hxxps://www[.]googleadservices[.]com/pagead/aclk?sa=L&ai=DChsSEwj4m9-Q0s-XAxVVUEgAHa3XMmgYACICCAIQARoCY2U&co=1&ase=2&gclid=EAIaIQobChMI-JvfkNLPlwMVVVBIAB2t1zJoEAMYASAAEgK6B_D_BwE&cid=CAASuwHkaKaWXI1B4eRklWqTmGLoywUdA8pFf69h7Oijgaqlz5dNC9sFXL6vcLJIf6kuzmKtBV3G3C21ILopOQDlsy_sI-SLpKNNHMNBZqFhoOaF06NKJ36JoXpsZDuXXB3DTf0EtE5t5ay-KyDhoLpefn7Q54l6aivSoc-PF7S4rP9Tz609w0v6RgYaJ0n5NRplsPYYjUbPetKGxItnlMEAts26aMQRuqouiDSk43q3PsJvdN9oeE63v7tUpZKb&cce=2&category=acrcp_v1_32&sig=AOD64_2EGReF2He3oINEW480RisYZmYZpA&q&nis=4&adurl

Analysis

user interaction
yes
max time kernel
1049s
max time network
731s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/10/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChsSEwj4m9-Q0s-XAxVVUEgAHa3XMmgYACICCAIQARoCY2U&co=1&ase=2&gclid=EAIaIQobChMI-JvfkNLPlwMVVVBIAB2t1zJoEAMYASAAEgK6B_D_BwE&cid=CAASuwHkaKaWXI1B4eRklWqTmGLoywUdA8pFf69h7Oijgaqlz5dNC9sFXL6vcLJIf6kuzmKtBV3G3C21ILopOQDlsy_sI-SLpKNNHMNBZqFhoOaF06NKJ36JoXpsZDuXXB3DTf0EtE5t5ay-KyDhoLpefn7Q54l6aivSoc-PF7S4rP9Tz609w0v6RgYaJ0n5NRplsPYYjUbPetKGxItnlMEAts26aMQRuqouiDSk43q3PsJvdN9oeE63v7tUpZKb&cce=2&category=acrcp_v1_32&sig=AOD64_2EGReF2He3oINEW480RisYZmYZpA&q&nis=4&adurl
Sample261023-2ach7avy3k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1808	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{08DCD323-89B7-41A9-941E-5AFA76A5CC9B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-686476835-2493921010-524562731-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2916	msedge.exe
2916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 3928	3640	msedge.exe	85
PID 3640 wrote to memory of 1808	3640	msedge.exe	86
PID 3640 wrote to memory of 2676	3640	msedge.exe	87
PID 3640 wrote to memory of 2676	3640	msedge.exe	87
PID 3640 wrote to memory of 2676	3640	msedge.exe	87
PID 3640 wrote to memory of 1464	3640	msedge.exe	88
PID 3640 wrote to memory of 1464	3640	msedge.exe	88
PID 3640 wrote to memory of 1344	3640	msedge.exe	89
PID 3640 wrote to memory of 1344	3640	msedge.exe	89
PID 3640 wrote to memory of 1344	3640	msedge.exe	89
PID 3640 wrote to memory of 2640	3640	msedge.exe	90
PID 3640 wrote to memory of 2640	3640	msedge.exe	90
PID 3640 wrote to memory of 2640	3640	msedge.exe	90
PID 3640 wrote to memory of 2900	3640	msedge.exe	92
PID 3640 wrote to memory of 2900	3640	msedge.exe	92
PID 3640 wrote to memory of 2900	3640	msedge.exe	92
PID 3640 wrote to memory of 2588	3640	msedge.exe	93
PID 3640 wrote to memory of 2588	3640	msedge.exe	93
PID 3640 wrote to memory of 2588	3640	msedge.exe	93
PID 3640 wrote to memory of 2856	3640	msedge.exe	97
PID 3640 wrote to memory of 4072	3640	msedge.exe	98
PID 3640 wrote to memory of 2856	3640	msedge.exe	97
PID 3640 wrote to memory of 4072	3640	msedge.exe	98
PID 3640 wrote to memory of 1324	3640	msedge.exe	100
PID 3640 wrote to memory of 220	3640	msedge.exe	101
PID 3640 wrote to memory of 220	3640	msedge.exe	101
PID 3640 wrote to memory of 220	3640	msedge.exe	101
PID 3640 wrote to memory of 416	3640	msedge.exe	104
PID 3640 wrote to memory of 416	3640	msedge.exe	104
PID 3640 wrote to memory of 416	3640	msedge.exe	104
PID 3640 wrote to memory of 4316	3640	msedge.exe	106
PID 3640 wrote to memory of 4316	3640	msedge.exe	106
PID 3640 wrote to memory of 4316	3640	msedge.exe	106
PID 3640 wrote to memory of 3196	3640	msedge.exe	112
PID 3640 wrote to memory of 2700	3640	msedge.exe	113
PID 3640 wrote to memory of 560	3640	msedge.exe	114
PID 3640 wrote to memory of 4508	3640	msedge.exe	115
PID 3640 wrote to memory of 4508	3640	msedge.exe	115
PID 3640 wrote to memory of 2916	3640	msedge.exe	116
PID 3640 wrote to memory of 2180	3640	msedge.exe	118
PID 3640 wrote to memory of 2756	3640	msedge.exe	117
PID 3640 wrote to memory of 2180	3640	msedge.exe	118
PID 3640 wrote to memory of 2756	3640	msedge.exe	117
PID 3640 wrote to memory of 3088	3640	msedge.exe	119
PID 3640 wrote to memory of 3088	3640	msedge.exe	119
PID 3640 wrote to memory of 1804	3640	msedge.exe	120
PID 3640 wrote to memory of 1804	3640	msedge.exe	120
PID 3640 wrote to memory of 1588	3640	msedge.exe	121
PID 3640 wrote to memory of 1588	3640	msedge.exe	121
PID 3640 wrote to memory of 2128	3640	msedge.exe	124
PID 3640 wrote to memory of 2128	3640	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.googleadservices.com/pagead/aclk?sa=L&ai=DChsSEwj4m9-Q0s-XAxVVUEgAHa3XMmgYACICCAIQARoCY2U&co=1&ase=2&gclid=EAIaIQobChMI-JvfkNLPlwMVVVBIAB2t1zJoEAMYASAAEgK6B_D_BwE&cid=CAASuwHkaKaWXI1B4eRklWqTmGLoywUdA8pFf69h7Oijgaqlz5dNC9sFXL6vcLJIf6kuzmKtBV3G3C21ILopOQDlsy_sI-SLpKNNHMNBZqFhoOaF06NKJ36JoXpsZDuXXB3DTf0EtE5t5ay-KyDhoLpefn7Q54l6aivSoc-PF7S4rP9Tz609w0v6RgYaJ0n5NRplsPYYjUbPetKGxItnlMEAts26aMQRuqouiDSk43q3PsJvdN9oeE63v7tUpZKb&cce=2&category=acrcp_v1_32&sig=AOD64_2EGReF2He3oINEW480RisYZmYZpA&q&nis=4&adurl
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ffa2893c188,0x7ffa2893c194,0x7ffa2893c1a0
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,8363491869539647371,5879924876357928062,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,5484893075354082884,13033272850411073072,262144 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,9922343798648589772,15476247156176856453,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16661448062602191887,2576073078215570586,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11707132071696442092,16756352161995181354,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,282963380797664429,7947802863748120735,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,2150767296392946560,9334431359609405792,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,16625926105444417892,11066987276230718275,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,5902847521596311194,5115992896016638608,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6074156236691324166,12619184797019027823,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6074156236691324166,12619184797019027823,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6156,i,13298016880305622793,13262646425372142129,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6312,i,10177980264220469021,4710997954144177443,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6476,i,10643182126808961470,13028696698130187190,2097152 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4928,i,13281699106594858078,16037746005381766734,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,4885522674187653039,15433072582635106305,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,3821565878149949555,5991051018808926351,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,13963027201459310033,9433909826214483660,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5724,i,4190782462256303114,6073999678113252601,262144 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10516043947996876144,4286877347100818919,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=3932 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,15238208513481782416,13782790655991294492,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,6027209150776695995,15164272704314454104,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,17659970932449581112,18053415543011427479,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6820,i,4754393988357901061,10844199563823072293,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,554857736063309442,16395047130160576366,524288 --field-trial-handle=2248,i,12095521810163411678,16345265701191782526,262144 --variations-seed-version --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:2128

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2788

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

007ef3a0-2ac0-4034-b6db-d297bccfa36e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\007ef3a0-2ac0-4034-b6db-d297bccfa36e.tmp
Size 8KB
SHA256 78e74c5506839015cf1996091e0a779355eb3f5f6a6696ba8549c3a9e4e7c28a
MD5 31fe963d4e93519d1922427266b971a2
SHA1 8f0094b53e80fbb5fabd898a786e3ae499e3fda5
SHA512 00d8e8c9770af86333b44a1aaa8a15370b337c0daa62fb6cf0967e87a1d492c17f5bca6f3fe83da6409f90f0eb4c37e5c41f4b030f3bc752b51c1b27c23673a9
SSDEEP 192:QON16xGMQmiUyCfgD0hZ/1TEXjzoeHX6e2PwoRq23PqO8U6:QON16UcZgD0hZxEfhHXkYoRLX8U6
TLSH
T1EE12F836A868AC7B5DE3B594B48B36435EA41127DA897F80D6EC2E1C01DF69C130EC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55420088-8bcf-4f39-995d-9288a78ff69c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55420088-8bcf-4f39-995d-9288a78ff69c.tmp
Size 18KB
SHA256 17ff7e635cc3566e94ac18f96629cdcb0183a60a3cea6b447b30d058aab0b5c0
MD5 7b36945b28a621a9357625cd05ed65af
SHA1 011738dd8aaabd92a26054ac1fa7456c1794ac6d
SHA512 3e5393787397d670cabd86e2cfd172d0e2b99093d656b69924ac278a889dd57f1ec70ffac36237f750afa595d84f78233bc8d4b5b55765b09192a7233f690512
SSDEEP 384:qQkUSvKsN0kQNTwBtAS0hZxEfhHXkYoRkX82IMMtU2IIlW:SK9Yx0JEp3k+s5ZU2Lg
TLSH
T143827D36A8B86D379DB3A650B58A36439EB4901BD6D41F90E6DD3F1C01CE2DC234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77d7de88-d533-461a-8847-e96f51ccc373.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77d7de88-d533-461a-8847-e96f51ccc373.tmp
Size 26KB
SHA256 7388cd6113e4b2cc534ed19f691adbe9ef17fc3326e08d48bb89e47d41667aa2
MD5 244e74adb180d24e1c35bbe76e27f3da
SHA1 1cbff75f4d9a39dcacf18cd3f65eef8a5c667a00
SHA512 e16dfbd4c4e02976834da66db432a9f64362a80727712db5cf74435fdae591ae17e10992281dfc0fc17ce0e579aae46df02cd2d98ffb85a72c804362db0908b4
SSDEEP 384:JiFzQkUSvQ5sN88TUNTUlIlkZNTwBqAS0hZxEfhHXkYoR6X82IMMtU2IIlW:gFdCVwgKLx0JEp3k4s5ZU2Lg
TLSH
T121C209F258DB993AD9AE5743B77D2D038EBCC017B5905A50F3981A1CCC8A1BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81a6d1fd-b67a-4c50-9bf5-6f1c10996184.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81a6d1fd-b67a-4c50-9bf5-6f1c10996184.tmp
Size 8KB
SHA256 ddc73ef421087565757e834f7a04f0e2f0c381c9e914d1b7ee25ac409bf68560
MD5 7e6119dcf50f84f13ebaca0f32661eb6
SHA1 7b3e369d5f3c814a346d0f1f8ab5e7611bce963a
SHA512 d6ab6123993d2dc648ab1cad8970c6d587642e56e1c1ff7b6df80c61f19b3581eceeda9c37d5cd8a0639ebd5f64580be2904e666e49fa5793f9258cd0d889723
SSDEEP 192:ZONj6xGuQmiUy/f1D0hZ/1TEXjzoCicWlU6:ZONj6Uq41D0hZxEftOU6
TLSH
T11F02D935BC686CBB9EF3BE45B58B2B135FD4102BA6956F84D6E81E1D00CB69C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d9557cab-ccfe-46d0-8766-1ce780a0666b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d9557cab-ccfe-46d0-8766-1ce780a0666b.tmp
Size 105KB
SHA256 70186446beefb5f52a8af72dc666f019127ca772ab346b24c242d8d83b3dbd41
MD5 8d16574ea95ad59e658fb6fff1145f82
SHA1 42a86208229e0acc976e3871eed70b257d3c129f
SHA512 ebf403f83599040727e9e64202ac06775ca09653730607a6ba8c761b4cae67d1081bcafb880105f893dabfba290a649f0680da526b9ba72be3a3764ea147eb6e
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T154B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d689794363e91be4e3d40432af9279354599c0ed54686304040d6a59b7db7829
MD5 e58de714840f6fbee1d39b033a0ecbc4
SHA1 6054c414731b3c89cfe5db86fc27446e671d1a22
SHA512 37ad74e09d90232881592dacb5df5c06d03990c25addf4022be40e82cd44284af1f9d402c761a7ce19d1fd4ced4b43cc1d009c97c0c7726a148487574a01097e
TLSH
T17FD09B54B7599D90D456647C17214701758DA9145513E103C5E112D55C86FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb99b812e0f26496acf7edf8450c7e883ac93e161575fac4f8049c4bbb09dbdc
MD5 92a1815fe5f806ea550dc57373648623
SHA1 7d7c74ac6b25be926d5735733d65769dfa013948
SHA512 8c9be61577e3db490af35f3f6d0968eb947e1058b31432a80348469b982f86c545376176b95332b1cae6dd1db830b221e4aa4c2b602e0a7649bb73ce9732236b
TLSH
T1C0D09B5477999D90D856647C17214701758DA9145513E103C5E112D54C87FF241D50B5
MD5 SHA1 SHA512 TLSH

Submit Download

352ff15b-030d-468c-a30a-d3b17df77f62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\352ff15b-030d-468c-a30a-d3b17df77f62.tmp
Size 11KB
SHA256 3f9566a7f32c6e9c1e3d622732a5dee623a35d6d07657fa48e9dfacee503d105
MD5 35ab4f260e9a4a973e0b0b42aedf5a7f
SHA1 a82132d4b6b0a2b1deb3e544b32f1fec510efb6a
SHA512 29c7fcb2cba62980d723b5fcca907861624fe28f32c98edb2b070e0903442c585d1462a815a4b73db24edf5c8dfdf53ce902566d8ae0b6fed29b606547cf27c8
SSDEEP 192:sxZ9RtWD/fQsG2LIdpXNJliHW6+WNznHlbJP/YrluJCIg5iHJ:sxZ9KD/fQsG2UYHbBh/mE
TLSH
T17B32B8526D78A97B9CC7D209BA55BB13E2F9503295D11E88F6FC8A1C04EAFDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6328263d-2aec-458b-8fc3-b3c895028111.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6328263d-2aec-458b-8fc3-b3c895028111.tmp
Size 10KB
SHA256 0fff7cec3ddbea3ca40eb3b958f00df0aae755566581735bcad167a0c87b53eb
MD5 380bede1c97e0b58d37215018e1d6eeb
SHA1 2ef4f1fc9fe963e4d7f3cf08623c81ff61fed4e0
SHA512 a5416eafea6f0d568d63ec57b39d068130bdc8a5211a1559c21559d5c03d012c67133cd6c4b3dfac81ce830b8a6a23a0dcb8fb9331f1a6ea934ffe241e85b230
SSDEEP 192:sxZ9RtWD/fQsM2LIdpXNJliHW6+WNzcJP/YrySJCIg/HJ:sxZ9KD/fQsM2UYHba/vR
TLSH
T1FC32B8526D78A97B9CC7D309BA55BB13E6F9103295D01E98FAFC851C04EABDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90d5c3e5-fcf4-442b-af20-559c3cc530c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90d5c3e5-fcf4-442b-af20-559c3cc530c7.tmp
Size 11KB
SHA256 30854c0dc3f0d1a374385c12bab5425e5a511761b310519298ed757afa0ad005
MD5 22b9cee5198323c75bb893c11edb6930
SHA1 e2278c3022517321328228f0b2e08906e0ff2403
SHA512 6b7b9c43fc137d63d966da1d32d939a9a797d53e87fcf53b738b73c028fea63408c4166272579e8329880f9875f60fb2893a9f0f73fb738257fe1abc0f4732e3
SSDEEP 192:sxZ9RtWD/fQsG2LIdppNJliHW6+WNznQvtJP/YrcNtCIg5iHJ:sxZ9KD/fQsG2UeHbsT/kE
TLSH
T1F432B7526D78697BDCC7D209BA55BB13E2F9503291E11E48F6FC891C04EAFDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 ac632b2d499ed18bfeb214e08a964c184ae3d3e6b4f6fee4e1a8d8d7154c6843
MD5 15c26a3e52db029e45cb9a25f5a7aac3
SHA1 7b161993d94c26c4324df4f15c6d7ad58365c0d6
SHA512 7f64c8b69e7d51d2520282d05cff06e3706f631842306ea33327168ed4be58674d8f54ac6e108dcbb7c9f5844e239445dcd6bd273f5a5edce40f72e8d77e98f8
TLSH
T136E020865AE8D31DB284644B026CC30C8F81372BD6C5AE5D5704D5957246044E681964
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f9cca1ff8b21b1dd1c8ff915badbd394f84802770a92567f103b5c9a91dd5042
MD5 633906039bbd90b878eb4c66efd72208
SHA1 fac07d5c5eab816b68dfe4f32b66db85c21e7133
SHA512 15a830bc00f1bb5eeb8fcfc913b49c86467ac4236ee8b0a4c10eda106e399d976de833b4fb7fe97171ec148f4434fb577cca4ff44e623d3c0cf265d5bff0a384
TLSH
T13CE0DFC716C8C32EB3886447027C430C8BD1273B93C16E9A2700C9857686048A387AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 77b35af9cff86e8e72e684a86f7bfeaba6ed226fffaff5b6f6cdc105f202fc9f
MD5 b4a129964c60b8e5eea97c00db166ee2
SHA1 43a290b5aec9bc9b1b0f0708ab920a5f86c065e2
SHA512 75e4a75db1a2e40b42b8864c0020afeb970952ae489a7cdce126193b76576ed815dcfd03c76ed48fed06ee5d651cf5d1fdc19239d99bbc412df329ba455a7a34
TLSH
T19BE0268564CDC32EB24C644B026C474CCFC02A1BB2C06E9E1704C98977C609CE6C6AB0
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000ab

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ab
Size 348KB
SHA256 af63cbd3cfa3905bcd7e43f3bfc69c4c3ebb61919044975828afcf6a070fca97
MD5 5336801d8462622355375779b2b9320a
SHA1 b1171630a50cdfab20f608785eeb5352b14a524a
SHA512 45e201935b534878c9cff59b6758d510fd87618960f8c67284a85b8fec2209122c85ee139c6bfc8e6744d875f1d05fe0e0a285f96c89961261235ea4e0c40165
SSDEEP 6144:94smwf96c20H6QCJroM4CGGue5Hcd5OEcBDAA+TtWFfkdklAyYmL5NcrcfzZSxRe:dmwf9XvlCRofCLdUfcBUesalbYmLsrcf
TLSH
T1D17423491782FA92BE0C6F5629C1D642F345BFF29667271C19841835FDAEA460BF00AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 31KB
SHA256 7819fb152d169476dcbd6bda3c8e793de9963da264d1d2da48f091e9a45198d2
MD5 33369c6165919d56b657319cc07d8b01
SHA1 1cf7f13b2c8f5b415754871d0e5d14da2a88bb39
SHA512 6926f6c80c57961833667ccc094398f95eddfb258ebac1a15385117f9e8d751c08f084d30accaea8fe4a4a871f193bd422afbb86345ccf915fee361f7869eaa0
SSDEEP 768:PGNeRyKtgIBhx93MpZpozef7V2kk2n5r/U6IQOsZvsC0IFPC2G3291i:P+xugM93MpUzefkkb5rcY5E0Pu291i
TLSH
T160E2F160DD55229EA414CA11C526C33D44EC0912A98D6E91C748875BCBFF5AF3A2AF5C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 67e08e79244ae28523af5d67e0a3cddcbf48b10a4cf13c9c8868c9c2b11fee1b
MD5 cd7d383102522a3d790d9cbad8d6d8d5
SHA1 4276bcd8518bf980179baa4a4ede8db1512cf7da
SHA512 a35ef1f81c76f7b667010609afbb750301461c188aea33255995553aca384b62f3b9a0125d602b9790dc804655833001f72c4c55be3ab5ed2efc267a6e267f0c
SSDEEP 96:fVeuaiAt4I9pYuxFWJ4Q+1BN8Gd2vGfaeJo+w2iXeF9i8+dX+z7arSkWK7G+quOL:9DaJthSuxoJ5+1kGdAGfaP2iXeF9p+dW
TLSH
T102A1507728A04F54DB6EC27E44DC04C23E3059982CD3EEBE6358D93B9786B9C6982C34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6546374672d2709f1721fbb94a499b1dd79ee2fa0e8145f1fbb6d09f724cade6
MD5 6faa1bf548737975cfc6dc5721fec692
SHA1 732e7f36fb096607ef459b4e641a1b34b9f67113
SHA512 0c7dad366f1e963b6af49fdb80b3a535ecd04e4965500cb402a1c6bc22b481ee084bdf058b8dc6c6502933e6ccefe229b90e9eed18a44d1dfc51ede883a421a9
TLSH
T134613C7B06B04CA8EBAC427E85CC01833E3156942CC3CE3E2598E47F9B063AD8582C74
MD5 SHA1 SHA512 TLSH

Submit Download

eb5cfbf7-d9d0-469f-9433-8dec08dcdcd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\eb5cfbf7-d9d0-469f-9433-8dec08dcdcd0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_motorcredito.com.do_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

22889387-d60d-4785-b7ea-d61bf3266873.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\22889387-d60d-4785-b7ea-d61bf3266873.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

2ec27172-e9e0-4c5b-9551-c18da196e07d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2ec27172-e9e0-4c5b-9551-c18da196e07d.tmp
Size 9KB
SHA256 9069b1f7007cbac8968dcaac53690e07cbd3c5dfa39f421da6505b7e0af7c760
MD5 3f9f4eb97e73d3d11c56cfa02703e1f9
SHA1 a49df05f9143d004f185cba804ef28e4d82e9f56
SHA512 26690bd48232dfba6e99e71231d8cb081e7781138db8c0ccbd4fd05657b148390388e112f95f3ff4de738b3ddd96ef00c8d7f1ffd27e01d0ad2fca0ad4893a3f
SSDEEP 192:DWZHlykJXLlnxddVcldZx4K1Z7h6UHta0Y2vp3Y90vIpUqonYYA6UIeHDkdsU2G/:DWZHlykJXLlnxddVcldZx4K1Z7h6UHtN
TLSH
T185127BFAF270826EDB1155F0A529BE178F1C182C035D3A1BC6D46F0B93E1872D2167BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

557c6f8b-ba5a-42ff-8b69-a825ad57b9bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\557c6f8b-ba5a-42ff-8b69-a825ad57b9bc.tmp
Size 12KB
SHA256 6070ea816e4d1a0699ac53dc9fa37d6e9db0743f576711b42d7b13db4852d564
MD5 3f696107dece22b6898be068eee3791a
SHA1 91684af650cb12dd71d5431fe3c6a6ad92a4a5e2
SHA512 2e4a88e3bc911ffe4b8e93a0c4274c5fdd57796345f627a86ff499b661825a8663fe19fd9dc5990c2099c18fc3ffb29e6f2cee80f7b8862e7b91a8f0e3fa3231
SSDEEP 384:D6oeIBTiZtY17wYsFdjKWurZ5h+WPUHra0e7vnJY9HvIpwYuYPv6UMejadnU2w3V:ieiOVoC
TLSH
T15A42B2EAE2E4826DCA1215F0AA257E57CF1D1D2C031D3E0BC5D4AF0B93E1871D3566AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68a1b7a4-fe3c-4ac0-a487-5a333e361cf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\68a1b7a4-fe3c-4ac0-a487-5a333e361cf4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\93d5a8a3-11d2-450c-8a06-3ea16e422425\index-dir\the-real-index
Size 1KB
SHA256 e5b58c1e30fe51581e7483d0c792f5bb526a1e40fb5e204c9ba11fc76e1a88e1
MD5 91732327e5ebd5c30ee1261eb2de37b6
SHA1 3d531a62b69e52b7a3b787731883cc6f6bc03c10
SHA512 7802d83d14677eaa6b91af5b33f1142fa057002621285148ae475260248de4fa600cce02d5700d9d689c2aa54cd13b6f3f18bf78ce5666f25598b5580cdc1bf6
TLSH
T15431461715624B57E88021B6086865D63335D5480348771FA2E6E13AECC0F84AD96998
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\93d5a8a3-11d2-450c-8a06-3ea16e422425\index-dir\the-real-index
Size 1KB
SHA256 4d9521551f27d156ea72859b763f563b2d7d61013dc23968209eb47f4813cefc
MD5 a1e4e213f7d075a646d1929b2986ba26
SHA1 0645d79ec88ddeb17205de58e0f584d512ff948c
SHA512 6188b063e03746d3d0b3ea1e3b6c7874bca1b12f69ca076af4fa487c99215ea900df4f4c6df052d6ca02a8dc998308b7cb918e06d0a7b6c238137f923759aef6
TLSH
T17831634A9E510EDBFDA051B5243968957338A2DC13047A2F92FDF13ABCE2704AD4686C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 e6eb6f68032b290a71ff6e08df49460c3aad37ec6e90ecb3ad9eed52e53c301e
MD5 5d1f002ab38c844413cd1fb80e6d0255
SHA1 2639d149842c57e617b54ebeefed2326fe250db9
SHA512 47d380bf1ec546b695278faabb219897ffff34363163dbf4687bb5546d979b605c6d8513196858a06dc8525e130812f77518bdb5d22c6dec7cd3b00d0128a539
TLSH
T1A4E068F22DF33810EC6FA3D5607064D145843695C485DC5E141FA2C310B1221204AC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c3d3a81e079b704b6d01e698a70c483d5540b6bcf0d064c5ceda6ecc9c202b2c
MD5 cf7264e9d035f093b9970fbc49c2d764
SHA1 c5439dfc901259bc7dbb48e18cd880f4b0df88da
SHA512 4c510929ccbabb22ab3e0cbb82ce23e4cd7f1a535c9fece837f0ad644466157c59e405f5148168ef0bfec961f052b853eebd4a5e7e90ad5cd7ced9d226ed0ac6
SSDEEP 48:KKPUTvhJ52XJu9Igv2KxT5F2Vnm+m1PnyN1IBKOUsahI5KCUkzyn:KcUgKNy2e1uKOUNhGKCUyk
TLSH
T114914841B17B1201397D2D4C41A6B62EDE8275633428EA7F3BB940B95F6BE140EBDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c85f0d37-f7e8-4ae6-b42b-ab8ec84bdc29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c85f0d37-f7e8-4ae6-b42b-ab8ec84bdc29.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8ecde39-b50b-4ca2-939f-d2e6616c8594.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8ecde39-b50b-4ca2-939f-d2e6616c8594.tmp
Size 27KB
SHA256 ca35f91b2d609b250f36c89bb7d6ee725bec0c70d171f8b73683ce5d346e315f
MD5 6e9af64c752e5cb4ad44c138ae7b0b2e
SHA1 db62be4aa2d4e2bc57b904b68a9b5433f4234712
SHA512 f0fd013c5a9fe308d06e11de3441c78c113955cd6a95682c15abdb9e8d5fc032d4be6099653fc8d6bfc48077f3eea491c2adca1854e96a49a23c1bf62d789d59
SSDEEP 768:tIqqHHlWvdDHT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVU4LliA1nmro8iJ1cw:tIqqHHlWvdDHTu1jaF4LYsndF
TLSH
T1D2C2FB3B644CCA7E4FC00A9DDD6A6F973DA802C7A6648D4047F9994C02C77EE612B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cb5553e4-c628-4fb9-8dd8-144667bccb3c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cb5553e4-c628-4fb9-8dd8-144667bccb3c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

e6f0dec5-0961-4341-a22b-a32cde21e0eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6f0dec5-0961-4341-a22b-a32cde21e0eb.tmp
Size 11KB
SHA256 5398de8c433e95e95a42279400d2fd36037f59757dae7c9c27477123e461f336
MD5 62db15783ea3d8262fb40af733469b38
SHA1 5dac1cd1b94a4908ef039e0f2291e252dc86bc5b
SHA512 5143708d31cab43f9e157a8d72b452fabdf93298885a0effe2977c05e837eec090f1831412367358d2a94f9653d0955839c53b89c4040fb316cf4141c2cc3a0c
SSDEEP 192:sxZ9RtWD/fQsB2LIdpXNJliHW6+WNznwWbJP/YrhBSJCIg5cHJ:sxZ9KD/fQsB2UYHbRh/C5y
TLSH
T1BC32CA526D78A97B9CC7D209BA55BB13D6F9103291D11E98F6FC851C04F6FDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f05881bc-0155-4fd9-841f-5c141678ab5e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f05881bc-0155-4fd9-841f-5c141678ab5e.tmp
Size 25KB
SHA256 917e2b4290d51272b9186c797fdc505a1c4b78c2efe26ec602d8f8c753322ded
MD5 23142335772e8eae2e9e0f149b7e876d
SHA1 cc8ee4659853ff8d21494307209914c9cb9dd64f
SHA512 861af3dac565fa7a6f134a44602446845a06c5f8a1320bf9801776f58e4214b87f3369187515a329cc9a8c51801d0603a6c4bbc1690a05590b148e7456847338
SSDEEP 384:sxZ9KD/fQsO66s8qMpRiYnazAW8pZS15posJWeT+72UeHbcB/PE:s1KD/fS4Mnc7WeT+72HHbAs
TLSH
T1C6C21905A824C8379FC39D19683C7E33E9EC506222C5DEDA6AECCA1C019D5FDAB4B453
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e8ad32ce-2440-41e4-8940-f4f2e77f2c0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e8ad32ce-2440-41e4-8940-f4f2e77f2c0a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0658667-be69-43d9-8333-0b9011aeb220.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e0658667-be69-43d9-8333-0b9011aeb220.tmp
Size 18KB
SHA256 62d3b4037a2bd9ffd510bbbabbc24daa49b1308991d2945fae4d9407c47f56bf
MD5 de38d26110c8bbebafededd51a59cd87
SHA1 c86a557897acfdcd8172de48303f92ad34ba759f
SHA512 3e90f9e24da66a1459c3963dd5174b0d2c7e8631205e7fcd8fa31a4e8a9b58db575191fd48d411885e5dcf4b05e1adc6048ac9b580e64a112c5c7a09fbef8ec2
SSDEEP 384:BQkUSvKsN0kZNTwBtAS0hZxEfhHXkYoRkX82IMMtU2IIlW:zKkYx0JEp3k+s5ZU2Lg
TLSH
T190827D35A8B86D379DB3B650B58A36439EA4901BD6D41F90E6DD3F1C01CE2DC234B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80817ab9-678c-407d-b0fe-97743cd5e32f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\80817ab9-678c-407d-b0fe-97743cd5e32f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 738ca63c6197824a12cdb95ed50716a8d1de184fed3b7b688e0b517aea3773c8
MD5 d74833d49db821b90771bf8b9d2dcecb
SHA1 7290a62b6c86d81b5682aab0bd99e796b546779b
SHA512 839ba3f534a793afbab49a6dc411443b73dab6492765d433dcec680493be307ca39f066a21732ce6a19d00bd881dee80855ad291cb3d6b46979093ec86fb71a8
TLSH
T106411458A6EE1148B3B76E56ABF6A96C187EBC373E16955E00010D8E0A23B41C872737
MD5 SHA1 SHA512 TLSH

Submit Download