hxxp://crm[.]klasseuno[.]it/hub/ntl[.]php?id=SHwzMTM2MDkxfDI1Njk4NjIyfDIzMTAxOTg3

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/10/2026, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://crm.klasseuno.it/hub/ntl.php?id=SHwzMTM2MDkxfDI1Njk4NjIyfDIzMTAxOTg3
Sample261003-vbss8stv7j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{5B2D51BE-0013-4AD5-9D95-1D59DB1A1EE6}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3562044790-535044693-348086427-1000\{CF7A05AE-CF8C-4553-8B17-4E05DBE75363}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
584	msedge.exe
584	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe
3908	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3908 wrote to memory of 4256	3908	msedge.exe	80
PID 3908 wrote to memory of 588	3908	msedge.exe	81
PID 3908 wrote to memory of 588	3908	msedge.exe	81
PID 3908 wrote to memory of 588	3908	msedge.exe	81
PID 3908 wrote to memory of 3348	3908	msedge.exe	82
PID 3908 wrote to memory of 2116	3908	msedge.exe	83
PID 3908 wrote to memory of 2116	3908	msedge.exe	83
PID 3908 wrote to memory of 3628	3908	msedge.exe	84
PID 3908 wrote to memory of 3912	3908	msedge.exe	85
PID 3908 wrote to memory of 3628	3908	msedge.exe	84
PID 3908 wrote to memory of 3628	3908	msedge.exe	84
PID 3908 wrote to memory of 3912	3908	msedge.exe	85
PID 3908 wrote to memory of 3912	3908	msedge.exe	85
PID 3908 wrote to memory of 720	3908	msedge.exe	87
PID 3908 wrote to memory of 2064	3908	msedge.exe	88
PID 3908 wrote to memory of 720	3908	msedge.exe	87
PID 3908 wrote to memory of 720	3908	msedge.exe	87
PID 3908 wrote to memory of 2064	3908	msedge.exe	88
PID 3908 wrote to memory of 2064	3908	msedge.exe	88
PID 3908 wrote to memory of 4536	3908	msedge.exe	89
PID 3908 wrote to memory of 1144	3908	msedge.exe	90
PID 3908 wrote to memory of 4536	3908	msedge.exe	89
PID 3908 wrote to memory of 4536	3908	msedge.exe	89
PID 3908 wrote to memory of 1144	3908	msedge.exe	90
PID 3908 wrote to memory of 1144	3908	msedge.exe	90
PID 3908 wrote to memory of 664	3908	msedge.exe	93
PID 3908 wrote to memory of 664	3908	msedge.exe	93
PID 3908 wrote to memory of 664	3908	msedge.exe	93
PID 3908 wrote to memory of 2408	3908	msedge.exe	94
PID 3908 wrote to memory of 3260	3908	msedge.exe	95
PID 3908 wrote to memory of 3260	3908	msedge.exe	95
PID 3908 wrote to memory of 2408	3908	msedge.exe	94
PID 3908 wrote to memory of 4016	3908	msedge.exe	96
PID 3908 wrote to memory of 4016	3908	msedge.exe	96
PID 3908 wrote to memory of 4016	3908	msedge.exe	96
PID 3908 wrote to memory of 1188	3908	msedge.exe	97
PID 3908 wrote to memory of 1188	3908	msedge.exe	97
PID 3908 wrote to memory of 4472	3908	msedge.exe	98
PID 3908 wrote to memory of 3568	3908	msedge.exe	99
PID 3908 wrote to memory of 4024	3908	msedge.exe	101
PID 3568 wrote to memory of 3308	3568	msedge.exe	102
PID 3908 wrote to memory of 1316	3908	msedge.exe	105
PID 3908 wrote to memory of 1960	3908	msedge.exe	106
PID 3908 wrote to memory of 556	3908	msedge.exe	107
PID 3908 wrote to memory of 2064	3908	msedge.exe	108
PID 3908 wrote to memory of 2064	3908	msedge.exe	108
PID 3908 wrote to memory of 584	3908	msedge.exe	110

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://crm.klasseuno.it/hub/ntl.php?id=SHwzMTM2MDkxfDI1Njk4NjIyfDIzMTAxOTg3
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x294,0x7ffb6ac3c188,0x7ffb6ac3c194,0x7ffb6ac3c1a0
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,4620320258269566530,5966757581443017618,262144 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,10502843438275139014,14543848671346228199,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,13366110264825156315,12246340944356544945,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:13
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,13005462662030964739,7472837551693219138,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,12502682950060496852,629566086911131511,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,12310880792318435898,12621845725618741910,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4084,i,6308616401360303881,13400385673959492631,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4116,i,12710382336868625649,6405011149809325145,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4136,i,15776780644330851917,12605922148069294546,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:9
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3568,i,7515655233515646691,7376741115910485,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3488,i,5729138068625352555,17068830678032181058,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,12420059808468559741,8779599774472883588,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:14
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5216,i,14879014067304698686,17955584027394641149,2097152 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,1641512702737617023,15596250856207951135,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:12
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,593965945625471957,14037150367589231,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:14
  2⤵
  - Modifies registry class
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,11201958426478308304,6116748749239826416,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,4474213033034841604,7532533596304794121,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6948,i,4474213033034841604,7532533596304794121,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=6960 /prefetch:14
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,14546126707570789841,16660728714443237728,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4904 /prefetch:14
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6960,i,13740315076140469182,6671618869486415170,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:14
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,6765600851486866159,9816939064537765675,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:14
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2844,i,15325115550806642531,34059867696949204,524288 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3944,i,16210248119382623350,4214580863140619326,262144 --field-trial-handle=1940,i,12856697061870405312,7956538240127121030,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:444

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:1784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

071480d4-2d86-49ba-a7f9-81bcd5cdf13e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\071480d4-2d86-49ba-a7f9-81bcd5cdf13e.tmp
Size 21KB
SHA256 25f1b113396ea08e6e880ffa58d99bc52c4b81dd594d9549651e6ca39a3f498b
MD5 e718222af946be5021a69c8906d6832f
SHA1 23b0a1eafab5a0f677779046f26222d8823fccf8
SHA512 12a6cc6fe19ff7c523b3c45b078d06dcfd54826f7244cb8f217557e4fe8b5a2954a0b1427a45b39a0adb906675b11ea7075681e6057aa9b768f74f4dafdcdb55
SSDEEP 384:Z3iFiZcIm8NY8TUNTUlIl1l2fM977T3za1sBri10gWtgOIwZOy6odo8:ZyFQmJwgQfM9quXgWXsadf
TLSH
T18FA26D3248A88D7FADFBDA44F54A3203DFB48067DAD5EB54E6DD6A1D00AB1D8130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a8b8221-8cff-40e7-aab6-85929b482570.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a8b8221-8cff-40e7-aab6-85929b482570.tmp
Size 8KB
SHA256 58103b305e279d9a9ae0323abcdbc02d912a9cd397dd789162e18f6f18794ae0
MD5 8033ae9cc2d3d5e10e11938eec943003
SHA1 1fe35de9bbfe359fc48bd6c0f17f422202843167
SHA512 797d358336b643f9fc4b900632e05633525de4d808a257c725844896dc68d0adf9b400cdaf8551252fbac5edcadb3701412cbfae26266bc06ada1ea277f51ac1
SSDEEP 192:GGNR6GeFQmiUyQF5H9e7q0ki10RwE1q/U6:GGNR65jHrH9Bri10LWU6
TLSH
T11A120831A4A8AC7B4DD3E955B0873613DEA0412BEFC56F54D6E93B1C01EF698630B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

261319e5-ab9f-48fa-bf77-248b9a0db08b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\261319e5-ab9f-48fa-bf77-248b9a0db08b.tmp
Size 12KB
SHA256 3c06cc45b139e937ec879aa2c52680d30e5aa89d6c0f4a0b2b246148b7f4c619
MD5 7251e6bdaadf6ae92046b626a32db607
SHA1 276c4749816321261b1826b6e16fb28cedc37b7f
SHA512 40f2a1a2b34f0da3e6033106f7ab50c5fb22ad6b8bb09eed242922c769551665875f35802529c8fb776399b6fa3f91db320877a99ecc24ca9e1d525040e7c03c
SSDEEP 192:ujL8NoCQI2nfM9ce7T3ZQmiU1Bmnq4se7q0ki10Efp1q/Lqyl:s8NoCl2fM977T3zu1sBri10wWXl
TLSH
T159423931A8B59C7B4CA3E555F00736139FB0806B9BC86F5895ED6B1C01EF298630B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8916b88a-1b88-4bdc-ba04-932c7c7b1a90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8916b88a-1b88-4bdc-ba04-932c7c7b1a90.tmp
Size 18KB
SHA256 840c03c73141ed647cf280afc77adc0c9a5d0b32c25b1f5e6342b19fd56882d7
MD5 28bccedd1e0c13eaa45dc35314e47bfb
SHA1 091e8c743a54fe473d3e0125cee6f9c4c44f46b5
SHA512 17c359e06c33cd8dd32d028bc58d4ba8c42f19f62ddf41d1b082218232368f14ed3e19347e4a2b5d0f0a03f9a7e9a8a337393b68044f4d7fe1b978926661d53d
SSDEEP 384:VZcIh8No4l2fM977T3za1sBri10wWtgOIwZOy6odo8:thtfM9quXwWXsadf
TLSH
T19F828C3198B85CBB5CEBE544F08777039FB4802BABD99F4494EE7B1D05EA5A4130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bc97280e46f7440a45ca3d2a51a46ccbb21ce65970031831397544d067fcd39e
MD5 87f523fa1a8097da3fde9c71dbb969ff
SHA1 7375fced196b7c9cce63a3345a696821addfdc92
SHA512 a94bf6eafa51a7b6313466d304e63e375b1cea0b04977cfda8012d4caa95bc0dd63b71901be89e02b766b5371ccbfa9869b8ff1599483dc18a36d6c017ae936b
TLSH
T1E4D02B18C5FAB5A2C0372938112A4309718CD01164431200D0810591084335B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c159157b0e79e7b46a891e8afe68807c4e711f82964d04b80dcddf1d39eda259
MD5 94dc53892052e6d2db9f8b5550a4b43b
SHA1 29ebe8501640ce4b863ac0649c205fa162e24128
SHA512 5e174dd65b7b3514eefe1aeddfedb95e15f93bea92c1841942e97f8d717b896b0064539e74f7bb947e9e6a169d4427e3dfb7aea428ac47f5f7ef07fce464f22e
TLSH
T16DD08014C9FABAF6D03B257D02354705719C955365431305E0810D550D562C706E1EF1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 70982429a94c7f5dd6771982ccb678db478417c7823f5314a8ce85f4a72ea496
MD5 dfb696b1e6808f46315e2c8c5c490abd
SHA1 eed8ea23066b3749e52e643f4324c70d274c6e27
SHA512 746adb56bac7e6958650c3d0d518b5083955a4fd952fc98e6a5d9afa120b58ed181711f9d8797d55a5873c62e5525749aaaf733913575d7e6f10d2eba443d3f2
TLSH
T129D02B18C5FAB9A2C437293811294309718CD01164435301D0810591084339B02D10B0
MD5 SHA1 SHA512 TLSH

Submit Download

30f354ca-01c5-43db-82c0-11b5e5094ab5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30f354ca-01c5-43db-82c0-11b5e5094ab5.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

31c07004-7991-40bc-be01-d561c892b801.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\31c07004-7991-40bc-be01-d561c892b801.tmp
Size 10KB
SHA256 bcc827013ab4d6859130eab8571a41d3bb0b5eda5463a3b8c9663e78d4cafe0b
MD5 da75e6d2fec948ff1bb452f47e98abf8
SHA1 d74cb84199856e926dca33d05bd81353735a6b94
SHA512 d2e99d814ce4dcbcc98c41fd36a222466895ac58e48c2aa63b32311e2d1a9db80cd3f322614bbfc30cce555074346d1112010e27ff82d71a3f4a8e09e60d8052
SSDEEP 192:sxZ1RYbz/fAs2DaIdpzSh3xs/W6+WNnHzXY0tw0MXIg5zJ:sxZ1kz/fAs2DzuQ/bTX5JGv
TLSH
T13832C9526E34A97B8CCBE219BA19BB13E3F9803195D40D9CA6FC951C08E77DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fe57231-388e-48f8-ac6b-e03dba450816.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7fe57231-388e-48f8-ac6b-e03dba450816.tmp
Size 11KB
SHA256 75016073d4084d49ec6cbdab6a2061d6abd6b6597092a6b9a0604a8af0306471
MD5 f31e9efea0a1bba0e7d87c706f8b388a
SHA1 1e3281b6bde4a854692794daab688581fdf914a4
SHA512 f559a73a3f7fba65d55ef49aa8f8633c055b9f5a62af00129c4a37fdd56c114be6b35fd2dff8eb4d74f6d3b5fb2bb811697e37c1ad04d0b62124fe7cc6213b9c
SSDEEP 192:sxZ1RYbz/fAs2vaIdpRSh3xs/W6+WNnsytY0t+0MXIg5BJ:sxZ1kz/fAs2vzMQ/bvt5HGx
TLSH
T10032C8526924A97B8CCBE219BA19FF13E3F9903295D00E5CA6FD951C08E77DE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82d787d8-c448-4326-ac43-9abbd4c60da6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82d787d8-c448-4326-ac43-9abbd4c60da6.tmp
Size 10KB
SHA256 dadf7631d78686c35cc2ff6c2be86e447dd5ad72bff5ad1fcaeb45df7b61a157
MD5 55b4db3877c8f72963a48cc924a26043
SHA1 d7e596b86d25f2f9364ab77afaf05ae2d3c6cb76
SHA512 78ef957e1cf8505eb518318ad5389f68cd5df439a33e8a59b868a0f00af2d38ba833ac2807ff184c7dff1111b3c9ff723feba34f3dbc845dce14d37473aa4fe6
SSDEEP 192:zZ1RYbz/fAsODGEdpzSh3xs/W6+WNn8g/Y0tdiMXIgrJ:zZ1kz/fAsODZuQ/bT/5yG9
TLSH
T1FF22B9526A34697B4CCBE219BA25BB13E3F9803295D50D5CA7FD951C08E77DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e71881f-4fce-4e4a-9563-76af0a9e71b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e71881f-4fce-4e4a-9563-76af0a9e71b3.tmp
Size 28KB
SHA256 0b92d3809855b5241acfc187b1036ee58f001fb21490b6888ee4eda23efe5395
MD5 bc7fbc843447cd30bfe396b20eab6fd7
SHA1 79a6886bdd3f5affbf3dac1f4665d50bcd886ea8
SHA512 551c41cea7c5da70ada1e9618bc20bd9f050a705d8f75b686bdfc49d0bb23ec97345139114721cfd395b566de7c2a043d14a0b2f7f83732fbad7d3caade657df
SSDEEP 768:sjWwy89q2pdWRm1rQ/78F1+UoAYDCx9Tuqh0VfUC9xbog/OV3nQLl/CE0Mo7ronx:sjWwy89q2pdWRm1rQ/7u1jaKnQLpClMJ
TLSH
T1ACD20B3F240CCB7E4FC05A6DDC566F976E9802C7A6648D4087FE894C02D77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c51e6d8-924f-4cde-910e-b4f497a9a6f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c51e6d8-924f-4cde-910e-b4f497a9a6f9.tmp
Size 11KB
SHA256 c09a6d1df65a11025c5022e18f8bff7fbfdee3eb19a5d521644f1a9def2ea689
MD5 434080103c05a7aff17fe62b1055f4e4
SHA1 5e01c2a801134ebaea735addc2f3a8edb767bd40
SHA512 068c5ea92a16f9dcfbb4f7b08c6906032ab6721d0adbc2a5879f21bd2a0bb0f16e6483de2d31e85f45066bfc290f389660aa0753572e676c5ea5f040958fe1d3
SSDEEP 192:sxZ1RYbz/fAs2vaIdpzSh3xs/W6+WNnEjVrY0t20MXIg5BJ:sxZ1kz/fAs2vzuQ/bgVr5zGx
TLSH
T12E32C8526924AD7B8CCBE219BA15BF13E3F9803295D40E5CA6FC951C08E7BDE220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 789ff518e4481ef0bf5c445925b04db17fa49c4d43a773a82c25440ea36851fe
MD5 1ba1d5a726a7d4363012cecc523c0f2e
SHA1 5513b03a78e4bbb17b26fbd542634bfb0ea6fedd
SHA512 1992a46603072d468f8eefeb1e78785ffe7a0a3b88bd471f70ef61d715aceedd7517b4948da12d84a0412628817da77d0c6f828b34229cc6813e1cb04689c432
TLSH
T1D871C6B292B050FDF7E5B430A4D594473B3C2A8179C35E4324A6C4FC6C8AB9B52B7214
MD5 SHA1 SHA512 TLSH

Submit Download

2ba5e71a-644e-40ee-a94e-b3387ced648f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\2ba5e71a-644e-40ee-a94e-b3387ced648f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 245KB
SHA256 215f727e64e0027ecdbec6c5575059d858a26aac6013932b9222f0e93fca37a5
MD5 9d25e411e322b00f52784d921c21e206
SHA1 27eb39eb3e05fc29b325e67bace5ef8383eae993
SHA512 d7d3a58785e5f17a8b73361b8b68b56df62254b8289b7da493995506b11e40aacf7cabdb1e0b53c05ddccce948301d8d88c43881668c29eecceb5897aa4ad8f7
SSDEEP 3072:7OBOxcKg/tB575f5WR1BBgO4gFYKcpjbD5qP2+rTAtbDNqK:9gcgdgYhT7
TLSH
T1A834E85871A772E5A02F83335903DD16E3355BD8D6483096B8B27E1C26FBB443AA077E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 26653a636fa6fc28d86a4ab1686b85c187f061125c61f04f937f275a125a847a
MD5 ae824d8b934b12d4975a24e369e6c5d2
SHA1 f9e6011915738add26f5e4f5191de9dde1fa2ccb
SHA512 aa596780d7d37833777dc090b90b13931c5b39826e6c00fe826dc79f3e5b435bb88ab207f75d5f4578f754fcf1ab73d6d9b74be31cbda69fbbad8589db37232a
TLSH
T168E0687C88C8C12F612820DB04347B0D9697A61F97CCAE991F45D800744B488D02D160
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

680ad4bc-5205-4edb-a3b4-2d32997c3f53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\680ad4bc-5205-4edb-a3b4-2d32997c3f53.tmp
Size 6KB
SHA256 6c3ef8598d00f10900b8ae94d13ba568156d1327273eb031b1fa9b85d96deef7
MD5 d372a11c62ac281a3e39f6609dc376e7
SHA1 b5bb96775f538e5ecc1d6360d32ad9421e9e4040
SHA512 9214f7f4c6b4286d537472aa7e5b06d328ecb790249dad971dc1d637a912989ee46311129e52bf81838dadc959e3499e088646bdbc3988e895e1e02c6d677eaa
SSDEEP 192:DGYJsGtMrItgZExcho3v29bh3XyHSzoLy:DGYJsGtMrItgZOcho3v29bh3XyHSzoLy
TLSH
T108D17CF2C3D8C22DEC1116F49A583D1EEE2D0E2483683D2ADDD6AE4B93E5071D351A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

976bc964-b72f-40f2-a0c5-0eeb29fd05b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\976bc964-b72f-40f2-a0c5-0eeb29fd05b5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

ed769fc5-e06f-438c-848d-94d36366d688.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed769fc5-e06f-438c-848d-94d36366d688.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85e7fac4-457b-4315-9dcf-c996d234bad3\index-dir\temp-index
Size 2KB
SHA256 22281a09807f45f9ef4e783f387bec62b2018cfb66b56e1d74d99ee953199765
MD5 36cbe44b6233e6649d2d735998b567f9
SHA1 bcfcf09bc3574b526fe74c107fe10a7c424ec8eb
SHA512 88a76655d850d3280aa2fb4ed60520fe2d784642466874c2cf012bcec24bde3659a90e1aaaf24db5334a9ed8f0fb0519e1ceb7d67319e2b5b377da437377271f
TLSH
T1BD51654CC990679DE87551FD1DA415F253762C38FC59C3A18194B1B130136641B4B9FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\85e7fac4-457b-4315-9dcf-c996d234bad3\index-dir\the-real-index
Size 48B
SHA256 c16c6056e3008a402eff356882925ad9a42b58d129ea9bea4cda21bf8bb58d91
MD5 f2b9cabe84322f34417a794007136910
SHA1 816e6ca8d2e81fe3c3a7f8c9f5c5479b129a1ac2
SHA512 11ac1edd4067aa352e0a768da0b636a23db6cf9295675c206cc41e0e50c5bada29573dc522f3d47ea8d592727b20182b67a66bc9be9bd5bba64b3e3c9aa2fc3b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 137B
SHA256 e38598976de4d8de519ca21e7e6a99f891aa6a60ce0916a9104c751493ff7653
MD5 bb7715b1d00dba9aafaf5549f1b6f2a3
SHA1 db01f92372eb3b679fbea8fb9fb6582688a1edf3
SHA512 8cee441c666b6cfc86b1fd29dd03a90f7108bed03abca2e012c873ce41f84889421f853c7f3f4d5256dd458a2b8bea67c9e50e970b95cc4669697e5e9791686e
TLSH
T11BC09BD3593446874B71E6C460346F6D951B8D4DDCC0DDF4D44670463074917C405F35
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 132B
SHA256 904782ea6377615602183e99a8eea716256baedc35e95984c07507053883b613
MD5 b4fb6404434284a239cd1a8ecf483a96
SHA1 7425369f16880dee19f7de80eac3d476c4112d69
SHA512 cf666c94f9760b56a158abd03e9ebc0fcd38b68063e24872625b504abd0690c870c911167bd2bf9e386f7cdde5ea4e227cee8b6eea9bc9f6508afb09129bf5db
TLSH
T12DC04CD2592446864970E6C420246E2D951B8149D8C0DCE5A845508631649168401E25
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 214B
SHA256 a89608be781763a0ca82bf724cd139e3ad5995540c52557944244e1e45895789
MD5 78b6b3341ca9542e940bbd2bf8e4445a
SHA1 00838ce7a3f2fbed2e6cca7c97a0b2853d590ce6
SHA512 eb70595f12923d4bd82043ba0a8dba02e0e4d973a91f826e83546bca9e4781db3a919cbef7d4ecb03f045b24aef5955b074f63dfc7e4b225290b1162afe51a24
TLSH
T147D0A7E24632D5421930EB842034555C411A8D09DCC0C8E54948708238B4612D106E39
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt.tmp
Size 130B
SHA256 03a27ac13b792dce294de9c9c5aaabb7ef5fcb1747e379cae626503e4729f340
MD5 c6d1ebad5a43e507c2b31b4941233b0f
SHA1 bbe6db639f5ff5fbaaf1436ff0ce4703b330c608
SHA512 5efe407ffa4c28b08eac782f89ac9370bf64befbeaf0c559ed6ec393f646d16ffdd1fc21103ea609014b08346288c9ea5e9f6cf2cd886fb95abfe35f031cf1f7
TLSH
T125C09BD3592496874974EFC420346F3D950B814DDCC0DCF5944550463075917C405F35
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 30f0abb09706b8b20c2114ac19d1255b7878f332534de195739b60acb9e3c726
MD5 11264baaa377ce7a2f401c9b69f6aec3
SHA1 25e28a1ad1ba2f246b478a4e30f9fcacf01505c4
SHA512 f449883b0ea3221419b803dacd9f58934779e3b8946951ab33a48eb868a65cf30d7620d47aaf5cf240c10046745d1e007fdfe14ee7a71818d8ffaea4b7b0bc79
TLSH
T184A0023D13948562C42002F0D85221ED7720889501121311D0EC84D4F950180652A508
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 edf52a2280ee59f0ab8172910d9a2731bc9bfee863569a83e254777426b9853c
MD5 729f4b3ff8c8ddd2360fed10823ca170
SHA1 5d271f4baff1d3b9cf46c97a56a6f6af2b77f562
SHA512 125a3b2aa29841d94b1956b8fbe7b4452e4d07c177a8d7205944deb0e2b1db3f917f9540a6b6abcd80ecd2b70d3afe3733f65131f108cd4ab8d6ef645cf90fb9
SSDEEP 24:KtQrTCVsatkk+O0O4lI3u+KEthsQ+1i2uSQE6tq+fyXHIb4M6IxK4h81yS92VyX5:KQRIVKyQo/ydFIxKu8UjypmIXK7KAk
TLSH
T16C91FF1630BB078139BD750992B89B6B424271B33018EE2F3FBD94625E76E084DFD6C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dbcfa2e8-17f2-42f3-a895-870fb299690c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbcfa2e8-17f2-42f3-a895-870fb299690c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73223f05-16f6-4892-b894-5893334f527b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\73223f05-16f6-4892-b894-5893334f527b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ba30fcab-8251-42f7-9228-23987e1c95e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba30fcab-8251-42f7-9228-23987e1c95e3.tmp
Size 8KB
SHA256 b94836f96b833d768a6e7d818ce98a7b2514d6e5d0cf01ef51164a3a6a5dab03
MD5 f9c150eb3eee1737db44fc9fea1109b3
SHA1 368197fd2da281319b54274b5087fecb01a69c02
SHA512 63f2c8c921e732e1dd7c9c0ca0985742049589d8d080f54e5c32a6770fc305d8f576fc20e83d22c71191f7462f2333edd14b5871625dbf66bb03239f951a5fce
SSDEEP 96:DqGNkOQsjpf4eEE325ih/cIPURHl8h4otop5U1iD0mB3PnvQixdZuP7inyib3Kx9:GGN66GeLQmiUyME5/9e7q0z0/MNU6
TLSH
T11602E934A8B86C7B8DA7EE55B4877713AFE0102BDAD16F44DAE42B1C01D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c5c958b3-bdab-4b1a-a85c-683da449d026.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c5c958b3-bdab-4b1a-a85c-683da449d026.tmp
Size 18KB
SHA256 70dfadec44a37bcc0fd4dae1668718dad7bc9e669ed802c59e7ea9eee29c72eb
MD5 f9ac9f8b146550175016d37abf884d61
SHA1 40e17009fb7bd615b1e83c3ab1b9b3580fa4bfbb
SHA512 fdba522108dc5489103dd1e339a325e4c8b84d94a1b2a5800e6d56ef69a5441163104c35c6d5e1f7bf7e95944f6c96282dbc8acbc253c86b6fc1406efdcc237f
SSDEEP 384:NZcIh8No1l2fM977T3za1sBri10wWtgOIwZOy6odo8:VhOfM9quXwWXsadf
TLSH
T101828C3198B85CBB5CEBE544F18777039FB4802BABD99F5494EE7B1D04EA5A4130B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eb30942-27d6-4093-b6a6-c006a627bdbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8eb30942-27d6-4093-b6a6-c006a627bdbe.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download