hxxps://q8w2[.]engage[.]squarespace-mail[.]com/r?m=6a442881fbe9e779c8771aad&u=https%3A%2F%2Fwww[.]spatheory[.]com%2F%3Fss_source%3Dsscampaigns%26ss_campaign_id%3D6a43f5998e3cf21b79895c18%26ss_email_id%3D6a442881fbe9e779c8771aad%26ss_campaign_name%3DLast%2B3%2Bdays%2Bto%2Bclaim%2Byour%2Bcorporate%2Bwellness%2Boffer%26ss_campaign_sent_date%3D2026-06-30T20%253A35%253A20Z&w=5f2864b6ee63644ee0b157d3&c=b_6a43f5998e3cf21b79895c18&l=en-US&s=EgyGUXgPy_DujCkZoFw7IK2dYsk%3D

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/07/2026, 02:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://q8w2.engage.squarespace-mail.com/r?m=6a442881fbe9e779c8771aad&u=https%3A%2F%2Fwww.spatheory.com%2F%3Fss_source%3Dsscampaigns%26ss_campaign_id%3D6a43f5998e3cf21b79895c18%26ss_email_id%3D6a442881fbe9e779c8771aad%26ss_campaign_name%3DLast%2B3%2Bdays%2Bto%2Bclaim%2Byour%2Bcorporate%2Bwellness%2Boffer%26ss_campaign_sent_date%3D2026-06-30T20%253A35%253A20Z&w=5f2864b6ee63644ee0b157d3&c=b_6a43f5998e3cf21b79895c18&l=en-US&s=EgyGUXgPy_DujCkZoFw7IK2dYsk%3D
Sample260701-cp371set9s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1456	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134273457730751831"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-125073035-2952146151-721812867-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-125073035-2952146151-721812867-1000\{9175A491-4336-47E5-B144-85E6D0AACF90}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1712	msedge.exe
1712	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe
4292	msedge.exe

Suspicious use of WriteProcessMemory 61 IoCs

description	pid	Process	procid_target
PID 4292 wrote to memory of 4396	4292	msedge.exe	81
PID 4292 wrote to memory of 1456	4292	msedge.exe	82
PID 4292 wrote to memory of 2232	4292	msedge.exe	85
PID 4292 wrote to memory of 2232	4292	msedge.exe	85
PID 4292 wrote to memory of 2608	4292	msedge.exe	83
PID 4292 wrote to memory of 2608	4292	msedge.exe	83
PID 4292 wrote to memory of 2608	4292	msedge.exe	83
PID 4292 wrote to memory of 1832	4292	msedge.exe	87
PID 4292 wrote to memory of 1832	4292	msedge.exe	87
PID 4292 wrote to memory of 1832	4292	msedge.exe	87
PID 4292 wrote to memory of 832	4292	msedge.exe	86
PID 4292 wrote to memory of 832	4292	msedge.exe	86
PID 4292 wrote to memory of 832	4292	msedge.exe	86
PID 4292 wrote to memory of 4164	4292	msedge.exe	89
PID 4292 wrote to memory of 3284	4292	msedge.exe	90
PID 4292 wrote to memory of 4164	4292	msedge.exe	89
PID 4292 wrote to memory of 4164	4292	msedge.exe	89
PID 4292 wrote to memory of 3284	4292	msedge.exe	90
PID 4292 wrote to memory of 3284	4292	msedge.exe	90
PID 4292 wrote to memory of 396	4292	msedge.exe	91
PID 4292 wrote to memory of 3868	4292	msedge.exe	92
PID 4292 wrote to memory of 396	4292	msedge.exe	91
PID 4292 wrote to memory of 396	4292	msedge.exe	91
PID 4292 wrote to memory of 3868	4292	msedge.exe	92
PID 4292 wrote to memory of 3868	4292	msedge.exe	92
PID 4292 wrote to memory of 840	4292	msedge.exe	95
PID 4292 wrote to memory of 2364	4292	msedge.exe	96
PID 4292 wrote to memory of 840	4292	msedge.exe	95
PID 4292 wrote to memory of 2364	4292	msedge.exe	96
PID 4292 wrote to memory of 3068	4292	msedge.exe	97
PID 3068 wrote to memory of 3992	3068	msedge.exe	99
PID 4292 wrote to memory of 2768	4292	msedge.exe	100
PID 4292 wrote to memory of 836	4292	msedge.exe	101
PID 4292 wrote to memory of 836	4292	msedge.exe	101
PID 4292 wrote to memory of 836	4292	msedge.exe	101
PID 4292 wrote to memory of 1300	4292	msedge.exe	102
PID 4292 wrote to memory of 1300	4292	msedge.exe	102
PID 4292 wrote to memory of 1840	4292	msedge.exe	103
PID 4292 wrote to memory of 1840	4292	msedge.exe	103
PID 4292 wrote to memory of 1840	4292	msedge.exe	103
PID 4292 wrote to memory of 4764	4292	msedge.exe	104
PID 4292 wrote to memory of 4764	4292	msedge.exe	104
PID 4292 wrote to memory of 4764	4292	msedge.exe	104
PID 4292 wrote to memory of 2148	4292	msedge.exe	105
PID 4292 wrote to memory of 2148	4292	msedge.exe	105
PID 4292 wrote to memory of 2148	4292	msedge.exe	105
PID 4292 wrote to memory of 4660	4292	msedge.exe	106
PID 4292 wrote to memory of 4660	4292	msedge.exe	106
PID 4292 wrote to memory of 4660	4292	msedge.exe	106
PID 4292 wrote to memory of 1488	4292	msedge.exe	107
PID 4292 wrote to memory of 1488	4292	msedge.exe	107
PID 4292 wrote to memory of 1488	4292	msedge.exe	107
PID 4292 wrote to memory of 2236	4292	msedge.exe	108
PID 4292 wrote to memory of 2236	4292	msedge.exe	108
PID 4292 wrote to memory of 2236	4292	msedge.exe	108
PID 4292 wrote to memory of 340	4292	msedge.exe	109
PID 4292 wrote to memory of 244	4292	msedge.exe	110
PID 4292 wrote to memory of 124	4292	msedge.exe	111
PID 4292 wrote to memory of 864	4292	msedge.exe	112
PID 4292 wrote to memory of 864	4292	msedge.exe	112
PID 4292 wrote to memory of 1712	4292	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://q8w2.engage.squarespace-mail.com/r?m=6a442881fbe9e779c8771aad&u=https%3A%2F%2Fwww.spatheory.com%2F%3Fss_source%3Dsscampaigns%26ss_campaign_id%3D6a43f5998e3cf21b79895c18%26ss_email_id%3D6a442881fbe9e779c8771aad%26ss_campaign_name%3DLast%2B3%2Bdays%2Bto%2Bclaim%2Byour%2Bcorporate%2Bwellness%2Boffer%26ss_campaign_sent_date%3D2026-06-30T20%253A35%253A20Z&w=5f2864b6ee63644ee0b157d3&c=b_6a43f5998e3cf21b79895c18&l=en-US&s=EgyGUXgPy_DujCkZoFw7IK2dYsk%3D
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffee42cc188,0x7ffee42cc194,0x7ffee42cc1a0
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,7614579079049823061,12837053544244049675,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,13161400933764294384,1344513823448494048,262144 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,14375208743151013628,7773449975173411722,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:13
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,14688555983174707176,1589744605803049763,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4880884143899927674,9333431722591856111,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,4839115612922311753,5933403937171150456,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,1732613531546519498,12432480459503493228,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:9
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4336,i,17916334630453214211,6945528587318728916,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4348,i,8017716873509624454,9790631804412017159,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:9
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,492323116294817934,4404662499889355696,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3916,i,16740840476017540216,14358898446760545251,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,18209449522020610215,10676150767463672638,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1044834927187148753,5759133559057140755,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,1044834927187148753,5759133559057140755,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:14
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6500,i,8432919472372760877,633048910575296006,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:1
  2⤵
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,6403825673507755021,5883785981348316974,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6768 /prefetch:12
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3600,i,12482690259000906615,11308866353507903865,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6844,i,34463058494812305,13535959006522640563,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6944,i,11755649621213719662,15718260073149502812,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=7140,i,9307232347254192516,16462739437704490448,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6844,i,12304271140178648045,16508488525969688498,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=7012 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7368,i,6558486202250879566,13989912264976135358,2097152 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,4249843093671055639,4789683699253260423,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:14
  2⤵
  PID:340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,10024304362085846344,18412464817310114896,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4736 /prefetch:14
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,9796602238920305828,8783348984050598302,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:14
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,17860414650933281027,11609391228774550260,524288 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5956,i,2972926023994926474,11559067913512241332,262144 --field-trial-handle=2044,i,16836688870552737080,2647366209044329891,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1712

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3d6022b8b09d410224e6f49ce6c5693abe531fcaf66bb13ef03126afd2691fe0
MD5 57d5bda89a3ce0cec5e5ba7de9f0b14b
SHA1 f3acef3d86afcfd0b7d491c8c55dd0679342b314
SHA512 b3100104fdba74d8ec0cde3847c8629b3f4d7d2f4eb07a7e44b61ece266b201daf1b4c4f2922da6731aa7e1518a90a163383bcb9d2738a6f78d052f8141237c8
TLSH
T1D4D012237A9CA410D2A78131D017D71556A910E468575A45F2A4C86D556B0A467CD187
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 940cbc9ecbe8080b4f78231e8ea559e5f25ba4586d9b9c7484580010ea141f8b
MD5 7b136c46d44a9c4f8f42a3893196bfa2
SHA1 65e92a8f631d018328a7c2cd1ea9b52d24fb05ed
SHA512 06b71e8d2ad9deb7c9ad47e7b7fc808b8513e4cd6ba4c5e561fab3aec9e937d3990c50625c22f7f7a281e06579a42d4a615f255576af4efa3a9daab503cc1a59
TLSH
T1E7D022233A8CA800D2A78130C016C30002A900E068178A01F2A4C82C442B0E063CD183
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 1024KB
SHA256 1b361240f8a4a373e0bd6aacdced5f993b751d3c2f980e036f36d98899ee127d
MD5 72f14d9b41a91a85d64df987757041ff
SHA1 e8d2da119b16e1ecff98f1c81637ba987917a457
SHA512 36691af7d4dea2cc011bf49e4eebe4f48df29341877ef21302b013a8279acbbdb4db532ccc4b7b9503f20139faef0cf116b32fd03d57a6156ba4cbddeda70ba1
SSDEEP 24576:ymwWEupyCze6ZuZRkPXfRI4NPmyA91SqJiHk81t7ouBwB97dyA:/BEu4Cze6ZuZR8XxNPmPfSqJip/7FBwL
TLSH
T18E2533367AF2593772B4752B09AA65C12A37807FC738138DEE84E93033557A47FB6620
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000094

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000094
Size 1024KB
SHA256 0ca3eaa19b355eda6ce0d40f65b9b289e96709b716252015fb637e3da9a1db93
MD5 713f728a1023dcb819d274f4ff340e72
SHA1 c81eca53d4f22e2325c1c444140f188f57a5fce8
SHA512 5d40f2eff21862ff7b35c75785377db3d9dda20dff04f61b4b5bffc9e11f62fb4b684e29931f75349ba7e6b7197cd837b04c3a6bd7ea879fc63f3fade277b7e1
SSDEEP 24576:NhPx4bFO3mSp70W1VT3YGyVztDAgj+ZtMZ91wAPEyOc:voM7hTGztDmZ2ZrwAPE6
TLSH
T19F25336AD9400C88A4671C544B6BD645B320A4BD63BD0770157BC8BC53BAE946FF8F8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 620KB
SHA256 2e6104a66833e02dbb5806da23f88de745a2cbf2d283906479b22629c908cbbe
MD5 1f09f7c7ab3b9cb98d0a8ff6f71c876d
SHA1 5b3c19420aea0108904a7104bfe2fdfa89b36b5e
SHA512 f97c5e998432d27df813c6d66de2cadb9f454ad336dba73e02453d6f75e4f3a75c08ebc8cb7ae5851625bf3cb7898290e765f935deb7c4c0fc57fe772b2334dd
SSDEEP 12288:Y7N07UCSA4aE5kkMuowPQebrDJiSAoYKxhKWmScxMNLN7u:Y7N07z5E5kk1owYqrgSQKx9cxMv7u
TLSH
T16ED4226567F1520FC8949F7029F353487B36C2706303875F86B893BE8C6AB944F56AC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a1
Size 1024KB
SHA256 56b33be3900075f0e228087f43e1bf0f828e97f2934333146daf0cb28502bb3f
MD5 9a5db84ce54d937e53b86e88afd3db9b
SHA1 b01d3baa4ef54e4fc78f72b8a776871402582179
SHA512 5b5bd6491e4311376d217e5e0dedb1cefb2cfd3954b712ec6300af7bbb5c8677551ecfced7f483d5e0357ac695d0689e864b2add7691bc331aa6cc3679f3798d
SSDEEP 24576:EQ0hgcOZTu22cb+8XwOyNsobcbDkF+n3Um:EQxu22cDXdyFKkFmUm
TLSH
T181253384F01521159A3261D22B74A62853A75DE8BDBE18AF8133F598D3CCCE72C7CB5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a2
Size 1024KB
SHA256 acea95fb0785515de82e7faa5404c29537c56ba92191a80753d024f44227934d
MD5 a30125ffd2923316549c053e7cc143be
SHA1 6615f7515ef2deb2b4ab34c43acad4b9a1952f88
SHA512 f30cd61aec5aaf0b006252d0567ffa377731e904c16a03787be7f33d77cf0c2cb1903a431f2bbc17ce0878bc18271fc2fd95073a4c4674a12f6a5b381724e158
SSDEEP 24576:D0L55NTrTsp1vXb0MMd4cqFyTt887CrVZQWyksg9Vcm:D0/RrTsp1/b3MH7CrV0k9R
TLSH
T1A42533248B58DAABB9F6958ECE0AF1F03D44B861D4A53D4C089D45733BE3DA3D142AC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 1024KB
SHA256 30d5d2954321fb83fb894e5e866da5b89da7aeecca6b4d81176904d3dda74856
MD5 e51674b44f07358355363ea2f537ceb7
SHA1 3f9cd0c027a624e51772add9c67a0a9b919cdce8
SHA512 b64537eda0a2aee53da7bdaea7cfb520ac92896f21aa51dcde0b553eaacc81d3921338500d37c6f2ca9597661eec37490cefb8718ad6aa834d1e890f1f993829
SSDEEP 24576:LelwAkVtLnwPfWk10q+q25E99MHnPyU5eWcLwLYzhxGUu:1VtLIWG0q+q7yPyUgBLw0CB
TLSH
T1BA2533C23DF48D08285DA16B82DCCD012E3F8EE42AE11BC39EF94BC56FD84E955A65D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 1024KB
SHA256 2e411ec46ccf17000b5ce1ac3b73d8e75df4e56af8d60f8736bda419ff5e2db7
MD5 e80b3623b14056864bbdf920bd962f87
SHA1 45707915539c20d3036321e1b0562ec347bc5264
SHA512 9834b6972faa61f20cc70503339d500ca7c57d4ca34c405fe4b68039f3bce230a8bb9bc135be5ac86519c9c559786f17b553edae5630722bf9e2ba741da6cb1d
SSDEEP 24576:iSR0/6foN/e7B9TyrRab169pSP2MmONhvIFkNhetrs1cbP:KLwB9T0ap2MX3IFkNhetI2z
TLSH
T17D253373A6C356C036C01A6165F25E0FD1912EBCCE3943728F95F4AF0EEBAD44099A67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a5
Size 1024KB
SHA256 38e9500c19f147ce2515e8d424ca9eb061bf92ff1fd1bef9f747299fd1d4f279
MD5 cf94caaafa423f663fb5ed1bfbd29448
SHA1 0f9513ed9e84bd5c5cb567b53eed421791d3bff3
SHA512 75a106f8548d3f8e034572ec47cd074f99b25fd513afaef73ce0820c84b0664ecab196c52826dfb5bff9687e5b4edfcf2bfb662041efcbd24129fe222af00102
SSDEEP 24576:X8fVcyM+artzbrCt3MCO6OKvf7fYJph6Mv7yHcwNZf:XxyM+a5brm3x/Df7A5vv7up
TLSH
T1F825337978DF1037CE3D516136BE2B6C06E73A1147B88B2D95A44A2AE84CBD32077F19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a6

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a6
Size 1024KB
SHA256 dbeb2bc187654985dc2e3cc9897bbdb0893cc2cbc402045dcaf6b0e77b9902b2
MD5 0f1a2f0267c6f4154ca7d0ac0c6e2b6c
SHA1 79efdf2018b1adbd06ff02f590b4d0dcb3e0dfa0
SHA512 4603de80cc51b9e2a2e83287c8c254632ceb040c879c71d426892ed6a9078ac63780f8941c99d372caa17872d49b180f2eb901ae1678caee487f0f2805a9f716
SSDEEP 24576:6/I1i01s39Tu9zr3Y1JcJNa9Wfo2p4b4bIwv9l2++m/59sFqqqXz0kcK:6/Aq39aRjY1f9WfZbTvzBn/5Sgq5pK
TLSH
T1FD2523973706EE49CB8F599A2FD842E9FD560CEBEDE440123B96CCD4E4B29139452CC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b0
Size 1024KB
SHA256 ec8967542ca8f50d1349d73480751471bb3a36e6b79b9320b4c5c6a17b16383b
MD5 9619e4e58b97eafbc540ef2b5fbe18f6
SHA1 84b50931834ee06bd59160c27a9c135e903a7e6e
SHA512 dc93c7b58241f5b06206c298512eaa47ce6e107110f17a92e4b0b4a79e77fa73ac837c792cade121bb3076c98278a91cf1fb33f371cec7a535ca41c004bf31e9
SSDEEP 24576:RJpCjoOZr5mZ1wIfhNGtb+eusJGQqvzbZ0ATrE0Hi:Pp7yrS1nNGp+eVXiXZhw0Hi
TLSH
T1BB25336BFE323E09E986724ED067C8E422060C5E1A377A156963874C3F7F9467DA0F09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b5
Size 1024KB
SHA256 8d39ec3af348b2e26b3bde5c6ce78bd18cdc280e3006f8b70516832fdea6b8d6
MD5 3f098a7ef6a19d7c87bf0e2becc4dc33
SHA1 8ece3ec2fefacd28076f564b2e704cf52678c50d
SHA512 44b6c131c0540bcfa64cb0ff17f6334a3ff22b6de264491f771ca573e232a01f964fdf9abf60976113aee1035526e5e56228e935926f3be49abdbdf70824fa5a
SSDEEP 24576:nUfx0Yd2h6F2x3avfOAeDm4EeAfB/wSFGGbtXqw/uUsSXzEdOc:nWEg2ovfheD7n6FbTpE4QYc
TLSH
T1EF25331A39A1AD411124E150EF7595A2F3E41F700BC00A1FBA871B2D13FFF89E5A5B9B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000b7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000b7
Size 1024KB
SHA256 145ebfc9eaf4d232369f4aa5513f17ad9a6c7a71a0c26a3964b4cdbf060a0402
MD5 32b11407466bf28c1953142c936608c7
SHA1 b9b44b3d2f08345093d04a188f19bb65d27842d0
SHA512 993f0f15496f48f30e81b4440fc702b061661c426ecdfc78e63dfaef3e68a2b2240956586c28c626856aa2d79ece16f80f9bf8ad9109ef73602466f0c533cccb
SSDEEP 24576:ZDyB+4ni0Ud4xqx/ZPty7N4Kf1w67j/DATUElmDElNB2xTt:ZD54nivBS7NH1w6f/Dq1DMBt
TLSH
T1B425338E72CEA71EE11C7E05458D4939D8CD14AB7721E9F40C87BB43D71BAB3058AB26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000e0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000e0
Size 1024KB
SHA256 a78fe4a6c35659dd95a88786bcf2bb914ebd90ccbf20bad2498675ca8be8b8c4
MD5 0f6ea6bbacf0147b6267f42409daf0fa
SHA1 cef09b85916641f9c65b6396f5a4ac24828befe1
SHA512 3af157b6bb597b13e88313692ba0cc48452ba38ba3615f43c194e8e7118d83816678d8b6a3013a9d072b5b45f56c1f7bae481a186478d8b7fbcfaf7697674a45
SSDEEP 24576:FZLiFHDOsf0kiPxJgTsrfyK0mBsGpBLjU+Jzxd8RtG:FNiFJwPsbsBsGpB/LhgRtG
TLSH
T15D25332A441ED164DCCAFE6606E960E92518BB2B5E24F5FB3FF4D2C2A753337E014186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 51b1147c08ed6a8f501d83e49cd2fec985bfb7c9c247503d5aeeec901437aced
MD5 6e032295c666a5e754ce0964163747c8
SHA1 8eea276450aa43718297e729aaa7dd960b5ea17d
SHA512 9ded183dfab4f48662931ac39b6b3d51121415d347135c6f4f7c6a8baac55dcd8268e686411174f28a069629b59b5c3dce9e5d26fc4b8eeee853932ba95ae424
SSDEEP 96:KjQpIMHOkXUHYdLWMUNDA0t49J0xeeRFiNTSUuCIdgJfLMTMlURXv5:Kj7KOkX1UDA0weKEhC0mfLMQlov5
TLSH
T1CAC1C51D02E28AB6DB100130C4D75D0570FAA34409673F87269C9ABDE812BBF4D62BBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588122.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588122.TMP
Size 3KB
SHA256 6825a245ab227d1f43016cd996492179abf4be96d5214692fbf9f2d5cd750b7a
MD5 056cdde175a3914049305ed1097fa7b8
SHA1 c37f1749b32a2c07797ecc520d68971d7d6b01e4
SHA512 e2da7e9acc6e06e290ba9fe2bf42974c2f1ee4a1372712fb6390680d8104a14daadb3d71288c172efa9e3951ece8ee316d77423a4a4d090c597b40230db80990
TLSH
T19E71D71E04F2CB52EB510131D4E16A0434FD878949877EE6306D8FFE2A24B718963B8B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 248c3ed6f2b9f24b140c8b89ba4c9904d797a6f03c18fa0c9a1b604a08081b58
MD5 69c325cb03dbe7358faecb8b58b2d7bb
SHA1 6cdcfcc7df82856f4e404bcf8d02d9cd00eff051
SHA512 aabf9e6ffacdd6a982dc889e9796aee647addedacb337ac2bcea7bbd4666136b86d21b90b84cc3bd3ddf13bdc69f952dae7cc15daf5d20a1cc9eebd77a43ad31
SSDEEP 192:D9E0hohFKee0uei48scxlx1kj6IFoShWwV61dPQZQUE0RxQ9z1qMw5e/lpcuzID8:D9E0hohFKee0uei48scxlx1kGIFoShWX
TLSH
T17F228BBB87E4996E891255F16A246E2FCE5C0B14432C3DA689D8FF4BA3D3032D24175F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 646b8a01ef84dec9fad8d2ffcd531aeed3861fc1ac111875f0f95648f9c39b2a
MD5 72e240355350d8e006123901e82e4968
SHA1 ba27520f662901d942c69deadef63d2c60fb7702
SHA512 04c5ed801e6cc04bca74188ed6a0fd21223c58747146ede744eb1b374754753598335c273defce16f7ce457f639553f68d9a166d0d25a53108c26874c14c51b6
SSDEEP 192:sxZVKJRIPyM/jK1Ml8MFYG/f42snQ4VrrIdpIVlS/W6+WNVVR4/Y0YMUmV1Ef1MZ:sxZM0dJ/fLsnPKOS/b6/5p9
TLSH
T11852E912AA346977CCDBD209B955FF53D6F51462A2900E44AAFC8A0C05E7BED321781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3f1fc57dc98e13d64451f2db64d882dd6f06368b7376cfa54f2fa89c40b1a3b8
MD5 a9e3ebb7fe3869f5353cb74001132168
SHA1 1db2220801bcd3ecc5f2036c937b7b4e0d5384db
SHA512 fdca1044a7701f7196a75a041a222c06cf8c9ffff4c537e7b8fdbbc111339ea736ebb6b454eb1c2cdf52d61acd60a6219bb013e00f905436612d8cc919b7b952
SSDEEP 192:sxZVKJRIPyM/jK1Ml8UQYOFYG/f42sYmKQljVrrIdpeVlS/W6+WNVVTehY0YMUTe:sxZMEq5J/fLs4eKQS/bWh51B
TLSH
T11152F716AA345977CCDBD209B955FF53D6F52472A2900E44AAFCCA0C01E7BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3cf83207d336eb9b4e68dc016f1952d93662754e55b8c7f0d073ca7aceffeaf9
MD5 d94c1be821e0346f402b94f55a2efa58
SHA1 82e7079990970001be472c22e0b31b7df475f928
SHA512 80c09bc24c7e6e72bf1775c88baed84cfffaba89924985aee16bc47424772e4bf52da719bc79bb78750b83ecd67055b4fd04eddec9ca4a8df2ee519d0e738baf
SSDEEP 192:sxZVKJRIPyM/jK1Ml8MFYG/f42sYmKQ4VrrIdpIVlS/W6+WNVVR4/Y0YMUmV1EfI:sxZMEdJ/fLs4PKOS/b6/5p/
TLSH
T15E52E912AA346977CCDBD209F955FF53D6F51462A2900E44AAFC8A0C05E7BED321782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 abd4a8f40ed569550aa7c8c3f79d1ad3513fb780fcb9af964adfbfabe5872290
MD5 bb27908711a9c91b1347b961c2e8df33
SHA1 a613fb5203ce6317ff05ed7c050290816a0a9c94
SHA512 74051231e28ca92e3031f28b1d3217aec1b10e6d8d53aec850bb84f8c88740911aa3346b0325d83f493ec781ba4b9945f573f326aab1e6562b9dc37570df4d2d
SSDEEP 768:hml1j83r2pmWRmeKQBC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV33ALl/C80/WKrocH:hml1j83r2pmWRmeKQBCu1jaK3ALpCN/V
TLSH
T16CE22C2B680CC77E4F844EACEC266F966ED801CBAB684D5447FA494C03C73EB551B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d89d5ae7f3619009ac02df63e91611e8423bb31e753b57e34567a8733d549de4
MD5 dd88721c258f1b202a0169133cd586e9
SHA1 b2684c63faa0d24faa98c405ea5c7e81e51a8f73
SHA512 14b1108268d1d76c3253cc079ad8553ba42a1f152547cd440f99741188a0601f916f4789c48c319a0296ae4d5cfba2842fbc2ed6f0c1012b857c08a920315572
SSDEEP 48:KkUIHKtecXyZRiIvKXqgjyVpIRKSUU/0VAE+H:KkUgKtem6RikKXqOepWKSUy0VAE+H
TLSH
T118A1978631BB82823D3D684CA2D19B1A5B427563302C69ABBBF940714E27F740DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e1df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e1df.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9a6033b86cce19d55af779f24cdfcfde7fc686caa0234c3c91af2a995a5fc462
MD5 d02989259a9f4b846f8ad310f9ed6da7
SHA1 e4c7dd9392ad51034d8d1e14f3bfc1d9d8a20245
SHA512 ddc641cb2c4b1758728bd39a59d50282ada480e8a6e15043fa1af7ebd79fcf9c973c25e4d80e9912246f033c19c8b53578ec65d522145e46ddb7bcc012bcd248
SSDEEP 384:TiF1tNn/s3n9SN8NE8TUNTUlIl3aK1R9OJgX532uORHYFVjIX0IidKzvRuqu:+F1j+9shwglOmzOdYFpI78Kzbu
TLSH
T14BC21AF358D78936CD9E4787B77E2E168EBCC067B5406A40B3985A0CCD862BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8a946669ea203fe3b42ae62fa6d6ce2ac9b11cec410a5420555b1bdbd8609a41
MD5 2d539de854ee30f7c3753bd8f8f6a8c2
SHA1 3f37193c5a2a4928d0653616fe0802a31eb0c156
SHA512 eb573363f01a71f600eb05d0229fbca0fef7be5ae9bcdf845fec9389a594d87a75de1a313a2da25ad118e1e9f0e3f39b16ac05881dab80b63c20d1313e828ccc
SSDEEP 384:xtNn/s3n9Sf8NM3aK1R9EJgX532uORHYFVIIX0IidKzvRuqu:xj+9U7EmzOdYFWI78Kzbu
TLSH
T133927C33AD359D764EE395C9F54336179FB89167A7842F80D1EC6B0C01CA39C630AA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 de0e9e2a531f676a24cea1367c2b8782b84a6617c486b531dc782005da19898c
MD5 7cf2b1202a7e5f8a30467933af1b71ce
SHA1 7637c9c824b2aafae429eb302871021a2d47404f
SHA512 954caf789e2404277ea9719080fd75c387286d8c3482e145c7cee1d66fb2a973aefbd3d7b02c9ee16099273b4bbd7f12f09d307524dfd72cef5be18c6c32d437
SSDEEP 192:6GNN6i5fQmiUyV3dVYO7X5zPr2uOAY8oYFajiO03U6:6GNN62h2kO7X532uORHYC43U6
TLSH
T1C202D935B9686C778FB39E55B58737139FA4102BE9992F84DAEC1B1C01C779C130A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 24c0709a39ebf5afad1e03cf36aa1c92b1c19bfaa0dd1229d544b8a9c86313eb
MD5 6913654a1ccb5c898013604075cb04dc
SHA1 bf1b7f93456735240252db1b616632edc010c3d5
SHA512 ac22be87a41afa8f8aead9231a1b31f00ce126d1c440ac6e9dd855b7b13cbed4d4519df39cd6ba319bc9beb7855e44ae05b619593812d1025fa3c20e4dc1891e
SSDEEP 384:vtNn/s3n9Sf8NMgaK1R9EJgX532uORHYFVIIX0IidKzvRuqu:vj+9UUEmzOdYFWI78Kzbu
TLSH
T199927C33AD359D764EE395C9F5833A179FB89167A7842F80D1EC6B0C01CA39C630AA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fecb04c62f4b8f64cbda26e06f60898e36dbca09d634838a2393c513fd5d53c0
MD5 477343115610c33765ac790e58188a6f
SHA1 d4e23f39fda3bc6cd2fcb014963afea9f7ff333c
SHA512 eead2bb6fc41cad832d0f3e8740d5d78953638c0ed2b29e98e7c47a2d1c2b445da65f0d5ba81e3755b9b727e7c88ca93bb741e277467470dbc64ce1ae64e03d1
SSDEEP 192:fpGNrR6i56iQmiUyVqVYfD7X5zPr2uOAY8oYFVNGQieqnU6:RGN962p0r7X532uORHYFVdIU6
TLSH
T1D812F936B968AC375EA2A595F5C331139EA55127EA887F80D1EC2B1C01DF69C130EC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6039b778-f1c5-4481-9148-92b14a98dd73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6039b778-f1c5-4481-9148-92b14a98dd73.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download