c0a6c2f0fefae52f7633e8e494a270510e24e02526764067b5aef3406e2f34c6

Analysis

user interaction
yes
max time kernel
85s
max time network
85s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 18:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
clients.html
Size 29KB
Sample260930-xgppwaff68
SHA256 c0a6c2f0fefae52f7633e8e494a270510e24e02526764067b5aef3406e2f34c6
MD5 5bd85e12bb24f518af64f62ed3dbd8d6
SHA1 0a28131e4b123f90c1d55ccdd611a71e9044e385
SHA512 ed4d7359d75a60506417c8eb395d84aa3721f91372600c8e8e72c97426d7c58d62cd938950073eba5f00a9559e538a78f1e748da28bbfd2cd8eb54ffdac5a016
SSDEEP 768:oUzXnOqc8mvx9xMjBuXNBMsSHXMkDKyqJM44d:oUzXOqc80xMjBuXNBMsSH7
TLSH
T19ED2E86673001B3E6123C7A8F6A5FB789169D349E217DA2CF0BC007A2787E959D37784
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3892	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{B75F9A05-5905-4F2E-BF51-CC8AAFDA70E8}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe
4128	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4128 wrote to memory of 4792	4128	msedge.exe	87
PID 4128 wrote to memory of 3892	4128	msedge.exe	88
PID 4128 wrote to memory of 2896	4128	msedge.exe	89
PID 4128 wrote to memory of 1196	4128	msedge.exe	90
PID 4128 wrote to memory of 2896	4128	msedge.exe	89
PID 4128 wrote to memory of 2896	4128	msedge.exe	89
PID 4128 wrote to memory of 1196	4128	msedge.exe	90
PID 4128 wrote to memory of 3036	4128	msedge.exe	92
PID 4128 wrote to memory of 1408	4128	msedge.exe	93
PID 4128 wrote to memory of 3036	4128	msedge.exe	92
PID 4128 wrote to memory of 3036	4128	msedge.exe	92
PID 4128 wrote to memory of 1408	4128	msedge.exe	93
PID 4128 wrote to memory of 1408	4128	msedge.exe	93
PID 4128 wrote to memory of 1572	4128	msedge.exe	94
PID 4128 wrote to memory of 1192	4128	msedge.exe	95
PID 4128 wrote to memory of 1572	4128	msedge.exe	94
PID 4128 wrote to memory of 1572	4128	msedge.exe	94
PID 4128 wrote to memory of 1192	4128	msedge.exe	95
PID 4128 wrote to memory of 1192	4128	msedge.exe	95
PID 4128 wrote to memory of 3104	4128	msedge.exe	99
PID 4128 wrote to memory of 3104	4128	msedge.exe	99
PID 4128 wrote to memory of 3508	4128	msedge.exe	100
PID 4128 wrote to memory of 3508	4128	msedge.exe	100
PID 4128 wrote to memory of 3944	4128	msedge.exe	102
PID 4128 wrote to memory of 2316	4128	msedge.exe	109
PID 4128 wrote to memory of 2316	4128	msedge.exe	109
PID 4128 wrote to memory of 2316	4128	msedge.exe	109
PID 4128 wrote to memory of 4404	4128	msedge.exe	111
PID 4128 wrote to memory of 4404	4128	msedge.exe	111
PID 4128 wrote to memory of 4264	4128	msedge.exe	117
PID 4128 wrote to memory of 4264	4128	msedge.exe	117
PID 4128 wrote to memory of 4264	4128	msedge.exe	117
PID 4128 wrote to memory of 3876	4128	msedge.exe	118
PID 4128 wrote to memory of 3876	4128	msedge.exe	118
PID 4128 wrote to memory of 3876	4128	msedge.exe	118
PID 4128 wrote to memory of 5328	4128	msedge.exe	119
PID 4128 wrote to memory of 5328	4128	msedge.exe	119
PID 4128 wrote to memory of 5328	4128	msedge.exe	119
PID 4128 wrote to memory of 5340	4128	msedge.exe	120
PID 4128 wrote to memory of 5340	4128	msedge.exe	120
PID 4128 wrote to memory of 5340	4128	msedge.exe	120
PID 4128 wrote to memory of 5724	4128	msedge.exe	122
PID 4128 wrote to memory of 5732	4128	msedge.exe	123
PID 4128 wrote to memory of 5740	4128	msedge.exe	124
PID 4128 wrote to memory of 5784	4128	msedge.exe	131
PID 4128 wrote to memory of 5784	4128	msedge.exe	131
PID 4128 wrote to memory of 5840	4128	msedge.exe	132
PID 4128 wrote to memory of 5784	4128	msedge.exe	131
PID 4128 wrote to memory of 5840	4128	msedge.exe	132
PID 4128 wrote to memory of 5956	4128	msedge.exe	134
PID 4128 wrote to memory of 6060	4128	msedge.exe	135
PID 4128 wrote to memory of 6060	4128	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\clients.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x218,0x260,0x7ffc599ec188,0x7ffc599ec194,0x7ffc599ec1a0
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,2538081947288026526,4012331858511777412,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,7398458026868920709,14817033360974872512,262144 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,10968099153593957915,705659568753859040,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,3858220617144572180,13671147545439260388,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,2097749029958046015,430807495549036831,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,15873369381205968563,3423225357391276176,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,9652896304258446853,7325172088262442045,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:2
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,15159787077694079872,14920265578769122718,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11325838763178773874,5223049459392745534,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10128474261976332750,3824041516722232932,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,10128474261976332750,3824041516722232932,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,6056771410682227286,820287505410708704,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,16511846555505254574,3396627810252975467,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6384,i,14776044242895782309,11715204262726466378,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6704,i,9268704554561580899,3301998500600113646,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5912,i,4589948650030725278,16015514342494750260,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5996,i,17974934142385703010,11832216204644196511,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,13181788820656202044,14967527263150591066,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6912,i,12079316828085927958,451890125137030937,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=7104 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,12077679858808821351,13431803196051534637,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:8
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5488,i,6098628523982517465,17783189927109628957,2097152 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:5784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,13841964178730555220,4899496278079749551,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7232,i,6608986002799423538,338590828073364488,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=7264 /prefetch:8
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7344,i,7308973637876895249,7179852204574496686,524288 --field-trial-handle=2420,i,10478560297573491584,1954202057494266213,262144 --variations-seed-version --mojo-platform-channel-handle=7216 /prefetch:8
  2⤵
  PID:6060

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

38064f72-fa9e-4a48-91ea-39cae5d7e074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\38064f72-fa9e-4a48-91ea-39cae5d7e074.tmp
Size 8KB
SHA256 f3f722ddc5728b4692793952d6e80cb775bf437796adaeff8e41c11183457b7d
MD5 f2cf5f9b10c669c42be9c5d63a9aead6
SHA1 ba49913e17c613d8d95f5d680f7b461de7b751cd
SHA512 a06e0d510c7542f7d6f4198f3077345f5d81039356d45e70719af225b040811516bff7c649564d2232c8978a40da8b82a7883e1e700251d8efd00467e66f2a57
SSDEEP 96:KqONk0QsjpfbUmjH5ih/cIPURHl8h4otop5iaDwXBKP4v+Y1xf//ojdixHeYMyww:BONU6JUm0QmiUyPwRso//gyw3BCp3U6
TLSH
T18402D834BC28BCBB9DE3AE45B48777239FA4107BA5951F40DAD91E2C01D755C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 63b3e051645c9957f53c538586c3b5463f3ba4412c230d66eb66f06ad6052604
MD5 0070abe22a07fb36149648973e990688
SHA1 c8a203457b36afa6d0ce9b56d26cb7817d832d37
SHA512 cda9b7179f6f997dac4ee0624ff9f92ed77b7c27218584fb07f6b2ebc24d10fc25d45c3d2781b766d834f82054e29ee150712e7ab7d7a11465c468d0f8a31fd1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

835dce82-698e-488f-b615-f89f64a57cfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\835dce82-698e-488f-b615-f89f64a57cfd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 70KB
SHA256 099283ae22f8b2b9c1da13caa9546118d0eecd5af95e6cb26e1f5ed3d08a6f51
MD5 c53d3b22475c62b82ebc332c7d0a4915
SHA1 b7a4b057dfe4eae94abb6d3697f0c98dd5e54389
SHA512 e60bcf776a00ab20379e5912764edfd0eefb5cdacf1567980981c5b8d750d32b053e8081e9d01c522982fd55ea1e7a4979eef063e39dc71673bf4b7c33d51939
SSDEEP 1536:Ul5WDuixkL3zZGeDT1YPy0b6sse0TVbGR+M82lJgB4ugy:q5TeK5T1sHb6sQTVIDigy
TLSH
T1926302B14A447F961E01F995BAB7128B8DC60E26C78C7B29993F023D77C9785B08DB12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 417KB
SHA256 60de8a09eee268ea0f738ab70b7a881e3f2af3318262bdde789cf5e39a4c8ef9
MD5 bb0f21962981dd5843ed85a7400004bd
SHA1 b8dd6e01077017ad030555c754c822106bc5bd74
SHA512 6209bc71882d224152e79509f1f96ee20a9b13089783bfd07f08aac2ea4384a181d17341eb2b58548333b3875d837edbf3680edcc2c5e0402b2f58189c817c9d
SSDEEP 6144:SdOCFk5XjsWsP089QFeUVki4rBP1Btp3fEMGPzqFeEMJL4F13AqSmmxT5mCMl:Sdatp89QY+ki4VJB3MkQqSMCo
TLSH
T13D9423D27B49770923E6E0F567DF3EAA7B50C5879D1B21899253F906A6F2F371020B10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 4937ec69a7a420c1d26ada8fe3592995cb6891d86b71fe0e710bb88c729e5299
MD5 284642a025b04162750bca4d1b4ea261
SHA1 f6588b8920fc7b419931c34782e32cec51cd847f
SHA512 a7891a123372edc2724d696a24b3fc81232b93665e442f8a046eed9ca7540d14d73192f8a371f98c8c156be1688b3c31c8010852ac90836e2865f4440800fd02
SSDEEP 96:Dkbgt0ZVpxcueQX/jBBzvlk5KRRVjntZk1jILuizgQ7ewI9:DkbgeZVpaQdBzvdjn+fizgX9
TLSH
T10DE1C88360D882D1EF0AD374A0E9C947763A2031114B7E2AD4A2E77A3F73B949DC1B75
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593d6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593d6d.TMP
Size 3KB
SHA256 94d7ea5bd18f6fccce7b91cd86f7c982bec0e05c91a83126de8b28f365771111
MD5 9973efa1ed817f75db312ac3deffad07
SHA1 3c2a257d147ca0573867e602965458dae7124fec
SHA512 3b51fc3c91962b833af2fbec1a196251d213a83219c5e0de40e833c2239343e36e74926f4f78ae3fecf6c74b3a6aabb5de5949cc6c8188440a586f6516831b3d
TLSH
T1A6613D8051E0C0A6EBA8D671F1F6928F3928A571458FAD5A20E6C9BF4B4FB5CD3D50A0
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 0c9254cb2f2c4094c4e6a8e584b0859a4563d4cb9e06b4c87ee375275fc318a6
MD5 0e3ccd6b750d9aa02d9502268bc25e11
SHA1 539eb5d8b7e305b5707e245445d3dc35cc1c4d0e
SHA512 5e17c212038c9b5af34cb76be4387ca9d25dbe9953facd13216cb0d37489cb38e7e27dd3bd3b9a5b4ca597de7e5e41ce693200590f79222a8f3458a080cd25a9
SSDEEP 96:DqORZseX2KPHzBcGO5HzRurBGsviEBqr1fv6GwBZ:DZRZseX2KPH1c75TorBGsvigqrpv6GkZ
TLSH
T1F5B189F7C3E5826DDD1156F09A18AF1BCF2D0556436C3C4AC4D4AF5BA3F24A1E281A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 47fcbcccf768650c9e7ee322e26e1a71acb38ba0af4c6f1e4aa0ac70e7db12f5
MD5 133ed75bb29d3113ee725f14b3b77fd4
SHA1 6f43458678ec7a44610de33fcd849cc0b41f70c5
SHA512 f288ab923b4e13174d1d0b3eef1fdf4f1e177eab12babbd5b8bf5000dbd8a48d38674f569ca046b3e4195cee9ed459ca545a8f9f17d69eb48aee77dbd6849f2d
TLSH
T1F7D0237313047076D99C9FD5805FFDCFD76740605802DDD422D1549C093145C1547140
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe58dc9f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe58dc9f.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 adf297375c5392f4c9be58fea8124f9130e6646815b5a759cf0cb7c559d14ad5
MD5 de3598029a1215ca23f08eb73bdabd73
SHA1 a63032f08465a008b722e95d49d13e8e76f32ca6
SHA512 7b82eb05cbe4ea7f55136c94d8d4ca0a8e81949a831e9c84335c518c88bcf31f5d3d64aa33dd384c6d8aaf2ee1b2e6a028a862ac5a4d877aea217fffae535e65
SSDEEP 192:sxZnRVMOO/ftsi1Gb97dpmMlHW6+WNBzA/Y36Y2IZIgr60sL:sxZnkOO/ftsi1i3XHbm/7c20sL
TLSH
T14742D7526A28D87B8CC7D619BE35BF12D6F910739D951E4CAAFCC51C04EA6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1ec19758fa3c68b3d1933b07049591ce915df57c8f2ba394ead8183eb93ffcb6
MD5 88161cc9cc950032794233bc58fc666e
SHA1 9564c1532c8863d9a6fefc88463464a9bb362154
SHA512 bb5ab6137123aea7f5b1c9d4e437bbedb450f16f45004860842ba38428c56d227848130b4d52ce9f1c2fbca2e0642ea0ac7b229162c259ab59e48b7b8f6636a2
SSDEEP 384:sxZsmmWO/ftsP1zbdzHbtn9/7Kc0sHTN0ss:s0mmWO/f0ztHbTJXZ8
TLSH
T1D172B6A26524D8B78CC7C618BD35BF12EAF954639C954E4CAAFCC90C04AE6FD2207C57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 ae6c695720dc582f8f244746410959268a04ebae71cc5fea4843ab78ca1ba43e
MD5 c4d0112800c7cb19514c38b0c224cf12
SHA1 26f910c0370311adaa1feee5249e54a5d398f8f9
SHA512 88ef6170059a6c82e189a6710b2b09a388bbb01451fae45e215007d6dc392d2d29cbfbef103b1ba88ef2f07aa9d5567e27fa0be866018c498090a2c71122102d
SSDEEP 384:sxZsmmzO/ftsr1mbdmHbV9/7F20sHTN0ss:s0mmzO/fMmgHbfYXZ8
TLSH
T14A72C7A26524D87B8CC7C618AD35BF12DBF914639C954E4CAAFCC51C04AE6FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 f68473b4cbeaa7543469d65cb37f760a5c2e800b55d824daa760f98f4d9930b6
MD5 5f2cb5eaddcbc9f29de2b1bc54eb482f
SHA1 36fe36c9c43be7d37016afabe7d41054d44dbfc3
SHA512 757afce046e325793219ce202a50206d8360f74219dbe950f1c6ccbd4dbde3c4ea579492e8f5af40885b818a7b15d71e9476640ae7027a806c5414982203b734
SSDEEP 384:sxZsmmzO/ftsP1zbdtHbV9/7Jc0sHTN0ss:s0mmzO/f0znHbf+XZ8
TLSH
T1DB72B6A26524D8778CC7C618BD35BF12E6F954639C954E4CAAFCC90C04AE6FD2207C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 48a92f88fd46bcad73ac2edef8991cb47b1abff33d8824f04dd52e1b44050be5
MD5 ed32f232030548f44496e976eb7d5543
SHA1 88113a52b90543dd6fdbc996fa729ba0424620f8
SHA512 7c4c9f1e2656ffbcb4d067364fc0428f3146e76f587f3d5926265385746ef5c37ecc4d39341f0b16ca72018537ba2339bb316ccaa1655a568c2eb83f681e3db2
SSDEEP 768:rnKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/srob3:rnKlm7QWvUYe0u1ja8/L/E/3b3
TLSH
T1B3C2FA3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 cf1b32839bad0a7a8a410d234b83565e26236395734787504140bd0673678284
MD5 b8e9317d5b6ebe875421ea58447ea342
SHA1 7e513404710fa9014ea751d68de3eaff531ee2cb
SHA512 455c1d868cc8a362b65c6cddbf8976cef5df9a34c633c3ab2134239691b3736f3bb5cdaf6e5bec2d785ebb334db45b84129d1c6ff5869fc96c9b62b50c4edaa9
TLSH
T1A6A0022812E004A2C90313B279DB52D22310E9200245233BC19E034CDCA0545AEC531F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\16ab426a-132e-4002-8b2c-015bc0a100d8\index-dir\the-real-index
Size 72B
SHA256 a690113dbafc87891516a70f3d4e85626bda5f0ea88abc108a582aa815e8c7a2
MD5 74cda3d8feb84d551d06991c3820e21c
SHA1 ee48ba263283519fdffcd6a314d3613f2b070760
SHA512 fd96baad00dbefc995abe513349b077beb847e419d0acc6b262536342524f4eaff0a4a323e50bb0419c4fb38e460ed371f977c5bbd0bf1f66c5012fa4b7f6136
TLSH
T1ECA0029023B5605AC02611F1566247411300C921152123C740E1586DCDA04404FC300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\97197f9a-9b9f-45b1-a9e8-697375751dd8\index-dir\the-real-index
Size 864B
SHA256 91145428e87bfe2949ac8797f34e92f176650ac4fef2b2f60bc0b12fc2feaff8
MD5 0c40035b9dbdf1890e0e228996cc24a2
SHA1 a7e78a171670821520b89db4a93984e8c70e9d8b
SHA512 0c95ccdbee69007a6775a82ea4eabd4e2cc788f76009640773359d0b9f3586d4c98725bb4b5a0de8bfaec892d5e1b8937a60b6eba8ce90b0e6d01bf45a900a35
TLSH
T13A1102970E535F17EC440A75A43CB989A67042DC62106A9F51FFC02E8C92B84AEC0298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\97197f9a-9b9f-45b1-a9e8-697375751dd8\index-dir\the-real-index
Size 3KB
SHA256 d78cd92af5a0c82bb4d9a3733a81a0b44194aabe408cd65b8c9cf0c1ece6a400
MD5 9718b99b3bfd9725d48e2728b825a274
SHA1 f1c753cb613c73d3dd5f96968a0e4544fec41c14
SHA512 941c749dd31eebcc723cd620c46c60ca695df9ec634f4fbe94b664c1551477583895eb328d796027016dda62eca1f5647ca603f68df097ec4df0924a3d26fa0d
TLSH
T1DD51D80B4E031B1AECECA97204B6041937747DDC5B980D2B64FED538F8837681E98668
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589361.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\97197f9a-9b9f-45b1-a9e8-697375751dd8\index-dir\the-real-index~RFe589361.TMP
Size 864B
SHA256 99638acd375adcea98a2f58e43439e3d49103704e4fca151467f3b83c383f9c8
MD5 5ee3e89b8e16ca49461047c33aacc0b6
SHA1 46b00f768262bc1aeacf402dbf03b6fa5ef8847a
SHA512 26d02213484c8501889d0311a98d34d90bf91afb8b2d2d21c68ab6cd8d838f27c1585b104e20cba0b4a434cdac8cf9701d16a19730ea37ef8736908ba4dd6408
TLSH
T1031147E501538B46EC840370DA3C9956717542446344674F93E7E115CCC2B846DC2FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c33eeafceabec7b7e5e0ce2ea6e77776fdb9b149052fcf5e44d2f9b932f53085
MD5 2bb655546bef6832424d9b614663e8ab
SHA1 5c4dac56cc9b5f9d0c6ad650fc5e826abdb38635
SHA512 03be4c4678e07252fbeea3428381e72b23fddbf9cf2fdbd3a9dd411b409a2a66d7b54edbf3571d82e07f591e54a6c8fd5566aaa45c310ed000fe97811f8bed06
TLSH
T14BE0C0B63DF32410EDBFE7D6243168B00040F844D415FC1E142DD9C750B33057019C22
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 bf9b8dc2d7d2fbbb3f48c1dc389192cf23252b7c73c3598df58765e7dd19ddf9
MD5 b0c586e89ab8eeed4f90cc8a769a43bf
SHA1 70bc061057929cc117887d891e491e337dc7f8ac
SHA512 2159669aabb28f14ad9bf3d8d47fc3286bf1de947da12e0d802d1edb57ccb20add3a4e1b3c39012dcab3e560553787bcded97a1ae8da04d699ce54fe677d462b
TLSH
T1ACA00251ADA88149C8A44278B16203C476228CEC2609229D51AC21659E563B54993806
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58eac8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58eac8.TMP
Size 48B
SHA256 7eb1a54118ec28b4d45a691272b976db3af4e5025d5d5b0c788f635c1478ada0
MD5 5a1555228f7920f0a31b5ea7bf3739d8
SHA1 038dcde2e048454f991aa30aaa000a84aeaa7d45
SHA512 3153497de4d4ebf3fb7c3db72640922d56d9bbc1aeb828d1e267184f55982818aaa191cb26183858e5a84a39e4a269b8ddd3b9435158aed98276d812cfb99228
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2776ccfe23c9cf3984f2e1e0d4d36eba3e8dda164efefa40219bcb222355f130
MD5 670175f04ccd505688090f9a29a2abb5
SHA1 2126ddb499f2aa09281cc08034dd66099d6f16e0
SHA512 d39f8650795f0d6a04c1ee422d4f3bcab834f62b9b865ba37d9f4510d06ec7c42ed88fdf4a06e522c995350acdc5925c652075b285efc866493f3b6905e7a70d
SSDEEP 48:K098xN/rvQbjWDISFQK9F1nQxVAYGH99yLFk51Hznob7+7ISNoK9t1foxt4Yufb/:KMWEKbKmKSMKjCs6UK7qaC
TLSH
T158911514307B1291387D354C82A5DB1E46817173301AFA2BBFBD40659EABE5D0EFE9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46f72c82-eeb5-4617-8e07-0ddfa336b09a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\46f72c82-eeb5-4617-8e07-0ddfa336b09a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f7d3642816d558d35a064c7d8dc6f05daa5e05d7014c48ecba11bf9f1b7c883e
MD5 c8579853a1993f942b4c7d2f78336a18
SHA1 bd906ed093b5024518194e72d08205aae874a35f
SHA512 1aeb313f62c95336548a73ef651f427ac45dcaa3ac0c6d33c094537175c3be8f5bc313c974aa4fc4a43a4e8a7a129f6dc0b1308794e6d9707bc22dd3d1220bec
SSDEEP 384:2ZcIhsN3M4TfYbO76x2h//kTPAAJtgOIwZOyMLMoG:khWV6xG/PAJXsPgB
TLSH
T1A6828D32ACB8ACBB6CE79295F04776038E7484A7E6C8AF90D5DE6B1D01D55A8130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 338d6d6c72827eda9cb5c04b8905b06da2f89185c257274894c9b5d18b424a50
MD5 8dcc227ea67bf94f013356128fb6931a
SHA1 50cb8ad723252a81e7da6680858b7feb3721c3a9
SHA512 48ae10e3df70a023c6de534665e886a256d39cdcac64f2ce2688138695e3cc3c1b2eedde6627b153a309d1525d02edc3ee766677d767646f7aa69ef462e58bdb
SSDEEP 384:giFiZcIqzsNJ8TUNTUlIl34TfYbOF6x2h//kTPAOJtgOIwZOyMLMoG:7FQigwg2v6xG/POJXsPgB
TLSH
T105C219F258E7887AE8AE4747B77E2E028E7CC063B5849A50B789561DCC954BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 f0645be84a9665ef11c5c002fccaf9b4ce9c814ed90cb4f61f8b7fec9bcb3804
MD5 243b838b93c9ba71a8248c7a7d351b78
SHA1 c273aad1711342b4928b4531d28fa96d835cfc32
SHA512 ca2b509bed6d4791446490ad6319554a8866e9a37f74451894a16920e8c1aa16fa0cee1c98ad1ab27e4c36b91d9925018c27eb7d2b9466e000a7e0f18ad4d67e
SSDEEP 384:vZcIhsN334TfYbOi6x2h//kTPAAJtgOIwZOyMLMoG:nhxg6xG/PAJXsPgB
TLSH
T1DB828D326CB89CBB6CF79294F14776038E7484A7E6C8AF90D5DDAB1D01D59A8130BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 92ccfed7f313e0b1ad6c2271a42469550d4fad8d4120cbb87a08251b80f27bfd
MD5 9d8dc4fe1995621cc69b7e8bfc4e4de0
SHA1 860419082b8e3b0ed97c58b29d73cf4acfeb3c08
SHA512 2c17cca9cd2c072ca8b29729a34074dbd4c4d7b757858302d390bcb0aac5b4bd47d6cd07c8328ac28bb0fa5d4d3e36b81b89a9ff63b3ca02d78b60c2e4c10cd7
SSDEEP 192:BONa6JUHQmiUymwRgo//gywTPA5HNxAq7U6:BONa6+pGRgo//kTPALJU6
TLSH
T18A120A35B878EC7B5DE3A595F08336239E644077EB856F90D6DD2B2C02DA5AC6307C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 853984e8cb15780a00dc5fe62566050a62ca76ef79daa8a734fb410642ad92f4
MD5 0b68f687e151e81dcedcec7c09dce2ae
SHA1 1f90360d71f123c1abda82363e040dc9bbc756ad
SHA512 06d4c76642ee537a7fc441589c6dd143566690bfcef52f794a7d884b9dcda5ce154e85d4669d307d347f27a6cde080bedd5b72063d5ae96749628a70cda68de6
TLSH
T171E00407534004F5C01C033401433F105DD3403011F301555F3011540C333003D70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 d4324f6ddefb665338a115c56b09e2861885c3444c7215f8439db3463ae71ede
MD5 7c5386e46d1830ec27be7021a5e5b9bd
SHA1 8fb479321547acfa1e649b0245fc29e48f94a7df
SHA512 e3269793bf8ce756fce2825d9fa270194b85a01d8a2623b6226cf427e0869884a56cf3ea946caa1549145de044e984abb120188b7f6a032999f93a5cd618780b
TLSH
T1BFE00207534004F9C02C033401432F205FD3C03011F203575B3011580C333003E70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58c639.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58c639.TMP
Size 392B
SHA256 1fd585ce0e2e4cfe0afe62ae8002ffef58a2924de2a6dcb049f3e6586f0282b6
MD5 e20c718c4e516b270e8f6e363255057a
SHA1 6edd093d6f7012a082db953b7427eeae4945f918
SHA512 a185a674ad7357fe25cd91a9cfacd5911184a8930d171414bb4a6305ad9f35674df1bd361b5d5209c7da4c47d39dbfea090f35a5167a5e97bbbad99b6af928c2
MD5 SHA1 SHA512

Submit Download

1dffc71b-6ca7-4dab-ad5e-571104ebe5f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1dffc71b-6ca7-4dab-ad5e-571104ebe5f5.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5687a3007c5d4fec4455a5dae39023cb84a912a2276a166d72382d1826e545a5
MD5 58c0f3f49f09303acec65da4e24948d6
SHA1 10920d9dda3c06b11d46876376aa49f5fe6704dc
SHA512 97562bcf27184781f7d12e8334e02985067a5ec003db3a733d656e56aefef88d9e47f57ec3a200df3e2e44619a802b69bb38e386118c535da54afb96438c0e8d
TLSH
T15841F658A6ED1108B3B76F46ABF6A86D887FBC372E0A945E00110E4F0662B40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads