hxxps://forms[.]gle/nujs4jkw3g2AgLHh8

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.gle/nujs4jkw3g2AgLHh8
Sample260930-mpvwraxzhy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4076	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{AED71013-3BD9-4A26-A47A-952C9833F65A}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{3CF09D58-A393-47AA-A61B-88A88B7E2CC6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1144	1444	msedge.exe	88
PID 1444 wrote to memory of 4576	1444	msedge.exe	89
PID 1444 wrote to memory of 4076	1444	msedge.exe	90
PID 1444 wrote to memory of 4576	1444	msedge.exe	89
PID 1444 wrote to memory of 4576	1444	msedge.exe	89
PID 1444 wrote to memory of 4672	1444	msedge.exe	91
PID 1444 wrote to memory of 4672	1444	msedge.exe	91
PID 1444 wrote to memory of 3152	1444	msedge.exe	92
PID 1444 wrote to memory of 4488	1444	msedge.exe	93
PID 1444 wrote to memory of 3152	1444	msedge.exe	92
PID 1444 wrote to memory of 3152	1444	msedge.exe	92
PID 1444 wrote to memory of 4488	1444	msedge.exe	93
PID 1444 wrote to memory of 4488	1444	msedge.exe	93
PID 1444 wrote to memory of 884	1444	msedge.exe	94
PID 1444 wrote to memory of 2516	1444	msedge.exe	95
PID 1444 wrote to memory of 884	1444	msedge.exe	94
PID 1444 wrote to memory of 884	1444	msedge.exe	94
PID 1444 wrote to memory of 2516	1444	msedge.exe	95
PID 1444 wrote to memory of 2516	1444	msedge.exe	95
PID 1444 wrote to memory of 3740	1444	msedge.exe	100
PID 1444 wrote to memory of 3740	1444	msedge.exe	100
PID 1444 wrote to memory of 3740	1444	msedge.exe	100
PID 1444 wrote to memory of 3772	1444	msedge.exe	101
PID 1444 wrote to memory of 3480	1444	msedge.exe	102
PID 1444 wrote to memory of 3772	1444	msedge.exe	101
PID 1444 wrote to memory of 3480	1444	msedge.exe	102
PID 1444 wrote to memory of 3464	1444	msedge.exe	104
PID 1444 wrote to memory of 2252	1444	msedge.exe	111
PID 1444 wrote to memory of 2252	1444	msedge.exe	111
PID 1444 wrote to memory of 2252	1444	msedge.exe	111
PID 1444 wrote to memory of 4032	1444	msedge.exe	113
PID 1444 wrote to memory of 4528	1444	msedge.exe	114
PID 1444 wrote to memory of 4032	1444	msedge.exe	113
PID 1444 wrote to memory of 1608	1444	msedge.exe	118
PID 1444 wrote to memory of 516	1444	msedge.exe	119
PID 1444 wrote to memory of 3932	1444	msedge.exe	120
PID 1444 wrote to memory of 1492	1444	msedge.exe	122
PID 1444 wrote to memory of 1492	1444	msedge.exe	122
PID 1444 wrote to memory of 1492	1444	msedge.exe	122
PID 1444 wrote to memory of 5200	1444	msedge.exe	123
PID 1444 wrote to memory of 5200	1444	msedge.exe	123
PID 1444 wrote to memory of 5356	1444	msedge.exe	124
PID 1444 wrote to memory of 5356	1444	msedge.exe	124
PID 1444 wrote to memory of 5356	1444	msedge.exe	124
PID 1444 wrote to memory of 4224	1444	msedge.exe	126
PID 1444 wrote to memory of 4224	1444	msedge.exe	126
PID 1444 wrote to memory of 4224	1444	msedge.exe	126
PID 1444 wrote to memory of 5476	1444	msedge.exe	127
PID 1444 wrote to memory of 5476	1444	msedge.exe	127
PID 1444 wrote to memory of 5308	1444	msedge.exe	130
PID 1444 wrote to memory of 5308	1444	msedge.exe	130
PID 1444 wrote to memory of 5308	1444	msedge.exe	130
PID 1444 wrote to memory of 5432	1444	msedge.exe	131
PID 1444 wrote to memory of 5432	1444	msedge.exe	131
PID 1444 wrote to memory of 5432	1444	msedge.exe	131
PID 1444 wrote to memory of 5684	1444	msedge.exe	135
PID 1444 wrote to memory of 5684	1444	msedge.exe	135
PID 1444 wrote to memory of 2808	1444	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.gle/nujs4jkw3g2AgLHh8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff932c9c188,0x7ff932c9c194,0x7ff932c9c1a0
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1728,i,17966958893221395154,15671665123089403817,262144 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,4483464825728257894,8209763037799100008,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,1073997881454620908,9466284501612475109,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=3152 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,2692143731720762019,2595281549040880210,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,6689411301353605730,13033642523863514322,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,14361534769641990031,2407837480265552051,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,10803807644523754317,12243083299585036571,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3684,i,15924323698154703942,17548666948332243954,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,15775210477569233401,18338966426979664990,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,8471121967979853809,2798889609931244675,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13040249343405929374,3123288559935351277,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,13040249343405929374,3123288559935351277,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6276,i,14543642527338070990,5061697173293677912,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,9190663600379214887,10145840577132138663,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6448,i,9564995460998212721,8963538916408258294,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,8482468613386536679,5658059338006810123,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,14030643349946565931,4589644037795516955,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4056188375969967124,14863055120069691031,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4236,i,1272240525795812693,16944971589500235330,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6752,i,2564366629858940671,12843098093393060193,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:8
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6912,i,7000137944177902055,17744933479702764227,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=7208,i,11680591084830345033,13368239736833234694,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=7224 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7104,i,18405735691951184828,7793131004215162995,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=7388 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=7612,i,18164281147797273343,8907465271421266720,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=7628 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7112,i,9910537478854848251,5733785078140908606,2097152 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=7384 /prefetch:1
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7644,i,7745064183446402612,4732302890567131657,524288 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=7928 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5320,i,17350883115033440304,5217614887834230691,262144 --field-trial-handle=2232,i,10761326070921612630,6221111767815857555,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2808

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6f5e46478d41d06b8f960556e960bc133c72843bdc29d3bea15e775638e7676e
MD5 23d3e0760d1b5786c9b107231dd97f06
SHA1 a1d5570f94bdf0d1218aec67da9e0b6ff355889b
SHA512 c05b5d0ff3d54b79cfb8dd111d6eb774ab5e1110dca6f5ea5f8b591e5ee715a59e767b941a518208203ac2e792a9349c74bf1ebe662ad25a5248e5bc2ce227eb
SSDEEP 96:VUg00YX0Tm5yREC/JR5UdcwA8cojm+F7dhi6EtFOKIi:l5mkR5Uyc7j1Zhi6Ex
TLSH
T1CFD1A8B494D0A1ACFF144CB689C5588E383527D6A493AFF34973E4B9BCBFB8001A42D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 c73cf76695d69e4c042d51ed42718d8be3545137e73427c2f4acc97a870eecb5
MD5 9cb07b5d556b9800b9f3bc2016f0bf45
SHA1 b01e55dd3a6bafd0d538e95e6b95b4e090df75ae
SHA512 641c502faef4dfd2635df8e2d3ad1b9d3c078d9260bd46b64db6a252bbb0fc8e63b1f85958478ed320a990ffe713ff5fd2070c7041cddb7ae6102d3ba83eca47
SSDEEP 96:wg00YX0Tm5yREC/JR5UdcHA8cojm+F6dmi6EtFOKIm:D5mkR5Uyf7j1Omi6EV
TLSH
T150D1A8B494D0A1ACFF140CB689C5588E383526D2A493AFF34973E4B9BCBFB9001A46D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ed7fc5eff3398832bade80461c75638bd6654c8f9b7e78ebbd5b2c8911ef90df
MD5 3ce17b680230d0ea405d48a439456100
SHA1 6245bd570e5be7a085797d39e23a469673ffdd93
SHA512 870f9376fca98d2a5445dbbfe3c380430c8e9b85223fc102aa633e56a7107122f33f6c6f3f100301c700dc48245c2be8d5f33d0fcee1c4a5ccba6d691239f145
TLSH
T19771CB79A9A0D2BDFF684439D1DA14CF3D325D94B447AEC34EB4E87ADC7A31491B8240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe590313.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590313.TMP
Size 3KB
SHA256 719c2c49f9cd14babd2339ad792fa67986b9d9547b0b93b473f662c50ebf7758
MD5 3b00af4893f40eca161d3984aeae3173
SHA1 95adc992d18ef3ccc775a389b78c4e89fa113b8e
SHA512 226ac50a0c05f56fd8593ee5d857cf55fe210e1af25b0cc4183e3945723c90faade6a1e35fbd5042b207413a89039968b0f95cc92548729273f5b04b366d604a
TLSH
T174618479AA60E2B8FFA84479C1DA14CF39325D95B457BEC30EB4E87ACC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 55fae2921409112993ea85b2b36190a1d015a45951bfb43f3809c0bd77d90c86
MD5 e484760b10226b1b150c0e0ea5b683e6
SHA1 bcc5f4ece79e0c48b8127c2bdda543b4cdd407f3
SHA512 b534d54f8e3e384cdf16f16c9fa4d9d31be874683f2c27f764cbae5b05d6cc4592b960167de31e4f6023b4b82fec14bb46c836834363ba1aa9ce8ce71da72721
SSDEEP 192:D2viktqOpFKA+glHswR8uQDqk6Ik57cj89zp+nZG0F+DR:D2viktqOpFKA+SMwR8uQDqk6Ik57cj8H
TLSH
T184F1BAF7C3E9862DC91156F49B146F2FCE1D0519432C3D2A88D8AE1B93F2471E151A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 b437af84067fc1a911b7518a053cdab05619f7df805b0e2c04df87479bc2cbb2
MD5 3f3f2f21255cab8203828d9c1c212c8e
SHA1 d395cb7d2221a2a482db39bac767a237edea2a01
SHA512 01e39be7eac320cdb7ea5a0a464a70eb38b6e9ddf0ba157783677053e62a60ca292abae94b09783f4681131e3eaef3b0f744ac5b780a5024245a4728bfcda5ed
TLSH
T153D02277230C30B9AA6C6ED2586AECCFC77B50211822E9E912D1B89C4532CAD4A97242
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe59578c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe59578c.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 ca1c65933d221ecd3ad27248fde79830e37ad8781bb1271b3cc3eadc9f2231c5
MD5 9525cc4b5e10d7f886926017fba0436e
SHA1 4e139ea978688f5248756803f91b6e11acd1fa32
SHA512 2a6ee2ae7a34f8f5e30c056014e49d3a568846c21ace7f80c548e5b03ae77b2bf07dbbaa25bb3590b1161b1437b600b20ea76b68cb28deda9b36bf4373620fb7
SSDEEP 192:sxZsXRBWJ//fpMsh71AIdpJsjgHW6+WNOPDh/YgpF+IgrJ:sxZsXyJ//fpMsh71B/Hb8/g9
TLSH
T11A22B6526E74A97B8CCAD21DBA15BF53E6F91032A5941E4CAAFC861C04E7BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8645c90c5b1e0d96fc0352300403adfa704e20580d2b7ac4f3354345abf9c2a8
MD5 1c813a057cd831ab4bfe1df8b8ebfdf8
SHA1 ced6dc2686844dc592cb75cbea2e49ce44ec6885
SHA512 692590edd10f7bcc88cda58204609633a7d678549f1c6abc165cea35076c34d2dd3669b27773abec1b4e5e7c7bec413704d01ebe749f4a9cd4cf18d70eeb9318
SSDEEP 384:sxZsXCmWJ//fpMsg7He+rV2Hb/NFQ/+W6OSsK:saCmW1/f8+E2HbCQOo
TLSH
T13572F953693499B78CC7D519BD34BF56E6F5602298E14E8CAAFCC91C04EB6ED2203C47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2dfc6640ae6fb0244a44b9e9b349411f3aa093473583a0f7ed94554386b189cc
MD5 1559fc440935c10988589a8a3c2d3041
SHA1 fa60f2edbe51761791807bc870718ea0eea543db
SHA512 7489931c86de494850480798bda76626aa6d7c3d395a8075a711afc1824a16f9ff091e9a3de2e729b27e722540650dfe58dc308188c389837cd5569922cafdfb
SSDEEP 192:sxZsXRBWJ//fpMsx7HAIdpJsjgHW6+WNOeTcMDh/YgDF+Ig5UJ:sxZsXyJ//fpMsx7HB/HbkW/yy
TLSH
T19032C7526E74A97B8CCAD21DBA15BF53E6F9503291D41E4CAAFCCA1C04E6BDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7ca4846eeddcca406d991ec9cc5ad7b949222df3e0cdea2c2094d33704df19b2
MD5 cc90aacf1760ffa40368f912e1de1bfe
SHA1 e3b5d2c5ecd7a850234ca397163d5b5b7789162b
SHA512 1905f7efda0dd9d7e8dfb42f2432628e1eb0e8705f0e120bf829d4b55794559d629ed6ba17c6f4254659b77b1e9d1f52a8cc9ac9b806efccc9ed02924ecffb18
SSDEEP 192:sxZsXRBWJ//fpMsg7HPpb50ddpJs6j0zgHW6+WNOVRTcMDhqpGHYn/YgCF+Ig52J:sxZsXyJ//fpMsg7HPnu3HbNWlQ/Lw
TLSH
T12052F84269745DBB8CCBD219F914BB57E6F9503294D44E8CAAFCCA1C08E7ACD2203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 284e5a591ade46c8bd71722efe3fc6ce5843693e5f3114a6b99825b141a1dba4
