:nUiFiZcIhS3sNu8TUNTUlI4ST4mgovkNK2flBVQBO0/upa7dLKklygL/7IzYom:vFQI33wgB4HBV0O0Sa7dLKkl7Z
TLSH
T173C24A36DCA4CABBECEB4AD9B60A7A03DEE441A385CC9AC4D9D95D1D00D71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9b57ccc240ea32fc324de496cd733cca7205439d9e4b2ccb5245e888a35d0fc7
MD5 17781b09801b9f71cf0e0f4f4c73ad49
SHA1 313ee186463036f40bd10f3078e6eb9685a7e025
SHA512 e47248221b41782510681788126c96d50ff330e02345cae3968d72f3c268add5c9566ddc4520f6a75d972a03ab3aa956e99f1c1ecb9e7a6ac542c52c8d6f192e
SSDEEP 384:nuZiFiZcIY3sNu8TUNTUlI4ST4mgovRy2K2flBVQHO0/upa7dLKklygL/7IzYom:uwFQY33wgBdyMBVCO0Sa7dLKkl7Z
TLSH
T1D2C24B36DCA4CABBECEB4AD9A60A7A03DEF441A3958C9AC4D9D91D1D00D71DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 a890b4f150a67008a3cb5ff3e846b8e65f9cb3cb88072df574ae1449cafdea4c
MD5 30bd15e07f715796a73d4d805c1c1374
SHA1 30fc734f5f71bacebe5c8c92f41f47b9cc776135
SHA512 d80fa2c5b0b263f224155b6fe4c9b0804a18d659e26495a7d9882b125d40fdedd3bd5d42c4ab0c42ee455a371e9f1f7f6b5cf99a2f5fc5ea42ba3c7e31a6850a
SSDEEP 384:nJZiFiZcIY3sNu8TUNTUlI4T5mgsapK2flBVQgO3IgL/7IzRoB:JwFQY33wgvoTBVnO3oO
TLSH
T171C24A32EC94C9BBECEB8ED9A74A7A13DEE04163958C8AC4D9D95D1D00DB1DD030BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98e3fab32f49858505300ed87bad050bfee7377d619fa0c280159dd4e8def187
MD5 4ffa271b820ebf421391e027e5e54999
SHA1 46e90d7bd48cbd836c532bfa5f4f803b1c6a1405
SHA512 e0a79b4d64a0d2e4b514a9d82863aa92b01f61abaa6271979cfd5dff90ae7901c5cda2f5ea458f2156ebb3624af32ca2758fc93342b11b10e06e6e51eaf59fc1
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 63cd6ec03bc9b871e949737519ce0eeb1c95543dec122a3a71076b134e14ef43
MD5 170ba052541ecf5b260a45e90f3a7163
SHA1 331e3de1c393f80a83812dd17ff0d3ab91e1b2a0
SHA512 630301fde58e3366cd65f34e062fc38c093832858501f3af787c9de7248a90b38505173ca93712ecd1c854e5a8fa4cf866d91ba09e3d18f3d879d1cd76959619
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d9c786f216acf18a46f7c91feb771264fd0472ed250bfa878d717f5cf3a53178
MD5 75bb8a530429737c8dc6085e0c76d325
SHA1 f31963d6da07ffd36ee5efd2fc156411a16394f3
SHA512 ced251f7c63d125a97d3dcfb0f664c177fa05f84234aecc1630f894d1a670635f4a9479c39664b59e764aeddfda535ddf0e0c3ef8b34823eeb997ea48f15a900
TLSH
T172E00123930400BFC02C033544932A313AE2802002E212559A2045A42C233012F30F80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 afeeccf1896ad3100216ec1629b469d47eb69a8f63d54cee286f713aa19b1609
MD5 f426400b97558df868c44aa879e54ec3
SHA1 91c3e2ce18258f118dd34468145da0fe4d4c9bb6
SHA512 2acf6fa40ab57fb3e50eedb96fc21f35e3895b2ec6abe9f854b47b9bd32b6774ebb19e85cb20187a903565c815bc777f3ad0359aa643bb1266bb9bda707df556
TLSH
T1BAE00163930404BFD03C033944932B313FE2802002E222569B3045986C337013F30FC0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe592f63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe592f63.TMP
Size 392B
SHA256 38c5dad4c7932d3a550a50e9ec1f332e944f640bc701d16fbd4beb6d2cef9e0a
MD5 cc524e6d06fcb12590692df00bfc5c50
SHA1 25aa45bb602b2dd12e564091dc4de528bf14b4a2
SHA512 3a4abaddc998461a7da3d97344e6992c85d52142e8350286045248afc014d3141547f5f8317ec9732971f59b9a26bbba378df3a9cf65fab1bab03a47dfcce570
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 55280b4266025cd5e710eb53d155576228e3ea8f5adfe39d4e835c0a1e304367
MD5 b0d0600fbd922c20684aad2a47927b4c
SHA1 0bac550800b71f0ddc9df939d3cfd28c20e9054d
SHA512 1e97ea0f71414f562d579bd64cce974b7a3521e7fd19968e5d5decdc2c63324dfd14fc4580646e69646dc6bdbeb49daf13cd62242b952161a87f71cb489086e7
TLSH
T1E741589CA6E91108F3B36F5AABF6A86E447B7D332E56D49D10110E4F0A26B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/6016-195-0x00000135E17F0000-0x00000135E27F0000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads