Overview

overview

8

Static

static

1

URLScan

urlscan

1

https://cdn.discorda...

windows11-21h2-x64

8

Analysis

  • user interaction
    yes
  • max time kernel
    899s
  • max time network
    874s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260911-en
  • resource tags

    arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    24/09/2026, 19:55

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    https://cdn.discordapp.com/attachments/1473380840909312000/1527428253114040350/balm-21.10.12.jar?ex=6a5c9a29&is=6a5b48a9&hm=6df674ad069bf24f7a2219848ac41ab3586a2395496a31615705a1aa0a6c272c&
  • Sample260924-ynfk8a1ckf
Score
8/10
discoverypersistenceransomware

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Contacts third-party web service commonly abused for C2 1 TTPs 5 IoCs

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 48 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy WMI provider

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1473380840909312000/1527428253114040350/balm-21.10.12.jar?ex=6a5c9a29&is=6a5b48a9&hm=6df674ad069bf24f7a2219848ac41ab3586a2395496a31615705a1aa0a6c272c&
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:912
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x258,0x7ffeb7f6c188,0x7ffeb7f6c194,0x7ffeb7f6c1a0
      2⤵
        PID:1688
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8342330170242143373,13160688560951273761,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=1984 /prefetch:11
        2⤵
        • System Time Discovery
        PID:3784
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,16192506685610517002,7977618813643738767,262144 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=1936 /prefetch:2
        2⤵
          PID:3184
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2456,i,11759513692747007621,2094312208644621205,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:13
          2⤵
            PID:3012
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,3546614683308878299,13610743265044557884,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
            2⤵
              PID:5088
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,5083394361462620988,5296842606493596857,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
              2⤵
                PID:2592
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,6442434706703457705,2001133464622957042,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
                2⤵
                  PID:684
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,17776346805606406106,15764853698779823516,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:9
                  2⤵
                    PID:2044
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4192,i,12147519084146573080,4116155461255640956,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:1
                    2⤵
                      PID:1256
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4380,i,8761578441366444892,14926684353500639831,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:9
                      2⤵
                        PID:3708
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3664,i,18321116609921199898,5851171592382147430,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                        2⤵
                          PID:2484
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,16624476709806919781,9994356522463387873,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                          2⤵
                            PID:1428
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5828,i,13065796211018662739,2371269151815250450,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
                            2⤵
                              PID:1068
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,4335087121078368828,11368751763018870906,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
                              2⤵
                                PID:2756
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,17645989507079637192,4286369147241852627,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:14
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:4420
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
                                  cookie_exporter.exe --cookie-json=1104
                                  3⤵
                                    PID:3576
                                • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,5075558966132277802,10578713031256510714,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
                                  2⤵
                                    PID:2800
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6984,i,5075558966132277802,10578713031256510714,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:14
                                    2⤵
                                      PID:892
                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7132,i,14077426420374240219,5086089772815572475,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
                                      2⤵
                                        PID:3068
                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6484,i,2746976577680854051,15364404682165542720,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=7240 /prefetch:1
                                        2⤵
                                          PID:1920
                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,15920195207874710904,11426797542309293400,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=7692 /prefetch:12
                                          2⤵
                                            PID:6016
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,7903174259462979498,3684485374834001130,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=7700 /prefetch:14
                                            2⤵
                                            • Modifies registry class
                                            PID:6024
                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8136,i,7521216821539839216,17532465413106390519,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=8292 /prefetch:14
                                            2⤵
                                              PID:4480
                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8268,i,1272943636772695360,10713574595134614201,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:14
                                              2⤵
                                                PID:480
                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=8256,i,8577887016647448642,12836615435654632581,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=8328 /prefetch:14
                                                2⤵
                                                  PID:5124
                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=8284,i,13249284994908635859,5037074151538702237,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=8296 /prefetch:1
                                                  2⤵
                                                    PID:5304
                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,7988699838147985916,2875577247733878791,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:14
                                                    2⤵
                                                      PID:4388
                                                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=8176,i,13609874874101199906,13658988074312844218,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=8124 /prefetch:1
                                                      2⤵
                                                        PID:5692
                                                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=8360,i,11086443808693952223,14403452972028269406,2097152 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=7504 /prefetch:1
                                                        2⤵
                                                          PID:5804
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=8156,i,10149801116289099664,1914633146496125984,262144 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=7040 /prefetch:10
                                                          2⤵
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          PID:2188
                                                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,1440885797519356291,4994544532223768567,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
                                                          2⤵
                                                            PID:5232
                                                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3104,i,4243568648829303728,14594225843443574650,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:14
                                                            2⤵
                                                              PID:5220
                                                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,10163242117542483471,14319288828158798612,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
                                                              2⤵
                                                                PID:2152
                                                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5612,i,7906297346100257899,17428530349998982619,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
                                                                2⤵
                                                                  PID:4636
                                                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4188,i,645112383768430125,11768823985518721407,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
                                                                  2⤵
                                                                    PID:2296
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,10514318571927844800,5909392249889713717,524288 --field-trial-handle=1940,i,15940831017773200180,7559216084873935912,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:14
                                                                    2⤵
                                                                      PID:236
                                                                  • C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
                                                                    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
                                                                    1⤵
                                                                      PID:1620
                                                                    • C:\Windows\system32\sihost.exe
                                                                      sihost.exe
                                                                      1⤵
                                                                      • Suspicious use of FindShellTrayWindow
                                                                      PID:4352
                                                                      • C:\Windows\explorer.exe
                                                                        explorer.exe /LOADSAVEDWINDOWS
                                                                        2⤵
                                                                        • Boot or Logon Autostart Execution: Active Setup
                                                                        • Enumerates connected drives
                                                                        • Checks SCSI registry key(s)
                                                                        • Modifies registry class
                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                        • Suspicious use of FindShellTrayWindow
                                                                        • Suspicious use of SendNotifyMessage
                                                                        • Suspicious use of SetWindowsHookEx
                                                                        PID:5480
                                                                    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe
                                                                      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\SearchHost.exe" -ServerName:CortanaUI.AppXstmwaab17q5s3y22tp6apqz7a45vwv65.mca
                                                                      1⤵
                                                                      • Enumerates system info in registry
                                                                      • Modifies registry class
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:4364
                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                      1⤵
                                                                      • Modifies registry class
                                                                      • Suspicious use of SetWindowsHookEx
                                                                      PID:5032

                                                                    Network

                                                                          MITRE ATT&CK Enterprise v16

                                                                          Replay Monitor

                                                                          Loading Replay Monitor...

                                                                          Downloads

                                                                          settings.dat
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
                                                                          • Size 280B
                                                                          • SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          LOG.old
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                          • Size 331B
                                                                          • SHA256 88c4609458f24bc26994a25f52733f04e7fdf3d08e1b31df5b9ccd65e7f98c6b
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          LOG.old
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                          • Size 334B
                                                                          • SHA256 32f53ef343c87f64861fddcded90c1ee5e3e0571dc5d2b67972e173dbda54210
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          LOG.old
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
                                                                          • Size 331B
                                                                          • SHA256 fe405ed81c4a64501cc6169112ef67a4c415af00bdf657b2ca7221951f191db2
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          BookmarkMergedSurfaceOrdering
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
                                                                          • Size 6B
                                                                          • SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          f_000060
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
                                                                          • Size 205KB
                                                                          • SHA256 8f22b70e3895c44ce3705e5b99199b1730bce82a1d1f26f1c26240929dfb8e7b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000062
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
                                                                          • Size 128KB
                                                                          • SHA256 85b6a6ec3ff4d947c9859904da096dee0e8412646ced7ddc983c1fcb8d2e485e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000063
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000063
                                                                          • Size 256KB
                                                                          • SHA256 505a60581e00f540e78c523d9d9f204135557e597ba0c0c71451b93b660d04e7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000064
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
                                                                          • Size 512KB
                                                                          • SHA256 0e169dfd532e84c92cc907faf5b74f77c485659a069564f3fb4df09db5d7d473
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_00007c
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
                                                                          • Size 38KB
                                                                          • SHA256 a80ef4f7a78ec326368059208e9fa5e6e095631d94bc839906cdd6a00af3d4fb
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          f_000082
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
                                                                          • Size 59KB
                                                                          • SHA256 1946a41ca94fc77b843a53051625575e09877e659a11860ee65aeca292d3c936
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 11KB
                                                                          • SHA256 6cfef7ee0394e54f2c808d8d8e543a073f86fd2a4511038f4c389b8546dab2e6
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 12KB
                                                                          • SHA256 2daf5f09fccf8f22b2cac5a725c9eee1fb93813fa0ba18023746bcd98b1dd4cf
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
                                                                          • Size 11KB
                                                                          • SHA256 f44fb5fa450722df07af1746fe1b7d8f86957f0c1f4427e131043ac47d33b943
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SiteList-Enterprise.json
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
                                                                          • Size 2B
                                                                          • SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Edge Profile.ico
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
                                                                          • Size 70KB
                                                                          • SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          LOG.old
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_ntp.msn.com_0.indexeddb.leveldb\LOG.old
                                                                          • Size 383B
                                                                          • SHA256 084dabfba023aae5d984accc3cc4533211ab47bc252dcd33557a8cde30ce5368
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                          • Size 7KB
                                                                          • SHA256 ecf568b38529d49ae20c21566bc477ae1469e6b250d5bed88723a8d5fbd02551
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                          • Size 111B
                                                                          • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                          • Size 5KB
                                                                          • SHA256 a3efac3d81d8b3b6ecaf204a5e8f06023a57a9077c0ad8f46f14be93e95bdfee
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Network Persistent State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
                                                                          • Size 8KB
                                                                          • SHA256 b8cea6a6560c431f8cdfe0523765a902eb76b5412d3c77b3eba9d0bbbd1d1dd2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          SCT Auditing Pending Reports
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
                                                                          • Size 2B
                                                                          • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Sdch Dictionaries
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
                                                                          • Size 211B
                                                                          • SHA256 f3b8b0f4f4375b107e343fbb3959aa610281e548d11aca57142bd46aa66c252d
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          Sdch Dictionaries~RFe58bc27.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58bc27.TMP
                                                                          • Size 40B
                                                                          • SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 12KB
                                                                          • SHA256 afc51facbbfe32d85df97e9b44636f20a01181a4eb0fe8ab2e888f308a0de042
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 12KB
                                                                          • SHA256 24174d060d239de6dd440029874815ba77b758859214af6bfff62a5c5833c2f7
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 13KB
                                                                          • SHA256 9d27d317c55063131e7ff1cd2741fbd47d56b6d1107af76905ea4dba52960d4b
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 12KB
                                                                          • SHA256 377d4ab0255f70b2f959f08041f3f195e175814d8486e2a7ae2fd331aeb438af
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 28KB
                                                                          • SHA256 4fd5a0ac9f5e2e7f3a7c46305d60c5c9746ce0329fa48ed9e51d7f6c4d6cbbb0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
                                                                          • Size 14KB
                                                                          • SHA256 890357a4f1b09069eaa8f2ce7175823e51fe40f437f08e06254e84cfd8fcc31e
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Secure Preferences
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
                                                                          • Size 28KB
                                                                          • SHA256 d462526fd7388ec13ae30829eaf688a92878d20f844fa903f3266b9196ed4a09
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\the-real-index
                                                                          • Size 528B
                                                                          • SHA256 b549cd1ec4beb1533fca961bcb5f2142664bf5d97d728471295560018fbd3bb2
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\the-real-index
                                                                          • Size 3KB
                                                                          • SHA256 8db8913321cc4910dc62fb4157ff2b66d790d36e9187ae60bd963d92ffb27aeb
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index~RFe587114.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\12985c3e-df34-4f3f-8ca9-a477663954dc\index-dir\the-real-index~RFe587114.TMP
                                                                          • Size 528B
                                                                          • SHA256 446267784752f116562d1987aa7e262cc0db7011aeee87416d5f9e9b6e231b61
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6612d80a-c626-4f53-9e1b-7d054123828d\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 18dbbab667dc79cca1015e92bb39358278dbf6ac11da78de6dd8f600dd4165b3
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          623cd082b6202da0_0
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8fc1e8d3-7833-4bb1-8635-89096f3afffc\623cd082b6202da0_0
                                                                          • Size 82KB
                                                                          • SHA256 83ebe1c7db2afba2dedd870b3dcaf7c3c6543124d17c5109f75d8f87f8e8ac45
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8fc1e8d3-7833-4bb1-8635-89096f3afffc\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 28d05d1b89f2aed8bd0c72e9198d2ccb9845a6fefe686c8da2901582a5903671
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8fc1e8d3-7833-4bb1-8635-89096f3afffc\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 f602e9e9bcda7c394c9d8f813f14ed1ba61006e08a4a1bfb6a1048d3547e0b10
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8fc1e8d3-7833-4bb1-8635-89096f3afffc\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 7833b3740062bba60b6ce5da5377031bb10406446cf0eda96fb6547c28e516e2
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db75b239-1a82-4777-beec-65ee59a16f61\index-dir\the-real-index
                                                                          • Size 96B
                                                                          • SHA256 b0a840d8f7a64d50ef904e5b030d51d53f32241088d917e6d98da9bcf4654ab4
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index~RFe5a1dab.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db75b239-1a82-4777-beec-65ee59a16f61\index-dir\the-real-index~RFe5a1dab.TMP
                                                                          • Size 48B
                                                                          • SHA256 af4d398c32827ff3271a4e3f4244c016bea0a3dc8c9ea57e7da947634bb7d90a
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e1843cd5-b940-407e-8564-f24fa15e2085\index
                                                                          • Size 24B
                                                                          • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e1843cd5-b940-407e-8564-f24fa15e2085\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 99f2062ddcc112f9c1db7535f68575de15b48db24ec6a1c330094972538df4d1
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index~RFe5a1dab.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e1843cd5-b940-407e-8564-f24fa15e2085\index-dir\the-real-index~RFe5a1dab.TMP
                                                                          • Size 48B
                                                                          • SHA256 bae5349c3197047cd535ee969f7b6fb940e80edbe24559f13a2cdbff1a50d622
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                          • Size 624B
                                                                          • SHA256 abf3345beab84b81c043c0b8e05b37dc2649ad7079d5e795e5607e96c712fa33
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                          • Size 519B
                                                                          • SHA256 cd2ab2c39a54b70291b5e535a97cbbd48db3a3aa4d900cfcc3cc2caf9857268d
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
                                                                          • Size 371B
                                                                          • SHA256 587b0139c78b0da95714a3e46bf94de283b92765ea7cf8527fbeb591142566b6
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
                                                                          • Size 619B
                                                                          • SHA256 02a8e96307153a2a97fb1fb668c486b655fcfee799c3d81e5eaa8f87b2c8464e
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                          • Size 233B
                                                                          • SHA256 8982a2d9fb92855bb5a61027dd484f129b704d3851b8e55577317c5a6ffec2f7
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
                                                                          • Size 226B
                                                                          • SHA256 955dc7ca2ccfcced87baf27e7d145d70afbe76a5aee2b55551240b604ed8d517
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt~RFe5890e1.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5890e1.TMP
                                                                          • Size 138B
                                                                          • SHA256 6c56c41118d0f9c0be6645106747485dc90b230bd2fdca33f664672b09fed6e0
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
                                                                          • Size 72B
                                                                          • SHA256 396445d894e43842c7e075fed4e4efd3299b2564b0574efb86bf06a260820f42
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          the-real-index~RFe58c6a6.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c6a6.TMP
                                                                          • Size 48B
                                                                          • SHA256 3868bc4b5d2222240bf4ab73c49d8c88b8c20b46ecaa88b340fc45552ab04bb5
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          sync_diagnostic.log
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
                                                                          • Size 4KB
                                                                          • SHA256 a8ef0e7b3d5301c034928c771d8a1c5cbde50d2ae150250b3e3dd352287fb644
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          index.txt
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
                                                                          • Size 91B
                                                                          • SHA256 b5ac12376878718d3accc7ed17f9d3350bcd6e6924328ed81d69eb1b250f83a7
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          index.txt~RFe58e153.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt~RFe58e153.TMP
                                                                          • Size 178B
                                                                          • SHA256 fd333cbf012ba4788ddb105a56784d65205f2bec585319cf74476fe0212deea0
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          62826347-6476-4d1e-8b02-f83df0f12f78.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\62826347-6476-4d1e-8b02-f83df0f12f78.tmp
                                                                          • Size 22KB
                                                                          • SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 18KB
                                                                          • SHA256 1d55c2753d9ad9989c7592bb46f9c06a301005b7ccec06a8d8da3ff70e1229a0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 26KB
                                                                          • SHA256 9544dfceb58501eb8ce5229453ee0f3101a0772bd6afc30acf8555552a5267a0
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 26KB
                                                                          • SHA256 04be9fbd4b40bfa6de901b39445d01755e9e8fdd47148b2abdec4a1c9eab1ab2
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 8KB
                                                                          • SHA256 464a9ef8ebaf6cd2794086c77cc3a6f30c2124f7ab6f6934b178abd6c6a4037d
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 18KB
                                                                          • SHA256 61aa0e2e1f5c8611559d447a39892e7a2e121fe8ee2e9d794deb004cd32b9f59
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          Local State
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
                                                                          • Size 8KB
                                                                          • SHA256 32b490532e26f856c2c945bd81d7337fabbe266ef63f60f677c85067e23c0cee
                                                                          • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                          Submit Download

                                                                          RevisitationBloomfilter
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                          • Size 392B
                                                                          • SHA256 a9218b977a1f503f3404fbf68e079af45a5a18833acc6d2a79ec65868415d81d
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          RevisitationBloomfilter
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
                                                                          • Size 392B
                                                                          • SHA256 166bfe79da47dad544fdc8e57c3c1e88a106622ebffa0fe25168c9cc9377844a
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          RevisitationBloomfilter~RFe597d35.TMP
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe597d35.TMP
                                                                          • Size 392B
                                                                          • SHA256 0c03a99f37a6b0aca3ab50824742d85bee2ab8901b398bdffb8b77965cb6621c
                                                                          • MD5 SHA1 SHA512 TLSH
                                                                          Submit Download

                                                                          6c59af1b-8c01-432c-bd1e-061e11f07037.tmp
                                                                          • Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c59af1b-8c01-432c-bd1e-061e11f07037.tmp
                                                                          • Size 13B
                                                                          • SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
                                                                          • MD5 SHA1 SHA512
                                                                          Submit Download

                                                                          memory/4364-2340-0x00000202C4960000-0x00000202C4A60000-memory.dmp
                                                                          Download

                                                                          memory/4364-2366-0x00000202E64E0000-0x00000202E65E0000-memory.dmp
                                                                          Download

                                                                          memory/4364-2396-0x00000203F8580000-0x00000203F85A0000-memory.dmp
                                                                          Download

                                                                          memory/4364-2397-0x00000202E6720000-0x00000202E6740000-memory.dmp
                                                                          Download

                                                                          memory/4364-2428-0x00000203F9B10000-0x00000203F9C10000-memory.dmp
                                                                          Download