hxxps://teams[.]microsoft[.]com/l/chat/19[:]42d47981-73bb-4845-a062-aa96c0d9ff5b_4473f51b-51a7-485b-b5ff-7b043b5ea0b2@unq[.]gbl[.]spaces/conversations?tenantId=3055fa7f-a944-4927-801e-a62b63119e43

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://teams.microsoft.com/l/chat/19:42d47981-73bb-4845-a062-aa96c0d9ff5b_4473f51b-51a7-485b-b5ff-7b043b5ea0b2@unq.gbl.spaces/conversations?tenantId=3055fa7f-a944-4927-801e-a62b63119e43
Sample260930-qxp71ssdlf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1572	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{1FAC05A0-BB5C-4D98-87FF-9982B090BDD8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe
4728	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4728 wrote to memory of 1700	4728	msedge.exe	86
PID 4728 wrote to memory of 1572	4728	msedge.exe	87
PID 4728 wrote to memory of 4000	4728	msedge.exe	88
PID 4728 wrote to memory of 4000	4728	msedge.exe	88
PID 4728 wrote to memory of 4000	4728	msedge.exe	88
PID 4728 wrote to memory of 2612	4728	msedge.exe	89
PID 4728 wrote to memory of 2612	4728	msedge.exe	89
PID 4728 wrote to memory of 1480	4728	msedge.exe	90
PID 4728 wrote to memory of 1480	4728	msedge.exe	90
PID 4728 wrote to memory of 1480	4728	msedge.exe	90
PID 4728 wrote to memory of 4408	4728	msedge.exe	91
PID 4728 wrote to memory of 4408	4728	msedge.exe	91
PID 4728 wrote to memory of 4408	4728	msedge.exe	91
PID 4728 wrote to memory of 1184	4728	msedge.exe	93
PID 4728 wrote to memory of 1072	4728	msedge.exe	94
PID 4728 wrote to memory of 1184	4728	msedge.exe	93
PID 4728 wrote to memory of 1184	4728	msedge.exe	93
PID 4728 wrote to memory of 1072	4728	msedge.exe	94
PID 4728 wrote to memory of 1072	4728	msedge.exe	94
PID 4728 wrote to memory of 1240	4728	msedge.exe	100
PID 4728 wrote to memory of 4732	4728	msedge.exe	101
PID 4728 wrote to memory of 1240	4728	msedge.exe	100
PID 4728 wrote to memory of 4732	4728	msedge.exe	101
PID 4728 wrote to memory of 1828	4728	msedge.exe	102
PID 4728 wrote to memory of 1828	4728	msedge.exe	102
PID 4728 wrote to memory of 1828	4728	msedge.exe	102
PID 4728 wrote to memory of 4412	4728	msedge.exe	103
PID 4728 wrote to memory of 4412	4728	msedge.exe	103
PID 4728 wrote to memory of 4412	4728	msedge.exe	103
PID 4728 wrote to memory of 1384	4728	msedge.exe	105
PID 4728 wrote to memory of 2380	4728	msedge.exe	108
PID 4728 wrote to memory of 2380	4728	msedge.exe	108
PID 4728 wrote to memory of 2380	4728	msedge.exe	108
PID 4728 wrote to memory of 3652	4728	msedge.exe	113
PID 4728 wrote to memory of 3652	4728	msedge.exe	113
PID 4728 wrote to memory of 3652	4728	msedge.exe	113
PID 4728 wrote to memory of 5136	4728	msedge.exe	115
PID 4728 wrote to memory of 5136	4728	msedge.exe	115
PID 4728 wrote to memory of 5136	4728	msedge.exe	115
PID 4728 wrote to memory of 5132	4728	msedge.exe	118
PID 4728 wrote to memory of 5132	4728	msedge.exe	118
PID 4728 wrote to memory of 5132	4728	msedge.exe	118
PID 4728 wrote to memory of 2408	4728	msedge.exe	120
PID 4728 wrote to memory of 1668	4728	msedge.exe	121
PID 4728 wrote to memory of 4576	4728	msedge.exe	122
PID 4728 wrote to memory of 6132	4728	msedge.exe	130
PID 4728 wrote to memory of 6132	4728	msedge.exe	130
PID 4728 wrote to memory of 5944	4728	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teams.microsoft.com/l/chat/19:42d47981-73bb-4845-a062-aa96c0d9ff5b_4473f51b-51a7-485b-b5ff-7b043b5ea0b2@unq.gbl.spaces/conversations?tenantId=3055fa7f-a944-4927-801e-a62b63119e43
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffed3dfc188,0x7ffed3dfc194,0x7ffed3dfc1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,1922355389668494729,8697601435480395903,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11401378096408135451,2715618931102289581,262144 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,17355439616556563618,3413614011350289040,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,2858326533021289922,13670492593834720394,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,1025719540239336976,9818861033809994942,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5823033540844792512,13950212441610648013,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,1642239301090012884,12099346177584973984,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:2
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,10414177863835914219,5120627290620684084,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,9888054796806863085,11280842876783082660,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5460,i,6532533976489024465,10634657352641681376,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5676,i,4731780108156644414,16994224299214391871,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2701784291184152562,5696343111091892005,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,2701784291184152562,5696343111091892005,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6436,i,10261612416124885026,17416311579029540049,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5648,i,4632916965316647544,16507803709938148083,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4416,i,4453073659736400402,6270475908598033184,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6812,i,10306808767589215337,17906755135832029377,2097152 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,7975037385680751507,15197396984353721081,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6516,i,11920426123928390517,3237453837373885765,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,9037206822141511200,8747429825619084964,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5680,i,7768546564717496160,17719000781947967490,524288 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,16913729093611431520,14246023819276075267,262144 --field-trial-handle=1960,i,12856608064520149489,7881344742029685850,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3392e3a7-bb4b-4f0c-bd75-a16cd5ef40c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3392e3a7-bb4b-4f0c-bd75-a16cd5ef40c7.tmp
Size 18KB
SHA256 67bacccd142857fb8003db851eac944c24f5bb951db3d81a1882260fb0a62be7
MD5 47d329a5affcd28a91493132564bfaca
SHA1 12388424b925872cea409bd281249def5a178cac
SHA512 86fe6fa6c5559c654f40fb420c4ae9a64970f0a9507e6632866a84241bf3287d44a04710bb0c5351466a06e609a988dd22f06858b08e82e06b959bceee3d82bd
SSDEEP 384:MZcIhsNErN2i8ceFQX5+DtP8gXTwztgOIwZOyQno/:ahd2N/ikDlTwzXs9M
TLSH
T15F827D3299F85C7B1DF7A285B0873203AFB8501796D96B80D5FD9F2C01DA6A9130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 117KB
SHA256 c4ffe67db8a8b75fda2362f82d04d904778feff4397bea6217e543f281648521
MD5 cc5b4177e4a84374e6b02ec727f330a8
SHA1 89bc8bcd5be52689c522b3cb594b0e274fd13cdc
SHA512 b0fa8a2446c7bc575b719f131bfc0e9a12fcbb6088ff15a4c82606e3c714dbea209ceded176f3957bcffd33238bb901e4cf5775a181bce89d3f00524160a63a2
SSDEEP 3072:mnMIkdfhcf89KoVohRxrxBJVIJfjnGhEwcdzB9mm:BIk1h489KEo9zrIJzScv9mm
TLSH
T100C31338874D7953597D75435522EF093BFB9D50CD53D0A0B06D2F8EA3AA0CC6DE2289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 35KB
SHA256 4a3bc42d6d30151b97564b8264b376a032646f34c03f60427c6c6ad53912090e
MD5 fa25b2514d8b49a3d83c6bd353c3902e
SHA1 6bd0e39e9dd1392d2768d12c74974ca60058becf
SHA512 4cb55b18da82ff209764aa7068b124b146c76c7dda9d39ce9d5128bb9c06c136fa7b2be289d62c5d3d2974316e3550cf1b2a5b98187ffef0a13eef479c5000d8
SSDEEP 768:140p+ri+0YXR8w65SifQdotUjpqCunGJLH4ls:14X+3YXv65R36ItGJ8y
TLSH
T192F2F11C91B4D3A52494E4CC2B02CF8E77B6710DCA5BDB780F1DE026D4C45AA66D8E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f7758601fa267e881a60dcf0dc443a429d7db84fde6f5409a3b24d518b22e07b
MD5 b5264862b8300d4ed4d80cd6e2a891b4
SHA1 2d1a49c352c766674c255d7e39bbb0cdfc1b882f
SHA512 99c072abb3a52ed8f0112ea20f7f422da4c6fa92b6d20fe370dc7531ca9a02558345f0e9f94f46814c72ee1850c7538d58274c29ebfc66be136ec379dfe093ed
TLSH
T11B813E9349D24DB4FB55C17ED8E05E8736B2B1E08EA31F4304A4D5B57D73BA09AC4A32
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\000003.log
Size 18KB
SHA256 0deb790d958c545fa26ffe3698ca2f4f6545fefeced22b04b0685a0fba441ac3
MD5 dbf5513f0118d4be422e3ef1f75f725f
SHA1 02efc4f601cc3c1dee31eec3ebd3f4825ca2a877
SHA512 aee786f616f46aeae1fcb9186a18960253012dd8a7685cf192b3d45484e0f1b3f45411b3dfdad25bf3523ac877c4fe9307ec297c9a814f54fec4e574ed55c2e9
SSDEEP 384:bOLGOFPJNWxMjNec+omUGcoYhatw6qVgbddOJNa2cxn:aLGOFPJNWxMjNec+omUGcoYhatw6qVE1
TLSH
T19582A71F96D89E23E82A87B299B30FD45B377E847D94820FE4C0B36EC5B19908D31756
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\LOG
Size 361B
SHA256 8501790765f288d2139788812456913a39c10def2b0213ebf658f559c0986960
MD5 95e367624e2ac5ab7b4f7989414fd67f
SHA1 acfb1b1610921b614e489041f88996f86bf24ad5
SHA512 1f8bd1580c6f84a1999b36d7cf509c319307b45493e3826a6f3ce3ba45b00269ba61758709e6a3ee0d51c5636e93503e85d19d617c034b142784900a4490c19e
TLSH
T118E0D868C5C9C25F921860960525FB0AE5AB270F96CCBE8E1F46CC447047088E56F1D1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_teams.microsoft.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4aebdd985db978e8c31ea91700887534dbfe8a2a99608dc68e5afb3da3341bb0
MD5 bb4677358531bf30831653f5d606b840
SHA1 51663be10afb255725899d622e047ad87f82a314
SHA512 6022350cf92c2aecc1162516d369e49e481806adc31baf7d08d60d466a43ad7a76313144cdf65214fdbd75930e80377b604de57f71c8021aa1f37e974b915ec3
TLSH
T1B171ABF783E1856EDD1166F09A18DE2BEF1D0616431C78198AD4EE27E3B3072E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 16b8eb60a4fb5e55683fcfd272434d5d40c7438b4773176dd0a57beeea12819d
MD5 6f6b9196df6f27e3a555400f1158fb73
SHA1 e3edddbea23dfbdff4a09010c404b0d2b03613dc
SHA512 6005a239f94e130437357bbb856915429380549a0b2050ceb9a1493bffdd114d80ff6b32674dadd8bfe30ef179e40328cffea09b6e925508cba5e39839c8a7a9
TLSH
T18581ACF783A1856EDE11A6F09A18DE2BEF1D0616431C78198AD4EE27D7B3472E00275B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e66e117558c020591a8b5bdfa51f2ba80b79fca214826d484a396414b95695b4
MD5 27b00f61d9447a496ef8033114d95eb9
SHA1 c6c43ea6a14218d39451699f15b6fe0973dd52eb
SHA512 4990257d89c92a4e477a879b48b397fe25cc554d79dc8913980aedde5f25046f5ddfef59995d771919b5d14bb91517dbaf741b4d285b93b217c86ab400b59a6c
SSDEEP 192:sxZUxRYWFl/flqsRp2IdpwOHW6+WNvOc8/YYBqkWIgrJ:sxZUx1Fl/flqsRp3nHbc/fy9
TLSH
T17822CA516E78A57B4CCBE20DBA15BF53E6F9503251D11E48AAFCD61C04E7ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bf5b56c59bac29d874f619404fe7125126b79ec33d04f48c8e324fdae13aab4c
MD5 ca744a26c9839030c094c50d31222af5
SHA1 e5742f9a4f93df6d96490554eb2df66a93df5fd0
SHA512 9e7a55ed8966986ff8f81b306d961057167ff353f99845a575dbb26df82112691ea782501e7e3e2cc16d81ae54cef1fb2466d6e17ac727e30cf61c4c1a3f403f
SSDEEP 192:sxZZxRYWFl/flqsru2IdpC5u5HW6+WNZIOc8/YYBHVkWIg5yJ:sxZZx1Fl/flqsru3zHbF/fH5s
TLSH
T14332C9516E7469778CCBD209BA15BF53E3F9503291D11E48AAFCD61C05E7BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f90f57290c800f4df97eb9a7e94a8702fae434b41979dd06bd7695b29a33c7fa
MD5 31ea9257e0976253a279302199bd8003
SHA1 f9dc53e6a2d354dbdb1615cb1f5abaa09957110a
SHA512 c7d3ef90559781d389c82a769ec8c0d3fd26da260f1d9ea9edcf6ad65c22ccd0e8a6a8c4b1cdeb590a30badeb6b5ddbad8c308290b7ec28f6812e57ff2829a5b
SSDEEP 192:sxZZxRYWFl/flqsFu2Idp05u5HW6+WNZIOc8/YYBqkWIg5AJ:sxZZx1Fl/flqsFu3dHbF/fy+
TLSH
T15732D8526E74697B8CCBD20ABA15BB53E3F9503291D11E48AAFCC61C05E77DE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9ce62532e527c8a529f5a0271863ff22295dac8efaf3a12455e3aed630c8c7b0
MD5 a02b4985157735c153ce86339e6a2b75
SHA1 6ece5aaf76e7abb62a70244ae5854eea566989fb
SHA512 2c482735c71e85da1cf6daf8d1c13e9839684b8ebbbf53a4a96905bf24f38a0b8334225923fd5c8540306266dfdc3ba4238f0166e695f05f094fe52b94b0d80f
SSDEEP 192:sxZZxRYWFl/flqsru2Idp05u5HW6+WNZIOc8/YYBbkWIg5yJ:sxZZx1Fl/flqsru3dHbF/f3s
TLSH
T12B32C9516E7469778CCBE20ABA15BB53E7F9503291D11E48AAFCC61C05E77DE2207C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 88b3892189f8604ca139ba1f1f3c937ac0d8d9b7557b4061dc0de8e491de7f98
MD5 342e03ec6b253223ac13c86bd5db6a12
SHA1 084e9494914fb55743e4d2f58d880be71bed4e74
SHA512 95bf2f37722f66e0d67ec47b3988fb0761a1cfef99d542f699a3388dd3adf45fffa1e5304a0e0297523132c6f7c41fe42cff301a26435e2ec18c4253319d12c1
SSDEEP 768:TEyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvX4ropYdM4d:TEyYR7jWv3NpBu1ja/CL8OXDS
TLSH
T15EC2F92B640DCB7E4FC01A9DDC5A6FDB3EA802C796548D4047FA954C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\3c65b322-56a7-44c1-8d54-351c76c4d6a6\index-dir\the-real-index
Size 96B
SHA256 b12b38ad9ecfe3234b32d842f00f7ce1504b05bb7c089d7d184c2447daa85c1c
MD5 2f10f7deee3ae9b924e8bfafff3da91c
SHA1 f3461b7be0e2fac14b29c485a901279bab21aa66
SHA512 1145e55c67849e6625d64e6d7e6ddcef81b8727818735ee197457e1bca088544f9facd6eedc87e02cecf011ad70277e01adda963a417bb2366bdfc454f398d06
TLSH
T114B022C028000022C00B03F380C22CF03FBC0FA88B03032C02C832A3AC223808A80000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59429d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\3c65b322-56a7-44c1-8d54-351c76c4d6a6\index-dir\the-real-index~RFe59429d.TMP
Size 48B
SHA256 8ef5e217de505ea16605717f4de3ad8142abeaaf165af0131dfd4345ee563d42
MD5 7b6a1d86f3d9e888cda4fd84c51de04c
SHA1 853cbfb72ba1afb56024b43e692973c0f160036e
SHA512 bad3c8ff6990059cde023d92fd26d3d25f7a57d08855935f52ca34c1b65e5a53acb444efb8aae548910ca95bab00a682703f616fe1deec6cbf5153a21dfbaa4a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7438a243-6e33-4856-96b7-784660b6383f\index-dir\the-real-index
Size 168B
SHA256 1bee7877c15b2374c5c30e24dcf7ab92793f2c5531ec948e36076b6dee50e03b
MD5 6b63f1f47e90f1547b289315f2a9209b
SHA1 a10ac561208d6f7f540aa116d8caf909df9d764f
SHA512 fbc59b8b0e7059074828f1bc6e407790d3683604aca8db6c85fe2d20bd287fecc8f8af8b751e215534dbf2333109458e9936c318a22891b4027d34363b329255
TLSH
T1D8C09219A8904560F05A62B18A5704E8332C14AA8226A780E09C962DEDB3BE4E8C1115
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591c29.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7438a243-6e33-4856-96b7-784660b6383f\index-dir\the-real-index~RFe591c29.TMP
Size 48B
SHA256 a501940c5d43b59879f5cfba484703cf1c675761fc1c9d6a7d9beee59edf085f
MD5 98bd393e7f67cc752f689facfe7d48dc
SHA1 570431261e8d92cfddd976a7936eafbb99f4ac37
SHA512 c344aa617c4d70d045c254dc0d93488f2460731941b769553794f2368b55fc439c76897d24a9f5e54a46a1dd047af1652e71cff43206faf1dc8045d830958d31
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\a60ca519-8cb0-4315-8323-02a07ccdc444\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\a60ca519-8cb0-4315-8323-02a07ccdc444\index-dir\the-real-index
Size 456B
SHA256 7003c76f35776bf9f8f7f6f9de7f17d9f080cbdb5e0338d5bca7f7aeb0ef94fd
MD5 af277b440315f69ef20d6cb9801baf75
SHA1 b98a385076a7f08a430acfed7e39cdab73abdce3
SHA512 a9bdf98083cbebaeb84ebee51f97e01a4704ceb3c53a3c07013b058754efd09dda342c0c0bb99b78e48aaf4fd44bc08ad3a605a21e4c20c2d2c120f07ca3d0ba
TLSH
T1F7F0C09CCCC05863F5040EFA31F7856A32B231FC41031F110B2E11B45D62748DDC1145
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594d3c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\a60ca519-8cb0-4315-8323-02a07ccdc444\index-dir\the-real-index~RFe594d3c.TMP
Size 48B
SHA256 1ba68a08ca67df593364e1a7a7cc200c2fef591c8c948e5abd84967d944f0fe4
MD5 dc35940698425ed8ceb3a3ac6454e324
SHA1 be5099f06e164f0e3d5e2fb4024be6051f02424c
SHA512 6f0aca1bc9b3e5f01bb163ceff181b53c6c831280d35d0423d311d07d67a4b9f770881eff7be4dd944e7bb3603ba697c7384d45e338bc68237125b72421e5638
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\fb667a80-22e5-41f8-bfd8-a12ad8382827\index-dir\the-real-index
Size 96B
SHA256 299858cee6dbb0e15fe17c88739aa2cc9caed08c7ce4925f9ecc66edd3434cb4
MD5 783f8f8f11ab7a2cf31bfc31624e2e32
SHA1 3450c1b7680368f9749bcbeb8f91ddf393a2551a
SHA512 6acf47c35e74919f3fa97ba1944a01058f3a0b37199b9ba316a127a6f16327f5606a70801f53238fcda152e42044f4324cbe4387ef358b89be19321d083c148f
TLSH
T1B3B0011ACE10C45BC0148BB99EA986A572292EAC9AA69245949846A89C3B65582C12A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593f51.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\fb667a80-22e5-41f8-bfd8-a12ad8382827\index-dir\the-real-index~RFe593f51.TMP
Size 48B
SHA256 d28464bf4c674fab752adaf06dc81ab4051b61e69373c1713061efe5319fa445
MD5 c4de44a023ea817d7112a778fff73a2b
SHA1 9e65584dbb11bc1f4e21d26245ab7f74b1a8b579
SHA512 54f1a736cbda00819250a8ae5faeac04e3c9d574abe4244474a4a87fa773faa5a3beb0674a8b5e266044e1c567b5572c6b0547c8c3c159a00f9da2d127cf2220
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 278B
SHA256 069a81d8fc9ec55bf4243790d46ff8e57a78439dff480a3731cc7bd12ca42443
MD5 6a3d725588b8751969c5ef004c1f468b
SHA1 1de5869d0a46ef268c635a954f5c2261b88b8be3
SHA512 ec0f20ca620a594a23928588bd9b968e5e06b643902f34c0d2465d329b664e882195ecdd61ce147ce1e8238a38dade344eaa8c8970a5c2f9e9a24f5a5ed4dbf4
TLSH
T183D0C26A83A00128FE5986920464D05759BD7D4A4499E8985586E013687E6A5AB00DE6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 425B
SHA256 501a492f0162e71917a453f22688d477c9607a29df6034c3f6ca07f546a457ea
MD5 e5a9170932233cb76c65075f4b80c3a5
SHA1 6c66cbdc51f4f1f987277dfdf8276137f650d89a
SHA512 e3b7779889f01698d2b66f08c55558de0026ec3fe2313b5bba5f1c4643639fec487102f4a3a9000bdeb9ae6fcc11e6dd8087b3bf8d673c809e45395797b1d4c5
TLSH
T1A7E0556687F10439FABACA810460A027083CB8424899EC0C0A82A403683F9A4EF10EA2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 549B
SHA256 6bebf8906cdb506777562d6f6a3f9678ee9feae429b7452f13c827df97f3392f
MD5 dafab4d0fffb9d810e0d8a81bbb0ebca
SHA1 25d40084c7a61adaf67588f312a82d1c7b3a93e9
SHA512 1abce5adae746dcddddf9687d5e4f7736c5fd67e367b834f588778ccc8ab860ad722a5f616d02ae7195e439ffdcfea415b2103ffa9a8aeceb670386b0c6ded99
TLSH
T1F3F08B1287E50429FFBBCA810870F157593CB8015995AC4C0D929403687F9D5EF60DE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 651B
SHA256 cee5fbe23d3b344922973549dda918705ab4541e47fe17f045d27bfb1550728b
MD5 a1de1e254ad20a0969b90f8bf8058cfa
SHA1 e793cc06310061626ddd54cf085a5b9bfb1ae7ed
SHA512 425478581353db7e79f0aa491f1d3be55501a9161d43bfc893887a575ff7afacc635a186e5213c5499fc6de6da663968729a996daf8a98306242ae84fee33860
TLSH
T1BBF0DD1247E51439FFBBCA8608B1F01B093DB84509999D0C0D82A40368BB8D5DF64DE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 647B
SHA256 56ccde9dc2e6f2b3cad467d5e101386a661a6d715ce0dbaacf2c7ec4548bbb62
MD5 695514ea3a43504aeecf94e27d62db5a
SHA1 6cdb6fc7c4c47d5eefcd2f0617fd92752e3243eb
SHA512 ff820a23842d8c3ac36e251dfd38a64c665e44f22c7c4ef4f39cf6e8266b4906251cd31824921f999d91d684c1e3a378db31c3fbb8553a49864da15a1cb8d0fd
TLSH
T127F0DD1347D51479FFBBCA8508B1F01B0D3DB44509999C0C0D82940324BB8D4DF60DE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e1b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe58e1b0.TMP
Size 160B
SHA256 afd30d84c03e15a656f66338d4986bee057b28c424a8d5da623c7d2e22b59899
MD5 aca85107185ebe0bc1635c4ec053f076
SHA1 e52768d068e11fabfb5626330a2bc6a104e98992
SHA512 aec0c14cf472a13e5b6634ce99dd2f6a24be55dec5efadc0db7bdfd3a858239b475331fbfa9ef3642559bdb0a84cc0598786345a6bd63980817da084b0f9fb9d
TLSH
T12DC08C2A83A0000DEF8882A30019E01B59196D4FC46AE894A288E0026C3E6A6FF02CB6
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 cdbffadc3f018185f78d945f01b6daa892f672903a8576a69a48351f61161116
MD5 ed9bb29396f40887951f43c43ea14f0d
SHA1 47d2109bd7bc58f363fc2963e030adfa113a4a86
SHA512 edbeaffaccd1ed0b03f572c529f8047055a28f864947c6a0639be6b9ce9f2f637a13c62fd76a380d46921e10a8cef77f490149d34f59ba6f03c7291ffc36adbc
TLSH
T137B01100820B288AC0A00BB0B083028033208E008A022222C2F0B0BAC82A2002880A20
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5943f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5943f5.TMP
Size 48B
SHA256 a011375ba7e7a79798f45963440aa0a840a77d0fd4abb822a22686e978fe3a37
MD5 1ee445ee502308b52779064582ab10fe
SHA1 06e0f7a1ade180cfb333d9937173ce28bfd6c88d
SHA512 47357f6b68837e16a48f08f6ce6c8dc982a8c3934646d6c6f201e39a11861b91a5ca16e75acc291322c823bc8bb51de3b0199fec4bf8184c27d904aa7880e1a0
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 60fbc5296b0e70975404d399574388931703157bd1912e9cf056353eb28888ba
MD5 fabd97e032e5d81888f3c2ffa4e6568f
SHA1 27fc55f3b514d98f0569d9c7301ca1fba97d94db
SHA512 025f0310387db5a3e62019e8a56d51645bdf341b52ca04184ca4a733bd4ca2057f226023d747602edc8f65c434185f4f6f00e6c37423f0f73720f10abeef6d77
SSDEEP 48:Kg6lI064I5bkjUISs5K9Q1K5xipYb8IKyLdcRtfLPwbD2jISlwK9l1Hwx1gYmnXy:KsZmKKkaKGkKDSwVKKu4iT
TLSH
T151910D1131BB061039BF39C892B5CA1F524235767119FA2BBFB944B1CA6AE045EFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

846809f3-6834-497c-b699-757972873a7d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\846809f3-6834-497c-b699-757972873a7d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a946.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a946.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 bceab22c7cdb1aba6fbb29cea7a35dd6cb920a28274763abdf225fee81bd1ba5
MD5 70a47007cbdd8de8c039c84de399c1b1
SHA1 9a7f9a61678e38816dc3d84573b82af583702ca1
SHA512 9c62ba992d5540bd65616eb36aa4864637f4b54d0bb4c2c6da259e5a114b43120ad7e49f2c18a482a3169b91760b1d032d96c35a51625b55bb9d93ebae805a73
SSDEEP 384:vZcIhsNEON2i8ceFQX5+DtP8gXTwztgOIwZOyQno/:nh22N/ikDlTwzXs9M
TLSH
T1E9827D3299F85C7B1DF7A285B08732035FB8501796D56B80D5FDAF2C01DA6A9130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bb5a7d0861763629c51a076b99783c77f76139f453ea676aada68170b66b5be6
MD5 ddb671f7453c22222b86a7005dfeb42f
SHA1 d511ea5c1241dc5252279ae3d34d2ae7d9a4817c
SHA512 51c91c0aed61cf91c8982487362b1a745aa09d8ec7563be89d6cf7e2c4f0cd134e348f1d531ed4927279bcaf27fe69117af32f846e8c1c9219ead3b2fecca8ca
SSDEEP 384:kiFiZcIZzsNM8TUNTUlIlrN2i8cVFQX5+DtP8gXNwztgOIwZOyQno/:/FQZdwg/2NyikDlNwzXs9M
TLSH
T17EC23BF248E7987BD9AE9743A37E2D039EBCC057B5859680B7985A1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1e8050d0cb27bee01892c8ea45c041fd1c96a6dcf7ad386d44e86969bab6de5
MD5 60db5138918fbb63a1683a4e05e83f34
SHA1 ffd169334c48d466cadacfccbd0e3445f4c27f5e
SHA512 7020e8a4cc926af7f0f3be265e5f1b99c36ec30a34ad9893f757ff887b5f944646a4e319f301c38cad10f02f881a60232ffbb3e56cc315a19ace217dd7ea2244
SSDEEP 192:EONX6nnHGQmiUy8mQYcX5hQDP1njzorBRGMc+lUU6:EONX6nCaQNX5+DtP8ynU6
TLSH
T19F02DC35BCA86C7B8AF3AE45B48637139FE5216BA5956B80DBE81F1C00D765C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 04e63099a006352d0cb0e14ea84b21f51bbd0b4eacf95d366c91a867f977e6ba
MD5 c42c11e07e0e141b20c980982cc326bb
SHA1 cce8d10a0d193cc423c503bb0546e0e4875f5051
SHA512 52c82b5544f82af7bf72efccb8b1cb3c1132ceaac23e24a5274ca259568e9e76ac45af70c21e842172ff9de0751d00bc35020c24c9a52ce9c8a710895d1a6af7
SSDEEP 192:EONF6nnHwQmiUypmA+YcX5hQDP1njzorBRcX1edg3+CrqXzU6:EONF6nQp3NX5+DtP8gXHwzU6
TLSH
T1C612FB31F9E8AC6B5EE3A995B0873113AFA51117D6896F80D6EC1F2C01DE6AC1309D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5efaf4b70068ae2533880bcfc0ab0a8d2e69a076885aa9d220a61b5be1f23e6b
MD5 9fffde744ab4e80a94762a4d167c07cb
SHA1 ac6d0016521da164ef8b6942475534cef7a4d519
SHA512 25d3853a4f6aa206a43e15287c8fd2f7b73d79b256a4fc486c74273db7dba050887b6e327f31a85fa5abeeba9e0bf10e89d1349f0600c1f8e8b96cc43584fae8
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe590af3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590af3.TMP
Size 392B
SHA256 2834d1c5846dac042abd7e5e0dd766a77ba8ddbd480eb7493bbce86fa36e9427
MD5 374e53b6726198ebb0fef233f85cdc5f
SHA1 05cc9adc59116a74c7b8965c7f7f81d5670e3271
SHA512 1701eb850d20d3ea956e3a002f9513d4988cee3df2a568aeb1a989b064af49684348d0716b7a82c27819c39a088842557d73a6dadc0b1cb032c39e26df2d253e
MD5 SHA1 SHA512

Submit Download

a0b5fc80-1b7a-4b13-898f-f78509eacab2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a0b5fc80-1b7a-4b13-898f-f78509eacab2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1533c93eed5833f1e542e571227ec734c80afdc927eec0ea40526dab7c0ce714
MD5 42b78abd0b0136435f299a87f112ecfe
SHA1 5951417cb4a430af9a3713952fb451c1fadc3ba0
SHA512 2d43afdff6ae6b9d3caef14b4d6bffa06a106d0a0860e7beed17991ebbd3b59d09a0e139465d4aa0d212ad66a638fd87d3a1513b2a61016c0ee92e36bf06efb5
TLSH
T12041285CAAE91148B3B7AE5A9FF6A85D447BB9772F0AD44E10110E4F0623A40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download