MD5 8a96f916bb9d568e095e525b8ecade75
SHA1 c429ec7bf1e125ff8fbceab7cb90e85e4d4ca67c
SHA512 0ba7564be28d5c5da51075a2b0db37fd276a83f5768abe57318de80852f07524adc38c2321477dbd75376c69b890ad1f138df40bd5364a5894b466ff4a981fe8
SSDEEP 384:sxZsXCmWJ//fpMsg7te+rnwHbNWlQ/LW6OSsK:saCmW1/f8c2wHbrHOo
TLSH
T1D3621A53693499BB8CCBD519BD34BF56E6F5502298A50E4CAAFCC91C04EB6ED2203C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ed6fe6e85ce84fc649b9dfb3a2a7a33f4c356f4551bd282424e5c925b5c84240
MD5 ecf7c0369012bd90599d98692a04996d
SHA1 139bf9e241ff8c3f574037ec5a599462159de8c0
SHA512 fd4d751f50c4e5c0f2f47881237942f9118c21a6f58b61eb0d7f2e4c926a7000af10f188f73a9c009967ed4c8abbdc939f3ad67efc8d5eae5fbe68bd20929e9e
SSDEEP 768:EBichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzjro8dqt:EBichfPWvPZplu1jan+LKgzQ4qt
TLSH
T131C2FA3B644CCB7E4FC01E5DDD5A6F9A7E9802C7A6688D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 3KB
SHA256 a8f1aa7ab6bec78eaa0c760293d76e7ea4cd2253314bb6e187584ebfae8661a1
MD5 43084a8b7f6910173c23a378dd1d81ca
SHA1 18f081e4ee090ff9552c212a309ff96fae2bb930
SHA512 318c8c0dcfa838336566c60d95120a35025e19da8c0c880525b3969e568e6ebb16da844d657c4ea363ac5506f41d0f26ae524c0239d950a908f6d34f18c63a69
TLSH
T17051B54F4EA23BA7DD9CA2B205B90895373465CC6B541E37D4FDC134B9872142CAAB54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 768B
SHA256 f177f4be20094743adaa39d45544ebcd247bf862b8f3bf96fe86fa100d4dc9b0
MD5 43017d3e0d81b36ec1ed6106c4ff438f
SHA1 69e9c8ab9f987841e544f621ca45ad0c2c0f5c4a
SHA512 728bb24d8e22df13914c2b86731337a7acf78b1464fc71d184d944f227506f3a0a4cf968008b0ee46481d7362d1d91f7837fa1139557df6cbaaa6ba9b44b592a
TLSH
T10E01EB9B4E525A1BFC550231243CB89A66B906CC5241B64FA2BEC52AACA6344AE426A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59073a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index~RFe59073a.TMP
Size 768B
SHA256 a6df7b1166d0e4f8f84f61f9591e27b64d3a2a7c991fc7872db393d5f90f6f52
MD5 95bcac70774440fedfbf81c3041c55b3
SHA1 2560a117ecfc723900c801f942078fb21f85ccfb
SHA512 beff4323b42c325919a4d7c347bf6616594583c9cb1a3f6d7d9dec55824cb1558a6188f815a17083787137edde8d0ba98c314d42d2787d5535f11c9c3f0d0ead
TLSH
T1D40120D600034B46FC040370DA3CA406216A51486390778FA3EAA02ACC52780BD83EF4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 84f6b53899b5abded286ecd7571e99f91a4521bd1ddd8cbee740726b9b1bd72a
MD5 97f206ce90b5035ac830af81171a27cb
SHA1 141d0dad1bb57ecf0dc490b1ffaed3ea443537f6
SHA512 e60c5d70b4cdb267c4b867bfbbb6f81367d4fda7e424b35da51eacca041212acad96af6a579eea332c71bf93e709001645aa8882f95777443e38376f3f811cac
TLSH
T1ECE020B73FD72954ECDF83D2143188D54105B964C544ED4F206F91C7A2B1755385AC26
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 51314708fca88b2a93e7872733508a8ada4782da9a1992d8e1a6056496907d54
MD5 e27ec37b42fe3456747e02ac2d965e90
SHA1 e3fc3bb31df2e7953521f0e9d249c7ee7ab909a0
SHA512 43a363ab99ed17a3c02e25eba9080ea92ee582d3a6bf66559fe43aeb05c15d240b183c097b2e84c9e4fca71e3239ac7eea93215676f4a6697bf7076a4500130f
TLSH
T116A002158D588445C9240270ED7211953210AAA8170532AD44AD3054BA5626481F2C58
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe596075.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe596075.TMP
Size 48B
SHA256 0005862a76b45101d6ef5e22394b45a1cd98787a8e829c6419e6e95787b424e9
MD5 21d5567badc073a706c365b344207a00
SHA1 5eddbaf83ac2e93d33df888c88e480224e7136e7
SHA512 a067e13e013b8334439386305f89370c64a9a04367e1e46401431a5feb4ef1eb6e4723dff06ba9aa7f25c122bd9d53108f4ab8dcaf0e13b25553314e3180a397
MD5 SHA1 SHA512

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 73434eed3864e0cc40b93ebe686653c2cdfa4468ab2eed54f7c4397a84aa61c6
MD5 c9742b00d64b507261e0912370d7147a
SHA1 b6b7a04da5eb60ee3f34c5f4e04d34726bf48bac
SHA512 1d8260ca345906415d4ba461cc6ba4dec8ca7cafeabac17462a02ab73738ba3adbf7321a185434005ad89c83dee25c4df8f98404bc310b4dec7da594b3db7764
TLSH
T11E214184B3B910E47E8DB943C21FA94B79B53B1E235DDD32232E54F46F48C180E2EA21
MD5 SHA1 SHA512 TLSH

Submit Download

32cc276e-76a6-4d97-9226-dcb07273d4a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\32cc276e-76a6-4d97-9226-dcb07273d4a7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6109ab2c3d2eb05e9d3afc11a8118bfb1e3d61b274dcb3f02f6ab30bca16c4b8
MD5 c87c0b81df63b28de5b60644e81f62e9
SHA1 41196ed90086389b943f117d5fc2f24648f3bfee
SHA512 6c32bc62968dd85c4f7d7b79b9b0147127c33ae54075bc81117a0a0cd8206936c6227f8ce4b921dfd2f96ec2b105a3469576eecb2e84b0a20bbf86c7255cb1ed
SSDEEP 384:hZcIhsNuYN5a/vBGYX5E0S+YpDgjtgOIwZOyDvou:phc25GYu0SVp0jXsCh
TLSH
T1D1829E3698B99C7B5CEBA541F48B36038FB89127A6C5AF5495ED6B1C00DF298130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 87aa8e3d100f0e59f37c652599b123887f1146df7ab0cd757832f77be6cba096
MD5 231b3066c174c306d4c08be799e7e6f6
SHA1 567504b5f824fb17dcdf26726414142ac58b2b2e
SHA512 4eda46e47f85ec91e0025c1ed92cacf2bc69b7f4ef0f9db782806d5c4f5b319a154e7feadd110a840f55f59261037985b73dc8e5d03a6ca6ab6120614cc4eaa9
SSDEEP 384:ziFiZcIWzsN+8TUNTUlIl1Ty5ChbBGYX5E0S+YpDojtgOIwZOyDvou:eFQmrwgWk1GYu0SVpEjXsCh
TLSH
T151C22CF248F7887AD8AE5743A77E2D034EBCC127B585AA54B3D8551CCC961BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b2013833693a31588c3686b1a6d63b88ab9cf90ee67cd1d4e7cb809842b52f28
MD5 dbb6e19f8ecdce133731c9e13ddf6675
SHA1 959cd9c10b32b354f8028fd47214bc35e01972e9
SHA512 6d02d0c045e07122a33793bb153efe943ebf78d752351b90fd27caa0805c2c5c392c0e6b02ed0410f07a413981f637634cef309df436434794d1017ef66bdcbc
SSDEEP 192:LJONc6DphmqQmiUy2Vq8wGYX59ezVCNY+Yjkk7or/U6:lONc619XRwGYX5E0S+YbqU6
TLSH
T19802EA35E8B86CBB8DE36E45B48B36139FD4112BAA956F84D6E81E1C00D769C1317837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fa1662859509e03f1425ba3f9d5d39cc780f4a13897f470d279d2dc5de7de83d
MD5 05aaca09ab775ebcb69a4f37b8c4c28f
SHA1 d2e57d8ec6f4ed0f42ead37ae6f68e8bfc74b502
SHA512 34ba1c04d97dc1ec85b395dc353369e35ba3cbbc814728644db03ad585c5d42eaa8a9d1cb249b0241f182976e0b934d5b28817612860369a81eb2993d03af887
SSDEEP 384:uZcIhsNu1Ty5CCw2BGYX5E0S+YpDgjtgOIwZOyDvou:MhSHwwGYu0SVp0jXsCh
TLSH
T192829E3698B99CBB5CEBA141F58B36038FF89127A6C5AF5490ED5B1D00DF298130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9de9d141fae5d49184f3ae9f9240c3ec06e405d50a8b09bdc4148e57e7716d4c
MD5 53eb94ca47721a4cdc29907b465e10fa
SHA1 3315d2fc70e9dff550913621222e080cd4f1b028
SHA512 70b6e117c532eec221444552724c99b52739c27e446551908fe8ff49ae1b0403769518ae2fd83ddc7a53559ecb735d4a1c32b55b8e6a5074b5f5f7b76fc9863c
SSDEEP 192:LJONf6DphvqQmiUyWVtwGYX59ezVCNY+YpDye9kII1q5QU6:lONf61oxtwGYX5E0S+YpDwjU6
TLSH
T1AD122B31A8B8AC7B4DD36951F48B39139FE4522BEB857F94D5EC1A1C01DF29C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6a57320e024a3a7840ef6e89c858d3abbb7f7bde8a40a7b1a4d2ed23aa2ca66f
MD5 64ce0f2cf757fdd18a51b6e65e218768
SHA1 759559ade4564f6cef3cc2f571d715be77f5c6b4
SHA512 6f56117e900d288551fce179794bc309d6632cbc7e4c962d1ad639663a1b965228733e75d3e4e660ac7b4cc23b9f57cd316445282f6c50baae51a7d3c5e1bca4
TLSH
T1C8E00103D34040B6C498833400839B607EE3826551B286865F65066C3D27B012D31F62
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4e1adef160bce0954e58fdfd5a6fd2f52110b56363007be920397d41206c8854
MD5 83613eca29421a932f73ac8edc988053
SHA1 85c1e8ab250fe9a525e68d22eac868ded5a2e9c2
SHA512 0eb3f8d705ede7ee31d3703d21011d64f17de166681474aa6fc67519d819a37f87f7a48e2f28135b326ec595966d6d0ede21453c7f5fb44376fd7d418ca37eed
TLSH
T16AE0020393404077C454833400835F502EE28361517106875B64015C3D273053D35F52
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 80202004fa49546eb0f10313442381ebfa46e9e06c67ed0c4450070f2bf22a5f
MD5 a21d6e161f14be2bd4314348df0c3beb
SHA1 d3dcc6096b1f3ed95c9f3b05b4f2d482a91681fe
SHA512 b7c20dd4ed8443c9aac21eadf1aee1bf3ec49b50ebf0aa8d18ef8ed51b06e7d7156f7f4bbfa361ada94fb551414d1139f8b650904e6e0ee88bb26836d3a832f6
TLSH
T1A6E00103934044B7C468833400835A606EE3837152A246865E6401683D263012E31FA2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe591553.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe591553.TMP
Size 392B
SHA256 2a98fd81e53080e6c712a41516e4b0cd9850ce3ace5a19c45688707cf13c5c41
MD5 a023203bbdae55a12c7846171fa92db0
SHA1 0dbc87c1c9f04ae564e7af6d685514826526ef28
SHA512 d9f7deec0908514d8564beafa3273898f0e4516daa12059c4df11a2ac931e9aa25d04d8d8b2a7ddf49cf4cefb17debef08e252945857d45862c7f445799926f7
MD5 SHA1 SHA512

Submit Download

2a6a227e-7593-48e2-a853-6024c0b7a111.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2a6a227e-7593-48e2-a853-6024c0b7a111.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3d2a3ab427c6baf53a61b959860cfc0958305364fc624dc40b92b5397dfe7ded
MD5 998d898fce0d71da6fe2eacd3f3fa1be
SHA1 c48f08ebef8b7f2cbeb9e33c61eb01ce71d32a9f
SHA512 6f122a6a618dd3eb5cd55fc8520af1a56b41efc8db34be08415f4352996b6b2cdb26095580cca9ad8dbc219cc719b159f8c89d4381bc3f98af2f7e4f406ff7e7
TLSH
T13741275CA6F9114CB3B7AE499BFA786D487BB9732E06D49D00110D4F0B62B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download