hxxps://link[.]hawkmarketplace[.]com/ls/click?upn=u001[.]NRX3OcAfcLfHWEd5qsjyzIV0kVb32RLibV-2FV9ARCLEcgc2bwxWJYhMZztFH-2BWHlMdYQW65KNpG2vy8yzEwWkCDXkssfwCFiI6PJrvmLjCVKF2T70OBd6FGndd9v5OpHOz3pB7GkId0ODKEcGddFSHZkgXR-2Bgt3UXp3SjffHUxOI-3DtzBO_Rl7CHw5V1ba0i3Gf7Q0jq1nADBrHZM78AY-2FyNsfzgqmY3cmxHHjaBpSyNYysLkCxxnkD4CeeLXwfetR-2BljtPcF2kcs03-2FyS6EF70nCN8LjbvtzAnI-2Fde9S7yDLBgaBKMJYR-2Bq5-2B3UbW1WzxHFGu2189NtpydcPTUbJd1-2B0MdvRHPcDchTxNm-2FQeQEMtTJLtLIff7WyZZ5zLjgTeh8rr28n6VQbQyUEVyjXq61p3jKBaNz-2BjgtsAd4XqpM6AXfq6-2B1sFkng5ZZQv8oPHkjbsmjR0ruFsxRKvvBx0tHPn0WpsX7s2x99PCKqH-2FvTyw8-2BhUzFV-2FfC9KL0ln0LTOTwQS8AGz3m8Bn2S4BMZ1cWYp6XHs0VgBH3HQqNpJchWZpF4N15xjhsoOhhghHWXJrS9XddsDPbNzzetrlE-2BmqzudUwIkvgSmyBF5Ic6exF8FZ4ktpBaM7TAYsgqehtw9EwI4e5Men2A7-2FS-2FNo9nrEhmWWW-2F2AdfB7mlckqhEvoLGoQwLLa3P9J-2BKs7mHYfxOAjTBx0RRdVLf-2FvOfUjqYyW9MmPPDjoaloHv7A7v9x4OJY7yBlwEdMh-2BeCan-2BaTtPq5jKifGlt0PjWBwjxCPBuYH5jW1xXTkSc6qAPXqmQJutYVfRQPp8XqLoqQ-2F18l3PlI5zM3D84kxazYDpuHn4ro9EkOADHqHNFoyE4T6HXIBj-2F4nD23WJu4wdusXf1I2QuX-2F1FYk9Jb-2BI-2Bizsi32-2B7tnkz6RNsSCIZwLHLSKSDJBMKsmEDVOHQzQhhCJcmWLFD7pNIDsMIZUMZDE8a8-2FyHD1LmXHtcowlztdZCR-2BC3kJEmc2fiMfqoLJ6amcC6WQxQJtpB0oXHtIvV7EfBV4VBNRmpCN5FP4thJUGlmGs4hqcLE3rRV8ugqkJ6UzqY-2F8Yc89wC4hDW2DCr5w-2B2qw7akvjtKPC4u8hFXIG76T4v0S-2FkiEF

Analysis

user interaction
yes
max time kernel
388s
max time network
377s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://link.hawkmarketplace.com/ls/click?upn=u001.NRX3OcAfcLfHWEd5qsjyzIV0kVb32RLibV-2FV9ARCLEcgc2bwxWJYhMZztFH-2BWHlMdYQW65KNpG2vy8yzEwWkCDXkssfwCFiI6PJrvmLjCVKF2T70OBd6FGndd9v5OpHOz3pB7GkId0ODKEcGddFSHZkgXR-2Bgt3UXp3SjffHUxOI-3DtzBO_Rl7CHw5V1ba0i3Gf7Q0jq1nADBrHZM78AY-2FyNsfzgqmY3cmxHHjaBpSyNYysLkCxxnkD4CeeLXwfetR-2BljtPcF2kcs03-2FyS6EF70nCN8LjbvtzAnI-2Fde9S7yDLBgaBKMJYR-2Bq5-2B3UbW1WzxHFGu2189NtpydcPTUbJd1-2B0MdvRHPcDchTxNm-2FQeQEMtTJLtLIff7WyZZ5zLjgTeh8rr28n6VQbQyUEVyjXq61p3jKBaNz-2BjgtsAd4XqpM6AXfq6-2B1sFkng5ZZQv8oPHkjbsmjR0ruFsxRKvvBx0tHPn0WpsX7s2x99PCKqH-2FvTyw8-2BhUzFV-2FfC9KL0ln0LTOTwQS8AGz3m8Bn2S4BMZ1cWYp6XHs0VgBH3HQqNpJchWZpF4N15xjhsoOhhghHWXJrS9XddsDPbNzzetrlE-2BmqzudUwIkvgSmyBF5Ic6exF8FZ4ktpBaM7TAYsgqehtw9EwI4e5Men2A7-2FS-2FNo9nrEhmWWW-2F2AdfB7mlckqhEvoLGoQwLLa3P9J-2BKs7mHYfxOAjTBx0RRdVLf-2FvOfUjqYyW9MmPPDjoaloHv7A7v9x4OJY7yBlwEdMh-2BeCan-2BaTtPq5jKifGlt0PjWBwjxCPBuYH5jW1xXTkSc6qAPXqmQJutYVfRQPp8XqLoqQ-2F18l3PlI5zM3D84kxazYDpuHn4ro9EkOADHqHNFoyE4T6HXIBj-2F4nD23WJu4wdusXf1I2QuX-2F1FYk9Jb-2BI-2Bizsi32-2B7tnkz6RNsSCIZwLHLSKSDJBMKsmEDVOHQzQhhCJcmWLFD7pNIDsMIZUMZDE8a8-2FyHD1LmXHtcowlztdZCR-2BC3kJEmc2fiMfqoLJ6amcC6WQxQJtpB0oXHtIvV7EfBV4VBNRmpCN5FP4thJUGlmGs4hqcLE3rRV8ugqkJ6UzqY-2F8Yc89wC4hDW2DCr5w-2B2qw7akvjtKPC4u8hFXIG76T4v0S-2FkiEF
Sample260722-qa7tjsfa52

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3736	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291990851489931"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{494700C3-DEA8-44CF-A2B5-44E59DEE897E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{F4F7123F-C612-45D3-82E0-B53E39C4039C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 1440	1144	msedge.exe	88
PID 1144 wrote to memory of 3048	1144	msedge.exe	89
PID 1144 wrote to memory of 3736	1144	msedge.exe	90
PID 1144 wrote to memory of 3048	1144	msedge.exe	89
PID 1144 wrote to memory of 3048	1144	msedge.exe	89
PID 1144 wrote to memory of 4748	1144	msedge.exe	91
PID 1144 wrote to memory of 4748	1144	msedge.exe	91
PID 1144 wrote to memory of 3788	1144	msedge.exe	92
PID 1144 wrote to memory of 3244	1144	msedge.exe	93
PID 1144 wrote to memory of 3788	1144	msedge.exe	92
PID 1144 wrote to memory of 3788	1144	msedge.exe	92
PID 1144 wrote to memory of 3244	1144	msedge.exe	93
PID 1144 wrote to memory of 3244	1144	msedge.exe	93
PID 1144 wrote to memory of 3976	1144	msedge.exe	94
PID 1144 wrote to memory of 3976	1144	msedge.exe	94
PID 1144 wrote to memory of 3976	1144	msedge.exe	94
PID 1144 wrote to memory of 4280	1144	msedge.exe	95
PID 1144 wrote to memory of 4280	1144	msedge.exe	95
PID 1144 wrote to memory of 4280	1144	msedge.exe	95
PID 1144 wrote to memory of 4712	1144	msedge.exe	99
PID 1144 wrote to memory of 4712	1144	msedge.exe	99
PID 1144 wrote to memory of 3336	1144	msedge.exe	100
PID 1144 wrote to memory of 4852	1144	msedge.exe	101
PID 1144 wrote to memory of 3336	1144	msedge.exe	100
PID 1144 wrote to memory of 4852	1144	msedge.exe	101
PID 1144 wrote to memory of 3388	1144	msedge.exe	103
PID 1144 wrote to memory of 3476	1144	msedge.exe	105
PID 1144 wrote to memory of 3476	1144	msedge.exe	105
PID 1144 wrote to memory of 3476	1144	msedge.exe	105
PID 1144 wrote to memory of 5108	1144	msedge.exe	106
PID 1144 wrote to memory of 5108	1144	msedge.exe	106
PID 1144 wrote to memory of 5108	1144	msedge.exe	106
PID 1144 wrote to memory of 4340	1144	msedge.exe	109
PID 1144 wrote to memory of 2512	1144	msedge.exe	110
PID 1144 wrote to memory of 1716	1144	msedge.exe	111
PID 1144 wrote to memory of 3304	1144	msedge.exe	118
PID 1144 wrote to memory of 3304	1144	msedge.exe	118
PID 1144 wrote to memory of 4240	1144	msedge.exe	119
PID 1144 wrote to memory of 4240	1144	msedge.exe	119
PID 1144 wrote to memory of 4564	1144	msedge.exe	120
PID 1144 wrote to memory of 4348	1144	msedge.exe	121
PID 1144 wrote to memory of 4348	1144	msedge.exe	121
PID 1144 wrote to memory of 2208	1144	msedge.exe	123
PID 1144 wrote to memory of 2208	1144	msedge.exe	123
PID 1144 wrote to memory of 2208	1144	msedge.exe	123
PID 1144 wrote to memory of 2676	1144	msedge.exe	124
PID 1144 wrote to memory of 2676	1144	msedge.exe	124
PID 1144 wrote to memory of 2676	1144	msedge.exe	124
PID 1144 wrote to memory of 3400	1144	msedge.exe	125
PID 1144 wrote to memory of 3400	1144	msedge.exe	125
PID 1144 wrote to memory of 3400	1144	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://link.hawkmarketplace.com/ls/click?upn=u001.NRX3OcAfcLfHWEd5qsjyzIV0kVb32RLibV-2FV9ARCLEcgc2bwxWJYhMZztFH-2BWHlMdYQW65KNpG2vy8yzEwWkCDXkssfwCFiI6PJrvmLjCVKF2T70OBd6FGndd9v5OpHOz3pB7GkId0ODKEcGddFSHZkgXR-2Bgt3UXp3SjffHUxOI-3DtzBO_Rl7CHw5V1ba0i3Gf7Q0jq1nADBrHZM78AY-2FyNsfzgqmY3cmxHHjaBpSyNYysLkCxxnkD4CeeLXwfetR-2BljtPcF2kcs03-2FyS6EF70nCN8LjbvtzAnI-2Fde9S7yDLBgaBKMJYR-2Bq5-2B3UbW1WzxHFGu2189NtpydcPTUbJd1-2B0MdvRHPcDchTxNm-2FQeQEMtTJLtLIff7WyZZ5zLjgTeh8rr28n6VQbQyUEVyjXq61p3jKBaNz-2BjgtsAd4XqpM6AXfq6-2B1sFkng5ZZQv8oPHkjbsmjR0ruFsxRKvvBx0tHPn0WpsX7s2x99PCKqH-2FvTyw8-2BhUzFV-2FfC9KL0ln0LTOTwQS8AGz3m8Bn2S4BMZ1cWYp6XHs0VgBH3HQqNpJchWZpF4N15xjhsoOhhghHWXJrS9XddsDPbNzzetrlE-2BmqzudUwIkvgSmyBF5Ic6exF8FZ4ktpBaM7TAYsgqehtw9EwI4e5Men2A7-2FS-2FNo9nrEhmWWW-2F2AdfB7mlckqhEvoLGoQwLLa3P9J-2BKs7mHYfxOAjTBx0RRdVLf-2FvOfUjqYyW9MmPPDjoaloHv7A7v9x4OJY7yBlwEdMh-2BeCan-2BaTtPq5jKifGlt0PjWBwjxCPBuYH5jW1xXTkSc6qAPXqmQJutYVfRQPp8XqLoqQ-2F18l3PlI5zM3D84kxazYDpuHn4ro9EkOADHqHNFoyE4T6HXIBj-2F4nD23WJu4wdusXf1I2QuX-2F1FYk9Jb-2BI-2Bizsi32-2B7tnkz6RNsSCIZwLHLSKSDJBMKsmEDVOHQzQhhCJcmWLFD7pNIDsMIZUMZDE8a8-2FyHD1LmXHtcowlztdZCR-2BC3kJEmc2fiMfqoLJ6amcC6WQxQJtpB0oXHtIvV7EfBV4VBNRmpCN5FP4thJUGlmGs4hqcLE3rRV8ugqkJ6UzqY-2F8Yc89wC4hDW2DCr5w-2B2qw7akvjtKPC4u8hFXIG76T4v0S-2FkiEF
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffece17c188,0x7ffece17c194,0x7ffece17c1a0
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,3572787031973225095,14774112380332430548,262144 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,6776952548469092629,3889211225994748190,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,2125899378637829416,11855172504201686252,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,5124683906093624632,2759342342177849763,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13469959854489874641,9640882743576400054,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,6125527315422406235,9616146584775722475,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,4243356379891259019,7839070744091448211,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16708228602604146793,12923183390643015288,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,18371227901130513457,2006273272712354681,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,18098694360319882080,10629671927787576099,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,4576329480410961876,6541888174923027661,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,4576329480410961876,6541888174923027661,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4416,i,17858268691953426160,10264097182965462354,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3420,i,4850071897903559459,15898638145042192650,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7708278466910463391,14318176472873563031,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,257991627649436955,9327295621005305956,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,15300018866593389253,5082914842989218973,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,3596256963351702481,3198304690814345901,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,4899519057058987557,6794545170397024854,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6824,i,5721116023193642617,2056955567625464784,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,7422664965915690846,15961817531877247087,524288 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6212,i,17419459208230472484,2323737682220679471,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4988,i,11401902297091710028,2403300153617848390,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=3732,i,15674123310343979145,11567199072572660564,2097152 --field-trial-handle=2072,i,1681661033975304622,15291367972945985332,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3400

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 758df8d3fcc8153add0884f31eebee2a2577adda6817b51a21944c2f22794229
MD5 dfe64ea383e58df01fbdd8c6865b3a83
SHA1 64d0ff086bd183d34c0b6b57979d47d1fe496dd7
SHA512 524a90cba89216a298c0432d24ac36c2e9c4be3586290c83a8e424408da052cee2b563929aeda73dc89ea7e7dbb596e97fee811e69b8a48e16ebaa5a39d7063e
TLSH
T1BFD0A73076696C96D538147194314701BEA58556219A96066144840D5C796C2B68A5A2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e20f45d9fccf8be47620d90a84c52b80df3489b3bf2e5d4b4c5e44867edb8642
MD5 b9dce92949b172bbbaf9152ecc20a571
SHA1 4312ec29c44c1be4af0ead8c86e8ff4f6e85f01d
SHA512 12cacf1b08ea055c0f89cb7480cc50b860b96503f621b4286e2bf9359330498f70711dd1b851876815313b0691696058db5a4d2bd0dd35affaeaf4aeffde1aec
TLSH
T16D81D56C49E16745D7D23234E0CE390B3431D8AA269BBDF29BC8847D5F1675D8E7204C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 5d6f503274b208118f3b4594737637121f49a2c9ebbd74894dca970535e19364
MD5 397a2beae2d412b5fca63d6ca03583e6
SHA1 b7004670d718adbdb588a42fc1d8a16e3f0d60cb
SHA512 1ce69d6cd713290037b7be3879bd45cea0d8df438636aed3737350e04c24daf13458bf019a48b0fddf8b44eb0bd56056b41479f7421bd9c6e184c97ec92318cc
SSDEEP 48:BqonYrx5gmPJ97nasxnxkisZyH6MHJaaWxHmMsnY5tLUiutDWfFI9N:soYF5gmP7naAxqZBMpazxHRf7Puq6N
TLSH
T13B91B35809D23749DBD62234E0CD395B3030D5A62AD7FDA68BCE947C5F1678D8A6208C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f46412fa0218c97559e00c53f18b6fcb3139bce81f2f9b635477a1d127521143
MD5 2d57a7e54cbb38ff21128fe0dd579a06
SHA1 3d040b9904e4b817c15ee9e24014fde8c1490460
SHA512 67a9eaa85a110d4456dcae7399f815838140ab5187b27315185157104db86b6443716e259751fb90dc21fd008ae58bc74c54cefab7ecedadaa15c21bf5245063
TLSH
T10471C51C05E26B05E7D23231E0CD390B3571E8AA0A2BBDE59BC4C8BD9F0671D8E71048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 304c9cc99535791485f3d92834599f7a0f4d429dbe232fc3cc627834a2b0f2da
MD5 c3fe491edbe439c710f689e1119748e3
SHA1 f7a87d9afab2c3cf316778d7262a772ca7aa5358
SHA512 5f680827c7f911e20a5fe2acf9419fe56f170f56a8b9dfcf3db43a1cfe9d122c33ea833ac22bc614212a3d18b0ac75165b57fecd780a77c6312ab434dd7fd742
TLSH
T14371C51C05E26B05EBD23231E0CD390B3071E86A0A2BBDE59BC4C4BD5F0672D8E31008
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a563.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a563.TMP
Size 3KB
SHA256 51b70519db63e35d7ff3e7a090b6a6a8457bb7424f4515f26fc72e96ea27996e
MD5 c9d97f6f068fdfc0d0e30d01735ac71c
SHA1 8c06651d9f0c461749453fd90d29c0b659b4164c
SHA512 e70b53b2f8905586324ca3fc753801603b7f4a6551fae1bb491812fa260f18937e1dd08cd5f3e5012495b597973075ef8bb690b1bd314f38bb2c737452296978
TLSH
T1CF71D61C05E26B15E7D23231E0DD3A0B3571E8AA0A2BBDE69BC4C8BD9F0671D8E7104C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 da24bfdb7ee7747bce206872c0dbd3cb049d140faa9ba410892137f1749a211a
MD5 3a1cea0ee578a7edf3a8a9c247b65332
SHA1 b00c19f41278df35a070f3620cd83558893b8200
SHA512 3ceb46b58a6801cbbbe31b4b772ee5595643d39fee87bfcf3b5056273bb0f77986bd048307f84cefb67dd04f5d172efe28bdbf8c156880c42625ed9da00f61ab
SSDEEP 192:Dh8/1FN/Dd/5GwGYG+JkGKVtXXXqmJ2R4sJ5RW9J3JmFcXJJlRVJ+w:Dh8/1FND95GwGYGUkGKVtXXXqc2R4C50
TLSH
T1C6D199F783F895AE8E1269F5AA08AE1BCF5C051443AC3C6AC9D86E4793F3471E10164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 27dd8ad1e5d1644eb420e743245c91db9b1694a8d79dc56b8124ccc2c2c57292
MD5 3d9c3cc41fdd5fe19451e69fff13e29b
SHA1 433e05202cf646dc7afd8e293fa4f3ac302b0254
SHA512 d9e7b1b855a4df17e69aea7d33d43c861a166d2043f3cdece19b3c9afd5e9ff60160c300904f64335fdc6f855c3462e82973aa382a26333289a759ffb352079a
TLSH
T13A2186F787E5956E8E0156F0AA18AE2BCF2C0511836C7C5AC5D4AE1B93F30B4E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eaf1f48a5e956a624205bf44fb68194e6b13641f5aa83cd2ad35614e1b6f1ac4
MD5 e44b215747a03390d36a4095a8aa80fc
SHA1 1227e15a311d1f3ba7f767bb80f2c79050cc20f2
SHA512 950f111626b42113fb9c81e811a166451c2e00057aa6ed15a29bd5cd9463fc774eca217c46f59c30c3cacd69c655d28496e25f8035a5770c9dd5f5a8636085bc
SSDEEP 192:sxZ2RyyM/jK1Ml8M94/fGsjLfIdpJHW6+WNGYw81zdIgrJ:sxZ2s14/fGsjLQJHbGW9
TLSH
T1CE42E816AB349977CCCBD209FA557B53D6F54432D2904E44A9FCCA0C09E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 8f3143a44b9252a5617d77397dde21c983d3757fbb50cf334ba98fe00c4fe3ea
MD5 cceb04c62a0b398395267e1f5f923c14
SHA1 84b25b0467cbb6275dc3d716065609a8fe2039c2
SHA512 137563dc86c3e862d803134220cf8116aebe8ee8419e78b6bdfd35664c007f22f62c70b31f1dcaf69688f2f25bb0e899a18b6f88ecf9383180ca847e18aebf02
SSDEEP 192:sxZ2RyyM/jK1Ml8994/fGsmWpVPJPUIdphEGgRHW6+WNEblH/F5XYIYtvQ7IgbVJ:sxZ2sO4/fGsmWvPJPN9MHbk5jXggT
TLSH
T16C62E816A634597BDCDBD20AF9517B53D6F54432E2904E44AAFCDA0C09E6BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0bd2bafa3aeeaee88d2a8c33ba54f6921dff6b6ac82f29a095d09571a56244c5
MD5 920af4a008230f755ab6894b1c12c627
SHA1 d50c8508ead30fffb8a27b0ea06a91b35ac78ac0
SHA512 1ad3d2eb61fc8c7fc145cfef03ac10c3437be73c7e93fb4c6e4dc399867b2913e8cdab0fc996416e16de647b2dbd22d49a09baa4dbb75b38d9b9f5f0bcd8bcff
SSDEEP 192:sxZ2RyyM/jK1Ml8M94/fGsbJP3IdphEaHW6+WNGTI/Ywe+mdIg5VJ:sxZ2s14/fGsbJPYRHbJ/a9
TLSH
T1FC52E816AA349977DCDBD20AF941BB53D6F54472D2904E44AAFCDA0C09E6BED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b2e0544301e7f4964ee25a5b3aa4760e66ac3244661da909928f92b99ee6e35c
MD5 19bf4cab60965351d3a9d28f86a797f4
SHA1 1988f0f1b941eb258525e16e58a502b50073141c
SHA512 a06490e8409c8fa9299aab6a6eb0fa5fac6806c0cb1662925906985e799c4e145dfa1d1fe7390632038ebaf93def8515471415b25099e8e2f1aad58654b1f274
SSDEEP 768:+P4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dNrohRc7la4:+P4jeXmWvmKLEu1jacPLZQdmI79
TLSH
T10AD20A3B280CCF7E4F844E5CED26AE976ED801CB5A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 211563b5c130f6a1229f8a88cff815c7f3d9b63d3609914c4a59b7a7e2ca541f
MD5 dc9d374e6bc1f8c619c3a3778cdb1d36
SHA1 d8a8e168a778ed1f0d94416856b602afcb90fde6
SHA512 3b8018941341637a72640726011abf45e529d55a9376362e64d73e97bf1e952f71984dddb6ec9d4c68372139e453c693fba54111defc7fed766003f2e0186aeb
SSDEEP 24:KdXfu1Mapdddt45V+AIjptKiahant1E/9SmHMC89WyXYOfhSTaAdUws4EQ+3IjWZ:Kk8I3KJ2UTyFDIFKMk4c3IRKIAEPy1
TLSH
T10091A50232B716052EBE250C91A896574783B467356C743B3BE944F28E2BE360DFD9DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594184.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594184.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 f9ed3e2778aaa97e97c2750afa496f58c288ea25e6561cb8198a9fb094a0b692
MD5 fb9f96bf14782a30b4fa52b95c74449c
SHA1 4d63e150177f38ec049cc354e6018c453cee413a
SHA512 2fb17636416f6d008020ccc2ae00e5bdd091c6b4e468e49ba6648194c35f1317a3180fe1be4edcc81ea21e365c0bd665c4e8ce36a5f82e6bbea9be5b3b67f8bd
SSDEEP 3:MsEllllkEthXllkl2zEO3st:/M/xT02zPst
TLSH
T199440445FFC10D05CD101130C031C35013F0D4150D51D7433DF344135CC75C01D00004
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 bbb05c6f3335f5bffb595ea681d6c27baac4c1f94af1a97f2e25ebdad7b439fa
MD5 09b4d0e8665d06f2269c80ab703178e3
SHA1 61a3413a7466feed2005b4c652979a785e9c60da
SHA512 be25482ed11b1a74100c167205eb4f493a170c133b014543b05e7706d7559693c26384bca1312ca772e9cdbe0e93bec3f620e72a6c715b2d3ea13c20873954ca
SSDEEP 384:WiFDtNn/s3n9SPzsNy8TUNTUlIlQ9fuYeT2f+w8kZyXH+2xFmf7SwdjLMJqKkBYo:9FDj+9sjwgmMTmbKHlLQSrJqt41jq
TLSH
T1F8F26DF294D78CB6C49D97C7A37EAD1159BCC133B5845548B3E86A2DEC8A1BFC302960
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e3583fa9b97c509b69b126bc35191400ebcde085b2f280bb13ef3a785212244c
MD5 77b73a42b8f92f9ef7000d98043f2cd3
SHA1 dfcd4021e8a134a98cc4a5ccbc2fb6caa7e1a131
SHA512 20949cd1f8c643f420f05179eb789fe4ef87f213ca9fded7287b81b530740ad200ed7b232d6e6d299d6fde8e0333ab23a38021d4708c01da06b0dd64f9a28623
SSDEEP 192:EONp6hZ0QmiUy9Npc/+jV6jzorkZk5wOZLxU6:EONp6o8pu+w8kZb2lU6
TLSH
T1FC02EA3568686CA78EE2AE46F48727135FE5112BEDA56F84D6E81F1D00C769C2307833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fbfb38941aa61c6b34539c3e4c62537944056c28dbe5534c91ec9ca4f9e63cc9
MD5 283855e1f96077b8ec2393d2fa0f6568
SHA1 2ccbd40f1695d17fdeeb5b6e93b76270ef9ff6c0
SHA512 06e44cb79174056dbdabe5c9313106152d27ab678701c0d34b49921ebf0178cc92b21b172c1557be5cca30649e6c91659457ff6a01aeb44babb7ec6c48b35db0
SSDEEP 192:tON76hZNQmiUyaNuc/+jV6jzorkZyXH+235cOqEqwU6:tON76HZuu+w8kZyXH+269yU6
TLSH
T109120C36B468AC675DD1A656F08732234EE55127DED6BF84D5EC1F1C04DB6AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 be378d475c07cbfe998e9e6b8db42e1b650f7024cbb757381716c0aeb5144a5f
MD5 d10c14d7bbbe5d4fc464171fef1966c9
SHA1 c476fbd10d8a33c5068519148e4847b7d20b6a7b
SHA512 ea38ae98005614827ae19e7b6a23b28207a027d3727c78c59e69b4fab322ec8d5ee07110cbc1c00bc674592eb66a70fa241279f20ff87fb6c7a7eac44e78bc15
SSDEEP 384:WiF1tNn/s3n9SPzsNS8TUNTUlIls9fuY3yf+w8kZyXH+2+FyScjmwO:9F1j+9s3wgWxabKHlwy1jq
TLSH
T198C218F758D79836D9AD4B47F77E2E128EBCC063B5816A84B7985A0CCC861BFC306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 70b3e9fa29b4d8a79d3f32d7d1a7f42cc0878c540d53c62c20085371fcaf91b9
MD5 9f604f7d7ee3d46236e9f08e25a84613
SHA1 6b7bc165e518f19656892dc44fd52eaff3eaf3d2
SHA512 c1159d98d5dce892f384e7cf546c4738507696c1a89d8a82ae9bcafc58614cbce1baae31f3731f1f58bf2d2781bb2f983b0add0d5ad009c81f9576e2fb9b772a
SSDEEP 384:ttNn/s3n9SfsNKs9fuYGyf+w8kZyXH+2YFyScjmwO:tj+9UuQabKHlGy1jq
TLSH
T195928D37A829AC679DE29646F44B37178FF8507396C12F84DAED6F0D04C66BC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7aae6db3d94d186bca7f32ba1d97fe453478cf3c6605340ac0eaffa6ed35cef5
MD5 a50e016e22748c1e1896b11e58d3ae9f
SHA1 2d8793c81a91cba2d4246670cb5dc527085d2489
SHA512 e1d288367bcb89c1e61191c0652a051090669b77e06b64d88fec1e07ad157af1102d705b69bfde63ff1e37590a72b6b0646debdccbaade08fe97b7e435113d30
SSDEEP 384:ctNn/s3n9SfsNKR9fuYGyf+w8kZyXH+2YFyScjmwO:cj+9UNQabKHlGy1jq
TLSH
T1A4928D37A829AC679DE29646F44B37178FF8507396C12F84DAED6F0D04CA6BC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3ed49a52d97ea464472c0d8ce036d47752f83738319d975fe528600c7635e36a
MD5 bb4474ca2da290d940306b6b3192149d
SHA1 a5ad040f66f8538c83cbc8cbc60b0c26a09cd0f7
SHA512 b8794a1910c640de6b004fac8704b0cb1251fcc6b6c3947f0741d02de98caff991c70c6ff7cbaa5ec667081fc08c58084273411ace97fed394f3911e702244be
TLSH
T157E00404D300D10FC030433100C3177137F0D4503F130707551001757D017010F511D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a0a42.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a0a42.TMP
Size 392B
SHA256 5fa7161d3899c4ebcacfb70ed1d4e85a6e5242d8984826ef20d658a3774a5dc5
MD5 5bc85ffdacbdb9654637741672ff279f
SHA1 2b45b38cdf3501d9446d5a67aec7d1739c2fe3bd
SHA512 3629094ec0e7cab8c8bff87eb35bff962c5680a3779c083e12ada406b320674d8bbfa18f628af19d43d35ed4ddf1e5fa85fc327860019787c04f220d8cd7a136
MD5 SHA1 SHA512

Submit Download

80776f03-0c11-4de8-8627-b36795b015de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\80776f03-0c11-4de8-8627-b36795b015de.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b690be1b3b1aee5e490c6b8f2b6670096ce2532e3cacee5d94197d86f5d6aac2
MD5 be7db5018237d2cafccf4d60be5458b7
SHA1 3caafaef34b0b64c2147130b72133c5be09dd49b
SHA512 c9e50391f5242632b4c677ad06129e642a5da8813854fce0a1c6bc429397c5e0a34d360a22d8af9fea695f09b73e65d3f9e0e2c462748507c63e788e06b3465b
TLSH
T164410A5CA6F91158B3776E5A9FF6686D887FBC372E06D05D10110E4F0A63B40C962B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads