hxxps://teams[.]live[.]com/l/invite/FAAc7AcxGKLbSHhCQ?v=g1

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://teams.live.com/l/invite/FAAc7AcxGKLbSHhCQ?v=g1
Sample260930-v2w9caea66

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 1 IoCs

phishing microsoft

flow	pid	Process
144	4104	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4104	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{F20A3AB6-D028-49AD-BC24-B9037B753DDC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe
4380	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 1544	4380	msedge.exe	85
PID 4380 wrote to memory of 4104	4380	msedge.exe	86
PID 4380 wrote to memory of 5100	4380	msedge.exe	87
PID 4380 wrote to memory of 5100	4380	msedge.exe	87
PID 4380 wrote to memory of 3864	4380	msedge.exe	88
PID 4380 wrote to memory of 3864	4380	msedge.exe	88
PID 4380 wrote to memory of 3864	4380	msedge.exe	88
PID 4380 wrote to memory of 4532	4380	msedge.exe	89
PID 4380 wrote to memory of 4532	4380	msedge.exe	89
PID 4380 wrote to memory of 4532	4380	msedge.exe	89
PID 4380 wrote to memory of 3876	4380	msedge.exe	90
PID 4380 wrote to memory of 3876	4380	msedge.exe	90
PID 4380 wrote to memory of 3876	4380	msedge.exe	90
PID 4380 wrote to memory of 832	4380	msedge.exe	92
PID 4380 wrote to memory of 1772	4380	msedge.exe	93
PID 4380 wrote to memory of 832	4380	msedge.exe	92
PID 4380 wrote to memory of 832	4380	msedge.exe	92
PID 4380 wrote to memory of 1772	4380	msedge.exe	93
PID 4380 wrote to memory of 1772	4380	msedge.exe	93
PID 4380 wrote to memory of 1044	4380	msedge.exe	97
PID 4380 wrote to memory of 1044	4380	msedge.exe	97
PID 4380 wrote to memory of 1044	4380	msedge.exe	97
PID 4380 wrote to memory of 2124	4380	msedge.exe	98
PID 4380 wrote to memory of 2124	4380	msedge.exe	98
PID 4380 wrote to memory of 2124	4380	msedge.exe	98
PID 4380 wrote to memory of 2076	4380	msedge.exe	102
PID 4380 wrote to memory of 4788	4380	msedge.exe	103
PID 4380 wrote to memory of 2076	4380	msedge.exe	102
PID 4380 wrote to memory of 4788	4380	msedge.exe	103
PID 4380 wrote to memory of 1428	4380	msedge.exe	105
PID 4380 wrote to memory of 2356	4380	msedge.exe	114
PID 4380 wrote to memory of 2356	4380	msedge.exe	114
PID 4380 wrote to memory of 2356	4380	msedge.exe	114
PID 4380 wrote to memory of 3096	4380	msedge.exe	115
PID 4380 wrote to memory of 3096	4380	msedge.exe	115
PID 4380 wrote to memory of 3096	4380	msedge.exe	115
PID 4380 wrote to memory of 5404	4380	msedge.exe	116
PID 4380 wrote to memory of 5404	4380	msedge.exe	116
PID 4380 wrote to memory of 5404	4380	msedge.exe	116
PID 4380 wrote to memory of 5460	4380	msedge.exe	117
PID 4380 wrote to memory of 5460	4380	msedge.exe	117
PID 4380 wrote to memory of 5460	4380	msedge.exe	117
PID 4380 wrote to memory of 6080	4380	msedge.exe	119
PID 4380 wrote to memory of 6088	4380	msedge.exe	120
PID 4380 wrote to memory of 6096	4380	msedge.exe	121
PID 4380 wrote to memory of 5992	4380	msedge.exe	130
PID 4380 wrote to memory of 5992	4380	msedge.exe	130
PID 4380 wrote to memory of 3952	4380	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teams.live.com/l/invite/FAAc7AcxGKLbSHhCQ?v=g1
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe7bc5c188,0x7ffe7bc5c194,0x7ffe7bc5c1a0
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,3351589612003727871,13819593275234237057,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,4531069785590877341,1862544433717355336,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,17102716680339700665,9207647698471331497,262144 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,10543034940357993514,2173461513341840703,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,7578320893070840318,9203347228340000530,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,440382715176608305,6237379153246519201,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,5752785370733856690,15300171530253740354,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,13507605865096707995,8671662901764430776,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5288,i,1095942170002542472,13923534994771046996,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,4363549941776170087,16252653396867220223,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17481753243862955875,7949250015670860971,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,4291776084057240464,1997340903973063998,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,4291776084057240464,1997340903973063998,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4400,i,1040843484891112796,17055720391956856250,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6600,i,13099888041771581142,9735365429847877867,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4552,i,1149697239460150833,5282702398352379756,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6860,i,9676015789937875370,13236910517575750184,2097152 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,16936086544699054685,13260996585187266656,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:8
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,7820114872384961408,522007093620741071,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6880 /prefetch:8
  2⤵
  PID:6088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6892,i,1871677772296466386,12068719471294948808,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,4410563942331229412,10024160147477099868,524288 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4392,i,250147408081874265,15558863864163778329,262144 --field-trial-handle=2936,i,16121845029851145515,17686430260074650455,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 54d04b2f4056b13fae362a1dea66c5601198d0319803bdd864d8c70de79aad2e
MD5 8cf5270fcbbc2f104fbd82911723b2a2
SHA1 75d727807bb926d6837507d8b7832776eb51fc2b
SHA512 7b5ed4568836407bc87d9a47d60ee319b0a5e963c1babc94fcef51dac7ebc218c6dbfafd7b2b18bcdd653c59da768d90cafa1a11dc7327e9c20bd080d26bd398
SSDEEP 96:Bs6x7dOX1AGhoMOYrWF0wG0X9I91fLGZR5OzlLkFnS3wnLc:Bsc21Ae7pYcC9IGZR5cPgo
TLSH
T1B69173E06FA0B9E0FFA917716BD6198234F03641A5671E0F9464DDA93D172E40F2437E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 baebc68523d6f27496439cf4a214fc3c4d7698f158d2b1864f198ea125baaeec
MD5 fd3e44a72cd87e1394041a4beb622ace
SHA1 afca0dd3801cd5eb995c282e4caa535e2f5540bb
SHA512 03775f797194117781a099788fb66a1fd84023a618e6811ab85c7f89e8f123cfdf9e3e7e65f0153075340025bce06fa472e6a91cc106405f1cad08ba2a4d74be
TLSH
T13A618AF787B4466EEA2162F0DA18BF1B9E1C0557031C7859C1E4AE26A3F64B0F142A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 41eaf6b0122e2dbefdf60e08f05b19f4088ac02f91b0b2fd2cce440da700e8d3
MD5 d5572afd0ff6391df633c5967618eac4
SHA1 1c58c4c13140d550d032dcb80efb45b2c1c51c62
SHA512 5aec02400f88c7761f8a0beec3e5fb7a05519b5151f930ce7c57a6c5511b8a053a6300b797e20384d8b7a0f1a2764e35113bc33cf2be28038919836842a36b09
TLSH
T1E1618AF787A4466EEA2162F0DA18BF1B9E1C0557031C785981D4AE26A3F64B0F141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 48838b31de80e422a99713f477e6c0e32710ae535c89d9a9920fded51f9aa80a
MD5 6fcbea91107693be0d6796c8242df7d3
SHA1 fac78afaf1d4a688e6e37af08260f1ee96a8bd45
SHA512 227d7dcfa2971b54e3ad6234b4d745d17e4871b8b7c07560a14c9fe9eb0708ea7d20c4a172fc3f5df6dc9c475eb61d1eedf33f0e747f091afc3eefc5364ffd82
SSDEEP 192:sxZ5RjWR/f2snrwi8IdpWrHW6+WN1XE/Ya1BaIgrJ:sxZ5cR/f2snkilQHba/29
TLSH
T17022C911AE78B97B8CC7D21DBA55BF43D6F9143291D51E48AAFC851C04E7ADD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e70f0fd78d233b4163f76034a22971c58c07d065079d248c7c305cb099319df7
MD5 e8b1196c6a24adabb8b4ac147fa96145
SHA1 c5e2e7d21edad1731059c09c38434a2babb0e783
SHA512 5ff4fef16354cff4b3ebf21393b30dd2172c73135cd0e4681d53b7199dc2344b6733be4e68d1571a1a87dccaf34f7a89826defc9d7ae2f053e9c3302c1a96a37
SSDEEP 192:sxZiRjWR/f2sdrwv78IdpSgpHW6+WN8eXE/YaKNBaIg5WJ:sxZicR/f2sdkv7lLHbA/SWA
TLSH
T12632E912AE78697B9CC7D21DBA55BF53E2F5103291D51E8CAAFC8A1C04E7BDD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 047486906bdf822701e521f03367dac66d93f666dcc302f3003392db11f17e6e
MD5 f5186ef30195db2a8e8bb99cba060078
SHA1 da23f2b88dfa0d9b795a0ff81296692d83a35a1b
SHA512 c60e15b9595c93d95c20f8e47ab9656821b2150100af282e2df9a43d74e7c59e094d755e9f7f4e2938c7acbfad2a3d4c0bb13f7aa8831d151023d45c9a65b45a
SSDEEP 192:sxZiRjWR/f2sdrwv78Idp8gpHW6+WN8eXE/YaTNBaIg5WJ:sxZicR/f2sdkv7lBHbA/LWA
TLSH
T1C732E912AE78697B9CC7D21DBA55BF53E2F5103291D51E88AAFC8A1C04E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5509c7272070cc97b0c2ccf55990e80a23a300476cd12fd58044e3ce3123f451
MD5 0474e2970036b85e66de6a423920af7d
SHA1 6aad9c82453a5c2ca7145e58f405c63deb3b5d0e
SHA512 bd9690f65805cbfa15705ad1c4fbb35556f52d989637e4bddf3e8273b2712f93e9c39bc059d9d8bcc0598e7e8d195e1e621d43d091416d53ae4cb1a49996de7a
SSDEEP 192:sxZiRjWR/f2sArwv78Idp8gpHW6+WN8eXE/Ya2BaIg50J:sxZicR/f2sAkv7lBHbA/HC
TLSH
T13232DA16AE78697B8CC7D21DBA55BF53D2F5103291D51E8CAAFC861C04E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0e46c9070505b8c96a67eab95fc7974565f1504a5222b7ef0b8e105fb76f184d
MD5 75a8ac0e947b2eca80095d9fe00e52e8
SHA1 b335123ba0275dc5af3bca72260e758711c2411f
SHA512 6b5ed34b18cc5874d25fd4bde62f8bda0e2bcfd6172a4428498ad9fdf5c6312556f9e2dd572c0a3433ce8b0b72887caee206f760c32660133e461d50aa0735b4
SSDEEP 768:olyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3vroiZHr:olyQRbrWvvlpZu1jaXKLf338iZHr
TLSH
T147C2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\3eb2c538-c87a-400f-9d99-a87b0e133183\index-dir\the-real-index
Size 96B
SHA256 2228f04aabd53278e50f9f7fda63b10a35644da0b03f771ad6b2b3309402245d
MD5 cb2a70bec94fa562c724f7b14fba0b6c
SHA1 bfc3c4f222be01ac61bf5820dd2c2b4a65843113
SHA512 df20e63ec25e32b974a11d47e0b1f38ca76bb79d4323223771404ce256fa652f745627a5265326613d5c51cd3251611ebc52fd3800bb10daae8788272166a723
TLSH
T176B022E028008002C80003F3E2C320E0F33C0FAC03030B2C02C8082FAC323C88B08200
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59166c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\3eb2c538-c87a-400f-9d99-a87b0e133183\index-dir\the-real-index~RFe59166c.TMP
Size 48B
SHA256 87b90b5bb6e5ea41d240f9063b0572bb4b5197528c4624411738a64b3a07749a
MD5 5f3938a61f7ad5d643df036838ed71a2
SHA1 f90380f73e69d3369cc28542f4387411e42bc51d
SHA512 468932717cbd5b159daa4600e0495cae14a424966df82fb4b54fc81c882b1ab0462e6925ccf044a5477d432dd88535355bbc2a13faa2880eb1dee067e02b343a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\8a20092d-7538-467d-84a7-a149d52c8586\index-dir\the-real-index
Size 96B
SHA256 65c46a469c8d41b91d39efa32e19102125040c5742750abcdeeb0467038b9e91
MD5 312f36ccc10a2375a3e9e96fb7669e17
SHA1 1dbd5dfc8bf59829b607fd9df43306df852cd5f5
SHA512 7bd83a9ba202378dffbd3793d182bd951d41637bd9ff7f12410946c825bb63fddef0dcca93bd4d2b7e8777347b712c727d9712bb27dc61d9b04594c0d28c8b46
TLSH
T138B01120AC008003CC228FB802B80800333C0E8A232A032282EC0820AEA038882A880C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe591061.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\8a20092d-7538-467d-84a7-a149d52c8586\index-dir\the-real-index~RFe591061.TMP
Size 48B
SHA256 dbecb0476af0dffbf2ccce5bc772f4aa27111a000cef9386f5db450746275a14
MD5 f9f596b9a4ed672d1708626c44933862
SHA1 63a34ba4f1e4ed80c2801d5967025123dc06fa95
SHA512 b21bdd361ffdb2b17fc986e4ce36572c0b14ef521461024c9a3649e6a79d4234a8e8b7b02b7b942fd581057f6902b09097e2d561f89c46d530e947922c02ca95
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\aa95758f-eb05-4882-bb06-d445ddbc346f\index-dir\the-real-index
Size 168B
SHA256 60dcd08cb51cc5f607262226dace6708567d2e6ee9f7ad6f04826278c75868f8
MD5 5e9f934aa3c687ca2ac90f73a38f41d3
SHA1 2e173ffb0fcb1c2b312d5b5cfd8ba92ce1fa15c2
SHA512 4cebf88e8b7ba9dd524d41c3efb8f857b4732d4c9aced25448fe6b47deb3a727863e27116ad1da2ea780fe6f6425e3e29678556d3ed77386006852a163bd07a4
TLSH
T1C7C09B5D492D3211D753127D56D64480332899645015572252D74654ACF50575AD7908
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ed1a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\aa95758f-eb05-4882-bb06-d445ddbc346f\index-dir\the-real-index~RFe58ed1a.TMP
Size 48B
SHA256 5f1019d299cef8823d34324acc77c80dff6c63930370c683888ede4aed614f5d
MD5 ad9ddcafce2e50f2e890ab90aa3e782e
SHA1 5c6bedf4bb94e1d1ed034e8c74fefc417778377f
SHA512 f7a2f529d4851cd826338a880ea21be333902017ccc362bc186b5b687a09654693f2fa03e76ff837a618e466f797dbbe55e777892c122302d12c8617d1060076
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\index.txt
Size 268B
SHA256 97ee615f6c59d916a46fe1920ef0b79a738b4ff2615bae83b4776167a7e075bf
MD5 2375c7a7a293a1e109e2c8f4139c4f70
SHA1 0f31e77593c043d64532f21080e3c96134400898
SHA512 86ea2e13c2ef714e93f8e8a0b7920b2ab33189331755cb8ac5aadb8435c8a5d40abfa44a0682796fe1c6e24179c3f95c41314550d0af0f69b95e00f61f809eed
TLSH
T19ED02B9F47B01008BE59CAC1107D701B8D3ABC4A9859EC9015423093797A5215E14DE6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\index.txt
Size 415B
SHA256 a635ef9cfec65c8bd08ac05dcd37b1eadb3f2da24346ad40f02532bc2caa69e6
MD5 714ce1d51fb1a92dac1b624d40913bf4
SHA1 a34a12cc633dc3b37392339d4a8d0a696423d1d4
SHA512 722271f9a925cd62ddd2873524d7e7af07c40d0c663df968e728c3f16bddab0647f2a4c2ec5ff643a1818b8b87b63097102c7a1a8c68955267566e756bb79d25
TLSH
T178E02BDE47E51419BBBECEC41079B06B4D39BC855C599C0819123093757E9115E60DE2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\index.txt
Size 539B
SHA256 030a86a241fd7c147bd9635dd65babe15a1fa60bb79318610f029df62daeaba7
MD5 273d5923e4e38fa08a4db409986c286d
SHA1 da41efdde6ff47eb5b20e805ad89ffc4173e837e
SHA512 aad954aff4df20a9b1bc014e75bf1ae3399b32a15aa794abc3084daaef2bf9cf85863e5a58363618ca481b1a91d2bc1433b190a839081a012f18584979331076
TLSH
T127F0848E03E91408BBBACE840439B11E893AFC41586EAC0C19123093797A892AE60CE7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\index.txt
Size 533B
SHA256 b8e85c9bcd3872fe9a00b2b1dd10b4c16b2981b919f4f7cd8d57c93c1c65617a
MD5 6b2c279a9c56d57ae4e76b1eeb5ab78f
SHA1 bbfd2266646ac222f6b679314ccbaa380d04bc29
SHA512 5255bbb9ac610180a83f171eee93f2da8cc398dbc2d14a78253a09008efc8eaf040494d3d0baba6b98528111789729d54ddc6075ae6aa62e5e53286dead6ffd5
TLSH
T140F0C98E07E91408BB7FCF840479B01E8E3AF881586AAC4C19111093797A8916EA0CF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58b689.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\a957449e0c17def967fb86220c8cab1d9f0a68fc\index.txt~RFe58b689.TMP
Size 150B
SHA256 219c790a862cae05653e43a228c917d523d464fe5f4dd235c39d8fd9a4f1d3c1
MD5 6cf37a1ee56cd80c128f6509d2b4b798
SHA1 f98da06da1d5c08fd12cb8ccfedd8302f225c958
SHA512 36c925de6e2ec3b13fb668f2775a93643ba2473df0a96129e88423e91146de430a2e9b61c2fd9c4bee90c5c6eb203766685c953e5c74de93f292ab8f6323e380
TLSH
T10DC02B2F87B000080E8843D1102E302F8D01FC0FCC51DCC0121032E3B9301327961CE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 4c2083a5ed5d97984e67881db1c5891d9406f1ef97076ace1582567adc60f9b2
MD5 7ab4875b4eabd3e0e94631d63b8d006f
SHA1 63bd90a6ab9b0479b045c1e23146ee6e151e9e24
SHA512 32cff9aa4258af8b788feca8d185cb3e0fe0aaa6972390ba4f1bcf70498838b51d950e69c029aade428e32586fbd1171b833ef0dd6992412bfd60ad2dcb43811
TLSH
T1E8A00294414A2016EA0536B8944951803350E911712913234CD0DEADDDB1641AE45512
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ec7e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58ec7e.TMP
Size 48B
SHA256 d3f26224c1781e2249db4480942c3e084e71b79f701d740bd39c0bf0593569bf
MD5 fd6ccccc5fad980e80454b0b7e723090
SHA1 220fd859010906fb1a4389818ae6e39380a78ae6
SHA512 8847730bd066701a053a8a6838f16cd6e72b83d27cb714642c782d9b0582ebcedf84e8df1d8a87f97bcef46065f2352c6c4c12cc2d682998bdb19893a1f4221b
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18ead6cb5ffb0b4039fecc8eb6f8a621df93b6cad7bae1c6df7d151cb0fb0583
MD5 df4c65523cb989c3167c63fe4fbc2bc3
SHA1 172eb274f2f3edd3d617caae386bdaaefe46590b
SHA512 0b114cf39ab16958777dd6c9a1bde697e9a7d1fefac69024611a33375615e05d828762159f8f81523cc1e7705c498e75e4f57a850bffef1e98daab8637548374
SSDEEP 48:K03pYl5jn7UbHCfISRUK9R17Ux5EYCDZJyLAPGKQ6uvbG9mISivK9+1Evx4/YF25:KU2wKrCee/yK8YbVuKu4Cl
TLSH
T199914010317B2250387E284D85A5876F924231B3B25CFABB7BBC51A55E6BE040DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597f96.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597f96.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 bb681179bc83a3cc72644229a813e64fe0f97623027392e5988e3ac99a823a1a
MD5 a255d76fdd2c9b3839360da5467087d3
SHA1 1060a2b3735927a3eadc2c1f9bd18e3654296159
SHA512 963bbb6b7a298b8fe80904f5fddb78d01f67e19f1ab953eb33ad07d5736c183e6060f70292e52e62139de3b40d03a51358e995c709bdf38a203c4882827d41fa
SSDEEP 384:yiFPZcIo0sNE8TUNTUlIlKLJYUbup5u8irABZgxtgOIwZOyMLVoH:5FHD1wgCQkrAgxXsPhw
TLSH
T1A6C218F248E7987AE8AE4743B77E2D024E7CC067F6849A90B798561CCD965BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 94ec0273675142809629c7f666873acf82119582faf7e555eb557c0fa2f62e1e
MD5 47affec10271756697ba011f26bcc969
SHA1 8b33ab0e1834ed65f89382c0f58d81be2fce4c5c
SHA512 6c7904ead933022e744809434aff854c1327209eaec8ac59b8ebcede86035d6f30a44dcce23fac9cd3d04e94f32a595d9ffbba53a33052c8b0f1dae4256b9177
SSDEEP 192:SONz6iDCQmiUyd2Hq5u88PwuhmwSq7YfHU6:SONz6/5Hq5u8irA46U6
TLSH
T16102F8386C687C7BADF3AD15B5877B135FA4113BE6941F84DAE81A2C01E769C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 5c15f4acaf4a9484a22bbba661353c0ab5603f9c53b769a5fcba6b16a437b992
MD5 0f7c01821402f7436396a160addbfc9b
SHA1 825799ac9b68748a2db5cf59f4867d5087e4cda6
SHA512 215ecf2a06b88ee203cc88ab937982a7ced4bc0fb94754bc8c3e981986146c241d150340d6aeb705e394b36750ba3d497ddb55cc4833b6db907932ed8a821b5f
SSDEEP 384:GZcIhsNMnLJhfbup5u8irABZ4xtgOIwZOyMLVoH:UhDQkrA4xXsPhw
TLSH
T120826B3258B86C7A6CFB9451F58776034EB48527E7C89F84D9EDA71D01EA9E4030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 fa60a40788bfb5f7418b38e0ba6d5005b928168a67b9c7d26ee489baf3c7c78c
MD5 244e4c09e1a12a69f5de2cce6d4c6739
SHA1 6a433b6790967436d0dbd909e07a46585542c4b9
SHA512 324cd0beb54dc2a271f7cc1ef3dc1d3d64a9880a81d7cd745bc04d01963e4e176bc30a799d1c15942c97e840aca03a430e67df12d1143dbbb8ed7378dbf1734b
SSDEEP 384:2ZcIisNMKLJYfbup5u8irABZrxtgOIwZOyMLVoH:ki3QkrArxXsPhw
TLSH
T1DC826A3258B86C7A6CFB9451B58776039EB48467E7C89F84C9EDA71D01E6AD8030B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 a3924253270d78948ea0826b99d1efb150f068ad1db707d1088deab9cc16ee84
MD5 221e4e69002821658b82eb071ca153cc
SHA1 67bc330abab5cd9e4d48b4938ea3651c528a8ccc
SHA512 1e23b599261e9037feb429140e09ea4c0460c1570b5cffb8f880efb340d8bd199275d20dbab08bab9ac4cc806a41b81f7d1347314418e62c894903a2d021fd80
SSDEEP 384:rZcIisNM7LJYfbup5u8irABZrxtgOIwZOyMLVoH:ziOQkrArxXsPhw
TLSH
T10C826A3258B86C7A6CFB9451B58776038EB48567E7C89F84C9EDA71D01E6AD8030A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f781eedd564ffadcf60c56189e94b8b152eefec5f9faf85c094b2f85dc42a7e2
MD5 6ed1beba85920dc424737d6ff24255ec
SHA1 118a56c05517a4aa292dbad0d5a230c3dbf61f54
SHA512 1b732b3a6690477a4b9651339e04730c2f98866b397f6a26e6962a0b5ee4addf549497d6b98b78771f8a4d4cf0074b836807038947891a5c429f6070c2ac9b05
SSDEEP 192:SONd6iDPQmiUy72Oq5u88PwuhmBUohguZrqeU6:SONd6MNOq5u8irABZXxU6
TLSH
T177120B3568A86C7B6DE3A861F48736139E64417BE7886F84D5DC272C01EF5DC5307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 e484954f9b794615eed68247e7b722457b3e6da9a8e8c204f4d41ab8d126ed84
MD5 d73f413463ad2c0275605421d08b7e63
SHA1 ce1289b7e8633e44eb85516005eece34924ca29c
SHA512 861d8d1fb557fe9c9602a188008d6a920104c05c693d0435bf59a502d3224c4a1b5a5ef1aa5ba2de2459c4b2a7c33547a779238759cee5224296fd909bc88a31
TLSH
T1BAE0040117104075C07C033040CF7F1037D3C03140D10347D71011D54C533001D30F41
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58e0b6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58e0b6.TMP
Size 392B
SHA256 57c7881ab021242620b0baa128c4fe080b409d3324e8c8d15e7c84b4ced0cce4
MD5 8119780119872a1bed354206bb006610
SHA1 9626cb51901e65f27ded046fab47bf8252e01219
SHA512 65a130540356337a0f82d7e966e4a77b3a39929897d7eaba38d70cbad5ac46b5b5e3311b7411a43d5af6897f4d3f81a4ed280d3b6ded5c42119fc07ee9a8e025
MD5 SHA1 SHA512

Submit Download

79d92bde-cc87-4f89-bc7d-c1ca70918ace.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\79d92bde-cc87-4f89-bc7d-c1ca70918ace.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b0ff742871b626e2976754e79270f0a5fff2c2915d285a240c245711a4346dce
MD5 0723028a11ba484a8932f4271d97bab7
SHA1 b1f69836a95709a33b1885fe2e4cb83c57084d9d
SHA512 066e3b3f874fe1333a2b00c9233668b08d017c10230a26670e8c79bf1182183871cfc24baadb560d2a5bf847f0b8ca08e3a1f7e714176a2fe221894beb8d69a5
TLSH
T18B412898A6F91108B377BE5AAFF6B86D487AB9772F06D59D00010D8F0663F40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download