hxxps://z-lib[.]sk/

Analysis

max time kernel
899s
max time network
735s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://z-lib.sk/
Sample261110-lsj3zsed49

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4364	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{E8E9CD2E-212F-438F-BBF3-D0370C0694E1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe
4960	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 4656	4960	msedge.exe	85
PID 4960 wrote to memory of 4364	4960	msedge.exe	86
PID 4960 wrote to memory of 3924	4960	msedge.exe	87
PID 4960 wrote to memory of 3924	4960	msedge.exe	87
PID 4960 wrote to memory of 3924	4960	msedge.exe	87
PID 4960 wrote to memory of 2324	4960	msedge.exe	89
PID 4960 wrote to memory of 2324	4960	msedge.exe	89
PID 4960 wrote to memory of 2932	4960	msedge.exe	90
PID 4960 wrote to memory of 2932	4960	msedge.exe	90
PID 4960 wrote to memory of 2932	4960	msedge.exe	90
PID 4960 wrote to memory of 4672	4960	msedge.exe	91
PID 4960 wrote to memory of 4672	4960	msedge.exe	91
PID 4960 wrote to memory of 4672	4960	msedge.exe	91
PID 4960 wrote to memory of 3524	4960	msedge.exe	92
PID 4960 wrote to memory of 3524	4960	msedge.exe	92
PID 4960 wrote to memory of 1232	4960	msedge.exe	93
PID 4960 wrote to memory of 3524	4960	msedge.exe	92
PID 4960 wrote to memory of 1232	4960	msedge.exe	93
PID 4960 wrote to memory of 1232	4960	msedge.exe	93
PID 4960 wrote to memory of 2032	4960	msedge.exe	97
PID 4960 wrote to memory of 3008	4960	msedge.exe	98
PID 4960 wrote to memory of 2032	4960	msedge.exe	97
PID 4960 wrote to memory of 3008	4960	msedge.exe	98
PID 4960 wrote to memory of 4844	4960	msedge.exe	99
PID 4960 wrote to memory of 4844	4960	msedge.exe	99
PID 4960 wrote to memory of 1228	4960	msedge.exe	101
PID 4960 wrote to memory of 4216	4960	msedge.exe	110
PID 4960 wrote to memory of 3492	4960	msedge.exe	111
PID 4960 wrote to memory of 3480	4960	msedge.exe	112
PID 4960 wrote to memory of 3808	4960	msedge.exe	114
PID 4960 wrote to memory of 3808	4960	msedge.exe	114
PID 4960 wrote to memory of 724	4960	msedge.exe	115
PID 4960 wrote to memory of 724	4960	msedge.exe	115
PID 4960 wrote to memory of 2064	4960	msedge.exe	116
PID 4960 wrote to memory of 3364	4960	msedge.exe	117
PID 4960 wrote to memory of 3364	4960	msedge.exe	117
PID 4960 wrote to memory of 2224	4960	msedge.exe	118
PID 4960 wrote to memory of 2224	4960	msedge.exe	118
PID 4960 wrote to memory of 1316	4960	msedge.exe	119
PID 4960 wrote to memory of 1316	4960	msedge.exe	119
PID 4960 wrote to memory of 3004	4960	msedge.exe	120
PID 4960 wrote to memory of 3004	4960	msedge.exe	120
PID 4960 wrote to memory of 2416	4960	msedge.exe	121
PID 4960 wrote to memory of 2416	4960	msedge.exe	121
PID 4960 wrote to memory of 3360	4960	msedge.exe	122
PID 4960 wrote to memory of 3360	4960	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://z-lib.sk/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff932c9c188,0x7ff932c9c194,0x7ff932c9c1a0
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,11015750651122944384,7993241839181146809,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,5372623898389032797,11863302754118744642,262144 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,15616877937625427792,11228226287029494362,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=2544 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4692923771826388252,1126524209767934751,2097152 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5232893861739577401,7659632394359205976,2097152 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,10308801424413977168,742007987967405379,2097152 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2013703049148609547,4268798587407198561,2097152 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14973224098642046906,17730235846918848465,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,7019595049086690046,6321694564295202514,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,5328381400216485533,6728362291757023999,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12829728250419215978,6329631107802132606,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,12829728250419215978,6329631107802132606,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,17320544801219213583,7207764625422161236,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,8224535112850910004,1710779119308595394,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,14357898486243805502,9020348951389946399,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,510664085930890075,13697751574504300640,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,11881311186070552855,3174801268425775315,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,6731441561647431088,3431448231848767252,262144 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1056,i,10495759488309655350,16675200555994981378,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=1508 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,17748040830520666594,7297126852054766474,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,16887861056849911318,725769304101689785,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:1316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,10059246458543550298,11169252636127487890,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:8
  2⤵
  PID:3004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6556,i,13228766310446112924,11174645042761480950,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,6889155808293801446,12924352905681471358,524288 --field-trial-handle=2184,i,11438868378689108359,16306912624847062286,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:3360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

273d8e7b-f446-4115-aa9f-a6d2027d5598.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\273d8e7b-f446-4115-aa9f-a6d2027d5598.tmp
Size 8KB
SHA256 94e49f830af77b28e1b3892c34224f4616c10ea5650c06aa71f176741cec568a
MD5 40c3321a94e48185a8e8b3d31bedf08c
SHA1 34990433791c52641877748d517f1cdb5e71a000
SHA512 03d8371fbac33d8588d3d28fb43ac8068ad1ebb7c71be327e13883226cf7221ffd379db6ae979ded41cf98084034ac7e177c155c4efa6e23303ec5837198e1f7
SSDEEP 192:UON86DphpqQmiUy7iTwGYX59ezVCNY+YpDye7kIIVq5lU6:UON861KbTwGYX5E0S+YpD2uU6
TLSH
T103121A31A874AC7B5DD36551F48B3A139FA8522BEB847F90D6DC1A1C01DF29C130F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

129c9875-e164-4bed-9016-8b1c10cde7d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\129c9875-e164-4bed-9016-8b1c10cde7d8.tmp
Size 10KB
SHA256 811dd75aed11cdcc1e581ee7e11faa57063aff5d8bc0ceca050dc4c7c73b0069
MD5 fa46955b91c04479db09e66a2ce5de2f
SHA1 b31efd459e99ca4eeb005343e986d73c16d76a0d
SHA512 ab2fe1e32b79f4df7e9a652881a7006cd33a749a10e18b4c4dd93a17d61aa1e8bec6d7b23a69412484a973a712f41e6313d2714a565b4e6c62293b90a0b3e4b9
SSDEEP 192:sxZV7RzW0L/fwRsydQsIdpZLHW6+WNQQu/YgRxT+CIg55J:sxZV7w0L/fWsWQ1lHbq/9d1
TLSH
T1BF22A6527D24A97B9CC6D20DFA15BF13E6F9503291901E58ABFC861C04E7BDD224B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c9db9c5-ed05-479d-bd79-0ffc2c7abcc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c9db9c5-ed05-479d-bd79-0ffc2c7abcc9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ac007b2-a72b-4ae6-a976-e96a58ea2940.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ac007b2-a72b-4ae6-a976-e96a58ea2940.tmp
Size 10KB
SHA256 07db3468db5cc813e97832d4a147fe1b1e526a2c9e6158bd9139a0c69df0227d
MD5 a4dd981dd36325334410d26fbed83b49
SHA1 6a7d896145b8f4993b976b999e9a9b75f08f4982
SHA512 4cd298eebe346301ce3b09baa5f75dea8db937d00fde611803fee62ef61d9cd250c46de6437c9daefe43d98842133b456eb81dddbf48c89a6d62c5f0ae815be1
SSDEEP 192:sxZV7RzW0L/fwRsddQsIdpLLHW6+WNQQu/Yg56T+CIg5bJ:sxZV7w0L/fWs/Q13Hbq/qdD
TLSH
T1852295517E24A97B8CC6D20DFA15BF13E6F9503291901E58AAFC861C04E7BDD224B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a9729ab-c170-4b98-b0a9-1adf5afa4bf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a9729ab-c170-4b98-b0a9-1adf5afa4bf8.tmp
Size 10KB
SHA256 8fd5bfb6bb5e00c5f02fb598ad4a99b23f345210053dcda9aff757ae212ab334
MD5 874866f7365d6d608f0826836dabe8f8
SHA1 504b5df011240eaae9dc7ba16bf994de69ef17a1
SHA512 50067d486e8c9d1558721a709d603c570268d758745e0fd22fc0a4b0f9ac0ace91f16d6fdde53f282f8f507226a3a512c5f38370ad124d6a0f9c863049bb9357
SSDEEP 192:sxZV7RzW0L/fwRsydQsIdpLLHW6+WNQQu/YgAST+CIg55J:sxZV7w0L/fWsWQ13Hbq//d1
TLSH
T18D22A5527E24A97B9CC6D20DFA15BF13E6F9503291901E58ABFC861C04E7BDD224B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74c9fd6f-05a6-41f6-8aba-be4a1ac7aea3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74c9fd6f-05a6-41f6-8aba-be4a1ac7aea3.tmp
Size 24KB
SHA256 031383e4b197a086b9af58ec9f56e476357027f4477cbc47ba7c3b9e486bddf7
MD5 2ea464a7e85ba32011a4ee762bc1c802
SHA1 3bda47ed22de3a92a11558dc26ae0d21b28a65ef
SHA512 cc4bece62f7cfeeacd56c427a468651248fe754f16018014ad8bd7ea9c52164f8cb03628a52cbf0838d5db9cebe6a24335d5c30a36f49f028cdce9ddd776b920
SSDEEP 384:sxZV7w0L/fWsB66s8qMpRiYnazAW8pZS15posJWeT+LQ1lHbq/9s1:spw8/fT4Mnc7WeT+LyHbQ9E
TLSH
T1C8B2F705A924D83B9FC35D18A93D7E33E9EC506212C5CEDA1AECCA1C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9559e979-5bf7-4265-b70c-cd7813cd7dea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9559e979-5bf7-4265-b70c-cd7813cd7dea.tmp
Size 9KB
SHA256 ef4cdff81ba288f727e2d14dc2bacd41d32c54f189a4cf6123309fe29643c805
MD5 e47afaea10a69c9ee537428ad9fc8205
SHA1 0edc31b6ec8a5044dd48e2c69a06b07229538d1e
SHA512 0d15ce061338d02311cd6581fe6b97bfb88aa08c6df1f1ce784bcd3f5f95ea2a4ac57de975b5db0bc3d716a4b79124a9db2ea4c16a08cb342818a6535fdc2101
SSDEEP 192:sxZV7RzW0L/fwRs/dQsIdpLLHW6+WNQQu/Yg56T+CIgrJ:sxZV7w0L/fWsFQ13Hbq/qd9
TLSH
T1612296517E24B97B8CC6D20DFA15BF13E6F9503295901E58AAFC861C04E7BDD224B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 328B
SHA256 11d11aed8f92b043d2b5ee9e4cd4cc0333fd8694fec368a1486871e7b35c5a77
MD5 9e0f282d9f2b40ebf4b8747e77bcd19e
SHA1 6503d56df46f76a0eaa50c0a77670a317a262e44
SHA512 a1ef8e92dcbde3291c2901796d40e55ff80086e8bd23fc6883096ee842135cfd3de8eee1482bfc223601a7bc6b2e81d151185521a73e768fc8568e79e4f3efbc
TLSH
T118E026A524C8C22EE3086A4B42B8474C9780675AA7C26A1E3748DCC8750B080E3A2694
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6b9ab6a6ebeb9e7f6da8bd562de4db09083bcb0968e03b0530aa41d0babe8491
MD5 62d477c632167523a48518107c7e3a5c
SHA1 a03eac3f239eb133f3761ada4d8d49f8c0a8f58d
SHA512 c8a384f533688890ebdd914f2c790575ecdd982a52c3c483e73d4a8fb81fba95957b805d7c6cebf76e9a92261d6e328e226e1650158b00b5179ffa989ba55093
TLSH
T122E0209514C4C32FE304668701B5574CE1A03A5AA3C0AA0D378DC8C87502591F6B2B50
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ed1e6698e1bed4e51a72723cfe2c0cf47832f67a36027b2cc0d6fa9bed5886c2
MD5 bd45dba34bd8ba37d9a14a97cc03eab0
SHA1 64dd264be6b25a52dbea0a27204ab7ed4e8e4faf
SHA512 923af628a97b9cc1a3bb232e97ece55168ff18de6ada700e252e458dcccdf4c2258de54277fe1223c15cf2f06ac5a5b5dec945004ece89c0647adbdd4fae0039
TLSH
T10EE020E716C4C26DF308664743A4474CD281265AA3CEBB0E3744C8C97507080E293660
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7c43738e427222d36c8535939d7ff8099afd176ec130ce0a72d5f7c2dcb61449
MD5 1640367205bb8c7e04514296ec1991e9
SHA1 ffd93dd00f55203fded9b94a9eac5080fd5cec3a
SHA512 7abb6c5b3f23abed06bed92093ac1bc13c9c69540d84cded83a2e739f12f24105a5dcef92517d465b89c9c7ede6eeac5fdd4f286e90bbb0d96bbd59c3e65c4cd
TLSH
T166E026A518CDCA3EE318A74701AC430DCE85B65A93C86B2E3740C5C87682884F6EAA90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5ceb9a319767e6365b8738004db7dfa1bb3eb48d2fc11e618ed399bab1712be2
MD5 c0679b24880ac084dfdf2e777d3764a9
SHA1 d0ded978bb22f732e34738b31b1c126d744da2d5
SHA512 57472df7d1743983efd00ba1ef4fdd81dd7d7d58d91341284eb4e609a91dd0a218181acbe93e326eed6585500c7451b1f91a58a9ff6c6baeb6d031a09310c997
TLSH
T1FF718479A961D6B9FF944479C5DA24CF3C325D98B453BEC70EB8E47A8CB630591F8100
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0f4db7f8444de6af5110b9cb3f90337dc73d68115a553ca18bc3ac585cb5ea6
MD5 10abf98c3dc924db8aea9bd5b662dec0
SHA1 78c0728701c14ce457869b8835adaf04e1ef80c6
SHA512 000b5dd69189dfd1a817705dc8b58a2c2c15aded3cced9bb531be09628e5074d70b15cdf7d49dd99f72884b461d96b56c5935b0beed02e002a5deab9ad79d23e
TLSH
T16C617579AA60E2B9FF684479D5DA14CF39325D95B447BED30EB4E87ACC7630491B8100
MD5 SHA1 SHA512 TLSH

Submit Download

08675bae-4468-494f-999d-f4eaefb4e233.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\08675bae-4468-494f-999d-f4eaefb4e233.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1c7a6c4b-bee2-4cfe-b54f-797bf403581c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1c7a6c4b-bee2-4cfe-b54f-797bf403581c.tmp
Size 1KB
SHA256 017412c1384fa6e0b9867aaf424bfb8b5e1cf843998d7349959d7ee10d9f833c
MD5 4a521a6b811e96ec7ce68af07d26349c
SHA1 01e623d9bca64f34902b6bec4231ffaa24e19525
SHA512 8325a04f32bc77daf739eb56207abcb923a1f18c85910117e4224777b0855f372950e8d3f94a5155ff3668caaceba21b08167bf7100432a1c8158b26515c7489
TLSH
T14941BEF3C3E5856ED91126F0AA14AE1BCE2C0506425C3C1AC8E4FF1B97E3871E24296F
MD5 SHA1 SHA512 TLSH

Submit Download

9ac6ffc7-e8ec-4710-8c8c-def6cca781da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ac6ffc7-e8ec-4710-8c8c-def6cca781da.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d5ac2431-04e1-4a86-8b00-b4d3b36b6d4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d5ac2431-04e1-4a86-8b00-b4d3b36b6d4a.tmp
Size 1KB
SHA256 8b463754c4151dbfc83178eb87405aa0b5b7256bc30422a25419d8459b1c4866
MD5 30c703e69b5b54b0cf720bec324c3fa2
SHA1 d34a3732470b5875d9d5822c7243eb62a303b8a3
SHA512 5413d5341cf3bc6c7bcc12bee9d8c6e5c5469fd72e2eff9c2830673bfe9adcc4d9af034cc68007358a05036b11043c990dcbca6df73ffbb5a20c929512ae22d3
TLSH
T1AB31A0F783B0866ED91166F0EA14AE27CE5C0506425C3C2AC9D0BF1797E3431E242A6B
MD5 SHA1 SHA512 TLSH

Submit Download

ede6741b-4852-48aa-9400-de818f819447.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ede6741b-4852-48aa-9400-de818f819447.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 768B
SHA256 1f1a006e745a2d99f660f2404e35fedb8503966b44addec19370a41a498e6024
MD5 5cf088cf06e8b4b5db3d23b390784f8c
SHA1 eeb98782dc446d4077495191c3c4fd700958b07b
SHA512 d5a70995472e02c66468251ff2840056df5ead50ec4f897061d6ed088eaa222de394b38ba63a1748befd4b6a6abd1fa72c6b1931c1ac33834bcc5d7b76f757a1
TLSH
T17F0120D641034B46FC1403709A3CA406316A5148A390774FA3EAA06ACC52780BD83EB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 768B
SHA256 36ce7aa3bb3fbeb5ec641f67f93e8059d5b14654b171a2232c3d7ad288619418
MD5 8db5091f84f44387b58022caeac3a6ec
SHA1 e14c6a38c8795cb16100e57e5849aae0bc9a903f
SHA512 6a3f61217229d8f9875c6ca54d2c6139366a26c4ab3943b8e7d06b61373598b998d1ac0706de3d312a013176578f924972176ef961e914fb46d9ff13f5dca645
TLSH
T13D01E19B4D134A1BFC550330243CB85966B506DC5241764FA2BDC52AAC66344AE41564
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 94f807db41f868775c4d756db3e12033112ec80816846a75f55cd2ea3ca175ba
MD5 bba60b879c72f235373a53ef5f05540e
SHA1 18718700ee21bcf1c512b150cc303c362defafdf
SHA512 ba4b6ad1feaae3fd9c2c72deb5d8f11d690fb9049043474ed59f8e53d51932aeffe2ec5ba890da9524524719ac401f53cf07d4be786cc097b44a43ed6cd9f434
TLSH
T15CE020B73FD72854ECDF83D21031C8D54105B964C544FD4F246F91C7A2B1759385AC26
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\fd78cbece943091521ed0f55140241e9366345fe\bf54d853-43b3-4b45-ad53-4a5e18d0e50b\index-dir\temp-index
Size 96B
SHA256 78e4889ff5a740300f050599741f9d181e99a3e1a27aa70e2c96124d0ac8bff6
MD5 cca8aa91475278f782a84205ad1b32c8
SHA1 d705ac566a0748be488962fd7cac988669ef53f8
SHA512 d7868d5729c4e0ba5cb20bf55205e5553479bf9cb226799a48822630e13c8d5c80c00ae86b05d8170562033e63de7c6662f55a886c560e45d3021eb3b864cd95
TLSH
T1A6B0113028008A03C0088AB8088220023B30EEA023C3032F0AA82228CA203AA0C3A00A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\fd78cbece943091521ed0f55140241e9366345fe\bf54d853-43b3-4b45-ad53-4a5e18d0e50b\index-dir\the-real-index
Size 48B
SHA256 ade652ac26a88be9054bb38ad643644761392b5d5932a583abcc45b89219bd4f
MD5 cedeba7cd1e9c8e7c44381ec2c5b1a59
SHA1 af24071e56c7bac5551a57a69d18aaf0d90edc51
SHA512 2a350e7c1a5e24b1e39717bc5c9a7075f0ad532f4323593885801a283cf9ec79e2b91cce2d4e0db3c7bfcc30ebf2bdf13bf7e87b95817bac551b3223e0123428
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\fd78cbece943091521ed0f55140241e9366345fe\index.txt
Size 153B
SHA256 377fcdfcf6a2f03fd54a185e1c70e54aebd0adab98ba659a6389ced46f015473
MD5 72fda962306afaca4a84128bb41000a5
SHA1 1ec6726dce4b3a54573bea5b45e49cef5acc33c4
SHA512 f524d8cc793dbf3c411c0878a0d5686ad9d13f5f5e4d152e05ab0350a03a43828865d1cb248def83e619909f5df6872ec56e3ace183fd70c6097b2bc7ab45ca2
TLSH
T115C08CB648B1D214735042E4D932240C883B2CAC88430E0DA4043801D1358220E50C67
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\fd78cbece943091521ed0f55140241e9366345fe\index.txt.tmp
Size 148B
SHA256 05429ef584e9d64a781a9add6cb79715228ad216a33f5bec485ee11bd755da7b
MD5 5b3429d1e6d0b1849b6201b15eb74538
SHA1 8edb4ce7faae6e33b616f33988b55623f672425d
SHA512 66f4ab43ff7a50b261fedf8ef3036f2673e285c9aeaed54b9a5bc4a431e843df1ac772e83cfdaf4f9f85e8f6bec36354003a33809ac36f8ad3fe90e9bf6d94a6
TLSH
T1C9C04CB648B19654765097F4D962351C883B64A989570E0D95044941C1458221A55DAB
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 531f87ce4349cbed0048da54284fe85a55d360e91b8afbe2129a03858c9ddc5e
MD5 0ca408b6154bccf8f8852dfa445336fa
SHA1 66c250fb4dcdc68dac0de71fff1bb22e53582a32
SHA512 b4d26cc3d12da48ceb72ddbbe2eb22ae7bb533ec741cded1ceb0f543a9cdb28cef186b1d7d6f2ba61843b01ba5ed542184b963ce3704c0a897aea2fdd0ee99fa
TLSH
T100A002558D673155C4011275D6C641C5725088100119336B44BC05AAD8711D142E300C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 7d98572cbefc0e7955023e10d5e7ff70d0bc186ca85013a748e7f17878ba2ac3
MD5 f2d92bf0f10415c6b2d1ff03ffd652f1
SHA1 88a656a2cbbf5a9cc1a6f15adc8f3ae5c79131ac
SHA512 0244907d2af7761254ace749030495b3fa44235a5a6c4cc2918cabe265193b56b80869abcef8a4885e41b3672002ceaa87a01f5f49eb4ff0a72c2445fc1747ff
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d2067f88554f1ae1445e8e57e4bf681c3c435ad7a3f71d5bc8b4480b43d66c88
MD5 e06317e414ff0828708ce284d888f76c
SHA1 200a1f0cb1db843b11385acc9dc6005b1c422ef8
SHA512 339ff67333b6c4249840ed47412fcc4ed1c68155b01b5d9915e7ef8158c3bbf28e5a619af9450edd66cb3b5e2600c9c2e19bf1c7d717da018cb9c21610fcf3e8
SSDEEP 48:K0GDGmGHGjGN8rKWkmKzb6ZCISOzK9q1IzxsjYhyKQypEIvKtO8HyBiI/Kvq0d:K3idmC3TeK8ouKEAKtOeiioKvq+
TLSH
T19F91A440716E525139BE3A5A4078851B26833473304CAA7FBBE8F0F65EABE148CFD4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f02393b6-3565-48ec-8bbe-359e8b53218c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f02393b6-3565-48ec-8bbe-359e8b53218c.tmp
Size 27KB
SHA256 9922e5cfe45ae67e59551492ac6eac3e9750ca7567e01fd328bb88d1b9ce930a
MD5 0267faf51051ef3d8428d7cc84a709fe
SHA1 d83304ab186e98fab36bfad87a1caa19f1b9a9b4
SHA512 58425b0e6eac7f181c5578ed3df4ad0c9fcc9582c9f22dbc7c25c649a2ac5e71826eb21c0c324012626a8012515fe8e22edad2b2f0f79910e4857f33e42cc555
SSDEEP 768:UBichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzjronlg:UBichfPWvPZplu1jan+LKgzQlg
TLSH
T12BC2E93B644CCB7E4FC01A9DDD1A6F9B7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7358d428-c6ce-4915-ba27-9168e8bc1eb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7358d428-c6ce-4915-ba27-9168e8bc1eb2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c6fc8dca-43fb-4d02-9a95-b63ae7c8dab1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c6fc8dca-43fb-4d02-9a95-b63ae7c8dab1.tmp
Size 8KB
SHA256 81827b4da865f5531846c27243a2c6459698eb04db62990f53c4df6b2be6638c
MD5 82b60900515cdf5ca37c1bf7cbd71ab5
SHA1 6d8e357b68e1c8ce64837741f5b5917c25a94de7
SHA512 0bd62e7eddf41bc205e7eb47230207f4d6ef158e806d2de72961d8b079d226f0266683fa8af2089ac2925eca5575e8b4c4875fed20fae4fa2ca62e2db6cf0c93
SSDEEP 192:LJONc6DphmqQmiUyqiq8wGYX59ezVCNY+Yjkk7Ir/U6:lONc6194RwGYX5E0S+YbKU6
TLSH
T17102E935E8787C7B8DE36E55B58B27239FA8112BAA942F84D6E81E1C00D768C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3afdbd4-92c3-46ef-bbeb-63b8ae648e63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3afdbd4-92c3-46ef-bbeb-63b8ae648e63.tmp
Size 18KB
SHA256 38f69264a89e0a7e521bdab65e5a22727b53481b47a18254d2315dc5c1cdb310
MD5 5e24d955aa420b6165aa0a631591b96c
SHA1 a66e20a0371ffc61d1fd96af899f492bb530d90e
SHA512 f498dceda2fafcc5832dfc505878cdebffe3c1cbfb1523c0f65ab0223d3afe2e82f3c20b340c541d9654bf6df647cd49d555d0cbd4525cb00164a95c85efb13a
SSDEEP 384:MQkUSv0sNmUNru5p7hBGYX5E0S+YpDruvaTZcYHTIIlW:M03bTGYu0SVpfuvaTZcYHTLs
TLSH
T1B5826C32A879AC3B4EA35561F54F36039FB49127DAC42F94D6DD5B2C01CF298234F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f985baf-e324-42a9-acac-82187056b41c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2f985baf-e324-42a9-acac-82187056b41c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f0b65469-6928-4cea-a68f-14476c488d9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f0b65469-6928-4cea-a68f-14476c488d9a.tmp
Size 18KB
SHA256 dd3db65c07427c2b8e3ce60ebe52658bc0d6da05fa000be7a022d78732affa72
MD5 690d947cc1426fb688a300b7f51e74d1
SHA1 48d7b575481481df56693baebc94cbd06a034e72
SHA512 7fbc640c7067162a0c59a2b72e5059b8f8f55ab2d06240ec5e31d4f64172697b9e21710c607da4ea29b2becc3f1a805d9a5efdd1a2f2a5e28a088669193212d4
SSDEEP 384:XQkUSv0sNmUGru5p7hBGYX5E0S+YpDruvaTZcYHTIIlW:p0+bTGYu0SVpfuvaTZcYHTLs
TLSH
T1E9825C31A875AC3B4EA35561F54F36039FB49127DAC42F94D6DE5B2C01CF298234F92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f75bfe3b-dc0a-4496-ad1c-562d38a5226f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f75bfe3b-dc0a-4496-ad1c-562d38a5226f.tmp
Size 26KB
SHA256 82a562060da3d89970762b56547bd898484097f377d0bc898316931eea6c9898
MD5 ffa56063e0e8ab7eede4d5874ace69d8
SHA1 08db9f2e35222346c57ec62788f19849892dc2dc
SHA512 64a2dadb6ca5d67f80e5557bcc8c8a453415230f69e7b9400fedc715f34e95190aa124d86ecb7978232e4380ba08528d49ff322aa026de898a708608b18f9ca2
SSDEEP 384:ViFzQkUSvCzsNr8TUNTUlIlGru5pxhBGYX5E0S+YpDXuvaTZcYHTIIlW:cFdK6wgZRTGYu0SVpDuvaTZcYHTLs
TLSH
T1D0C229F258E7983AD99E4753E73E2E038EBCC117F5805A50B389491CCC8A1BFD34A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 aac2801e439a659671533b54d38abf01313a93dbc5133af68fe7d77cc1294997
MD5 cf0c2f9d2ad0f1e3a9116986a0159f81
SHA1 4c6952f3bc668e85c4d7d2a6b08929bf03babfe1
SHA512 514e3d0e4f4c41f94f9d90cbd30dbe99fe2c032fe878efdfcb1e076afddebac68850032eed25bf08ac932f3b670737c9b28882929cd8d078f2c7e226621f2728
TLSH
T151411C98AAEA1148B3B76F5A9BF2689D447F7C772E06D49E10100E4F0A37740C972B37
MD5 SHA1 SHA512 TLSH

Submit Download