hxxps://music[.]beepd[.]co/card/padreguilherme

Analysis

user interaction
yes
max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/09/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://music.beepd.co/card/padreguilherme
Sample260929-1mtskaxsg1

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	94	https://apnews.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a42e2ef6a8c46359	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1132	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{03B0DC36-9D88-4026-A3C4-0CD7A285FF27}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{050596CB-3BEF-4991-9BB8-34DE37AE14BB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
556	msedge.exe
556	msedge.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe
632	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 632 wrote to memory of 384	632	msedge.exe	85
PID 632 wrote to memory of 3352	632	msedge.exe	87
PID 632 wrote to memory of 1132	632	msedge.exe	86
PID 632 wrote to memory of 3352	632	msedge.exe	87
PID 632 wrote to memory of 3352	632	msedge.exe	87
PID 632 wrote to memory of 3488	632	msedge.exe	89
PID 632 wrote to memory of 3488	632	msedge.exe	89
PID 632 wrote to memory of 896	632	msedge.exe	90
PID 632 wrote to memory of 3236	632	msedge.exe	91
PID 632 wrote to memory of 896	632	msedge.exe	90
PID 632 wrote to memory of 896	632	msedge.exe	90
PID 632 wrote to memory of 3236	632	msedge.exe	91
PID 632 wrote to memory of 3236	632	msedge.exe	91
PID 632 wrote to memory of 2920	632	msedge.exe	92
PID 632 wrote to memory of 2920	632	msedge.exe	92
PID 632 wrote to memory of 2920	632	msedge.exe	92
PID 632 wrote to memory of 2072	632	msedge.exe	93
PID 632 wrote to memory of 2072	632	msedge.exe	93
PID 632 wrote to memory of 2072	632	msedge.exe	93
PID 632 wrote to memory of 3960	632	msedge.exe	97
PID 632 wrote to memory of 3300	632	msedge.exe	98
PID 632 wrote to memory of 3960	632	msedge.exe	97
PID 632 wrote to memory of 3300	632	msedge.exe	98
PID 632 wrote to memory of 1816	632	msedge.exe	101
PID 632 wrote to memory of 4160	632	msedge.exe	112
PID 632 wrote to memory of 4160	632	msedge.exe	112
PID 632 wrote to memory of 4160	632	msedge.exe	112
PID 632 wrote to memory of 4600	632	msedge.exe	113
PID 632 wrote to memory of 4600	632	msedge.exe	113
PID 632 wrote to memory of 4600	632	msedge.exe	113
PID 632 wrote to memory of 3736	632	msedge.exe	114
PID 632 wrote to memory of 3736	632	msedge.exe	114
PID 632 wrote to memory of 3736	632	msedge.exe	114
PID 632 wrote to memory of 2052	632	msedge.exe	115
PID 632 wrote to memory of 2052	632	msedge.exe	115
PID 632 wrote to memory of 2052	632	msedge.exe	115
PID 632 wrote to memory of 1216	632	msedge.exe	117
PID 632 wrote to memory of 1464	632	msedge.exe	118
PID 632 wrote to memory of 5084	632	msedge.exe	119
PID 632 wrote to memory of 4220	632	msedge.exe	120
PID 632 wrote to memory of 4220	632	msedge.exe	120
PID 632 wrote to memory of 4220	632	msedge.exe	120
PID 632 wrote to memory of 3716	632	msedge.exe	122
PID 632 wrote to memory of 3716	632	msedge.exe	122
PID 632 wrote to memory of 3716	632	msedge.exe	122
PID 632 wrote to memory of 2480	632	msedge.exe	123
PID 632 wrote to memory of 2952	632	msedge.exe	124
PID 632 wrote to memory of 2480	632	msedge.exe	123
PID 632 wrote to memory of 5972	632	msedge.exe	131
PID 632 wrote to memory of 5972	632	msedge.exe	131
PID 632 wrote to memory of 556	632	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://music.beepd.co/card/padreguilherme
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff952b6c188,0x7ff952b6c194,0x7ff952b6c1a0
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,15071697756013748734,8491540643887823791,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,9717582102151649746,5949317598792020456,262144 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,9799871412469595310,11516450955121753531,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,11478677002975758291,8888363439477785468,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,4634687817540423467,2183692434758615838,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,14622955196050197881,18169009481446534950,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,2945591735341907656,3138067435900238757,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,15307132094012943660,3176189850768234517,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,6375457030844887601,7402004431331008758,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,16324351560014650444,706550014759761148,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,16324351560014650444,706550014759761148,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4332,i,6713386925831769663,10081638154829044584,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5852,i,849624447876455980,7224444822004911757,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4364,i,13270340379780278066,11622143304755308994,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4260,i,5763493012192387810,11640622310469434996,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4380,i,13952177153198864241,10985260644130190239,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,4728182171379458294,5046440059320712172,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,7825956075669612987,18384609025417273597,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=560,i,13830913334900289395,16108475538313427715,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4820,i,12915743258710698823,6963309768962262535,2097152 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=3016 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,8865154179900016538,8222184296624714728,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,4016463119567050007,4237347206389650594,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,17224429550648595490,6590859186661666797,524288 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5036,i,7702481900102911410,4598541675689989077,262144 --field-trial-handle=2276,i,17036347344487436010,4775143653272228434,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

6f388b1f-faa4-4cbb-8314-8eecc5078d5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f388b1f-faa4-4cbb-8314-8eecc5078d5b.tmp
Size 27KB
SHA256 42faf87133403bba18bf28b6d345ef5e00e2b4c495be8063507938dac4cb62d9
MD5 6cee1fc285f90eeef5b1ce23b66cad85
SHA1 8f9ad004082cf266da7706f25a5f05d5906670da
SHA512 8e2e3347cce4c6221f70492a87a151c76602c84f036a52eeaff0e8252791b19ceeac3a7c5cc40e36ca5bff3e494aec7a332103c8a3beb5adf6af85cce12379ab
SSDEEP 768:P4ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzYrofH0:P4ichfPWvPZplu1jan+LKgzjf0
TLSH
T11AC2FA3B644CCB7E4FC01A9DDD1A6F977EA802C7AA588D4047FA984C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 966b4ef72b450e148112a7ddc23c5b552d20e4bbaec41daac60f57e5cf436be4
MD5 83a2263f9cbfe198926f20106dd09b7f
SHA1 f8a8037293aa431a52fdf830a029211cddf90586
SHA512 6fb5e90f15d673e65130ec91edc2f911d2a42ecf56da348f7237407472efef3ed35cb79c0bf4ddea9c7df5f25d1d3deddf28703d39e1a5fd99e850f7e31ff487
SSDEEP 96:7BHgM7ePkzPgG928G9P/N/NuWmKJYlxF/cjNDvX:7CCeQgGi/pNuWmYMxNUl
TLSH
T1AB91EB8062879379FB76207441D915CF3D322ACE198B2F22C2D5D478BCCFBB5622920B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe596884.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe596884.TMP
Size 3KB
SHA256 068c9e57f7a558486dd6322452b4780b18542e85639c70f6f01a3668103590bf
MD5 9aa2ed3f3833cd54557445fc83cb13d7
SHA1 0fb0f4e9a8a48f1ed0022427732553aa70c63066
SHA512 a41e809a811077d1172d260941918e660c883382baa7202195ae8b583a6f270952330da26186146f49eabf68be8b3d9f63364dcb5f8b7eebccd95b3753d9d2ab
TLSH
T14561B4802287837EFBB3607481DE11CF3A3458C9188B2F22C0E5E578B88F755B31811B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\000003.log
Size 187KB
SHA256 3b080d4ad43ecc0b7425db06eb6af70aab8076d103960d97a65d814eaa5e48ea
MD5 74f7321f2400745fd8ee21c00ecec7c3
SHA1 94bb0aa9200273327f4c61bda98a1472a4649898
SHA512 4ce43a78d4a9afea89a3ac291346d42a38581e91654787ff27f381e4c3f7dccdcf07163251bc878941460d675b2a23edae97974c266235ffd701f715693610f0
SSDEEP 3072:7TFqJx7ejiK2BjtKNeOlt9ueMC3jiS6ut6MMCMW:djL
TLSH
T10214D56562A2A2C4E03F83770A198C06E3369AC0D6DD7056BAF13A0D66F7F053F2576D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\LOG
Size 351B
SHA256 8217fa12babce6b3733d7c311e8169ee4eb6240c6bb6e24425d5fcd1174c4d51
MD5 d9d554aac2a4a86b956bed1557a1ff97
SHA1 2f591050d6cff4280e9d4de46608deb5913852a9
SHA512 76860996e3a9e49b597fe7fa7bf99d1fa3181b944c202676e38855be3e09e340c0f7d65c9784a7daefc53c4a2ff4f3696b7306ddb3a5ce7ab832ec857354ffb0
TLSH
T187E0D8ACC4C9D65F515864DA15347F0E9797661F97CDAE954F05C804B08A088D16D261
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 bf889cea496e9891c7e456aa25938cb630ac015fa329fd25de0f37b33253382b
MD5 7858fa37e8482b1638897e815627bd00
SHA1 e1d609d10b4dcc7a626c6814e5b250326ec12356
SHA512 3df4d1faf590c7bf25eacd597575ba7815bcd5fc6abbb79129fedb291329fa254f7c64bb5ba918e7f85563eab9daead1e238612cecb540be4b8f2b30ce6784e7
SSDEEP 192:DjisReKenT0i8T1SqJV4/o4mp+r+VY6PlPR/mo:DjisReKenT0i8T1SqJV4/o4mp+r+VY6J
TLSH
T144F1AEF3C3E8862DD81256F0DB547D2BDE6D0E2483283D29D9DAAF0B93E5471D241A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 fe13a911c9f9dc636d67683a250396c97d006ad910967d009414e0c34f8a8f76
MD5 9589e62fb145fbcec339d9f4a009070e
SHA1 8fb7cea42f019394b797785aed614ad9249677b7
SHA512 e8224504da6ff21af1f56e8e5726cde4ef28f32f1a3da58aed0cf38971bfdd2b36dcd35f8d5ab2f6d7ac290bc0e1e22fd3b03d91d4de358641b61cf3e36b9310
SSDEEP 192:sxZeRsWF/fksIRIdptloHW6+WNjhP/YgnbBIgrJ:sxZeFF/fksIa4HbR/P9
TLSH
T1A022CB51AD24A67B8CC7D20DBB15BF53E6F9503291D51E48FAFC861C08E6ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a22b7992019fa8d938c07bd0392aa1745028dc64efad370c77df8c2cdaf56e8c
MD5 f0e8aa5abe39b2d1e41682dd82c3ac5c
SHA1 c6d8be8221c0bebf1c0e0d2011408201f55f4fd9
SHA512 594d2039ccc912baa5eb5f2af01f9e912712f08c3f96b72451ec34d9beac8b6d1afc1ae723795a6350e3ce539bf7e3ffb24c407c8fddec22201088468f4e460c
SSDEEP 192:sxZCRsWF/fksuLIdpiKdv44l4iHW6+WNRCLQCsyCBNYgXbBIg5RJ:sxZCFF/fksuUZHbYECIN3p
TLSH
T15342D852AD345ABB8CD7D21DBA15BB17E2F6503290D05E58BBFCD91C08E6BDD220384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3a9c02057ac4a6169d18c5fe096c1ef129226913a31dd0e6761dcbc1d9196321
MD5 190c909fc20bfedc31d36a8fb3366d5e
SHA1 4f1d4bb1d4f12e708b770b455c33ecb1961bf238
SHA512 51cfa93a9974a0dc996490c29d6171359d09de885899c1a0ecf93ce3571ce95abbedd8d8ec75f9f02543603fb203acbc565b3276d78c7857cbe0efc9a200108e
SSDEEP 192:sxZCRsWF/fksuLIdp0Kdv44l4iHW6+WNRCLQCsyCBNYgtbBIg5RJ:sxZCFF/fksuUjHbYECINVp
TLSH
T1BF42D952AD345ABB8CD7D21DBA15BB17E2F6503290D05E58BBFCD91C08E6BDD220384B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 0f6cb8338318824bec9977192db049f54c80f1630c7658a4cab9de63ac6ec9e0
MD5 5af8e2ba2711ebfe80633b7a9c60ea84
SHA1 4a93852393823359a03253536928a28b5cb63b48
SHA512 9e6295462f60e1b5ff560ca2dc9cd7e42a4a4651dc3cebfa6857b3b36840480cc169d6e45b13f353b3e22f0ed1bb7f08956854de291b4f3bcd3088aca245022b
SSDEEP 192:sxZeRsWF/fksuwIdpI24lWHW6+WNRPtCBNYgtbBIg5RJ:sxZeFF/fksuRHHb0NVp
TLSH
T1EE32B852AD3469BB8CD7D20DBA15BB13E2F5503251D11E48BBFCD61C09E6BCD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 bd007deee084c82827ab392ccb1b6a998f8e39e383c1ce4317f67497c0a64e41
MD5 fa6e1e2fdd60cc94c286e1332bf2199e
SHA1 5e9865e9ad4f06d2ccd3910af73e1910321d3241
SHA512 6b8c3b2f348fac78846914296f326e6e2737a9ea81be17d1f3d0bca1f6642d773e95c86767791de4994e977b580dcb07cb604642036e4f7d8b00bdab48d4a44b
SSDEEP 192:sxZeRsWF/fksIRIdptloHW6+WNjCxdYgybBIg5DJ:sxZeFF/fksIa4HbId83
TLSH
T1E322B952AE34A67B8CC7D20DBB15BF53D6F9503291D51E48EAFC861C09E66CD220784F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4d2f6330-8470-4926-868d-4ad38628e629\index-dir\the-real-index
Size 2KB
SHA256 15af51427d13afc27aaa76d0f41a7995374dc41ef6c08c29bad9a6649d6effe2
MD5 976addfeba1c22c20cc12e60a41845e0
SHA1 adb2293a806a8776f81ee5b8c900287cec940636
SHA512 fd6e2d2fe73bac7b13a3d46e981129caf22cd4b0cd0646a0cf1a651309b108fcac1d310da77f94783d33d0a938a5dbca4d8fe9a213d6ee1e94c0f820f91d6204
TLSH
T18841744CCC84ABAEEC7551BE2D9418B297752C38FC68C39241A4B1B134032A41B475FC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593762.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\4d2f6330-8470-4926-868d-4ad38628e629\index-dir\the-real-index~RFe593762.TMP
Size 48B
SHA256 0ecd8233dea82e71d4358c2dd839d5826dfce37d502de477cdf9977fa29a3333
MD5 f59cd5c1f2c9162e20d144cd3de500d5
SHA1 bde7af6a9b09e69dbac850f1153d3626b91f9cd7
SHA512 4082f2096443c5517b0f2337e99518f8f2e300aaac34873fa89dd871bbcde52224ad960aab150c196413b045eefc3befd8c01dd37230e2964782472c604b7541
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 214B
SHA256 5a12e2d4cdacd1a075644e282289c1b873358415d2b79ce558e5af799ccf4911
MD5 14bc161d637f5f72aeab7bfd0e8c79f0
SHA1 2255a68fb389593d0186abf77376db344919ca9e
SHA512 aec7c4a323eb8d47e219c1b2f825810093f4e48a1780e9182a81babece6214094d9e148b2f8df92e71b4701496970cb93e97ee9de9b3c54788bdc2bc2e21c28b
TLSH
T110D022D705308E622338FAC9B0387B8C813B9C8FC9C1ECD89A00B48A74B8A02C1129F4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 130B
SHA256 3525c97b10805d4819bbe6e927a19ac63f65079759b125fdbc69b4bd4c1b2a3f
MD5 9de25b1262f149cfb13316b0afacdec5
SHA1 c4b8092282200447dc502c943711689a088f204b
SHA512 dcbb030fbdbf4543a9e8a4fbf4d5673368447c78cd76c0381a58c57778466250266f94dcb85ebe8d8d7a15440c962c83f8cab0663c221d83a3e1af378df198dd
TLSH
T1AFC09BD31410C9965674EFC82474A71D911B854DC5C1DDE8D50454457075953C5119F5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Size 132B
SHA256 f8194d50b97ba3fac908b6acbedcee4f8cb5cda9c98c53dd9538a9f37eaaf4aa
MD5 36ddccc80af0f5f2af3358735bda88ee
SHA1 0467875733e353a47846bf926cdb31894e780cb1
SHA512 eb21afce0886062db3e07777b76785ecb8d5e10a7c97b7301118c0525bb117786e364f3affb2726f59a798771013bb88ab2a6d7a2e23c4a352b9e3988ae3f684
TLSH
T17BC02BC3181049C21630FBC830F4A70CC21F840DC5C0CEE8D90450067275903C001AB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58dbe4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe58dbe4.TMP
Size 137B
SHA256 d5ede69b9037b338214ad038f8cc7c39263d806ffefc80293b4d4dc1dc71c5cd
MD5 6ef4b16d0c36b4477f9c729845409cc9
SHA1 8a5d4386009bf8e541ab5cf3561189dba97f86f5
SHA512 97b861077c5adb9863d23f0bf22c01e49a106cec573f4d9626cff7f0efdddf27a7b847fb96a901f5b0ea07a641e261dfdc078f42b2c791bb0daf96c5a02814da
TLSH
T14CC02BD314204A821730AAC42034A30C812B8D0EC9C0CDFCD104B0057035A03C1009B0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 5497f7743e9ec02dd365456615d3cbab1f80ccd7ee501d29c95d656f92b86d60
MD5 4d8ba1ed79608c2d2c1ee2e3e08e7623
SHA1 3d5c7e2f9ad630dae24bc31c34bdce2f3a392f95
SHA512 a2566edca4cef91f03bac2af77d0db11948437ff4d160c7410492b41e3a42b0cceed1932e5ed1e7fa665259062e2e165c9c2db42fbc3df52d8074385c08adc88
TLSH
T1A8A0021142944051C48043F4AC41028D36219CA80505235180BC80A4B990564623F004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592aee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe592aee.TMP
Size 48B
SHA256 664165dbeb39abaff9ff64edc02f2ad52c93947c3bdf1500675489be1c8c2b51
MD5 b475f38e73254949aecf55e2e75dd5df
SHA1 a20692b63f930644ebb91cb455e98df185572539
SHA512 7d3d2f200b4266cf02ece8831ecf30187038d7d92ab50ae400f01a98d8f88a94e0fbce97638ed72eb0fb756cbe557a7f07a2140e6c098c21743bcfb587dbf8f1
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593e57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593e57.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e4e975a4abf4cd1da2388e8b178d99c7e4f8167ce8ecbcc26945334e4a76b448
MD5 686eecd2688140230a4f8ac2d78e0eac
SHA1 05f1c7253e6e41413ba424e2ae26a3b100c927f3
SHA512 15f111d4fb2da279ef8559fea6d71d3b2bd32089f1921acb69373cdca42432dd20843b59437b37b969e30c353a9f87840412e67b4eac815e291608e4dab5492f
SSDEEP 384:JZcIhsNQ/w5tkCBGYX5EGQUFyvtgOIwZOyQLaoX:BhMcsGYuGQTvXsbeI
TLSH
T1BB829D32DCB8ADBB5CEBA141F54736034FB8902BD7C9AF8495ED6B1D04DA198130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bd32c1e8174d65e1b3f9f519e57551b21ebfaa74f63217bc3a080195b5c78771
MD5 fc8cfd2885a338be0f4a52ed5b8b8e18
SHA1 9c0f2e6fd99af982d9bddaf06558e7278e26fb8a
SHA512 2936731696d769a079486e2b7c103c385f4b9b2c9762f60d3def425d4c1f6cafa9f4c2b0dd2e04544fad5b0b3949f23df61b5ce2a2c774b3524777799ae811be
SSDEEP 192:LJONC6DphmqQmiUyTuq8wGYX59ezHC6mEkk75aU6:lONC619VRwGYX5EG68U6
TLSH
T10C02D935ECB8BCBB8DE36E45B54B3B135FE8112BAA916F84D6E81A1C01D764C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 e7ea5d6ab606d5b17e069870b7ed4dd9194c4f53b63c88801e51d4de3e03eec4
MD5 28b7fbb7a0fc5ea8cf484926df22b61b
SHA1 64f463a23a9b75df7dd12818e8aee16fb3d57270
SHA512 8f3bf377ba99213ac3c13ea729438e36c539a1e50ec2f0204714b746c22172be36c7eff7d11589acb5682a6c611c5cecd4a2f0c93915572d45424bd619a82a7e
SSDEEP 384:oZcIhsNaWw5tkCBGYX5EGQUFyvtgOIwZOyQLaoX:Wh/csGYuGQTvXsbeI
TLSH
T199829D32DCB8ACBB5CEBA141F54736035FB8902BD7C9AF4495ED6B1D04DA198030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2f7a8872a86a70a35afe3f5c01340b6f5c7f81acd797ff05cfc271e8ea318e64
MD5 ef2f059c575621d10e4b8c08527ba756
SHA1 eb9508ac886ddadf46560f4e2073b1f8791c0519
SHA512 c7f7b34da10583193f03deb5c980733de6a5dbd472f04758c0ab84e04242198f06aa1ae57c730909f481d43aae46c9163966d8b9ae58d7f1ae5cabf3e902561b
SSDEEP 192:LJONh6DphCqQmiUyBuewGYX59ezHC6m4Une+3kIIDq5aU6:lONh61R1ewGYX5EGQUFgvU6
TLSH
T148120936E8B8BC6B4DD3A851B48735135EA8122BEB857F8095EC1A2C01DB19C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b13d99bc-0f0d-4a7b-9a97-3877a3efc335.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b13d99bc-0f0d-4a7b-9a97-3877a3efc335.tmp
Size 26KB
SHA256 84c32dffffd38718d0f9c06232168db9bfdb156dc1a964b99e605cb04dc46963
MD5 b0bdad8f07d6c91b36eef50c155ea29b
SHA1 995657605bc44d2465bfbf41812449c1a5c33b43
SHA512 de5b577cb61aee637980c11c80a6d72f9d839b325602157630592b1d561b64bd539d06f098f12ac43bdd65dd3b5b08f85f8a7006276e057d0221714e663a9857
SSDEEP 384:miFiZcIdzsNi8TUNTUlIlWw5tTCBGYX5EGQUFSvtgOIwZOyQLaoX:NFQlzwgTrsGYuGQtvXsbeI
TLSH
T17AC229F288E7997ADCEE4743A77E2D034EBCC027B585AA50B799551CCC961BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26708e9c-7652-4dfb-bb94-6f29aacd77a3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26708e9c-7652-4dfb-bb94-6f29aacd77a3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4e41b3f98b17b2894a80cd3bf0bbd3c533837e8e7e1866c2c3b9117ac30852c5
MD5 e78e9bf56bdb97a47e32e17de350f26e
SHA1 b94f26a8a426456e256d88ba7d9292726eca8c8e
SHA512 793f73e580c8d32a8f267030c2672190709d294bc3ed0139c1340c9f0c76ab0cbe7716caad22ef83f18f4ed452b53a25112a5c6f08b8073401e441da2955754b
TLSH
T1CE412A98A6F91108B7B77F5A9BF3A56D487BBD732F0AD49D10110E4E0B22A40CCA1737
MD5 SHA1 SHA512 TLSH

Submit Download