hxxps://malae[.]z13[.]web[.]core[.]windows[.]net/4nf[.]html#mehmetrifat[.]uner@tai[.]com[.]tr&page=_adobe&pcnt=3

Analysis

user interaction
yes
max time kernel
140s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
08/07/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://malae.z13.web.core.windows.net/4nf.html#[email protected]&page=_adobe&pcnt=3
Sample260708-e6p3tsay91

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3184	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279588163831209"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1768642833-2142038154-4041560723-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1768642833-2142038154-4041560723-1000\{54E7B8E3-4107-432F-9BE5-DDD40006DDEE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 4024	2172	msedge.exe	80
PID 2172 wrote to memory of 3184	2172	msedge.exe	81
PID 2172 wrote to memory of 564	2172	msedge.exe	82
PID 2172 wrote to memory of 564	2172	msedge.exe	82
PID 2172 wrote to memory of 564	2172	msedge.exe	82
PID 2172 wrote to memory of 1084	2172	msedge.exe	83
PID 2172 wrote to memory of 1084	2172	msedge.exe	83
PID 2172 wrote to memory of 5564	2172	msedge.exe	85
PID 2172 wrote to memory of 5188	2172	msedge.exe	86
PID 2172 wrote to memory of 5564	2172	msedge.exe	85
PID 2172 wrote to memory of 5564	2172	msedge.exe	85
PID 2172 wrote to memory of 5188	2172	msedge.exe	86
PID 2172 wrote to memory of 5188	2172	msedge.exe	86
PID 2172 wrote to memory of 3180	2172	msedge.exe	88
PID 2172 wrote to memory of 3180	2172	msedge.exe	88
PID 2172 wrote to memory of 3180	2172	msedge.exe	88
PID 2172 wrote to memory of 3492	2172	msedge.exe	89
PID 2172 wrote to memory of 1756	2172	msedge.exe	90
PID 2172 wrote to memory of 3492	2172	msedge.exe	89
PID 2172 wrote to memory of 1756	2172	msedge.exe	90
PID 2172 wrote to memory of 1804	2172	msedge.exe	92
PID 2172 wrote to memory of 5488	2172	msedge.exe	93
PID 2172 wrote to memory of 4436	2172	msedge.exe	94
PID 2172 wrote to memory of 5488	2172	msedge.exe	93
PID 2172 wrote to memory of 5488	2172	msedge.exe	93
PID 2172 wrote to memory of 1148	2172	msedge.exe	95
PID 2172 wrote to memory of 1148	2172	msedge.exe	95
PID 2172 wrote to memory of 1148	2172	msedge.exe	95
PID 2172 wrote to memory of 2624	2172	msedge.exe	96
PID 2172 wrote to memory of 2624	2172	msedge.exe	96
PID 2172 wrote to memory of 2624	2172	msedge.exe	96
PID 4436 wrote to memory of 5208	4436	msedge.exe	97
PID 2172 wrote to memory of 4648	2172	msedge.exe	100
PID 2172 wrote to memory of 4648	2172	msedge.exe	100
PID 2172 wrote to memory of 4648	2172	msedge.exe	100
PID 2172 wrote to memory of 4624	2172	msedge.exe	101
PID 2172 wrote to memory of 2652	2172	msedge.exe	102
PID 2172 wrote to memory of 5172	2172	msedge.exe	103
PID 2172 wrote to memory of 4448	2172	msedge.exe	104
PID 2172 wrote to memory of 4448	2172	msedge.exe	104
PID 2172 wrote to memory of 2768	2172	msedge.exe	106
PID 2172 wrote to memory of 2768	2172	msedge.exe	106
PID 2172 wrote to memory of 2768	2172	msedge.exe	106
PID 2172 wrote to memory of 5396	2172	msedge.exe	107
PID 2172 wrote to memory of 5396	2172	msedge.exe	107
PID 2172 wrote to memory of 5396	2172	msedge.exe	107
PID 2172 wrote to memory of 1916	2172	msedge.exe	108
PID 2172 wrote to memory of 1916	2172	msedge.exe	108
PID 2172 wrote to memory of 1916	2172	msedge.exe	108
PID 2172 wrote to memory of 4468	2172	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://malae.z13.web.core.windows.net/4nf.html#[email protected]&page=_adobe&pcnt=3
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffe6045c188,0x7ffe6045c194,0x7ffe6045c1a0
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,3394672200064096133,439339271147895041,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,7341744224002064258,10602755259318937892,262144 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,9149296727087603464,15685977490173783285,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=2424 /prefetch:13
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3536,i,1169115643138980660,4216610291606295869,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3516,i,7280672806521700010,5070143491868529925,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,16978555158474525589,9787285544714546593,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,904558665909678987,8460150558139947048,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:14
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,2814751536525199616,17005456803230958269,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4841701896014886383,13946774557572600831,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,4841701896014886383,13946774557572600831,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4180,i,14994546610994764621,10338892349241134357,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4115711115760153957,12431808619293195819,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6092,i,4103365480916094040,3696653505187528453,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6296,i,1047369420645083878,8629945623298455415,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5944,i,6953812585041981415,6319774600553390785,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6752 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,10034679454465609517,11379722630816585602,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:14
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,9265495930375503626,763204065443765185,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:14
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6128,i,13917208435656424509,15999182772066347003,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:14
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,2040863776761248655,16279923933540948706,524288 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6644,i,964577201136953851,17242527199963570314,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6152,i,18419529712702209744,9689604402652924882,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6136,i,3756878520435675482,9522710517187683168,2097152 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6396,i,8124895891437254287,14401592090172598783,262144 --field-trial-handle=2192,i,16284855392405553098,14787867491430504745,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22487b9c-7ca7-4a5f-91d9-71d26692af25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\22487b9c-7ca7-4a5f-91d9-71d26692af25.tmp
Size 24KB
SHA256 b30560784d67bc4ec1824ae6bedcb69b371db01bcc08d0bd8ae71481cfef39a8
MD5 8a5c2b0ebe666378332331605dae70a6
SHA1 2153113c217256aecfd5ef9d4a819ade9270858a
SHA512 85f66595fbe9e70ccc3179352f1d0819957109dc0335acf4bd9c3afc3e50e688a8216961a65d8ac5dae7a85805df487aeadb558c803ba526253e4a5897ed92bf
SSDEEP 384:nyiF9CcmyWCs38Nr8TUNTUlIxBrk6OFYR1zCfbLoNuIn/9gXzQR+wT6ty/7IgA:5Fccps3Uwg4jYnOotn/9QkR+UC
TLSH
T179B23A36D899CAABECD64F99E74A7502DEE45273C68C9AC4DAD81D0C009B1AD130BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 90371bf7f2d9f3b60c0aa66ed89740cd725604cc541112971bd392e8746018f0
MD5 a9d241f865f7d582346ece871b98ee14
SHA1 c59a959f2a8673df7c09862b8f91a9e9492ec3cf
SHA512 4822e1484423dfa2530e9a541260d4dcddb675339b2e5fb22cf50c15d65cd0b147c7d94ff11a6d6523e90406c9ad88e5919ccc3fc5ec3b74cbfa28567977506e
TLSH
T1F3D01266374AB001E76D8230E4C2C311266654E038864A01B214C81D99A41D86293186
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 0064889d40ca1b53c416414d30d8ce9d1e69c5a9bcb868169c51345c578969e7
MD5 2d7a6130914e7ae36e82ded55afde5cd
SHA1 6cac01915dc6917bd943db083cd5a4add2d89651
SHA512 9220a0ff517dc196cc4b6495a605792c42566cf576a9ac31f0ba5dd66e78947b1d51eb4a58ab1782bf1ca1f28e8d1f8c2134d0cd3eebc0bb37d892955c3abf02
TLSH
T197E02BA6CA229C2B5CFD072974654A45D70513272A40994F373D820C8FB463B059691C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 a9111c94c3990bfdc378ae9e08ce383b4990d76ea3086d16250fdb90391b12f8
MD5 e6c5d19bb8698e8006be7ebaa9f80fb4
SHA1 996d92499f8c07b794e467ff7229e91303252b80
SHA512 b7a15a968646f513559f8e9ab34cc0d485ff65ececd8e90a8fb00400e5f65eaa114ea83ffe842038c40b40f00de1eb739e51fd8941565cc705a34198c5083bd8
TLSH
T1525110D549463690FB3276B061C381F9F731B0780A4F0F92C3849BBD6B1BE61CD9A004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 137f9e03acb6d4159339cfe7074a9e28e4810d98d27de59255fbffe55ebe295a
MD5 1aeb748fddc84fd904479194df0c8fe8
SHA1 766140c3ed85e5fffa1ddfda0842024d9fa200b8
SHA512 ccca78d5a8ebce3f162d84e16d137f27686f83fd72aa6c2822be4dc784e7e7a75a721e2e4c4d654965a29dbdd896c35d6fa17288e9db3d6a449236e7479b64fe
TLSH
T1AE5110E945423650F73276B0A1C391F9F37074B90A4F1E92C3849BBC6B1BFA5CE56004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588f4b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588f4b.TMP
Size 2KB
SHA256 63d4be69adb067369d5fe960771acdf06befa0e4f8521be92e920e226c74c33d
MD5 7d12c730ee0a5db8321d8399fb3ba1d4
SHA1 71bf52efe66cff86bc2cb68a15fff77c989f864f
SHA512 c7d06c2b2f7a2ec6a5e200de02c899343974e4e36e823676c306ed74c1940e3dfaf3410a50ae6229e7de3d4edb44f353b456a6ff3f805f6a9feae58461aa486f
TLSH
T103410DC946423660F73276B1A1D382F8F371B4BD094F1E92C3849BBD6B1BE65CE52408
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5ef95f74b89b587b67ef3d811103fa4e1fcfe372384db860a1b1e6dd44dad43a
MD5 2f407616a79e146a1500d948ac78bc4e
SHA1 6c962c280120937e9861e9eae5b120d0e9fa43cc
SHA512 2ad6c700f6f5358936940ad83116845010bc5e62e28d1a2532f4150750988f1540c1b64a7a45a61b6c69735eca08e959362f26650e68b7a72b119db4aac553b0
SSDEEP 192:D1QPoaL8DxcY9raaij66/WmgVwQR9/HCHIR0vO:D1QPoaL8DxcY9raaiG6/TgVwQR9/HCHU
TLSH
T1A1E18DE7C3F88A1DD85252F4A714AE1BDE2D092447383D7A89D9EF4BA3D1075E201A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 cbb42330e34d2061788106d9f5234cc8bc858d9f139b0f559ac5265ff509f86e
MD5 38317d8aa82e77ff4d805f10fa0699c4
SHA1 1054b241462dd41cd6c456e2d82e78862a4679d6
SHA512 817e88f1951bf8fd78ef6a1352d37ada4784f34cc765e3b5d16a4fda1d20b629715b2652f05112555faed58466190688d2827b961aa00f4d1d6f907bae8f9e52
SSDEEP 192:D1QPoaL8DxcY93qo2Baaij66/WmgVAYs3uJhONIkps0F2P:D1QPoaL8DxcY93qo2BaaiG6/TgVAYs3A
TLSH
T144027BE7C2E8861DD81252F4AB14AE1BDE2D09244B383D7A89D9EF4BA3D1074E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 1a08bb2251aacd81c37f845832b301c23cfc1c2e8e12161957a04bef6520aa45
MD5 d4bc2e4aaf07df70a60cb76f740b5d6a
SHA1 8646c95419c7b4e57b9b1156fa44efa967926ebd
SHA512 e369b9b789ab358f09e424516337d3b02e44157d775fceb2eba56b40f084d4fe5c7e66f388bd1ed7703215fcde85dc7531f932871329434ba9563859c585b86f
SSDEEP 192:sxZxRLyMqZjK1Ml8UQIF3/fEsysEfKQ7Px0VzodpYD22Z/W6+WNRF2dTRinI/Y0N:sxZx8q+3/fEsFCV750+dG/byrL/5xhJH
TLSH
T15372C616A6345977CCDAD31AF955BB93D2F91563D2804E44AAFC8F0C01E7AED2203D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a535e9e73db9ccddf0c784655eeea92b694768dfa9247dbdec3a912b0fb438f9
MD5 d4730377dafb07bc3bc15dba63b58ded
SHA1 20823f9d0cdbf6eb380b8040f1938b6306204345
SHA512 33513438ca96621d1f15350f07a06e117bf51cb2a7000d8c8adf0a5ce7c3505e539d34a6ca0830f66fd8197e1f9412c92ef41c994015215017752f3417c8c4a7
SSDEEP 192:sxZxRLyMqZjK1Ml8MF3/fEsqEWKQ7Px0VzodpY122Z/W6+WNRF2anI/Y0Z1uorI+:sxZx8d3/fEsqDV750+3G/byT/5njJH
TLSH
T10A62D6166A345977CCDBD319FA45BB93D2F91563D2C04E44AAFC8E0C01E6AED2203D2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 8652f2bb7385ec578c6649d0940f80691484a1b69d80c0b2c794c8f774c3b5e3
MD5 d51792b63ed3ba1de7e48851e2ecbcb9
SHA1 441158678a38e65a5837887ae322829c74aa752d
SHA512 468d51f64995a86b8c72048d3fe0014e3cad088e553e92f24ae91a3986ac987584f131594b5bfde63b68ca46b72748b9528957f737e8af7a0fc7e1752d42c053
SSDEEP 768:XwZh38Dv2aFWRm6GQXm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV309Ll/lv0bzkro15:XwZh38Dv2aFWRm6GQXmu1jaK09LplMbH
TLSH
T13AE21B3B280CC77E4F844E9DEC26AF966ED802CB66684D5447FA494C03CA7EF511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 26KB
SHA256 672ffa8ecdaa91a77ed0a81bf7b605477eb611e628acf13e8143fc4439520160
MD5 d4713abb715e60fb877334b345934c56
SHA1 a963cb3ca2cc72536107bec812d002103c27e661
SHA512 f37ba45b0c0688a22af1da22805817905fce7a58a6003902a868e80aebc07a40f946d57cade5a7e038a095aeb937e429ad011aa21530b0fb0600958e5105ff47
SSDEEP 192:cFkbIH791le1K77LTl56jbSp+bv+TVCNnCtTq/tVZ3KjlH3BbhXs+zC+4AwRgFex:ctGj+BCNC5qFVpKxHxbhs
TLSH
T191C27A1632BA02023C7D791D879597375A82B1B33028E93B7BE914B60E67E214DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 1ce7dd857e036248283a41aa772ab63b2b8c8c9eb67e6c72691f892c0d056f62
MD5 38567de660eaf8b2cd7e75a534ba6922
SHA1 c71fad29081bf148c796a81f4a4e71867f26b378
SHA512 2d5fc306a8e3a4ad67953a22c3032c50c3248b051ba9d391fd99591bfa73813a4eae25c50f2d08cd70ff03db288c7ed37f1db01a9109cab9bc0132ddfe4940da
SSDEEP 384:nViF9CcmyWCG8N/8TUNTUlIRUrk6F0k1zCfbLoNuIn/9gXzQE+ScjmwRty/7Ig+:cFccpGEwgtr+Ootn/9QkE+1jh
TLSH
T154D25C36EC99CAABEDD74B99A74A7602DEE01173C6CC4AC4DAD91D0C00DB1ED130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 eb7dede5034e51d0d90cd1780dfd4d7f3f6b55fc64db142750f88e58c0a3c46e
MD5 21b7b856bb5f2936e91432df1debbb8b
SHA1 d851ee928a29ef5d32a5f4527cce23b60f54a696
SHA512 c9dc3696fc57395182c0f627c79737cbd6851cae98696a62c1e9c1921bb541a7786ab61d75b4ca241d736cac04c725e69483f3a2b47aa029349131553a1e3d11
SSDEEP 384:n3iFltNn/s3n9SI8N/8TUNTUlIRQrk6+0k1zCfbLoNuIn/9gXzQE+ScjmwRty/76:yFlj+9nEwgt6+Ootn/9QkE+1j/
TLSH
T113D25B36EC99DAA7ECE74FCAB74A7602DEE0016386CC5AC4D9D81D4D00DB1AD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 6e09c25b8949b10b9ca1d0d4db7da30490ca23f30af12775e723595773eedcc8
MD5 dce79bac0a4a59eaa7b8896866a3acbd
SHA1 72a7e24373a07f03f18ecc86c8a39d0c0687f4e9
SHA512 a80f5570f995a76a5b39649406409d04774108d43d8ab2bd50606aa7b6e659032c2bb592bf877bc8adb6bb1ba7f8c8ba737697a976c80049c5e79f1a0b7460b5
SSDEEP 384:nViFltNn/s3n9SI8N/8TUNTUlIRQrk6+0k1zCfbLoNuIn/9gXzQE+ScjmwRty/76:cFlj+9nEwgt6+Ootn/9QkE+1j/
TLSH
T12AD25B36DC99CAA7ECE74FCAB74A7602DEE0016386CC5AC4D9D81D0D00DB1AD130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 ef8b42c9827caa5be48d3f6ae6b50e09c72f15e5f34d1df69dd71d8532423d57
MD5 852aaf9afe0f619109a3bce9f695c512
SHA1 f561a5c87538a57ba71dee4c75e7a44130124b77
SHA512 9e17a0433781f6c3a5f3b8026265619f396f49d0e9e41d97d845dd51b1db730b47f658a3dc4fdddad252eab532ee40bc43793e24c2567fbb4c3ea3391ed29fb9
SSDEEP 384:nviFKtNn/s3n9S88NL48TUNTUlIRQrk6yrk1zCfbLoNuIn/9gXzpm+ScjmwRty/+:6FKj+9NQ4wgtl+Ootn/9QFm+1j/
TLSH
T1F7F2C5F298D78977E89E4B87A73E6D0289FCC163B5885A84F7D81D0CCC861BFD206915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 c6a9bd18a50f854d63fae83204250d2e710b0cc19d0e10d1389c76b6acf81960
MD5 37389bccb60982276a630e6bb897f47d
SHA1 e2a4d0c12a57a2ce78ab2f416a0e77da74830478
SHA512 870a068af6b1c740aead9613960cfd3ad84b7994e346ff4b8b6e7a742408ba892dbe70e7b2acb1c885e098fa8c985c43539e2f31099303675afaceef649b1912
SSDEEP 384:nviFltNn/s3n9S88N/8TUNTUlIRQrk6+rk1zCfbLoNuIn/9gXzpU+ScjmwRty/76:6Flj+9NEwgtl+Ootn/9QFU+1j/
TLSH
T196F2C5F298D78977E89E4B87A33E6D028AFCC163B5885984F7D81D0CCC861BFC206915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 142a326330b2c1197bf99b815110bab0e52c1159ba440aebf9fefb60d01f5673
MD5 245d85f1270836831024357901259f23
SHA1 0c6c9186c9dd2d2749b075929c403a01be6e87f4
SHA512 430b0adad40683d2fac4679556c0651dc4d0672dc2620403a87a6fc79011edf0e5c3a2501c0e06f0c8ae6635a85760249bf00272e6c8019bd801cbbd946301b7
SSDEEP 384:nIiF9CcmyWCs38Nf8TUNTUlIxBrk6onaF1zCfbLoNuIn/9XSswT6ty/7IgA:TFccps3Uwg47azOotn/9XSsUC
TLSH
T1F8B23A35EC99CABBEDE64F9AE74EB603DEE01273C5885AD4DAD81D0C009719D130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1804-210-0x00000249B0620000-0x00000249B1620000-memory.dmp

Download