hxxp://onlysimps[.]lol

Analysis

user interaction
yes
max time kernel
86s
max time network
89s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://onlysimps.lol
Sample260810-ap8rdsdb78

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2268	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307950774630275"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{382BF45C-3245-4BDD-B975-A0E63D599373}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2600	2652	msedge.exe	86
PID 2652 wrote to memory of 2268	2652	msedge.exe	87
PID 2652 wrote to memory of 4136	2652	msedge.exe	88
PID 2652 wrote to memory of 4136	2652	msedge.exe	88
PID 2652 wrote to memory of 4136	2652	msedge.exe	88
PID 2652 wrote to memory of 3620	2652	msedge.exe	89
PID 2652 wrote to memory of 3620	2652	msedge.exe	89
PID 2652 wrote to memory of 688	2652	msedge.exe	92
PID 2652 wrote to memory of 688	2652	msedge.exe	92
PID 2652 wrote to memory of 688	2652	msedge.exe	92
PID 2652 wrote to memory of 4340	2652	msedge.exe	103
PID 2652 wrote to memory of 4340	2652	msedge.exe	103
PID 2652 wrote to memory of 4340	2652	msedge.exe	103
PID 2652 wrote to memory of 2288	2652	msedge.exe	93
PID 2652 wrote to memory of 2288	2652	msedge.exe	93
PID 2652 wrote to memory of 2288	2652	msedge.exe	93
PID 2652 wrote to memory of 1236	2652	msedge.exe	94
PID 2652 wrote to memory of 1236	2652	msedge.exe	94
PID 2652 wrote to memory of 1236	2652	msedge.exe	94
PID 2652 wrote to memory of 2856	2652	msedge.exe	97
PID 2652 wrote to memory of 2856	2652	msedge.exe	97
PID 2652 wrote to memory of 2856	2652	msedge.exe	97
PID 2652 wrote to memory of 3288	2652	msedge.exe	98
PID 2652 wrote to memory of 3288	2652	msedge.exe	98
PID 2652 wrote to memory of 3288	2652	msedge.exe	98
PID 2652 wrote to memory of 2076	2652	msedge.exe	100
PID 2652 wrote to memory of 4448	2652	msedge.exe	101
PID 2652 wrote to memory of 2076	2652	msedge.exe	100
PID 2652 wrote to memory of 4448	2652	msedge.exe	101
PID 2652 wrote to memory of 440	2652	msedge.exe	102
PID 2652 wrote to memory of 440	2652	msedge.exe	102
PID 2652 wrote to memory of 440	2652	msedge.exe	102
PID 2652 wrote to memory of 5044	2652	msedge.exe	104
PID 2652 wrote to memory of 3936	2652	msedge.exe	113
PID 2652 wrote to memory of 3936	2652	msedge.exe	113
PID 2652 wrote to memory of 3936	2652	msedge.exe	113
PID 2652 wrote to memory of 3748	2652	msedge.exe	114
PID 2652 wrote to memory of 3748	2652	msedge.exe	114
PID 2652 wrote to memory of 3748	2652	msedge.exe	114
PID 2652 wrote to memory of 2888	2652	msedge.exe	115
PID 2652 wrote to memory of 2888	2652	msedge.exe	115
PID 2652 wrote to memory of 2888	2652	msedge.exe	115
PID 2652 wrote to memory of 376	2652	msedge.exe	117
PID 2652 wrote to memory of 5020	2652	msedge.exe	118
PID 2652 wrote to memory of 4740	2652	msedge.exe	119
PID 2652 wrote to memory of 4772	2652	msedge.exe	120
PID 2652 wrote to memory of 4772	2652	msedge.exe	120
PID 2652 wrote to memory of 4772	2652	msedge.exe	120
PID 2652 wrote to memory of 1824	2652	msedge.exe	121
PID 2652 wrote to memory of 1824	2652	msedge.exe	121
PID 2652 wrote to memory of 1824	2652	msedge.exe	121
PID 2652 wrote to memory of 1708	2652	msedge.exe	123
PID 2652 wrote to memory of 1708	2652	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://onlysimps.lol
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ff88f74c188,0x7ff88f74c194,0x7ff88f74c1a0
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=1880,i,1515317545584520504,15693576060202207468,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --subproc-heap-profiling --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,3740342395404125662,6011772475448297014,262144 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=2600,i,14357948974577037790,3597013862179864701,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15367575942730963891,16324888492464151687,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,10948229649533744059,9990274225326525388,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,5964311038766650923,15858732153657822279,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,4334622830977550345,15387233198406746423,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5088,i,13688135187448815802,13104661328348276389,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5300,i,3048497286027297928,6761454526934847479,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5480,i,11347094717095710984,1500760939575174977,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5484,i,6764321010597415003,6869795789570919016,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5888,i,16729619716203816360,13682341777740081727,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6364,i,7788672061868669226,8021666697452244375,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=6364,i,7788672061868669226,8021666697452244375,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4808,i,5848346587245203936,210291966115724182,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4380,i,16332297336582337661,9744717359560819095,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3504,i,16709323767280152710,876388326078317855,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5944,i,17512240922331552752,6602349451040269021,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=5936,i,17734229438581665716,6563424291149386998,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=560,i,11354403971010370935,3316232474885271323,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2924,i,13805027551430049015,4877320739380392470,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=2068 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --subproc-heap-profiling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6792,i,8699750538376041442,490284428395298981,2097152 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=7000 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --subproc-heap-profiling --always-read-main-dll --metrics-shmem-handle=3928,i,4997394944980011697,6193789520732419366,524288 --field-trial-handle=2204,i,12700404505529322976,12643995603778373851,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1708

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f32186789ee213531ec433fa1c5cad713becba6a5aa80fa79a3f92353346366a
MD5 a33e0f980e52b6a95a4305365dae3acd
SHA1 71e87ca2a27596079965077beadbd02e4909156d
SHA512 b693c97cb43dd6f64b27f799a07b487cbd1977bf758b2b9b2032c5035a5b2b4972caa7f937242b35349de8ab8db6c77aec1d0001b6d9d804ead4b5b77ce2f460
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7W:fwUQC5VwBIiElEd2K57P7W
TLSH
T199B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 21KB
SHA256 d8b1b31cd63e9269a2c6146e0505bab14996cbdbe32f37274cf8601bd00096c6
MD5 2eff3d8f357a0029f356f0b9b29efc0d
SHA1 79f4a93a35e0285ddd110768b2dc7bcfab791212
SHA512 cd98e56a9d5a5247cb6d037ef60ef38f3de6d82f77b2d8b8044c821a6d194bde1373f2aa0efe10296883a092254592ba8da4f438eef1f586ecb4e3066742de2a
SSDEEP 384:u/xbLqGMcrmbD/oXdSQG76KfcRhN9wvp+uDef3x+8YlpBsL8PMLjobz:CNuGMXb+q0jNipOfB+88pBsIPu0z
TLSH
T19FA2D028A8CA01B330506685126D35E88BD104E1CDE693EBD4DFEEF70E491529F3D65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 da090030f628a7863f35c481d635ed5ac60bf4f7084ad3cf6fd435a472b3835e
MD5 76f7fac166009ecd648f5a4dece0308d
SHA1 25cabd78a0175dc9d2d0b0dca5e1edf0169528c4
SHA512 196dab7d57e23a1801e9b30dfddd9ab967fc93338b60b57c70bfb46dfb7033b664ff56dc08cb460704abbca8d9cbdca77ebe9b76d733760bedf064bebee71242
SSDEEP 96:Qcg9+Frs4Rn0+dgQ1E0maJY9T6/d8xkDu0jc5JeFpj1Zp:QctrhBdQau928z0jc6FpjB
TLSH
T1C0B1B42145EA92A4D70009B2D4D32E4531F35DDA4EA78F1A236B9EFCE2357728C5D188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593f22.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593f22.TMP
Size 3KB
SHA256 5bda15757fb7b73ec9026b332b6751fe20cf14b9c6179448f08c83182c8d331a
MD5 f11f7bf7778555c470133fb6195c100c
SHA1 4528e05cf6fef5620e7334da82c9e595c6e94c1e
SHA512 bed638a90267478d35ff429adf9e19c80d5c6862881558561543dd7a3b09f474ea39227f69c58eb5b4c5fd7d3e0a4ee6b015c7807e66935a3f7b4a02f676992b
TLSH
T125613A3402A113A5E3901572D0E36E0539738DD94EA7CF2E527FA7FDE635BA28C2E048
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 14KB
SHA256 34f5d2c0da9f2d7c719d0d9ed03bf7f48cc9cf38b0ab42a2f48cc51c626081e2
MD5 f98e34d7955c3b98986d295c37ac8d14
SHA1 f131759327847f1f5f1a0984076f7f9f57aef9fc
SHA512 4cf7d6bb02bc3a9399b0453d0b1127b2d30d3a14d11b91a67e52ae7cf73f4d85c28711e21b15c9c83ff9e4ec2af00016b297e120d0aa0bd6e8eb67495b2c2b4c
SSDEEP 384:DI9m9x9n9c9J9P9h9F9I9rK9uRS+5ap9z6vXJJE1q9eWG9s9Ib9W9j9CTW9f9vBs:8VC1kuMP1
TLSH
T16A6260F3C2E9D52DD81251F1AB153E1ACE2D095882183C1BCEE6EF5BA3E3472E11194E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7770ac1d8b6ba1a964ae14727729675c34e85932f494e573595d8c75803ac81a
MD5 6988eaec32d796e5d81dedf7bc24893b
SHA1 cf2a2a36735f78b804c0101a1ee41d62642803cb
SHA512 a22ad62bf284f0a049466dfe5dea87f96ee7e24fd3e8b114e5dad48fe37959a41ad1aeb21c92bc1a3b68973501fd7951ec39e9023e81ee05e40403ec44e27a77
SSDEEP 192:sxZqRHyM/jK1Ml8Mkg/fCXs1TBTgIdpugHW6+WN9M7/YwwhKQsIgrJ:sxZq7Mg/fks1TBt3HbK/f9
TLSH
T1E952E8116A34A97BCCDBD20DBA55BF53D6F90463D2900E44AAFCDA1C04E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 567ac41f158a9aec2deef1ca66c1e828d727c7185e730acf2775544344167349
MD5 c808e9dd3dac557fc3fe8e2dd2f50c9e
SHA1 27a539cbb344b04651716158051df182e8dd0c41
SHA512 9fbc5f30735f7ae0a0b24317c53963e0c21c01d0ddf59354b59eb3b7cd4e6117846f18e5f3dc2169882231a31ba63fd13873e27467ceca3f8e113af82df81973
SSDEEP 192:sxZ/RHyM/jK1Ml8Mkg/fCXs8TTTLIdphL8Cv/NenHW6+WN9pvXYw1dKQsIg5kJ:sxZ/VMg/fks8TTQrOHb/XGm
TLSH
T1C862E8526A346977CDDBD21DBA51BB93D6F91423D1800E58AAFCDA1C01E7BEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 779c2a9d8ce2102f2efecbd0435a03d307debb3c97a7166c28d28ae5226f1b9e
MD5 b919da9ba944b7860fed15bfe1f0cae1
SHA1 f41e3296ec01fd4dd50db70ba9ed7297b7d776e1
SHA512 0f75f7a592600c86ddff34cce7010b18d19a8c9d5338450c5cb851c3e049d6646b1c5855f76df705e3581ff0e0c9303c9563a991b0800246027a11bb8b0136ca
SSDEEP 768:y/4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dRrohAcHam:y/4jeXmWvmKLEu1jacPLZQdql1
TLSH
T1DFD2FA3B284CCB7E4F844E5CEC26AF976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3a6841462b10f2623f536895182bbfed8c86fa02\c1cdf63b-b00f-4de2-aaca-42f754ccca13\index-dir\the-real-index
Size 72B
SHA256 f188119e5f34dcd446ca4b8d67469faafbe548b8c821ae232ae18da330ac94c2
MD5 ce9ce084aeb5d9dac52118d1350e3986
SHA1 20f4f19f6c32602afdad0208a780c135e9ce232b
SHA512 2bf98c8c953455f753762fa6dfc0245a8310eeafc0356853ec5b228bf925601fdcb5b1ed836397198655c1cfa065d060f1d40a034e4871dd97c82453e05c7ae1
TLSH
T19BA0029542E84003C1012776E1421689373158118301430242D40594CD936589713247
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ab2f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3a6841462b10f2623f536895182bbfed8c86fa02\c1cdf63b-b00f-4de2-aaca-42f754ccca13\index-dir\the-real-index~RFe58ab2f.TMP
Size 48B
SHA256 7c19230698c8cc3adb9eafbd17d00a5a24a7e6990b8d62f21916fd7bce88af4f
MD5 89f1e8c915f6893322608fb2be0522f9
SHA1 b9b439cc8816f5ac8daa21b9758fb45999636661
SHA512 4ffc60700eb2135a856b046fc8843b5693f027243436388d027209fbcd28ff7e2cd054f59600fcf8e093469fabaf45d398f3b84b38a3457d30cbda0dc00fe644
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3a6841462b10f2623f536895182bbfed8c86fa02\index.txt
Size 133B
SHA256 db62b3710bbd21b60028ea0cd0d547627e907c881c82246e07e8fe88eaeae6ce
MD5 08f30c785b6b1c385fd28696be314251
SHA1 c709bbebee01af4be4c915839906ec04710f6ff8
SHA512 6236957f34181699855e32736baf4efb71a6190a22c305967c762234a220910e6a728d45faf0d3f77b90b0725563240f69c6efc66be4d9d677ed6b5f7988d53a
TLSH
T10AC09BE764357511CF5157A0155524FCC6775F555858476EDC7050086B0506612CBE17
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ab5e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3a6841462b10f2623f536895182bbfed8c86fa02\index.txt~RFe58ab5e.TMP
Size 139B
SHA256 9d0ab5419840e885850b4bebd7421a45123bd35d46c198b880385a5e5c85a8ec
MD5 18a276ed885ac00ea7301556d67d7f30
SHA1 222a6e8999db23c5774761fc8a2a86e4860d1d44
SHA512 eaaedfcae5621844bd61ea754ce7ff54ca8d2c685bee8b31bba1c8a56ee8ad67e16f57d169e2c70ef02dd38bcbdc7d1552082a91a0c2618521b5dd7fcf2956ea
TLSH
T191C02BE664313101CF5013A0055024FCC7374F550C4C432DDC303008663506303CEE13
MD5 SHA1 SHA512 TLSH

Submit Download

ba23d8ecda68de77_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\ba23d8ecda68de77_0
Size 8KB
SHA256 2e28e4764235d3f46373b1b20ec5efea44627e31f775a163af4b025bd7ba4ff7
MD5 e76e908f28d4ef244f097d12fe793218
SHA1 f39c5872a6d56d1021c4282bc84b2cc4329f8651
SHA512 ce259fec45a4d9f151a92378dcee0993ae267b7bc12421790862b8af05f76a726563aa9d6e3a540c735f2d5151a5de7cf1c417df6ede5d19ff9d5c81b8fefd10
SSDEEP 192:xircq09bV7jO0zqQdF4WodWpvO4qQD+FqtC:d9bZ+WpXqQD+F/
TLSH
T1EC02E9CDFF6CD4574B732078A84AD487287F70B31E8BE843E19D0968A5816939396F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 0359edbfc13c074a35a6256b4efd4a28349ad9f95bd68f3b52fb9ea64de85294
MD5 5fc4995f4d08382ded84b98db4562e9b
SHA1 ca24551889bcc4feae6a026d11c0937e89d362f9
SHA512 d2c239fbcc638a083e5f273c24bf0f384462229e1ba284ada037aabe41bec3c4cd2893c88501f783d69037eb97259f2400a92e1fcff2c6af2e66ed46ac4eb1a0
TLSH
T14DA002AA41E61251C0090771A051C5CAB32259150107533180F4156489999644163035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a96a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a96a.TMP
Size 48B
SHA256 f4fa2c6c86a268483b0349cdf82d6075092400609d02489a30dae2a4fa27f3da
MD5 45d1ab713455b3204d9b90fa529f2aa3
SHA1 04d43b841d619b43c948b7d4ad1fc664ebb92684
SHA512 6accea980a5314d236402273381fea50f855a7a31521105f84527344075b6aa563193c7371d78c9a5a9df7a5140e917f14cf9ee5e9cbb71cd66660fc7b501ce2
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4afa284178e1f4aaa16956d1c17565a3086f8a2fcc42e7f4ad8ddfd87d129093
MD5 4148b544acdd1e1f40699bc08d59dc88
SHA1 46bff25b9e6d77b304ca7cc928d0955bef4ebc4b
SHA512 b50016e925fc374a45832da48b1f409b5d32086391b0b82370929bd9dd8682282f09ab8ac233023bacabe61dd0218af546c7eed9ce7343b1cd6742cf1c73d12d
SSDEEP 24:KdQf3kVaadCC+4SO+lIjY+Kitham+1EwuSmEMt8ofyXYiflO/aUdo0Q4gM+DIjKw:KAJIdKawQvy1bI1KYcgEEIfKBOMjyw
TLSH
T1FC917E0135BB16423D7E2A0CE2949767964270A3705DA42B3FE940B18E6BE218DFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

59e5aeb9-2d08-49c2-b1f9-bf99de580f82.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\59e5aeb9-2d08-49c2-b1f9-bf99de580f82.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ccefe32223f7d03fd4daf584e646f045bee3c8e8988b98b36d6e29ae89713431
MD5 640994d08030bc979a5b2347f01f9e69
SHA1 f0ea540740ec2c3df48427fd822404e435ffe08b
SHA512 d37c2677671a18ab52a917dfd0c6a6c478dc2edb991252bab505632a21e29d4e7e1510eb488256287848daa9d64463a9775b4a2ecc76213a4ab5661c80335c43
SSDEEP 384:yZcIhsNXzNCV9NwMzf+DO5YShxJrlFfI6HlytEDq1f:AhTVxjWONThffIoy6DqR
TLSH
T1EC928D3158786D3359E7A245F88736138FF85027EAD46FC8E5EDBF2D00DA6A8130AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 5552f142c5264219f0ebb53cec1a670afd3d96de4a2f193e3e54f300e78ebccd
MD5 9cebe1fe91e7b0e550797b985aea3256
SHA1 73a6d1f2c5ec0939fd80bd3ea758fa560386fdc4
SHA512 f15c3ede77fe7e0d6ba38921307510e6dd20de14706971630e3bb103f0bb6e51cc7062a6edd3504166a1dfa41c5437499773a167807a33b830b3c8e37af90b29
SSDEEP 384:NiFiZcIPzsNp8TUNTUlIl2NCV9Nw7U2f+DO5YShxJrbFfI6HlytEDq1f:EFQrcwgHVyUmWONThJfIoy6DqR
TLSH
T1F7D219F244D79836D9AE5747E77E2D138EBCC013B594AA94B3D85A1CCC861BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bbf816be1df2065d483af8b2e775e6a5c7d86943ffab755155e129daae4ed483
MD5 c0836da054eab088f9e4c5d2bfaeb13d
SHA1 fae8aee665f638010ca12733e3354dce583606da
SHA512 fc807232a1bbfb3e2b238801940b5c6a83258b0f076afb34d9d553db09cfdeeb18215d4ae0853acef00e9c5a68ee313f24c469ddeaf9e1cadca994643f80a6d6
SSDEEP 192:EONt6hZ0QmiUyoGpc/+jVlO1TY55wOZtnU6:EONt6oWpu+DO5YA25U6
TLSH
T11802E93568687C778EE2AE45F48737235FE4112BE9D56F84E6E82B1D00C779C2306836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 44607f0b0fed86d898b014944789be0af3873d4bbebe0bb37e702513e7bb1ae6
MD5 d43a48ff5f3243943cfab5928e80035d
SHA1 1aff17e1c5a7e44a0651b6679264e64917b7f446
SHA512 533571374571ab738cd1fc3ef500a66b4f2f87fdbcef4000b6c88f5322f15c3bbd19a760bd8f1cc3265a8240f89c28ed0d5e68ac75ffb299f408b3fa7f4f1370
SSDEEP 384:GZcIhsNX2NCV9NwuU2f+DO5YShxJrlFfI6HlytEDq1f:UhYVXUmWONThffIoy6DqR
TLSH
T149928D3158786D3359E7B245F88736138FF85027EAD86FD8E5EDBF2D00DA6A8130A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ee6e78db7b550ef7506aa27cb8672346e0f42a9888ba8108dfa6a94efda4ca0
MD5 eb6e9b2816b33d01099d2efed976d093
SHA1 640460cf9b694c97e00e95dbd3c0e9a035f1cd23
SHA512 789f67f5dd508b2d8b1be951fc1b5f29613bc269d0703e0e03fc8c9b99284cb740a9dc27a4865ecf3c91b3e993ea8322ce71cd5176c9f77e14c8d1d27f62cce7
SSDEEP 192:fON546hZKQmiUyDGhc/+jVlO1TYSbFuSJrP5cOq+qLIU6:fONC6ybhu+DO5YShxJri9fIU6
TLSH
T1DB12F8316868AC374DE2A645F88736139EE55127EE857FC4E6DC3B1D00DB66C230AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a99ea14197e373ddc51457c1598c0ba83b8b5f8b5bf953fb5bde34575b0bde8
MD5 a91ab755c327b1207f1107e9e6e1b9b3
SHA1 501927a8117fc65c416d354c24636fe55220cc53
SHA512 168e693940721dcbf52f16ddffcdbf1a0e0a41b642b798f06a3cd32a9a35ed649cbad0e01b847519f5f06cef632c1adeb32b3a3bb682253d6e74e08839db7c47
TLSH
T109412C48A6FA1108B3B77F566BF6A56E487E7C772E06945E10110E4F4A22F40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads