hxxps://t[.]maze[.]co/589804347?guerilla=true

Analysis

user interaction
yes
max time kernel
86s
max time network
87s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/09/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.maze.co/589804347?guerilla=true
Sample260930-rywlvss13p

Score

7^/10

microsoft discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	192	[email protected]	1420	msedge.exe	1
Email address	192	[email protected]	1420	msedge.exe	5

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
212	api.ipify.org
213	api.ipify.org
215	api.ipify.org

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
192	1420	msedge.exe
192	1420	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1420	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{152E3CFA-F375-4E6F-AE7F-134EC0D51E7E}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{E01FA8B3-CD40-4E0B-97BF-4CA60064203F}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
652	Process not Found
652	Process not Found
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of FindShellTrayWindow 35 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 2636	3236	msedge.exe	88
PID 3236 wrote to memory of 1420	3236	msedge.exe	89
PID 3236 wrote to memory of 3648	3236	msedge.exe	90
PID 3236 wrote to memory of 3648	3236	msedge.exe	90
PID 3236 wrote to memory of 3648	3236	msedge.exe	90
PID 3236 wrote to memory of 4204	3236	msedge.exe	92
PID 3236 wrote to memory of 4204	3236	msedge.exe	92
PID 3236 wrote to memory of 3252	3236	msedge.exe	94
PID 3236 wrote to memory of 3252	3236	msedge.exe	94
PID 3236 wrote to memory of 3252	3236	msedge.exe	94
PID 3236 wrote to memory of 3940	3236	msedge.exe	93
PID 3236 wrote to memory of 3940	3236	msedge.exe	93
PID 3236 wrote to memory of 3940	3236	msedge.exe	93
PID 3236 wrote to memory of 1364	3236	msedge.exe	95
PID 3236 wrote to memory of 1364	3236	msedge.exe	95
PID 3236 wrote to memory of 1364	3236	msedge.exe	95
PID 3236 wrote to memory of 4404	3236	msedge.exe	96
PID 3236 wrote to memory of 4404	3236	msedge.exe	96
PID 3236 wrote to memory of 4404	3236	msedge.exe	96
PID 3236 wrote to memory of 1932	3236	msedge.exe	100
PID 3236 wrote to memory of 3240	3236	msedge.exe	101
PID 3236 wrote to memory of 1932	3236	msedge.exe	100
PID 3236 wrote to memory of 3240	3236	msedge.exe	101
PID 3236 wrote to memory of 1644	3236	msedge.exe	103
PID 3236 wrote to memory of 4536	3236	msedge.exe	102
PID 3236 wrote to memory of 1644	3236	msedge.exe	103
PID 3236 wrote to memory of 3780	3236	msedge.exe	106
PID 3236 wrote to memory of 1800	3236	msedge.exe	116
PID 3236 wrote to memory of 1800	3236	msedge.exe	116
PID 3236 wrote to memory of 1800	3236	msedge.exe	116
PID 3236 wrote to memory of 2868	3236	msedge.exe	119
PID 3236 wrote to memory of 4580	3236	msedge.exe	120
PID 3236 wrote to memory of 3056	3236	msedge.exe	121
PID 3236 wrote to memory of 4700	3236	msedge.exe	122
PID 3236 wrote to memory of 4700	3236	msedge.exe	122
PID 3236 wrote to memory of 4700	3236	msedge.exe	122
PID 3236 wrote to memory of 3948	3236	msedge.exe	123
PID 3236 wrote to memory of 3948	3236	msedge.exe	123
PID 3236 wrote to memory of 3948	3236	msedge.exe	123
PID 3236 wrote to memory of 5792	3236	msedge.exe	132
PID 3236 wrote to memory of 5792	3236	msedge.exe	132
PID 3236 wrote to memory of 5792	3236	msedge.exe	132
PID 3236 wrote to memory of 6004	3236	msedge.exe	133
PID 3236 wrote to memory of 6004	3236	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.maze.co/589804347?guerilla=true
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a0
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,16604505573668796992,1447839386691904016,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,360842516505315078,456181984341501612,262144 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,1719058407934574826,18394087855982916753,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,3869031139789150226,9319135682193958884,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,17152716300643528324,15105085236236603999,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12884891353386360845,2116957378298605220,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5198017825387357840,15101588968754951907,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3940,i,17602205975741884488,5074011030373377404,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,12130215963618199973,115809156282693441,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,5722748256915112735,6923293678365236942,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,4500520965653897884,8894426085695042098,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14585034559688977285,15826893748567136268,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6124,i,14585034559688977285,15826893748567136268,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6208,i,7434985222761721041,666976798210780143,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,13589110321983937553,1358464450764635961,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:8
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,384704225127095949,17762738295653239720,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,16483357856986630696,7807758662050722541,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:8
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4936,i,15792843094024019246,4343789305652662147,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4300,i,3526158262671423735,15019447156456418054,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6608,i,3503960855985189427,6955613446340792239,2097152 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
  2⤵
  PID:5792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7196,i,16576356886473536509,18181623459454380506,524288 --field-trial-handle=2276,i,8480642182909688738,893284998547102829,262144 --variations-seed-version --mojo-platform-channel-handle=7204 /prefetch:8
  2⤵
  PID:6004

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 c45bcc48be58ccc508a4cbb7b79ee91e51e8d20f8c95f557a1bcf4c2a56fbdb0
MD5 1d33ba6579964edc193f877d5e632a34
SHA1 0a5ebe6a8ba349f1e033417476f6882da00f78c0
SHA512 355eebb329a68b6d6af7d74a3e3e9c172d381b54e2eb6adf1c614359f3027861984c46f82cfca8c250ef811823e6ece91f4a6a61ebce415fc4e21061f9831ec9
SSDEEP 96:qWvurMI4Td3X9Dec9UxStVGSTVDymB2J4d+:qXQdgcxGqVDrBVd+
TLSH
T1D2A1928691E30841FBD8857047931CA6B6B7A983446F2E1A876CDFF47EBE3920309310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b47337251c93f6c84c4942a2e4dddd8e36bc239d53b50c805364704c3d66f1c9
MD5 6d555acff581d38b1869957363427767
SHA1 b2cf57487f6cf692544ea04ef8f3212a566c55d0
SHA512 50e91daaf19fc2f609b473c589fa104ddc892008d5963597cec245eefbdca0b6961602cd02d5dafcaa1dca543c98af5c0103591020ae4dbae84339bb48a1d850
SSDEEP 48:/IbWVIrR6kgCMGJYTdWsaS5mkLX7BaecHdUxS2Q6S7SzqSxVlaqDpZymB2J4rpzP:/DurMI4Td3Xsec9UxnVGSTTDymB2J4db
TLSH
T17DA1828691E30841FBE8857047935CA6B7B7A987546F1E1A876CDFF47EBE3921309310
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590bce.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590bce.TMP
Size 3KB
SHA256 28da7a2c63df8ec73b626d55af3e2d055e761e39e6500fae1c26d8275290139f
MD5 3fb50c917a08266d35fa1ff3cf66b3a8
SHA1 aefbce8b4ed3147f1dbc7830c43b77906faaf305
SHA512 14c5850d227366cfbcb1772b410b45596d8631dcc99a7b0dd2d8f657cb4238e4f593ad42009524c89d502e2a03db9676c1d9c0bfa4435b7ffc5ed16ef68a01fd
TLSH
T10061A2CAE6E34C85F7A806B047D71DCB3373CC8354672E5A9468DDF8788A3926109310
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 5d936ef65f8f2b6dddb5acaf8f96a7392cc984500df697cb653027656c8055b4
MD5 7eeb40abc3d2a40535845c698428f1a2
SHA1 bbce55bd2a52213b6230c2493858a25a29d31001
SHA512 35ba1b2de01a8a62b5d495e692cb8ed47e343c6f2a45d411571b8e4a19c8db6f06e4bc74bd4d8ea0f5cc6e66a5d686edc843de82caa68a4f6b735d5d9af03447
SSDEEP 192:DS8nj+SMSiS2P4Gnt4847OcBvNVryjjSCSU+SGhSGpSt/SBSwSF:DS8nj+SMSiS2P4Gt4847OcBvNVryjjSM
TLSH
T1A5D19CF2C7E4866DCD2156F0AB162F6ACE1D0955436C391AC5E4EF0FA3E24B0E142A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 8f847d27483c1d095d984e5fe8f44534f5bebc255a4bcc62036b3bba20c8c456
MD5 df4ca9ea8f9e6c01510c6e3d47f6338c
SHA1 647c2e6c1bf77a368805773ee53fe0d101e98403
SHA512 32b499fa0480f27029157058cceef943054fd03855f5e1deb5ad2b6f3a8ad29fecadcc9eebfcb73f0716467b89474fa993dad4bf1596eaea39e0c879f14c7f3a
SSDEEP 192:DS8nj+SMSiS2PHnt4847NBvNeyjSCSU+SGhSGpSt/SBSwShGkjS:DS8nj+SMSiS2PHt4847NBvNeyjSCSU+t
TLSH
T111D19CF2C7E4866DCD2156F0AB162F6ACE1D0955436C391AC5E4EF0FA3E24B0E142A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 09080d26086affc0f6e7c1a9024b8f6efc76ff3d55809c1c59ce7db98acb6f7d
MD5 4daeb60e7a141b01f365986c61c50049
SHA1 2925028ac81bfff87c8a428a9b88c69efef0af64
SHA512 47cd25a641f3883e9228eecbee0473c9828d1f21360af89e2f2c95092d333d69b5e95b0be6e950bf4e87a7ad34afa51795230e9ba4e67393bbde1f0145065454
SSDEEP 192:sxZV6aR2wWG3/fmms0yEWpVAqYIdpCIDflVlHW6+WNhclfO4Vg5F86odYRvcmn5i:sxZxEg/f3s0yEWvA0JHb22FGdmUQi
TLSH
T1FB52C752697468BB8CD7D21DBA65BF13D6F9102290D01E88EAFC9A2C01E77DD6343C4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 5df85bba91a9180d9c61f1bcd101200ff8bcc177e09a5dd0b77c0922d943ebcd
MD5 1cd9269476a4363755911e1d6eb0e799
SHA1 afc09fb4d37812a1453b828d192b75e4d5b18aa9
SHA512 8cf4a9b85ae28cdae56544ff9da8fc07dc3352a84d63146d4c22157c55ba8cdb70b748fc77ac508cb81a869572c42042637fa953fa392a7e8498e39851d3d0a4
SSDEEP 192:sxZV6aR2mWG3/fmms0yBYYIdpcFlVlHW6+WNXYWXYRPXh/Ig5QJ:sxZxWg/f3s0yB26Hb5Xm5S
TLSH
T1C022D9526E38A5BB8CC7D21DBA25BF53D6F9403291D11E88AAFC861C04E66DD2347C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6e2945b3d1a43ce946b15f4653205dbf16526f962147f0bad28a8cf57111cf9e
MD5 4bca02b800dae1df39f60f6379bad9fc
SHA1 b35a2c6d309734c75633cfefe169ddccf966be04
SHA512 33cacca6297f13e8cd512e627e0b947d38b17417d21145eb1dc61c5764ad7518f7d0f005c70d2e603d0cc4e1cb8368b99ac4d1b5d9583e93d2b76bbb36eafa3f
SSDEEP 192:sxZV6aR2mWG3/fmms0ymSYIdpcI9lVlHW6+WNX6odYRP9h/Ig5aJ:sxZxWg/f3s0ymcVHb1dmTw
TLSH
T10332B9526E6868BB8CC7D21DBB657B43D6F9503290D11E88EAFC862C05E66DD2347C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9341212c81807ce743b542d551d3d43019e2d16a35de832ceeac75ff99ae932b
MD5 248b6d089bb3954dd50fc46d09458c1b
SHA1 18abedf2229f140e0a3a0bcf888cee5c7cf2f8be
SHA512 920d74c1e4317508dd5ba4756c2179219a1a9481fc824e6bfa123d0428e5f518fb1d669c9ea4a82ec7c9e26e8829ce832ef3c46f0fb180f1925c3ee6252dc435
SSDEEP 192:sxZV6aR2tWG3/fmms0ymoYIdpcIDylVlHW6+WNhfVg5F86odYRPQWh/Ig5aJ:sxZxpg/f3s0ymGCHbf2FGdmIMw
TLSH
T16532C9526E7468BB4CC7D219BA55BB53D6F9503290D01E88EAFC8A2C04E77DD6347C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e65c4c73db959388654671a9039574d890f3f624ef62c687263ba4ba88c072f4
MD5 054ff97e163bbb106f4c278eec7e924a
SHA1 26c42dc53455ea7c9f744fcf6eb04896f599912f
SHA512 fb117dfd20384b4b1f35d4026fe01afef55fa9d2d8fed4b627c18d3fedd9e9e8cd563222118236f57a73df92c72c4871753c41860e338dc82eebb4eaadf7089c
SSDEEP 192:sxZV6aR2tWG3/fmms0ymkYIdpCIDflVlHW6+WNhfVg5F86odYRPQXh/Ig5aJ:sxZxpg/f3s0ym6JHbf2FGdmIxw
TLSH
T1A042C9526E7468BB4CC7D219BA55BB53D6F9503290D01E88EAFC862C04E76DD6347C0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 af538d451952842f532695a1b8fd252f425ad4bad657ce273836e3aa5d077c58
MD5 54977dec7403d19a7eb26923a1f15575
SHA1 17d8c7e7a443b08daa54e1101b93f4f2af1f34d5
SHA512 889016842d3b545b7eef6db16afe68bab1d33b814a62a3063097575657c985fa47b7cec7f5b39b029afa1341dfed809d99674d003902b4a8c220dfad9c49cd5a
SSDEEP 768:f7K9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3oroV+ZSd:f7K9uzYWvcQWsu1ja0HL7Q3TV+8d
TLSH
T1D2C2F93F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4f7208528b3a2002eae4d604e1416b3325a21b4fd713450f0ffef2a4edd06f1a
MD5 d86ad6f35dac57757633431b1c05d96c
SHA1 c4ede8f80cbbc7b9308438c1a81ca12e2f0258ba
SHA512 b3691e16817da14e19d0d8bc833125a5fc23306cae17f55a46e0114a140e7b0d4f39d7d4bebc6b7b6bef0ffe8c862b075a85eda189fe0f85b2c3308933a3a744
SSDEEP 48:K0mImRAthrvzMb/KXIS5MK9Z1zMxxcYKbRRyKUUUPUAUkUWUqUGUQaUCUxUDIVUl:K0mJGQKjiO6AoKpS+BHOKQwl
TLSH
T13591545431BB0251387E295885A4C72E524531B2355CEA3B7FBC44BA8F2EE154DFE4C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

dbb30c5d-d718-4399-86bd-86962a5b279d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dbb30c5d-d718-4399-86bd-86962a5b279d.tmp
Size 10KB
SHA256 445923323af0f54d299473e5e49019816b6e254f629bd6fc37045ecdaba07a04
MD5 6a54dc8218597e56f7f37eb910e81813
SHA1 1058fe8ba28594ae727933c4c56ec56ded9d566d
SHA512 5ce3c161456a14c089fab36054dcdccb096a19366192c24a95438448b0457c5a87d8bf1c534f224c076e49cd26e2effb1e7461b742c7758b7b3529d1746541fe
SSDEEP 192:sxZV6aR2mWG3/fmmscyBYYIdpcFlVlHW6+WNXV35c/YRPA5h/IgrJ:sxZxWg/f3scyB26HbE/me9
TLSH
T1FD22B8526E38A5BB8CC7D21DBA25BB53D6F9403291D11E88EAFC861C05E66DD2307C0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fc656fc-2526-49e2-95a5-54856d92da29.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8fc656fc-2526-49e2-95a5-54856d92da29.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GraphiteDawnCache\data_1
Size 264KB
SHA256 61ffce89e4b64e70acd937c9ac2ad9a28cf2afb72127d2c4d6a28cdab56fea8b
MD5 b69727184a0f98d6283e71d35e261004
SHA1 23af1cc3a537ed7bb52dd6c5113da80346e8bd9c
SHA512 0d5a684f7bbd05240c70bc96aafec90b9e5ec0b1070ebafb12eaa7e3dd45ebaa3b83b403c3c5fd8db614b2156da8b663316afa31ea1002975de591f4083c86c3
SSDEEP 3:MsEllllkEthXllkl2zE/liv:/M/xT02zP
TLSH
T11A4402446B910406E6112130405187701770D49106175743266944226C856520D00100
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 84435d78f5a5aba5834aa5b824719ee42b459f20eca300c744416b0d298b33c5
MD5 cee98c84b5c03672bc918e83c606340e
SHA1 b9ae23a807b77af9c2a7a1fa8af557928a70eaf9
SHA512 ac7e4412b020827b6fa43c517f2bfe88b647ebd7ef62e4da5ed922574c0d1c5a0160723159d13adf3ecd80bb6d98152775d4edf20b4eddc915f4bf82aa0012f4
SSDEEP 384:EZcIhsNJmw/65PYOjTVHglhBFatgOIwZOyyLhoH:ih9rnOFFaXsZ1E
TLSH
T1DB828E326C785CBA5CFBA145F4CA23035FBCC17BD6856B8094ED9B0D01EA6A8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 40685db4845fef669d241d408ab7073feaa0f4844db603cc3b898e2c6f5683e1
MD5 4decfabfe26dd5423ff90fd9bc262129
SHA1 cb8ece9139afbfea13a01fd83f18247a1467df89
SHA512 108db13caafd8ec6d795482bee77bd4c9f77388d1ecb7ed3dabbb4350d669319cc647a6e1f24e7c3d0d78b3339061e5bffbea24da2cbf7b3e5f14df3d2d87c2b
SSDEEP 384:BiFiZcIIzsNr8TUNTUlIlFw/65Ip2OjTVHglhBlatgOIwZOyyLhoH:oFQ0qwgQpNnOFlaXsZ1E
TLSH
T102C229F258E7487AD9AE5703A7BD2E024EBCC067F585A640B3D85A0CCC961BFD30AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 341f1982703437fc0ecf747052e42d249132f8231da8e6bc459eff813d534845
MD5 e98b9378e21959eefe436ceae7e4a3e3
SHA1 6983ad90e0031e6bd0a873c10c0fb25d0da57742
SHA512 e1b68b1a43f04dbc1767e70e1d4c875955dccb12e22fdd9cce953d1849a34046ca84921b572740d208bbcf707380a5f8332022c6a448c4689ac68a3834e278e1
SSDEEP 384:HZcIhsNJFw/65Kp2OjTVHglhBFatgOIwZOyyLhoH:vh7pNnOFFaXsZ1E
TLSH
T188828E326C785DBA5CFBA145F4CA33035FB8816BD6856F8094FD9B1D01EA6A8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 400423e652d1c117af164ec7d0e29f6ab3f7a03244ad6f2a7392c70eacb864e1
MD5 a87fdc959c974c7851841792298f2b8c
SHA1 b6d54717283658536d9d4786b073e3b07040fb33
SHA512 db57d14bad3a6f2764b213f1b125c20724396bfbe80aada5decbe668d6444212ee499949647aea5c2b14376f7a7759a8b37a9b29d5343a81b7b4573f5414d660
SSDEEP 192:SONk6ygpQmiUyNitOCTVgcSMosSPzP0oU6:SONk6lHttOCTVHglbZU6
TLSH
T1CE02E935BC687CBB8EF3AE06F88623175FA8117BDA552B80D5E81A1C01D766C2307D36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9fd5dfc1e5456444f8a4b1e11f68c49103c4df21b700a4b9e11f703721bec13a
MD5 da5b8d2c2d34169f5e3da03092e20b27
SHA1 5b629c49fc39056175669d97820ae9192fef9963
SHA512 5afd2838498d9a6bf89145e5847dc10cb81bd4e6d017ff04b2dd54efe2434e53271950358c66ce80a2827fbee357a17cb87deb530378bdfc895a0f041e760a3f
SSDEEP 192:SONk6ypQmiUyvioOCTVgcSMosSh2BEwY3UoqgU6:SONk6UVoOCTVHglhBWaU6
TLSH
T1AA120A357C686CBB5DE3A541F48B32035FA85267DA497B80D5EC1E1C01EF6AC630BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 707eb4cdacb0323cd9d9823f7251e990f0cb51d84351231c9a7034a2f8e613f8
MD5 fa3cfc11bfc494e15f2b605c70d0e4b7
SHA1 8700a66b44d5ca8c11fb54dbe9fb3ee803fc4aa3
SHA512 2da1bcc741c6291cdcfdffc3b3729d873c8cc022045d138b1a9bfa89f091d7b3f11105229db4565b4915f6f2ce5d8f2e875dde5bee72849fdfa553ee157dcca2
SSDEEP 384:BiFvZcIIzsNI8TUNTUlIlFw/65yp2OjTVHglhBIt3KSt+qZsM9aftgOIwZOyyLhE:oFn0zwg6pNnOFIwSwM9afXsZ1E
TLSH
T11EE26DE188D74CB6D8AD97C3A77DAE025A7CC077B4449948B3F4A92CEC5A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 54b20f4a55ec9e8962189e3960972f0fb238a2cd66a13952d12b135d6a02bccd
MD5 14e2385b05a5adc93b7d66e19ba49063
SHA1 eece3bbc8210a0831c68d2bda2439e24a06f8bb3
SHA512 26578e89586371bc46dba86734a4b5edd147bd08f2aba5366afe40c8459ded652fa552e4261daee833ea6f396a004cec5ecf01093bd3efc7dc916ed4ce46e286
TLSH
T182E00240D100401AC026077400C72F202DA4A01013520F455770017C7C723003611180
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59197a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59197a.TMP
Size 392B
SHA256 00bc2644088d47c1caa3120fdca5140bbfef05256dc825c34e638a8c40832c24
MD5 3a191c51154a836087a00ee0e04d417d
SHA1 274cf68bde73ad45a85a8ddff2a4a895bcaa7144
SHA512 f9858d17d385df9fb15ac01c3c513d5cb39dd59bfd998ca5c111323c11fb0d8d18f0c2c43db816c3fc82519fd66f98f41b658365c57845b539ac77b33f1a8d9c
MD5 SHA1 SHA512

Submit Download

cccfe262-deb3-40ee-9112-1758754e73c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cccfe262-deb3-40ee-9112-1758754e73c1.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 062e48daf0b9a7e83ab89ef2d56d6cb4b84e95f006e6286d7cc613a3f5676aa7
MD5 b3127272c682c1a65457ba8cdfeeecc2
SHA1 07f862b69796479669d8775b64e111c93690b33c
SHA512 5f30966baf4c23f41d29fb52bea1f519f9eb5f8fa97391f7d56891b09ba647d9d72b016e072df9867c01732e780bde313797d91e06bed5566b42473b788f56bc
TLSH
T1D2412A59B6F91148B3B36F5A5BF7A8AD447B7C372E06D45D00110E5F0A22B40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads