hxxp://url1011[.]lmslight[.]io/ls/click?upn=u001[.]BOtPG2TiW1xGtomO-2FuqjQsCLvEf3qsJyiSsHdoCbVifqfRgjm-2BMp1gbEoXSF-2FB-2BbklwdrQC1c7pqjaaGIRXaVjm2dXOykwmQ0gQwfdH5-2FSZFkOUV-2B-2FqA3z4HotNbzlm3BAh-2FUpIDq8SLMWTAIsMn4M3eWmOkDjqO6v2uO1-2FUUpwnt5TvibWQsgz1ae1WBPctqhC0oDOItVq0joGnueMUWJKB3EsJkW3EkGy5Fnar8WPq-2Fg7djt3AFlasR79cYbuICUDKs9vJrXVWyhaR5OGLavwENUOfp8KZL2bqpIn4p-2B6JKSiK5Mt4kQOLbFCdTWseyYVkUU6HPVOZsxgGNUU0nSBeSaOypuSde9VWfc9AsOt-2BixRUifpyeA1ZaggfBWNKMjdMRSO2-2Fy9zUYRZV4s22H36ehVwGbjV-2B5DRd0zQ-2FZar1Kn3T0UG7kpBxejMJbV5hvPOB6aAFGohUuKC04bt9-2FmeULjSRBNuy0OeCMbKMu5yUkQaMIn7DPVctuW5Vdnlvi-2BNWbRdvAE7KkhqNloqy1mu1R87Z7H-2F34vPlBoRSCsWcdVT7Ji2kM8TrdLEOj5IczK9-2F8d0hcZ0mt2Ubj-2FbOFBPjBHQTJzgAc-2Ba8MudtRMoHSUxclVIRpUwKAhXG1oLPh2DRYIo-2BevYAXQ-2FwQ6NEJghA5xgnxQdkIkGXhY-2FiqneWKSVZWhMG4k0Yo8zsENE0cKwG2Wsdu6GD-2B0LPK0JmZTEm8lc1NZy48kIhFVd7Js-2Bne1NkON7sic-2BlEORhH5pOuPf4n123a5uCHlm9qauaVxgd9NLV3AAWIPNbZ1jKeo-3Dr6WA_NVcyFgbo9ZZYCxHxiF7s3-2FRdTeU1o2Gcu2jcX84YgFl-2B1fKCn4rl9gW50uHf0RcHLKFw7WAbSIb1G7VPd2ZJvCCZksuILp-2F6v6vVjfWrh7a74n9a57Lk2qBVq3mp7wlhbW0cGCBtRc8gmrTZbF9GheQsPDVEfrmzHIZE8aER5mjnNZzxhLrgYYlQbDGXW142knWaHT1XFVcifwJHmv-2BHAQ-3D-3D

Resubmissions

05/08/2026, 16:57

260805-vglbcaw1d13

05/08/2026, 16:54

260805-vekl2aw1cz3

Analysis

user interaction
yes
max time kernel
79s
max time network
81s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 16:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url1011.lmslight.io/ls/click?upn=u001.BOtPG2TiW1xGtomO-2FuqjQsCLvEf3qsJyiSsHdoCbVifqfRgjm-2BMp1gbEoXSF-2FB-2BbklwdrQC1c7pqjaaGIRXaVjm2dXOykwmQ0gQwfdH5-2FSZFkOUV-2B-2FqA3z4HotNbzlm3BAh-2FUpIDq8SLMWTAIsMn4M3eWmOkDjqO6v2uO1-2FUUpwnt5TvibWQsgz1ae1WBPctqhC0oDOItVq0joGnueMUWJKB3EsJkW3EkGy5Fnar8WPq-2Fg7djt3AFlasR79cYbuICUDKs9vJrXVWyhaR5OGLavwENUOfp8KZL2bqpIn4p-2B6JKSiK5Mt4kQOLbFCdTWseyYVkUU6HPVOZsxgGNUU0nSBeSaOypuSde9VWfc9AsOt-2BixRUifpyeA1ZaggfBWNKMjdMRSO2-2Fy9zUYRZV4s22H36ehVwGbjV-2B5DRd0zQ-2FZar1Kn3T0UG7kpBxejMJbV5hvPOB6aAFGohUuKC04bt9-2FmeULjSRBNuy0OeCMbKMu5yUkQaMIn7DPVctuW5Vdnlvi-2BNWbRdvAE7KkhqNloqy1mu1R87Z7H-2F34vPlBoRSCsWcdVT7Ji2kM8TrdLEOj5IczK9-2F8d0hcZ0mt2Ubj-2FbOFBPjBHQTJzgAc-2Ba8MudtRMoHSUxclVIRpUwKAhXG1oLPh2DRYIo-2BevYAXQ-2FwQ6NEJghA5xgnxQdkIkGXhY-2FiqneWKSVZWhMG4k0Yo8zsENE0cKwG2Wsdu6GD-2B0LPK0JmZTEm8lc1NZy48kIhFVd7Js-2Bne1NkON7sic-2BlEORhH5pOuPf4n123a5uCHlm9qauaVxgd9NLV3AAWIPNbZ1jKeo-3Dr6WA_NVcyFgbo9ZZYCxHxiF7s3-2FRdTeU1o2Gcu2jcX84YgFl-2B1fKCn4rl9gW50uHf0RcHLKFw7WAbSIb1G7VPd2ZJvCCZksuILp-2F6v6vVjfWrh7a74n9a57Lk2qBVq3mp7wlhbW0cGCBtRc8gmrTZbF9GheQsPDVEfrmzHIZE8aER5mjnNZzxhLrgYYlQbDGXW142knWaHT1XFVcifwJHmv-2BHAQ-3D-3D
Sample260805-vglbcaw1d1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304226727165175"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3D7C8FA4-466D-4839-AAD5-0099A6D8FD00}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 38 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 712	3820	msedge.exe	86
PID 3820 wrote to memory of 2072	3820	msedge.exe	87
PID 3820 wrote to memory of 4008	3820	msedge.exe	88
PID 3820 wrote to memory of 4480	3820	msedge.exe	89
PID 3820 wrote to memory of 4480	3820	msedge.exe	89
PID 3820 wrote to memory of 4008	3820	msedge.exe	88
PID 3820 wrote to memory of 4008	3820	msedge.exe	88
PID 3820 wrote to memory of 4664	3820	msedge.exe	90
PID 3820 wrote to memory of 4664	3820	msedge.exe	90
PID 3820 wrote to memory of 640	3820	msedge.exe	91
PID 3820 wrote to memory of 4664	3820	msedge.exe	90
PID 3820 wrote to memory of 640	3820	msedge.exe	91
PID 3820 wrote to memory of 640	3820	msedge.exe	91
PID 3820 wrote to memory of 5888	3820	msedge.exe	93
PID 3820 wrote to memory of 5888	3820	msedge.exe	93
PID 3820 wrote to memory of 5888	3820	msedge.exe	93
PID 3820 wrote to memory of 4044	3820	msedge.exe	94
PID 3820 wrote to memory of 4044	3820	msedge.exe	94
PID 3820 wrote to memory of 4044	3820	msedge.exe	94
PID 3820 wrote to memory of 3116	3820	msedge.exe	97
PID 3820 wrote to memory of 3116	3820	msedge.exe	97
PID 3820 wrote to memory of 3116	3820	msedge.exe	97
PID 3820 wrote to memory of 5804	3820	msedge.exe	98
PID 3820 wrote to memory of 5804	3820	msedge.exe	98
PID 3820 wrote to memory of 5280	3820	msedge.exe	99
PID 3820 wrote to memory of 5280	3820	msedge.exe	99
PID 3820 wrote to memory of 5244	3820	msedge.exe	101
PID 3820 wrote to memory of 1152	3820	msedge.exe	102
PID 3820 wrote to memory of 1152	3820	msedge.exe	102
PID 3820 wrote to memory of 1152	3820	msedge.exe	102
PID 3820 wrote to memory of 5936	3820	msedge.exe	103
PID 3820 wrote to memory of 5936	3820	msedge.exe	103
PID 3820 wrote to memory of 5920	3820	msedge.exe	104
PID 3820 wrote to memory of 5920	3820	msedge.exe	104
PID 3820 wrote to memory of 5920	3820	msedge.exe	104
PID 3820 wrote to memory of 2368	3820	msedge.exe	110
PID 3820 wrote to memory of 5340	3820	msedge.exe	111
PID 3820 wrote to memory of 5776	3820	msedge.exe	112
PID 3820 wrote to memory of 3656	3820	msedge.exe	116
PID 3820 wrote to memory of 3656	3820	msedge.exe	116
PID 3820 wrote to memory of 3656	3820	msedge.exe	116
PID 3820 wrote to memory of 2264	3820	msedge.exe	117
PID 3820 wrote to memory of 2264	3820	msedge.exe	117
PID 3820 wrote to memory of 2264	3820	msedge.exe	117
PID 3820 wrote to memory of 224	3820	msedge.exe	118
PID 3820 wrote to memory of 224	3820	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url1011.lmslight.io/ls/click?upn=u001.BOtPG2TiW1xGtomO-2FuqjQsCLvEf3qsJyiSsHdoCbVifqfRgjm-2BMp1gbEoXSF-2FB-2BbklwdrQC1c7pqjaaGIRXaVjm2dXOykwmQ0gQwfdH5-2FSZFkOUV-2B-2FqA3z4HotNbzlm3BAh-2FUpIDq8SLMWTAIsMn4M3eWmOkDjqO6v2uO1-2FUUpwnt5TvibWQsgz1ae1WBPctqhC0oDOItVq0joGnueMUWJKB3EsJkW3EkGy5Fnar8WPq-2Fg7djt3AFlasR79cYbuICUDKs9vJrXVWyhaR5OGLavwENUOfp8KZL2bqpIn4p-2B6JKSiK5Mt4kQOLbFCdTWseyYVkUU6HPVOZsxgGNUU0nSBeSaOypuSde9VWfc9AsOt-2BixRUifpyeA1ZaggfBWNKMjdMRSO2-2Fy9zUYRZV4s22H36ehVwGbjV-2B5DRd0zQ-2FZar1Kn3T0UG7kpBxejMJbV5hvPOB6aAFGohUuKC04bt9-2FmeULjSRBNuy0OeCMbKMu5yUkQaMIn7DPVctuW5Vdnlvi-2BNWbRdvAE7KkhqNloqy1mu1R87Z7H-2F34vPlBoRSCsWcdVT7Ji2kM8TrdLEOj5IczK9-2F8d0hcZ0mt2Ubj-2FbOFBPjBHQTJzgAc-2Ba8MudtRMoHSUxclVIRpUwKAhXG1oLPh2DRYIo-2BevYAXQ-2FwQ6NEJghA5xgnxQdkIkGXhY-2FiqneWKSVZWhMG4k0Yo8zsENE0cKwG2Wsdu6GD-2B0LPK0JmZTEm8lc1NZy48kIhFVd7Js-2Bne1NkON7sic-2BlEORhH5pOuPf4n123a5uCHlm9qauaVxgd9NLV3AAWIPNbZ1jKeo-3Dr6WA_NVcyFgbo9ZZYCxHxiF7s3-2FRdTeU1o2Gcu2jcX84YgFl-2B1fKCn4rl9gW50uHf0RcHLKFw7WAbSIb1G7VPd2ZJvCCZksuILp-2F6v6vVjfWrh7a74n9a57Lk2qBVq3mp7wlhbW0cGCBtRc8gmrTZbF9GheQsPDVEfrmzHIZE8aER5mjnNZzxhLrgYYlQbDGXW142knWaHT1XFVcifwJHmv-2BHAQ-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,15539335652885827934,13003824652529229556,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,16653886770497460021,16144096247822100163,262144 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1376,i,5542377813398619478,8404559050058413037,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11243907301128084168,2518766562205581090,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,15619596767754402443,10776749934849962452,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,17528021163446488456,3652518087001667164,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,11312209538165562828,17213140059535836022,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5132,i,1613043672408587077,4055024019143753685,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,7489342562923409779,11290315031142712929,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,17897130174258263584,10826707118535827847,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,8092126875815163649,7065719338356131740,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,8092126875815163649,7065719338356131740,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6380,i,9428883509121663945,9888418136584519576,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4260,i,8115914537044109906,3919779317150880870,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4480,i,15631513434615805394,7540382840833236977,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,1815825124210863623,16384482451066076537,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,3356054730011969804,3785996664726420199,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,3471827182860981537,9452972227990959651,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6380,i,957534170224439250,11766078446676506229,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6604,i,2734588455859623443,3237363164060923495,2097152 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,7189903975984504403,1896555969675991303,524288 --field-trial-handle=2608,i,11136456630734723450,4367528953146664258,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 94f40511ea08a0b6a5296f0532f655edb1ff5b802568267057a10b9a850c3df9
MD5 1d5dfbc6f7dec6803aa8fc7ec805839e
SHA1 301f0013a4f8dff7ba9babad8791aa3ced8c30a0
SHA512 c72b47d1d5b8cbfb51273c5f54f380345f34c6234f6c4cb560c31768cb9b8965c22d1cff5b0f4f68e25ae5facfd1c5b91e33c6d09e6baea7aea919322ffd1514
TLSH
T1D8D023B4B42A75A1D72F00354430F150A26541737277938671554C0DEA7844497FAFFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 74ba280eb9f01288ae70607c708b4c562eb8d40b87678422b31abb76eae9b692
MD5 f0a84df930fb485c2dd996eeb964b0da
SHA1 3b22a5d82c8a7d1109668acc162f8a3361ca5160
SHA512 f48bd715004c3b07e93b0cb145a3db1dc31e5df217bdcceac5adfc4c26b2fce30c342c57d95898d5237a109eb25e106ed4311bae5d37259089903b484f760b67
TLSH
T1D6714EF4815D4CC1EFA21270E8D1CE0AF5F29EB9893B0FCAE55455BE2506B61C29B334
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7b9f91fd8b0d8a3bb4b3962e5ede4c8ca95d65538341a3a49b37cdeec9ecc397
MD5 051aa91a434922b11f0a3ff6110dc462
SHA1 42580165541b1be1e849367a7e23ff1a91e73065
SHA512 4ca2564eea05e0e74d5fd8609ec09ca3e28fc98d5548b4c423e90b30416e397cb128a5db6b3b0bd733cd976dc98d24dc256b7a34ee7acb215175672f1a185488
TLSH
T186616EF8414D4CC1EFA21230E8D19E0AF4F2AFBA99770FC5E55856BE2505B61C14B330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58529f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58529f.TMP
Size 3KB
SHA256 296f7ca6c6d1c536b357328c3e4e2ea89ad4cd5a6137d7c7fdb4eca6668de42b
MD5 e6f547f17629212a23b71aee1aa242c3
SHA1 b0cd1abc846789df7e605e2f05c310cf7257f82f
SHA512 6d96e193f89ce83dc9d37736ee652570f94e5529c3d45a9e9f197ed57b66b276a00c622dd656b241ed06aeeafdedfa4132e6334c38dbd0c272c47c7481b05d55
TLSH
T1A1616EF8414D0CC1EFA21230E8D19E0EF4F29EBA89770FC5E55856BE2505B60D14B330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 1161bd7107207c52a62667eff6de42d02d27bb616747d195788e770a28992d91
MD5 8df63d0b00d42ebb4a355631a231d2d8
SHA1 815e6aec1e9b3905ffca53a7e169b9ba33828673
SHA512 21aa6f6d7890dc6aaa5f053d6f1563f8639a011450ea50a9e3d5c47b4e09b8eb40779ca4572373cf06c1cf5098c50e12a541ca6e003bf6b8236f33048358965f
TLSH
T10E717CF783A5966ECA1197F49A14AE1BCE2C0521431C7C19C5D4AF2BE3F34B0D10174B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ddb5a470a41ef3e121cfc5c1450ba53c0e7862fdd1b48713331ec9260308ba73
MD5 f813ac1ca35eebc5e720059bdfcc1592
SHA1 d8db6b0c3e1614ddd485c1f713ea7335a4957f8d
SHA512 e98fec82ec4096f55e5df216d97a77848ceebd7c9f499c337e7ace9a0d151e9c86cd5f0a1e0de53caf6807380a6a0f83f01cdb4bc90afc5973f62b14b6291464
SSDEEP 192:sxZsbRxyM/jK1Ml8MkrZ/fL4sPzkMIdp6pTHmHg6+WNDHYH/YHRiZPIgrJ:sxZsPMl/f0sPzSaH8k/99
TLSH
T1A352D8226A349977CCDBD209FA41BB53D6F9557292900E48A9FC9A1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 65eed4aef83ee5230e8aa8448fb60f021c5f0e1181d9d46457268a871b45848f
MD5 8157c9af099c99c37ee7c3faf18e0538
SHA1 c6784f77070c42139078e837f78e978d5c279438
SHA512 345681fd203740abc53dc26390720615872bc357da174c7124c7232c5bc8d26d384666d7ee012cbf760bdf2216cd6ed5b326b83f49150718f5531efcb82641ce
SSDEEP 192:sxZsbRxyM/jK1Ml8M2rZ/fL4sTDXMIdp6iTHmHg6+WNDHYH/YHoKZPIg5yJ:sxZsPul/f0sTDFnH8k/64
TLSH
T13752E822AA345D77CCDBD209F641BB53D6F9557292900E48AAFCDA1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 1d67a887ded24debc088bf9f3a2ab86c71bdfcac11593d13390db4d3e49d3597
MD5 1144bdf4e93a466ce29b122041db2309
SHA1 be47490a3b08d85546be0d23742d7c466d71feee
SHA512 c6ec63c887a5d15a4bab614ae200443590c659501e8a1d2ce5bcfc265dbfe588dc96bd9fe05bac985307c4c6cfcc72d63ec46e9d5c95528337e4d2a920c2d91f
SSDEEP 192:sxZsbRxyM/jK1Ml8MErZ/fL4sTDXMIdpbWizDHmHg6+WNDxXv2YH/YHndZPIg5yJ:sxZsPsl/f0sTDFjH85F/+4
TLSH
T10062D722BA345D77CCDFD209B641BB53D6F9556292900E48AAFC9A1C04E6BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2d2816c520c621bd061f42db8be57c8fed9bd360724429b1217d5f20cd9c9bdc
MD5 99f154283503a87067843669ffded2b1
SHA1 9038023f2c82adf70747bbd8856e14619946bf1b
SHA512 759b443895be7facf85f3ff8a8b3bc59c1631cec6a5137b6befd3b2d24c4b64d889f0f1d0d82c281bb130f58787e221899a5eaf0e714b987b29d233ac0873357
SSDEEP 768:f+UZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RAroV20s:f+UZYTMWvg09ou1ja7eLZmRLLs
TLSH
T124E20A3B280CCB7E4F844E5DEC2AAF863ED801CB5A584D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 cdf82588018e1be5de84622bfa779f148506d22cfd6a7b568db75b559ebcc0cc
MD5 f16fe9311f5c3026609de308dabc9fad
SHA1 c384f992022a520624a980d23a4c5dcd97d42cd3
SHA512 57baa3b2b75bbd655527a414ab02b25b60e2e43f5c7d4ea529cb2a4e86cbc58ec00e14750ad4ac058c2cdc743a50699d9f70398d30fe02d7d7b3da49c4ee78d1
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLacz:E0VFFjnL
TLSH
T199E1281632BA02013C3D6A0C86D597A78E8272637019646B7BED00B5DE67E21DFFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58eed0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58eed0.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c2e631b496f6a52efb9d41d02a26d9883f2e1639d5064c50c2029acec930974d
MD5 43eb4aedfa61b841921650729a8ef6c7
SHA1 58dfa5c47fa847fa9f494f208c0e4c601cd4fe37
SHA512 a91ade1882c88bfa83f95abe959c083e359871c71fda90cc06bbb84517fb943caa8a8d62333753f98596ff71526b248a6082b33b818bb238045915c201d0125c
SSDEEP 384:5ZcIhsNKIlydYMCzX5od+V8ykVVX9tJrOqqBeRs9JKgqijU0f:RhkyB2OD1/hOqqTjKgqmU0f
TLSH
T103927C326428AC769DE6B585F44A37139FF89067EBC46FD492FC6B0C019A998130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 1891bc988cccc1cd3ac12b7634e497f046111fce0b677cc1ef26e583c273f2b6
MD5 eb174e453a1e871844ce2de88bb5bf95
SHA1 4cf4b943ce6087ffb86ee8241c5fe2c6db95b9d4
SHA512 4817737c8048d723f9c6c7baeaf027a01de378c3dff9ad5c9308787128c0e6f6bdf88538b9051c4702dad0f045170d3c3bcb840ee6ae688a50323067fe7352e6
SSDEEP 384:wiFiZcIDlsNS8TUNTUlIlilydNLYzX5od+V8ykVVX9tJrOkqBeRs9JKgqijU0f:LFQ5zwgmy/AOD1/hOkqTjKgqmU0f
TLSH
T109D23BF254D79876D9AEA743B77D2E128EBCC063F5806A90B3D85A0CCC564BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b290d02c1f958e57a344e2d53d8b159ff238a34d60370929dbab515d8213ac5
MD5 11a67c1d45546f40713b5c25db83b94e
SHA1 a057cd6a41516aabe2f73885fb7db1baf731c56b
SHA512 6793090723a427ee22d4dea17fc17ae992fa6bc690ab699af2dcded4a3770f0a02d187df1513ee1d3fdd2633667578d8d90bbaf8d23eb9999f7afffc2a9c5dfb
SSDEEP 192:yONL61VWQmiUy2vgGX5Obd+j1jzorykaoX/a5Q315U6:yONL6WHgGX5od+V8ykVCE5U6
TLSH
T11302E935A8686CB78EE2AE4AB48737135F95216BEA542F84D6FC1B1C00D769C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 6a03aa1b45e46e0a8368176bb119586dc91760c5c22687871fa80576159918c3
MD5 62bd9759cf58e26d3113d4372d9f46fe
SHA1 066c58d20baa1ada06b9e3d3fc207fce797efa1a
SHA512 50ed190326a1cec4339c24f36490686db102655efcc93557c8fdf0497a19bb6844a0adfae98a108f9dc08412b6f6a3bfcf92c6eea011cdf52aee94cd2fdd4eb4
SSDEEP 384:wZcI3sNKilydNmYzX5od+V8ykVVX9tJrOqqBeRs9JKgqijU0f:O3iyiAOD1/hOqqTjKgqmU0f
TLSH
T167927C326428AC769DE6B585F54633139FF89067EAC46FD492FC6F0C019A99C230FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4a1bca9906876f2ef59b77876c247c982c08aaf6d2b413688fe05c09becde633
MD5 3c04ea59f3f5c5258bec2837556dc988
SHA1 47229910db47eb0b94bd178859822120465ae715
SHA512 d6729e97110e89bfd0c688b1b6acac4c69945b182d7eef0eab92aff10f6d0281f34a839ba66cd792893602264ec35c4707ec2763e85dda1da10b19858b0d3876
SSDEEP 192:WON7617WQmiUyEveGX5Obd+j1jzorykaoVX9ySJrOqjJ58qeU6:WON76QneGX5od+V8ykVVX9tJrOGqU6
TLSH
T1D3121932A468AC675DE2B595B48732139FE45127EB897F80D6FC2B1C00EF59C230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 481cc7f84e3edd9f7662e03b2a367e441d57b39094706112d59b1f4a230a83c5
MD5 b69ebecabfb75108e571542b6de403b1
SHA1 8b2b844968d1dc17649f5e87ade1c79b0e0190dd
SHA512 8f13a8a2edee79a93cbbab8b7687152bd98eb3346a25a42c3585993708c21e2f8f567e6ea80c30bf3a0ac571e0f5071355e12ff91703db7f3bf3f0d95d7c072a
SSDEEP 384:wZcIasNKRlydRQYzX5od+V8ykVVX9tJrOqqBeRs9JKgqijU0f:OaNy0AOD1/hOqqTjKgqmU0f
TLSH
T115927C326428AC769DE6B585F44633139FF89067EAC46FD492FC6F0C019A99C130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 96baff15f394a5763a9fb14f21c8212d80185d94c673ed3a94bd8ca2fce64a2b
MD5 d4bc397dd803d945d1807fd5d3b11fde
SHA1 27398aec0364cd1bce59501b71d38d0cab3adca4
SHA512 41611f6590e91382407000653f26fa8a927d0afad5f4ea0af9405d6a0ed28dcd2d7d54ad95bdbbd73bd2c1081123bae9b137bfdefe94ac2b1717281f4bc24e1b
TLSH
T18EE00202D301009BC134137044D31B2433B3C16103631346491105743D463000E51591
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f8b0552276e9b7769a91924f8edacb3555088ba4c4838c1f307513b83ec985f3
MD5 785932545708ec5251db16adb76f433a
SHA1 9f57c764a3bfd8565cfa557b282a0d8085786f13
SHA512 535d37359e8511f437e9087840c41dd61e7d350ca6f59815e1bc7e84f04556ecc6d4710126a79429637ec87f73f015e095edd529a98607b809d53ac4c11f8e6f
TLSH
T1A4E002021301009BC134137044921B2423A3C16103610346491105740D463000E51591
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe58b997.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe58b997.TMP
Size 392B
SHA256 ae0990f2b01b6f0f108b825b339cd93e1fd38efc80c6407464309274b52f161f
MD5 65cfc4bde8cb3a496d3eb4c2faea0465
SHA1 c7a9113c50b766203d5587d475922c9fd3a52090
SHA512 0c789d88fb49745418406384c8461809d15bcab97accf691e41cf3716048c2ace34ebb659fd08378e3728e21f5a8c7232e78c7698cb508f3cd1186e47379e445
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b81285f793c2e64606b1ea2464782a8b46df861d57d98829f4012561ad9c16e
MD5 ede77caac1665bf30d1ff87726928bea
SHA1 dc09bdf85c97f9e95d35dd94624457a86ffe6a7d
SHA512 3b16a152479281caad90682929365cff30b673c204742ab51a01488e7e4e65a91df5349014af8be2fbb7bba581daa9e7f67765a1059e6142d917c1af7fb85300
TLSH
T100410D58B6FA1148B3776F46ABF6A8AE547ABD373E46905D00110E4F4A23F00C5B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads