hxxp://multistoragedrvit[.]space

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
09/07/2026, 09:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://multistoragedrvit.space
Sample260709-lwpsmsgz4s

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
114	ipinfo.io
115	ipinfo.io
116	ipinfo.io

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4916	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134280644202881405"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{09C351F7-B36E-47B6-B171-C3957AB2F3C5}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2684263265-1628758615-802431902-1000\{4C1FC3E7-621B-42AE-9A4B-234CBF185EFB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
680	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe
5256	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 5256 wrote to memory of 4876	5256	msedge.exe	83
PID 5256 wrote to memory of 4916	5256	msedge.exe	84
PID 5256 wrote to memory of 4912	5256	msedge.exe	85
PID 5256 wrote to memory of 4912	5256	msedge.exe	85
PID 5256 wrote to memory of 4912	5256	msedge.exe	85
PID 5256 wrote to memory of 5152	5256	msedge.exe	86
PID 5256 wrote to memory of 5152	5256	msedge.exe	86
PID 5256 wrote to memory of 6100	5256	msedge.exe	88
PID 5256 wrote to memory of 5804	5256	msedge.exe	89
PID 5256 wrote to memory of 6100	5256	msedge.exe	88
PID 5256 wrote to memory of 6100	5256	msedge.exe	88
PID 5256 wrote to memory of 5804	5256	msedge.exe	89
PID 5256 wrote to memory of 5804	5256	msedge.exe	89
PID 5256 wrote to memory of 1888	5256	msedge.exe	91
PID 5256 wrote to memory of 1888	5256	msedge.exe	91
PID 5256 wrote to memory of 1888	5256	msedge.exe	91
PID 5256 wrote to memory of 5252	5256	msedge.exe	94
PID 5256 wrote to memory of 1392	5256	msedge.exe	95
PID 5256 wrote to memory of 5252	5256	msedge.exe	94
PID 5256 wrote to memory of 1392	5256	msedge.exe	95
PID 5256 wrote to memory of 740	5256	msedge.exe	97
PID 5256 wrote to memory of 4320	5256	msedge.exe	107
PID 5256 wrote to memory of 4320	5256	msedge.exe	107
PID 5256 wrote to memory of 4320	5256	msedge.exe	107
PID 5256 wrote to memory of 4636	5256	msedge.exe	108
PID 5256 wrote to memory of 4636	5256	msedge.exe	108
PID 5256 wrote to memory of 4636	5256	msedge.exe	108
PID 5256 wrote to memory of 4264	5256	msedge.exe	109
PID 5256 wrote to memory of 4264	5256	msedge.exe	109
PID 5256 wrote to memory of 4264	5256	msedge.exe	109
PID 5256 wrote to memory of 5536	5256	msedge.exe	110
PID 5256 wrote to memory of 5536	5256	msedge.exe	110
PID 5256 wrote to memory of 5536	5256	msedge.exe	110
PID 5256 wrote to memory of 5620	5256	msedge.exe	111
PID 5256 wrote to memory of 5620	5256	msedge.exe	111
PID 5256 wrote to memory of 6016	5256	msedge.exe	112
PID 5256 wrote to memory of 2080	5256	msedge.exe	113
PID 5256 wrote to memory of 2080	5256	msedge.exe	113
PID 5256 wrote to memory of 2080	5256	msedge.exe	113
PID 5256 wrote to memory of 3088	5256	msedge.exe	116
PID 5256 wrote to memory of 5988	5256	msedge.exe	117
PID 5256 wrote to memory of 3700	5256	msedge.exe	118
PID 5256 wrote to memory of 3628	5256	msedge.exe	119
PID 5256 wrote to memory of 3628	5256	msedge.exe	119
PID 5256 wrote to memory of 3464	5256	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://multistoragedrvit.space
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x234,0x270,0x7ffc7591c188,0x7ffc7591c194,0x7ffc7591c1a0
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,5522275935752813141,14883133827095951746,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,14437293114898906810,332917880432234780,262144 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,7033927298003671155,7388867773880489700,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,14973083042719906431,16797608645417486862,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,13856201453469255379,4714795928252687670,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,14105421688597080707,9209359413675230854,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4904,i,15979483484521286694,8580940801222141582,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8017125085250167748,6379860205186498480,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,14866561317585090906,15698971747124090366,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,14866561317585090906,15698971747124090366,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6116,i,15806296406331947873,11543173313448513561,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3496,i,17705365904122840218,16059937982479831828,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3636,i,2287378507494044456,3138363175091029914,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6780,i,18418927026280141196,11211927435052716804,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6528 /prefetch:1
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6900,i,9648416505261475475,12127850899782239814,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:8
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6908,i,13439156885915589778,8131991987363682654,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6852 /prefetch:8
  2⤵
  - Modifies registry class
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3568,i,9227467502336373573,2581010445270176882,2097152 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,17552011732204035816,3029807202018503882,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=604 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7052,i,17978733699631263982,11600552942797221161,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7056,i,10063957019315407368,12697199864836526386,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,16502992968633698662,492506704364213594,524288 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5320,i,6801097724258513424,4284898033204378282,262144 --field-trial-handle=2436,i,7401585006524809234,11199770677022560627,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 524ae55519907b3ab75a388a7d8adb5b3e5bdde0aabefe20ce772a09ea687d5b
MD5 f6eb566f9aba7efdbfb5c795bd65c547
SHA1 0ce2d6e7d9e58cb863af3f628d52cd4dd694f6fa
SHA512 2b08121677adac5c93abf00acc6bfcb28d8a72bca78fdef9052724d4f592d583e28680a2ae9a96d1bb7c0a432f05c206ebc2ec8238e6cabafaf5ae8743b7260b
TLSH
T19CD0C023360D3004E3494231D002C3042311447810078301F330D88C89241C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2aafce1c037be05e4c7ebafed37cf7282f3b61da9ab3f68cb43c724193f2a4ab
MD5 1a34bb39930694ea7604881fe671a327
SHA1 984165fe8abd42a03cd121d90e23865b1b24606e
SHA512 c9c7ad13bf7dcca0de7ae942e5c953da986e722b63c12f23dbc118dda97022414b13f1027b23b74906f10699650754782ea88b9d17b1c4e8aad63cf538d45022
TLSH
T147D0C0233A093004E3454231D042C3043321407810078301F330D88C89641C4D2930C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 c31834688f4f2fa3d132e99a757ce0681691b9b51640ea9782336a3b5e571710
MD5 650708b2b700564b0226ef17770af78e
SHA1 9a8323673755bde1a6089410a24cf4e8f2aa4c9a
SHA512 7e6f14ec8b3c8ad86437f4fd847591e91354dd35049311dffd509e9345052e1ff436db5e82244fb9be0683fce92f944136ec1421ce4f846928e0bc290b135fb7
TLSH
T11FE02BE6CD61EC3718FC071860550B85F75003572B40490F3B7C9608CF70737568686C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 cd5b2d7d73c54dc53172af948cc09150fa2433b76dd26b8f5458145e0f78c352
MD5 32d2d28a16bcb89c4fbea75a4690d842
SHA1 5e1618f9b00d29d0471224c325e4d4fbd9097425
SHA512 c97ceafe33bf401457fbf7c64dbad0f2a87d44c852c7480a54939c6ccd68fa665ba72e78673bbfb9450a16c4e4d7faaad36d57206603b6cc1e93a2a6b6c96125
TLSH
T18A51C838CEB22622FB3301B0A0DC5666327A86D3F597AF7BE4E4B07D563E7258139044
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58f1fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58f1fc.TMP
Size 2KB
SHA256 666d0a153c1a46793329c263ad74e659d47a7e8e42186a6e573e45462797f70c
MD5 44c28013e4420aed8dbc0f0224146e1b
SHA1 738ed6abdbc96b7385c3392f49ef059290179356
SHA512 649b3729124c79fe840513b8eac33e955c6140f463aa38b8161184565133ff370dfd339d51336a189abd8568c24d4eb93fcf343e2291b454081ee988056dfe92
TLSH
T15E518438CEB22620F7330170A0EC52A6327982D3F5A7AFB7E4E5B13D563D7258136045
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 233fc547eba96605ceaec1e150aada159450da969e9c66b3d9693f58ddf3f804
MD5 52768b597f520930125c01100fd9b331
SHA1 85b1ef96baf765965f6fd47f67ca3d2871b3d973
SHA512 b7eb2d77cfa45941b7e6f89ce21f0a31068e95417acc4a28b8c06334ce5ce7f70f7a8f9bbc7b5e89f9d39a34a0156468e0f117439a004d5bdf55ee21b164be1e
SSDEEP 96:D1vOxWRqCaaij6hzBex2wlxIgxfFQe7vVBs5RBqxOQQ:D1GxWRqCaaij6h1a2AxIg9FQEvVmHqxy
TLSH
T189B1CDF7C7F4866DCA1266F0AA143E27CF6C0911036C3D5ACAD4AE4BA7E25B0D14264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 23ff117a54fdc4ee589360ab796cd8939f9e51c7c50dc154aa34978cb3a189ba
MD5 c72573a2dede88769bead24d8854c6b0
SHA1 04caeade4c5cbf8f1bb5447f9f07b5c644a7775f
SHA512 5c1c8ce1ca6d9e4c7de8b931e6efbf0de1c44fd1b7632e39e5dfc767802a5c8370e766d5fed868714881cc8eefeaf72173320dd65d6a2ee29ded0c8fac945e8d
SSDEEP 96:D1vOxWRqCaaij6hzBex2wSIgxfFQe7vVBs5RBqxOHGQQ:D1GxWRqCaaij6h1a2zIg9FQEvVmHqxO6
TLSH
T1ACB1BDF7C7F4856DCA12B6F4AA143E278F6C0911036C3D5ACAD4AE4BA7E25B0D14264F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 c685a51db92a54bac4c275473866d8d08e074b479a3ea4a8e498f49808af7007
MD5 7d637c319d6199b96ac8daf2dcdfcf57
SHA1 e3dc537b2d1a3aa8fb978cead815e81e37e73135
SHA512 8443ec230e5d42af9bbc857519984af0374c36d3050371921575ba9a2494d6d5857eb15d22e7bd47e196dcd444c5ac0bed6bfd93ed3389de81d9ce1a449fd3ec
SSDEEP 192:sxZ3RfyMqZjK1Ml8UQLk4/fSsRhU8Z5z/FzodpYMvXHZHW6+WNEixFXYQQyXcScb:sxZ3kqg4/fSsRKC5rO1Hb5XDcbBf
TLSH
T14F72E8166A385D778CDBD219FA45BF93D7F9456392905E44AAFC8B0C04E7AEC220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 9f32c7ef96c97acbc92365824e0868cebcea318e556013c5ee0b28225724495b
MD5 6a9edfd1f7bdd0695a65b20884b5e3d5
SHA1 e933895e340f1d077f264908f2ab024743de39ff
SHA512 5054ec37e05836a6f1e6c5a4ca4f4eec08634f152bfafe17241ab09679983448452f207860d775c55239eef7babe5ae9304d37c7f90bf529287940516b91d740
SSDEEP 192:sxZ3RfyMqZjK1Ml8Mk4/fSsLha8Z5z/CzodpemHW6+WNblp/YQwyGcScZIgj1J:sxZ3kM4/fSsLwC5r5NHbf/Wcbjf
TLSH
T16762FA166A3859778CDBD209FA557F93D7F9452392905E44AAFCCB0C04E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ddd93c640e662c502f8eb86638cc1df77a2298622f6e99b3321005e81ad97b67
MD5 05935d2041921213c2915352f66cfcb9
SHA1 da1777fe0ccc73476b61fb62b7ddeaded5a5d048
SHA512 12857425d3c7e0616dd87b28b12e481e52fac401d62cf2d444b3a35b85e2bfac067ef4244c51b9b84be70447d5a8135ce2be134629431716442650f79874268c
SSDEEP 768:cFADqXGWviq5i8F1+UoAYDCx9Tuqh0VfUC9xbog/OVfRLl5bKp7roK/X:cFADqXGWviq5iu1jaSRLDmpIK/X
TLSH
T16DD20B2F684CCB7E4F841E5CEC266F8B6DD802CB6A984D5447EA844C02C77EE512B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 22KB
SHA256 53bb88fbf4f54f50ad5dc7f5064160a1943568af16f5ce6410ace01cc74d0a27
MD5 648146bd509fd5e4c2b6dabfede63355
SHA1 0e615e933bc23510c9d79bd1ed29da8bd739fdbd
SHA512 09948fb1c6622d48a88b6efe9ab88ec1a6f16fcfb2968f27838af1abcd91e03a598f8429e8680b9dd822fc1ee9c2ad77ca73fd2cd69c682e352602a17887b492
SSDEEP 192:cVSnNDxZ9l3iZ3QxVl/1hVPEzBB9KD3tHbb:c8NDb9ViJQXlthlE9k
TLSH
T150A26A16713A461238BD6D4CB3A68A3B4F4271633418E5AF7FB810760E2AE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 6c3c42ec73cea095615c05bf8836c2f0027d1528c5f421652473b2b54e100d66
MD5 f0cb3308611d046b52093dae00636520
SHA1 fb95f54e6a16b9f2e35a6aba6dc421b6acd4f8bf
SHA512 e07c920730a0c92fd24af0aa94b435fa7fd174ff78e2bc90ec20ad3ada9cc478b34745343d7117ae350d29d5c528846846240fb3ed466b37682171520848447a
SSDEEP 384:nyiF9CcmyWCs3sNf8TUNTUlImkrJBuFCifbZoie1de1hkP+lFYS/I1l1F7IgA:5Fccps3OwggBoie1d+hkoFYS/MS
TLSH
T1BAC25B32EC98CA6BECE64BD5E64A3547DEE08177868C9AD0DAD81D5C00DB1EC530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 af6bd0ddc286312268ce3bec9198d4ee00733ef30f6fe75857591819ac3c6499
MD5 0c7019697fa2c4eb539b8edebb4c22c4
SHA1 04990b32769b7e54fa7c695c857cf004f40e00c5
SHA512 f241e95c1a145e2a9adc7097309bc5df1c4bea9dc95a0b1b5889abc0ccb7ae8cdf4f9f37d551f6b95a490bec5a4e35688a7ad2ef2da51fd59c6bb16f6d072379
SSDEEP 384:nHiF1tNn/s3n9Sq3sNz8TUNTUlI4khIJDSICifbZoiekde1OObjI9G6w7jYF7IgC:CF1j+9v3+wgNZSoiekd+29Mjp
TLSH
T1F1D25C32EC94CA6BECD74FE5B24A3A57DFE44167868C6AC4E6D85E4C00CB5AC5307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 f780d403296fdfc113fdfbec526c29ab245b36b467191844ce589afb30ac3a0b
MD5 4168c7f19cd703d5f330f4b63dcd9483
SHA1 297f26f4e5b781b48fe286a86cd37a21e832c95c
SHA512 9d54d7107230850fd37fc437166f65cfcc57e3ff648a2fd40ee5f3200cea3f65e63242dc7f8250205c6736ece3ae5f0b952ed495e4b52580528a613fc82497a6
SSDEEP 384:ndiF9CcmyWCs3sNA8TUNTUlImkrJ12JCifbZoiZd1hkP+lFYS/I1l1F7IgA:UFccps3RwgUloiZd1hkoFYS/MS
TLSH
T1CBB25B36EC98CA7BECE64FD6E64A3A47DEE011B7959899D4DAD81D1C00CB1DC130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 96cc87523dcada654f6fdc25a465478858908a58a5274aae5bb4edf76a58eced
MD5 359a8c9eff4c1dc50537fdb72253fd29
SHA1 899b1a9f9ff933384e4cce075ebfba3c7245cad1
SHA512 084e2fe39a2cf31c09a91c93a030a76ee449b1827fd6754f6ea870a3fdfca2ddd114e2dc1098cccd0d2438585c74426aca13db0869ef8b19decd27b1cfa53a2a
SSDEEP 384:nKiF1tNn/s3n9SmsNz8TUNTUlI4khIJdSICifbZoiekde1OObjI9G6w7jYF7IgC:BF1j+9x+wgNHSoiekd+29Mjp
TLSH
T19CD25C32EC94CA7BECD74FE5B24A3A57DEE44167868C6AC4E6D85E4C00CB1AC530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 197506ae261c306a397759b6a5251048f0315f5755524fff7b394987a63c82d9
MD5 ce83d4031599b818d7e55cc5f4ac2597
SHA1 997190fb6422f0d4eebe3ce8d919f5e48c971bae
SHA512 46832929072e5228eb519b8bb046d22e105c92557b7f81ad66747cfa9a52ae720492d3b8ebdae728617731cc1e546bece181045f2059bb6cc5befc12d9a101f2
SSDEEP 384:nAiF1tNn/s3n9S7qsNz8TUNTUlI4khIJdTICifbZoieRde1OObjI9G6w7jYF7IgC:bF1j+9N+wgNWSoieRd+29Mjp
TLSH
T102E2D6F298D78A77D89E4B97A37E2D129AFCC167B5885984B7C85D0CCC861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 2366fee88cbf52e689f3b58c6b0e699add6b26f90bba40121fab3c3cb7005589
MD5 cc9ef3f90333a055676279c22cf7a151
SHA1 db4847ded46fdebc0a2b7376070104b1c387d1dd
SHA512 daa461dcd564ff2262b75166eee00d6193505a3fca5ceba80c995a6b3029be5ed10828878b388f87e2912e1571f19b070c71cf63df88b0cd9270b08b2a15de72
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe589054.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589054.TMP
Size 392B
SHA256 a8e7569b765fd2ec8b9967c5819cb6389aec4b3a4173673c80d97b3d8c45b228
MD5 9fae929b3601405837c16979ea2c5121
SHA1 4ed733384f63793ba1e2263115ddcf0059ce7732
SHA512 c003d9f3da2175198af6410cb4f9271aed042cb853b7feaacc1ff2dbaf19ddca485e54e6ee30e71bc66b1200101966e9c52272f09cf2c1b0e11b76e68e6f7a5a
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3049c258d31dcac56fec3cdfabad0aacd4dca50c9145407b9efdc5aa3ac50796
MD5 c4cd2bbbd4b5d578534c496fcfa4af58
SHA1 4eb42bcaf9b14608019d8f5b910d8b05d31db872
SHA512 25b9f0ee06bf62f6e0b0998ed39b41719a282ae11fceebd2439e603ced1644a9a1f275990b3d13c3ef9035df798e7368daaf38e9fccbbacba2ed273cf6415447
TLSH
T15C41195CAAFA1144B3B76E5AAFF6A96D047BB9372E4AD05D00110E4E0627A40C871B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/740-212-0x0000021D15140000-0x0000021D16140000-memory.dmp

Download