hxxp://arrowing[.]fun

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 00:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://arrowing.fun
Sample260730-aztefswckd

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
32	api.ipify.org
33	api.ipify.org
39	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4364	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298455822946180"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{BF759097-3EE4-40AA-9CD6-AED6CB5BE807}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of FindShellTrayWindow 46 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe
2940	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 1476	2940	msedge.exe	86
PID 2940 wrote to memory of 4364	2940	msedge.exe	87
PID 2940 wrote to memory of 4824	2940	msedge.exe	88
PID 2940 wrote to memory of 4824	2940	msedge.exe	88
PID 2940 wrote to memory of 4824	2940	msedge.exe	88
PID 2940 wrote to memory of 3372	2940	msedge.exe	89
PID 2940 wrote to memory of 3372	2940	msedge.exe	89
PID 2940 wrote to memory of 3352	2940	msedge.exe	91
PID 2940 wrote to memory of 3352	2940	msedge.exe	91
PID 2940 wrote to memory of 3352	2940	msedge.exe	91
PID 2940 wrote to memory of 4800	2940	msedge.exe	92
PID 2940 wrote to memory of 4800	2940	msedge.exe	92
PID 2940 wrote to memory of 4800	2940	msedge.exe	92
PID 2940 wrote to memory of 2680	2940	msedge.exe	93
PID 2940 wrote to memory of 4628	2940	msedge.exe	94
PID 2940 wrote to memory of 2680	2940	msedge.exe	93
PID 2940 wrote to memory of 2680	2940	msedge.exe	93
PID 2940 wrote to memory of 4628	2940	msedge.exe	94
PID 2940 wrote to memory of 4628	2940	msedge.exe	94
PID 2940 wrote to memory of 1688	2940	msedge.exe	96
PID 2940 wrote to memory of 1688	2940	msedge.exe	96
PID 2940 wrote to memory of 1688	2940	msedge.exe	96
PID 2940 wrote to memory of 1164	2940	msedge.exe	99
PID 2940 wrote to memory of 1164	2940	msedge.exe	99
PID 2940 wrote to memory of 3556	2940	msedge.exe	100
PID 2940 wrote to memory of 1368	2940	msedge.exe	101
PID 2940 wrote to memory of 3556	2940	msedge.exe	100
PID 2940 wrote to memory of 1368	2940	msedge.exe	101
PID 2940 wrote to memory of 1224	2940	msedge.exe	103
PID 2940 wrote to memory of 4648	2940	msedge.exe	112
PID 2940 wrote to memory of 4648	2940	msedge.exe	112
PID 2940 wrote to memory of 4648	2940	msedge.exe	112
PID 2940 wrote to memory of 1372	2940	msedge.exe	114
PID 2940 wrote to memory of 4796	2940	msedge.exe	115
PID 2940 wrote to memory of 1224	2940	msedge.exe	116
PID 2940 wrote to memory of 5100	2940	msedge.exe	118
PID 2940 wrote to memory of 5100	2940	msedge.exe	118
PID 2940 wrote to memory of 5100	2940	msedge.exe	118
PID 2940 wrote to memory of 1084	2940	msedge.exe	119
PID 2940 wrote to memory of 1084	2940	msedge.exe	119
PID 2940 wrote to memory of 3356	2940	msedge.exe	120
PID 2940 wrote to memory of 3356	2940	msedge.exe	120
PID 2940 wrote to memory of 1988	2940	msedge.exe	121
PID 2940 wrote to memory of 1988	2940	msedge.exe	121
PID 2940 wrote to memory of 2604	2940	msedge.exe	122
PID 2940 wrote to memory of 2604	2940	msedge.exe	122
PID 2940 wrote to memory of 2604	2940	msedge.exe	122
PID 2940 wrote to memory of 4448	2940	msedge.exe	123
PID 2940 wrote to memory of 4448	2940	msedge.exe	123
PID 2940 wrote to memory of 4448	2940	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://arrowing.fun
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x264,0x7ffb3667c188,0x7ffb3667c194,0x7ffb3667c1a0
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1788,i,5852017249258319860,2066654152970689024,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,1934337618509603827,12909963455229829768,262144 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,9664919468960421092,7814638438067881613,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,12145324824450118593,4605467253877135434,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,11757092717943322,4711840617865671348,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,12282668028731854027,12654793026225145701,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,7743053467619726012,17190248168353811015,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,9958668345323787107,8590167448708726588,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,17630620553826393565,15202262545314852089,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5428,i,4620205064317526434,2318762926711832817,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,6181684750223015528,2664632522592698548,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,5713454825207451166,4723466414046143686,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,5713454825207451166,4723466414046143686,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6264,i,10292457082738485932,3750977502461744557,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,14511342972988674035,1092829436001177087,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,11485353238030724768,14312401754950957308,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,9214785516181684642,8823022561033535712,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5784,i,13366928372847562022,4583982188059320013,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5084,i,9962089573234552635,17639988220914104442,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,2600495596600984117,17693472656235113014,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,10840952261935676744,7774988798496330678,524288 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6632,i,15820225608680166383,15809689190880792900,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6372,i,731677544732771951,17061893917332875471,2097152 --field-trial-handle=2232,i,4295296732514551380,13229166982396082858,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:4448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c107d5cf33a714a068be0aded9bac4225385ecd3f59f1705fa681e4010125f6c
MD5 aa4214cdd355dd491d7e78f2dc15f214
SHA1 60b5b7a0e0c833918c018f11fa7354bbb8735685
SHA512 aaaa9dc5718e77344760f3ebe4d3dbfe1578d67071ac4752c2addfa29e2e562b6da4ab466d0cef8231f31f45568e99edbac8c445454402bcf9b5c4cbebeb232e
TLSH
T10BD02372BE91D3D0D019303D502002403B26023123CF832310A8480CDC7404082DEECB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b0055b5965e4edd05cd8a445b9fae820266499a5fbbd1a3828a80cf18b67670f
MD5 0a71246cca291da780c9d22a23303f66
SHA1 07a4e85f78a2fec2fcdeff40384ba3cf20c0dff7
SHA512 4ea96e23f8d20d2bbcb6661ab697cb7803d2ffe1b9479b8d02d8dd519a73d981df3169052cf79dd1aea5db03268d1e9aef86e0892f4ed799a2835f7e67806bcf
TLSH
T12161715B0216EBB7D329C930D3F12505BCB281150A2B2F7392818A7DDF31BE7B16620C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589390.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589390.TMP
Size 3KB
SHA256 98ca193582af2c2163fc1c068f7a707617c8baa37b8441ba769d3f84a996a394
MD5 769a33e84e0f97ce135815668b525a2b
SHA1 cc167673de54e5ac8839ded5d1fe6fff966725b2
SHA512 9f4dda0a61ff1926594837be0563d85e63169714cb54b1b6b08fd5d50d4024b404791bd6458199c3c771f952d3a5299455de0dd601894156fc0b75232480636b
TLSH
T13D61605B0216EBB7D329C930D3F12515BCB281160A2B1F7392818A7DDF31BE7B16620C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e86d27da4196fe1b52453fd3edaf82acb00d497b6a70e9d7c95e5c4c1bc9b77c
MD5 f1437e054572d54339e2aaa99acb4396
SHA1 b23854d22b6f78a20cb69860c8e40ecc22ae65f9
SHA512 a0437ae0570286aba5929b9f1f4e9a785ca105dddec7df47a5cbd344c18ed03e7aa51d7c751ea0ffb9028153a0193caea12619f6b153d234e455780a463c3d28
TLSH
T12D51ACB3C3E59A6DCE1116F0AB14AE1BDE1C092547683D2AC9D5EF1FA3E64B0E10560F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 76604cfc62f907e8f9193267e08fa1d8487f73f9c47caf9bba5284aafc0a7353
MD5 d3f2352f7ec075b805201067c0c62100
SHA1 5af5bca40462483733e95231bf10b1ccf88d62f0
SHA512 54853b3d02c9d0e1df26444691a1e25f8b8dc65e09171760abdd346f9e0376d2a52d4d1cdab341f5f4fca66d83911aa7422266cb99d7aa0efe647f7a34d5528a
SSDEEP 192:sxZKR2yM/jK1Ml8Mkv/ftsuADIdp7/HW6+WNAQ2/Y4MUG+jIgrJ:sxZKAMv/ftsuAczHb6/a29
TLSH
T10342E9166B349977CCDBD209FA557F53D5F94472E2901E44A9FCCA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4282d5d582a7a4afde9b2c34b2ebd160d1cacee1e5869140f6ab6cd73a38f499
MD5 25b2ead4ccd7e1eb84ea7fbb02e70ed6
SHA1 c32df611462c6ac5d1a88cdc48962d3cbcd50719
SHA512 476ccdc2267ebeedf62ffeb6980d1a26d8fcc4cde9f31ba6d205035f2ecbfccd808f06b7599f38431d39b14a39a8e788c2dd3b2a9ce57f032f31162a928dd272
SSDEEP 192:sxZKR2yM/jK1Ml8MEv/ftsDNDIdp73/HW6+WNAspBdY4F8G+jIg52J:sxZKAMv/ftsDNcrHb/dR2I
TLSH
T1FC52E816AA345A77CCDAD209FA457F53D6F94472E2901E44AAFCCA0C04E6ADD2307C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 41f0c66dcb9a7cd434c6dfbbd283fa1d031fb358314e806df4929ba0fc0306bd
MD5 8f442b8ade3112f900061a5271a345fb
SHA1 16f31060502b86c76929bbc02be554fca3ce9015
SHA512 21b4d6a249d850a0a9e262a1001046bcf2202e669f5c486348dea3b51e83135e0683ffb2ea1e1d5235ac93cf9a881c3ea9304c5297911423af778ee2e530c0b8
SSDEEP 192:sxZKR2yM/jK1Ml8MJv/ftsDNDIdpbj3tHW6+WN6EpRb/p+/Y4LFG+jIg52J:sxZKAxv/ftsDNcNHb34/e2I
TLSH
T1AE52C9166A345977CCDAD20DF945BF53E6F55472D3905E44AAFC8A0C04E6AED230381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b0fe319626724794275da3b2674440bf3d21f80f8b1b9d9db6b36e1621626e69
MD5 d3bdfece75da2dd00e7c663a0bb50b75
SHA1 88722ad1e527e92f482ad10c10b04702a6ce81a5
SHA512 9c4d19a3a1f9c8221f733e2cb21eab18b8936c4208457c146cccc107cf8eeeec822d305eee2fa62671d37aa9fa119a38fee258500310f892e5cf926a2406b517
SSDEEP 768:Yy8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdfroLkDUnO4:Yy8iJPNWvx76ru1jahALocdMEUO4
TLSH
T19CD2FA3B680CCB7E4F844E9CEC266F966DD801CB5B948D5447FA884C03C76EA512699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bff8fae1eb89e137870073c7dd589a0bc2e8e68b6ca4ee12c652ca7b99bd96f3
MD5 7114651e09dac954dd16c3aba748a864
SHA1 1295532806bd4a8cc3600191fee45f3583b9bfc0
SHA512 079d65d3a03b1eba5b3275bb14e542652b7d1d4842381806a77f15c18a504dd8fbf65d4c038314634d8b6ad6ad2c1b79d9956bfccd73ecea1ca1f5508f635a11
SSDEEP 24:KdeXKmfeXKJeXK6eXK7aeXKodeXKceXKIeXKk4eXKceXKo+eXKPIjeXK+eXKkKiY:KwfIlKoK6IfKTiELyp4IXKRGcBaIfKHR
TLSH
T19791140271FB42263C3E252896A587275B817FA3305CE42B77B854B11E6BE244CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593426.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593426.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1672b0b7b65384048355ea9e51ec4fa32cf3ec9d86dabf6a2734e5d0304faa13
MD5 7eac9d7e5a3fce8fec7f13bf334ebb62
SHA1 cd5c07588a7b2e66d2e26c48f8cecb6c4e49c62b
SHA512 20b093c4d7475a19f0eb35e53e318c7bcb42173f4e17bd09c2a666ba2149d19ddf9a3ab55a693999c3a5d37f7ea38077f55523dac91013e7b31b939c881dcd49
SSDEEP 384:zZcIhsNIUU8Ol64TkqbFUiUlMOObjI9G6w7rp:rhbhbUy29Mrp
TLSH
T154929E32AC789D7BAD93A511F4863A135FF8D03BD7C86F80E1EDA70C05DA5AC5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 4eda41fe12b252fd7ca0caf059db6f67b98ea9fefa200107e659eca5197e3a95
MD5 803b815a4bed73ff502f563a6c3e91a8
SHA1 1ddd5bf9ba8058fe91e3bcedf8b326509ed1f262
SHA512 c2ef82c4216c1d46734ed0d6ad81019c29cae3e0b0dd8a84c4509dbef0fe18e89b13e9fd6cfc227de14ccf796cad1d48b85658096cd8f802a4b99ec91db74c47
SSDEEP 384:riFiZcIeysNJ8TUNTUlIl+l8OlT/RkqbFUiklMOObjI9G6w7rp:GFQbwwgYLjbky29Mrp
TLSH
T17CD218F258E7897AD99E9B43B77D2E125EBCC067F6849A40B3C8560CCD960BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b3cbee1ce184902a522746e9d35345ee0e3793672d8139c2fcbb0b6ec9977a7f
MD5 738136f167ba8a282fba308cffc815c6
SHA1 a9d5152960a60a134d8794c1fd4a12a5edb12287
SHA512 da70af34d43bf74da4873afaf40e6a37e6726699b45418ac6c5060c8cda17e717fa0a89d34d179b7f720d4c807dc71c88a9838ceaa4af61b9bef8204f73629e7
SSDEEP 96:ZqONkxQsjpfmUTmDK5ih/cIPURHl8h4otop5l5DdBhPwivh50xy0SFYK4AxYYCb4:gONZ6kDfQmiUy3DZ903bb9XQi6CCU6
TLSH
T1BF02E835A8786CBB8EA3AE49B48777275FE4117BEAD52F84D9E81B1C00D765C1303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5db6fb99cf7b5a09f430405302bb4ea31e6ce913943f6689d97040ce7cffd023
MD5 3c9db4c4c45a864d7aa0da5aef1dc20e
SHA1 2505026a450776ea4e8b2812b42160afe3cfcc32
SHA512 4527f84674f5947ff61cdc88f4f439295af88dfece54712106c35f78b079f668864a586989da2eece8dff3b2201e83ae697e37187005eb43356a8c2281014be9
SSDEEP 384:NZcIEsNIU38OlrOfBkqbFUiUlMOObjI9G6w7rp:VErzbUy29Mrp
TLSH
T176928D32AC389D7BADA3A551B4863A235FF8D03BD7C86F80E1EDA70C05D65AC5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b1d6712f2987cf7ab26c06142debc9157c84563997eabcbfc6658ce4151e67ed
MD5 ada0cc096a6561d2f07aadb16f65c7fd
SHA1 49c4b8c3901cc42f76085ba3df007d85de9e5961
SHA512 037df1b5155a876f4782f9777e668fd088ecaad4daef702cd102dd35cbcbece9aff53dbf319f22f296df2a394a13dba611bc223540078eb3ae474dc432329c85
SSDEEP 384:7ZcIEsNIUl8OlRyBkqbFUiUlMOObjI9G6w7rp:jEzzbUy29Mrp
TLSH
T1EE928D32AC389D7B9D93A551F4863A235FF8D13BD7C86F80E1EDA70C05DA5AC5306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 af78e4df97a219f1baca6046d8b6b393691f522642763d618d9db7ffbf615986
MD5 7de53089cc9fab2b3c34370088b9c26f
SHA1 e13bcbbb97327619c88d44e1f4650c43b0ec8c60
SHA512 d5ef8018138086b98f030ebfc6d79d9bc63c7fd7c980716d5215b191187622d2bc1147bd3b40985421c9df2f3182e0306ec8bc868e434e4836169e52db8a18cd
SSDEEP 192:sONa6k0QmiUy9DB903bb9zUNEjccRlqUMU6:sONa6J2B9qbFUihlMU6
TLSH
T1F412287268B8AC7B9DD3A955F08737135FA8813BDBC86F80D5E8271C01DB69C130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4ece9018b641b473fb5aa731248a7c855c54df586b58a0acf783e57361f8ee6b
MD5 0cc12ad7a18c68517fadb3ee8a3add7a
SHA1 c49fffc0a525c82c4386f4315d0f2d4887519f6d
SHA512 3f2477e6edacd990b42af7842f44ed18b82c64876d25e106b547bf84dca80fb18e02d066e4a1f4c087b43d3148a583b8ea3eb8b07efd8c430977d917d45414e0
TLSH
T10CE0041553000077C014457000D73F541FD1D0370341031FCF30435C1C303103DD0440
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 ff992b80b44500cc163748d36091612209c848445d2fc752060d23a86f06e2f1
MD5 7673d2dda5f4fe4ea502f6e940bfd76b
SHA1 f8e1a2746d960fb7b0de9d258006d6199196c34d
SHA512 b5719edac34163bebbd0c8361062d356674ef5256076cacb8e4d4165baede7828324538346c09e654755b21d8965b74dbe52a223988affb2341b53d7449035fe
TLSH
T15BE00217530000E6C014467000972F541FD3D0370251031B8F30425C5C313103D90550
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe593b79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe593b79.TMP
Size 392B
SHA256 34c88dd3851e7ffba434dbe1069872ac8f7e54f27791917978a0e526112a1950
MD5 7ba7bb12674c5ec0c38e8dc6138d8edb
SHA1 50d111bf010974c927e9d17337b33ffd48f50c45
SHA512 3b1041bc04173f0c652323f168d9340a7e91ac8bd6482bb3a1f0b1c4f822283ef600025bc45e75489590f65322ce77fc80ddfc0c11defaad99ce09d03bd51700
MD5 SHA1 SHA512

Submit Download

58523652-e7cc-4372-9e7d-b983d6fa463e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\58523652-e7cc-4372-9e7d-b983d6fa463e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 685fef24d9cd1f088ab904a6d3321019a862c8989ba9529868349eb3f7a0f9fc
MD5 2322caf10f21e0fa7a84a297440c13eb
SHA1 3b72d6abc85429097cdd78d11fed1cfcf8e69cb9
SHA512 4e243b79509dd260f09c8bd0bcadf1a4b636e390e0f1fda845e144ade3629b5bd26d68446602f790756d614a2a64fd303718e463e5174684662fb34566f82854
TLSH
T199411658AAFA1058B3B76F569BF6A87D487ABC272E06D46E10000D4F0A23B41C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads