hxxps://simplebricks[.]com[.]au/

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://simplebricks.com.au/
Sample261001-za3z2aycmd

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
286	discord.com
287	discord.com
289	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{82218077-DA4D-4EA3-AD81-AE2EECFF34FA}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{826979EA-B242-418C-B74F-AA4E7375E727}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5336	msedge.exe
5336	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
652	Process not Found
652	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 1224	4884	msedge.exe	86
PID 4884 wrote to memory of 536	4884	msedge.exe	89
PID 4884 wrote to memory of 4928	4884	msedge.exe	90
PID 4884 wrote to memory of 3068	4884	msedge.exe	91
PID 4884 wrote to memory of 4928	4884	msedge.exe	90
PID 4884 wrote to memory of 4928	4884	msedge.exe	90
PID 4884 wrote to memory of 3068	4884	msedge.exe	91
PID 4884 wrote to memory of 1444	4884	msedge.exe	92
PID 4884 wrote to memory of 1444	4884	msedge.exe	92
PID 4884 wrote to memory of 3500	4884	msedge.exe	93
PID 4884 wrote to memory of 1444	4884	msedge.exe	92
PID 4884 wrote to memory of 3500	4884	msedge.exe	93
PID 4884 wrote to memory of 3500	4884	msedge.exe	93
PID 4884 wrote to memory of 2236	4884	msedge.exe	102
PID 4884 wrote to memory of 3180	4884	msedge.exe	103
PID 4884 wrote to memory of 2236	4884	msedge.exe	102
PID 4884 wrote to memory of 3180	4884	msedge.exe	103
PID 4884 wrote to memory of 3964	4884	msedge.exe	105
PID 4884 wrote to memory of 508	4884	msedge.exe	112
PID 4884 wrote to memory of 4508	4884	msedge.exe	113
PID 4884 wrote to memory of 3988	4884	msedge.exe	114
PID 4884 wrote to memory of 5488	4884	msedge.exe	115
PID 4884 wrote to memory of 5488	4884	msedge.exe	115
PID 4884 wrote to memory of 5488	4884	msedge.exe	115
PID 4884 wrote to memory of 5440	4884	msedge.exe	123
PID 4884 wrote to memory of 5440	4884	msedge.exe	123
PID 4884 wrote to memory of 1964	4884	msedge.exe	125
PID 4884 wrote to memory of 1964	4884	msedge.exe	125
PID 4884 wrote to memory of 1964	4884	msedge.exe	125
PID 4884 wrote to memory of 728	4884	msedge.exe	126
PID 4884 wrote to memory of 728	4884	msedge.exe	126
PID 4884 wrote to memory of 728	4884	msedge.exe	126
PID 4884 wrote to memory of 7056	4884	msedge.exe	127
PID 4884 wrote to memory of 7064	4884	msedge.exe	128
PID 4884 wrote to memory of 7064	4884	msedge.exe	128
PID 4884 wrote to memory of 5072	4884	msedge.exe	129
PID 4884 wrote to memory of 5072	4884	msedge.exe	129
PID 4884 wrote to memory of 5336	4884	msedge.exe	131
PID 4884 wrote to memory of 5404	4884	msedge.exe	132
PID 4884 wrote to memory of 5404	4884	msedge.exe	132
PID 4884 wrote to memory of 5404	4884	msedge.exe	132
PID 4884 wrote to memory of 372	4884	msedge.exe	133
PID 4884 wrote to memory of 372	4884	msedge.exe	133
PID 4884 wrote to memory of 372	4884	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://simplebricks.com.au/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7fff3d11c188,0x7fff3d11c194,0x7fff3d11c1a0
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,11605939115977725411,4396721010584108247,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:3
  2⤵
  - System Time Discovery
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,4975936689196739447,12773763162063172622,262144 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,3567923915432190911,16829142530830935890,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,10186061200859969679,2130858006532415050,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,2103224462299058359,8789863416655046974,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,5151138552028607671,17463882785472718956,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11261156191290541134,15836129497238549460,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,13300626421396284413,9540504619866711605,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,13300626421396284413,9540504619866711605,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,17931989266424010627,6860324912838864834,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13247282335696920615,6785299976343723637,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,8890834580615820979,17036945745927104824,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6064,i,12517909636346376217,6325946321787939285,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2988,i,17761785177934191611,17177415239938073810,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5216,i,17810916408357418970,15836137815781356745,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3512,i,5146844007087704390,10889777228245975579,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,312381770796559447,17863069490296082509,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Modifies registry class
  PID:7056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,17455271465078201054,11029573280181047940,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:7064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,11212912717915651190,17943424620672437951,524288 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5236,i,13368766518184336739,14535393905298506456,262144 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6804,i,3220482991537315628,12717562753390917112,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6816,i,9868988283723696239,6547882632937907568,2097152 --field-trial-handle=2440,i,14283956242260057554,12946161422997591338,262144 --variations-seed-version --mojo-platform-channel-handle=6828 /prefetch:1
  2⤵
  PID:372

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1a773c6f-8e1b-4f06-a4a6-a38a01220438.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a773c6f-8e1b-4f06-a4a6-a38a01220438.tmp
Size 25KB
SHA256 5d3694532dce12d31448cc94d50ae306954df1f9d745f2b3629ab8a4f270cd60
MD5 66a9dfb52df2413c703d2c732d470e8c
SHA1 7282af42962f2f0d96a94be68584fb6f53d1fe6d
SHA512 19e170233bb50fe7d06f7166838651403833c5fb0d48d3344e41761009b74c163410149b712e0efde4e26c02bf9b4a7215f43e3405433487810ef2d6648133cb
SSDEEP 384:n/iFiZcI63sN38TUNTUlIm2aKMik4w2f0BChCAQP4XM87O6R2FeoZgL/7IzEoj:KFQ63WwgcPZBChFQwXM87TRrg
TLSH
T13EC25C32EC98CAABECFA4F99A74E3A47EEF00163949C5AC4D9D81D1D009359D1707C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219978e5-0cff-4637-bfb7-55feb03422fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\219978e5-0cff-4637-bfb7-55feb03422fc.tmp
Size 25KB
SHA256 5ff581927285aaa6f3e4f72fb00c722515c4731f05671c1425ca22cda83e602c
MD5 b2e4b5bf26cf04204773907dfc816582
SHA1 3e8f4bd8c4d380976c107434a84c3ec03c0bc384
SHA512 7b25098e374020f652095636656bcf2158d1a121be83883ab7df2fb62f9d3d39a8f089bd3d91bd19eb0dc9a9b73d3a391c7b081a321ebf23514b7ce0895af3f3
SSDEEP 384:n1iFiZcId3sN/8TUNTUlI4raKMhuWQw2f0BChCAQPwu6kMwj3KQgL/7IzGJos:8FQd36wgdWgBChFQYVkMwj3KJJb
TLSH
T173C24A72D8A8CABBFCE68BC9A74A3A03DEF04163958C9AD8D9DD1D1D009719D130BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52dd7da2-a4f1-443d-b281-c3bb372ed8cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\52dd7da2-a4f1-443d-b281-c3bb372ed8cf.tmp
Size 26KB
SHA256 ee076fbb3137f7ad62d45ab8375620d02d326e551a05e41d6cc87ba06b9a58cc
MD5 ddfa34a827b08dac0569bc1e71a39af9
SHA1 4bd6c580bca3b73972057afb1d69205b28991c1e
SHA512 26e7f8e618eef4a53f40407e7271f731e94d06055b56f6da16c4db725dc71d4c19a8cf7fbcb16a36d0423258ea3fa8b43b37c881dfecde2d390db0cf16f06cb3
SSDEEP 384:n7iFiZcId3sN/8TUNTUlI4raKMd/WB2w2f0BChCAQPwu3kMwtgOIwZOy3FgL/7I+:WFQd36wgd7KjBChFQYykMwXs8J+
TLSH
T1D2C24A72D8A8CABBFCEA8BC9A74A7603DEF00163959D9AD8D9DD1D1D009719D030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7187d6de-1713-4fba-809f-49a0c9513ecf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7187d6de-1713-4fba-809f-49a0c9513ecf.tmp
Size 392B
SHA256 bf9cd5a6b1738d2e1069e576850c334fd4af4117f62716ec7d90dfefa9c9633b
MD5 afc3752e4ec8f8b8786f9be0d7c9decb
SHA1 ac024aaf35f2eb925342cec18079957cea40ab09
SHA512 d416b4fc358e4d92662a4cc47c3fd68bdfef2539bd6d3e6048147915016deebc2504ce8f7795a04b396c817627de233db9ecfa0ac89b011dcc770908738a1ca7
TLSH
T183E00213530000EFC13823300087153026F3843103F302465C0442704A023052F58BC0
MD5 SHA1 SHA512 TLSH

Submit Download

731a4875-0384-4639-a1a5-2cbd6851b892.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\731a4875-0384-4639-a1a5-2cbd6851b892.tmp
Size 392B
SHA256 997a29f31c8ad7ba9c4c67b4c7c1b1491fdeabe32279238f88544d18124a9b2a
MD5 62685422b0fb60979ef71df14df413b4
SHA1 040b05ebbe7e96e2b39d223afa1754e052c073d8
SHA512 36c0fd42f40c1d0c4c18914b5a141f0a97b0c5d5bcbbe85b061be13cab4f0b111cd857e912b5e76e0ab7317bb961f79a1b60f22125929612ad90be2f93a50ba6
TLSH
T1BCE00113930000EFC138233000872A302AE3843102E2024A5E2452645E223052F68BC0
MD5 SHA1 SHA512 TLSH

Submit Download

91c2ca36-f6a5-45a0-a300-b68fd9900012.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91c2ca36-f6a5-45a0-a300-b68fd9900012.tmp
Size 392B
SHA256 79fbd5db7a3be9eda01064d17bd466fc6c3da44f4985d5ac259a3d2190384769
MD5 47554729cb305838a52d7521bd80e53e
SHA1 45c483826d5cdab6e9216cb8d9f17c5251386537
SHA512 fde3cd1a9735c232022e8db4967a4c5e7affc789947a99be89a3a24dd25cb01ad36b7313db424c8138c352f09ec07366708bfaeb83cabbb34931ea939c4ede06
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

294a0ee7-e2a8-4d5d-ae39-91d07a557f41.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\294a0ee7-e2a8-4d5d-ae39-91d07a557f41.tmp
Size 12KB
SHA256 f22be7950f02aa6e59ada80602152b689827c9f83f32c9a0dd10713acc7dcc41
MD5 4cc4abcb33f5fe5b5422ef5cfc90df68
SHA1 017e29cd4cf8d3feff47f38c0e919895670093b5
SHA512 96e7f0807902910de76202a863963f0a6373aff70fa36c39584dd678d733ac80e906177b6a9c33ba9d7ae9d5f9066654329eeb6258a98cbf0eacde60c8c62ef1
SSDEEP 192:sxZkRAk8/fJsDQZLd82zodpUgKkHW6+WNpE8DZYoDBS9pIg5zt9J:sxZkp8/fJsDOGNRHbhZLSvdtH
TLSH
T1FB42D7556D38A97B9CC7D219BA55BF53E2F9103291811F88EAFC8A2C04E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c62704b-a1e9-4ae5-99f1-f6151e6cc420.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2c62704b-a1e9-4ae5-99f1-f6151e6cc420.tmp
Size 649B
SHA256 27cda1798f8f0e509e25e55f74342060a00a078c7129e30fa5d6cdcd3164d687
MD5 f2a50bc94d96f9d3c3f834b27b6bd14c
SHA1 e53cae6bb82af730ce1e931b84362767bb774e22
SHA512 33e6b3666c3517b0ba5232f3a1f3677f71bee047140e005151c48eebd15af95500901cb9891624edfd561a66d64f1f1234dbebda525f84a1777d189d18f7ac3f
TLSH
T176F028B9C821EC3B18FD0B79A0940B46F750236B2B41984F3B3D810D8FB163B469582C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c0900b647dab0bbe6e5f3cd4caf320a2af40bbdc15a2dfe29ccf87036013b0c4
MD5 a382cc4177ec13122c3b537f9ed20ee7
SHA1 dbf24bd31d546ecba062ab8ad7a2c8e22bd41d19
SHA512 13bd0b979fecd2d9902563bee9d4e487080d4dc3d00a9871fa6d43887ccdab663bd52fd5af4a06da2c358d97f17344ad8c8afee5f7cebbe2f5d980f534699878
TLSH
T117E0DFE414C8C32EA608A4870268830CC3D0365F92C8AA0E2F06C5C5760A484F6CA6B4
MD5 SHA1 SHA512 TLSH

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00003c
Size 16KB
SHA256 e25e3df4801d8303b97c89211076c8afc8165273075b86e80375fa5047c8a454
MD5 f645c4b0e981343e92a04441ed6084c6
SHA1 cad4068de99a57f6b7f12c109d80e1a523d6c15e
SHA512 b095395cbf1909cfe5d9d8b3254082248ced16a0892d9d1eb7f1d7b1a5e09a4f22bb87d87f90f5cec72b456ade008fc837da273c18a217a4e1cffa6dd6f496c7
SSDEEP 384:ZbHfzBa5oYau/YmIQG/iVvwrwewOB0TdQ3Lry2cS3Z+Ko54sjOWC:x/k5oYFfdxxwmfdQ7u2c0ZVon3C
TLSH
T19172D1CCC5E1DC09E022E8D60409765D1EDB4CD29A8126DCFD18E511FE2E2352B8D4EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 51KB
SHA256 bbc4044fe46acd7ab69d8a4e3db46e7e3ca713b05fa8ecb096ebe9e133bba760
MD5 588ee33c26fe83cb97ca65e3c66b2e87
SHA1 842429b803132c3e7827af42fe4dc7a66e736b37
SHA512 6f7500b12fc7a9f57c00711af2bc8a7c62973f9a8e37012b88a0726d06063add02077420bc280e7163302d5f3a005ac8796aee97042c40954144d84c26adbd04
SSDEEP 768:VtCYamkOlFDUPktxoMggUfuuyDS2/wNsr9qdep/t0LDCzBr8VcdYM2YLx+jYRatF:/HamkonKVfM/ks9q0Nt9rnLZ4jYcx03+
TLSH
T1C83302F9E03A27AF3A55A372F131FB506455EA8C82FF4789E87DA3508EB60560F03084
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 19KB
SHA256 98b1fafb6a77157247a7f26c6e9e47c652d03a7bc63e12e12d40d719ee191313
MD5 ba69d3e1da8ae43892bf1da85ef80d3b
SHA1 2c61fb3f0155139e269258bb3109bb20628c6b6b
SHA512 11c2703a561c28aebd6791018f84210b195022ea5a0638e7c15547a3e26b0862f792fa51350b9334b329284c89cb92388abd321b352c744a8f033a38fa909e1e
SSDEEP 384:oTO2lwlWXA9/0CiRXxvCySlq7tXztVMkUKOdGygsFEw:o/YPsRCJatZvKRL
TLSH
T1C592E780DADC7054FB78447558C41E3FF270A786A9A3CE3BA89DA536BCFB7C01154266
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f5705d6-75e0-4990-a6fa-e9d03abb9477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\0f5705d6-75e0-4990-a6fa-e9d03abb9477.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.roblox.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

0e78f2cb-550f-4480-8329-7245607dea19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0e78f2cb-550f-4480-8329-7245607dea19.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

36e7ce45-ab7e-4155-b021-63f8e68a4ed4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\36e7ce45-ab7e-4155-b021-63f8e68a4ed4.tmp
Size 1KB
SHA256 ce4043574da71be16df3e9760945fbc211a657edb8093bf889cd5aa97acc8db1
MD5 d8dc7167f8c7447e3a39d69b2cd15b73
SHA1 37f48f2d898c60af824cc9143c152af54f0a868a
SHA512 ebae0aeeddc837448afa32eb768f7ff4d7c26dc154cf337c51c7c76d2e4ceffb1b00e4b7f567ff17cab1b1a96ed4f8e47c9ffc0d2b7fb3ce3d94aa51fcbe68ba
TLSH
T1FC318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

4b450dcf-5aa9-4a1d-a7a4-56226eef2f20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b450dcf-5aa9-4a1d-a7a4-56226eef2f20.tmp
Size 1KB
SHA256 b405a00241ae518430fa513e804c57d05dadb7b212b2ee4c940965ae9904bf63
MD5 9b6c138697218436cf69d15f44c5cc02
SHA1 72b5cf1d727cf46fcf91344d98aa087b2d89b61b
SHA512 83ce9e4c31bf88be40bd2fb4fc1e9e8cf2b5e62f0902a036fda06e0512e0f54f1d346dcee2f150d58141fdd573d715aa5e60d16061d82a6d6583bc5ff33b2cfb
TLSH
T182318EF3C3E4C66E8A0096F0A618BE2BDE2D0554432C3D9AC9E4AF2BD3E3471D14165B
MD5 SHA1 SHA512 TLSH

Submit Download

50111585-2c43-4ad5-9dc7-c8f305682418.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\50111585-2c43-4ad5-9dc7-c8f305682418.tmp
Size 7KB
SHA256 af04940fc31f48f8734b155cdb1d5a5cc736153d3bcfd5056a7ca36a73bdf917
MD5 b127e0c2e8a75fdcd77e79d7e2234ceb
SHA1 88e5b4a8d28342561515a56ba0d8046658cc426f
SHA512 753761b0fa573c5f33f41722608c36f47c05f84234a0a67b8e0f655144a407acd6483b6dd0f95254607b59017ef1ca0f7db9fe9b9cc2ae22b30fdb383ef33e9d
SSDEEP 192:D1CvfrhLQFaq1pBGdHjGuMhV9flxtLpZ6zkYHRRIpTmQzRxlM:D1CvfrhcFaq1pBGdHjGuMhV9flxtLpZ8
TLSH
T1B8E19BF783F4856DDA1296F0AA08AD1BCF5C0525035C38AAC5E4BE5793F3571E2016AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fb2c96b0-94e6-4153-8821-ae3c0d4f7e12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fb2c96b0-94e6-4153-8821-ae3c0d4f7e12.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 c66d210518f9634afbae30da2df71db53bf5c3624724a395d83f9e3f438f59a4
MD5 9828e4e5be22356df19b8324fe18a5f8
SHA1 25a9b7831ab408743b1d5d377abe23bb8080bd27
SHA512 af78306d295ec4d30761a9cca8d6b63b0d116e2753081feee47d739869787b27c7509ab7e48a32d029ffd6e16908372315d610140ef4fc1c644791f1b52c75f6
TLSH
T1CDC02B77B4410421DB2507520332015F47452ECC48C180CD5403385430B2F3BA306FE3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 98cfbf8212f90453cb1818820931a906037215d4f9189d7bce028e546dbd8ad2
MD5 638ed6b91d75c8d2bda9596ee9f62737
SHA1 5f3596999baf3a28b429aa936aa33875477aab50
SHA512 c38a8611a5404782174b497c3db67534690057ca592a62648b120d865f264c26498fe921fb345785d614085e8195c9582297f7558fb76684ac43df57a559f887
TLSH
T1B5D0A73FAA330491EBA747935771049B47743DC598A8D0CCA903745A64B276AD226F63
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 ab0070ef4e76c82c9b25f5f6b796caa157bac9a44b15611372bd0cad45e61c26
MD5 b161aed8508583b66a97ba77f7beffde
SHA1 4a5a7a4a70b8a6597ceab28c5d52384905797bf0
SHA512 1135ddd99a7efde21a4328f77cbf4489f3e9e495300fde4e58313b194b452644824ac0b77c582b63467cf520ed97c9d3ca9e0f6187baf00519700f52e5f0a534
TLSH
T143D0A73FAA360491EAABCB926762046B47643DC494A890CCA9024456688276A9227F67
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0130b8148684f1cdba09ff42fe00f8e6b9a6b1066b1dfd3f00eddc34da54c4ff
MD5 19ad5dbc03fcf6cf4e97a4bd197e7f85
SHA1 ec44c86582be8f1200ec1c85dd0aaaf8dc627c09
SHA512 9a162d00d54428838645d70b050d5b8be6a4f57c6a163eaf20d8a7d74c116232d31b1607b75b32320bf2009995899a47f8e2c891d14006f4210ba9bea05acf89
SSDEEP 96:KM8wKFqmq2sK3qsrWKIcKKsAKVK66QKTywO3aKoErbWKY0KGnuKc82DOhVLZZdgk:ST/2dXOJhJlpfnpp3tNXVrN38I5pA
TLSH
T13FB2211571BB425039FE294891B69B2E064231B33119E67B7FBD00B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a9c120b3-068b-46c2-8b35-9975279fa7e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9c120b3-068b-46c2-8b35-9975279fa7e9.tmp
Size 11KB
SHA256 23e718e3fc934217aa763b118e8fd048f89a8de3c14da23e0273762fd033d64a
MD5 f893ee5725b6d382b04ad6064df550c3
SHA1 f6ffd3817af09012d6ef8b0e0f1b13079241a49c
SHA512 8331492dbf9dc5226b9c646be678eee57daffc78e788438bb352ac9da5ed539b28aabcde0162e438101275d734b5034893093d52d3c95e5021db4d54976f806f
SSDEEP 192:sxZkRAk8/fJs6aQZL/82zodpQqHW6+WNpW1/Yoa2S9pIgjt9J:sxZkp8/fJsjOwNjHba/NSvjtH
TLSH
T1AE42D8556D28A97B9CC7D619FB56BF53E3F9103291910E88EAFC8A2C15E7ACD120340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab317cbc-fd72-4ddc-b846-e0d0c92f370a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ab317cbc-fd72-4ddc-b846-e0d0c92f370a.tmp
Size 12KB
SHA256 28c625602e4ed39a341be96c0e207bd7399b0ed0b5374421a460a34aac8ca593
MD5 6e9c60f9b926748b67337e3a477281ee
SHA1 8076b036a88b0d662b0b5d24f634b620665a9826
SHA512 4877eda12a8ccf195df81730c990e49984a9c815d427a7037247f1b2ca3f67905b01e49f8be58e5ec708cbf2e14e5558e3c6cd7ec518787b6fe0727f41c3028b
SSDEEP 192:sxZkRAk8/fJsDQZLa82zodpUglHW6+WNp8DZYoDBS9pIg5zt9J:sxZkp8/fJsDOtN7HbiZLSvdtH
TLSH
T1F642D6556D38A97B9CC7D219BB56BF53E2F9103291811F48EAFC8A2C14E76DD220341F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ad299aa5-eb2d-4e9e-8a58-6a6ac48fbb8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad299aa5-eb2d-4e9e-8a58-6a6ac48fbb8d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

fa2090da-9102-446c-890e-f679dfa45256.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa2090da-9102-446c-890e-f679dfa45256.tmp
Size 13KB
SHA256 aeab9a694494db469b6cc0f2904144a0069934f96d962fc20eeb4fa4257f210d
MD5 5f53c011c537bdb9db4dc452ada9c992
SHA1 be951651f0d4c2e42605f326a70ca84b5821f7c6
SHA512 f26d1ecaf2cbb5c314a6a56289ed875e55e0faf77d087b6f2fa799463fb98f9ce9d73de0615a16e8ca3842bf376430156ee14a868cea2859ddbaeba5d93eec19
SSDEEP 192:sxZKRAk8/fJsDQZLd82zodpuCOgKkHW6+WNpE8DARAm/Yo7BS9pIg5zt9J:sxZKp8/fJsDOGNVLHbhAr/PSvdtH
TLSH
T18952D8566D34697B9CC7D219FA56BF53E2F9103295811E88EAFC8A2C10E77DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fa4a70c9-ab9a-4998-8753-9b3dcae02dd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fa4a70c9-ab9a-4998-8753-9b3dcae02dd6.tmp
Size 12KB
SHA256 a7cac25f1fa54dfad6269fe614f3b456e85b26d9ddeb6fe7ce8a7b739457eb94
MD5 063f1cb7eb174849bf2f487864a2255d
SHA1 3937e61b7b6f3c3bd692635222fd129f62a4706b
SHA512 b524d0fdf52a66ec2c22731e52caed6c64db0bad92b1c186c628899271ec72a7aa50ac7889671451f6ea907d36fb7a88116bd89b48c48ed66c657a68534a53ca
SSDEEP 192:sxZkRAk8/fJs+aQZLW82zodpQlHW6+WNpPcXYoTBS9pIg5zt9J:sxZkp8/fJsXOJNkHbeXnSvdtH
TLSH
T18E42C6156D38A97B9CC7D619BA56BF53E2F9103291811E88EAFC8A2C15E76CD120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fed7cb6c-bd22-493f-885c-6e6be48dbd58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fed7cb6c-bd22-493f-885c-6e6be48dbd58.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 5efc745b18ba48e9b8fc48159679b20ce4abd921975a3820fcba5da4999dacde
MD5 a8aed4958413d63a8040a7a0d14847d1
SHA1 ce7939431399c0e0d60ab0e2ca6e7b6f68c47e20
SHA512 36a0342c9943fc671b8bfec2e18675f7cc86dbd933b75d348337cf35a24d3197783c0dc43873b067f26b16c3397d9f6608bbc570136f9d04ed7c7cccd52cc492
MD5 SHA1 SHA512

Submit Download

bb260a8d-96a6-4bef-b6d2-7fe46dc59376.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bb260a8d-96a6-4bef-b6d2-7fe46dc59376.tmp
Size 26KB
SHA256 7c9c4092072512d41e9e5ac397b17632434fed05501b963e980d90f306edc89e
MD5 ece09248ffd248abf3bfb95e33c02dfe
SHA1 34d6198182e3cdaaf983b14ec3eb91518537d4bc
SHA512 f32db5d8152407f9ea635d437cb21de459e0755172fb5ab34b23a961c661363dfa8d01d09c94c5bf6109af89ed76c1f879006d545b08be65abb320c1c1afb529
SSDEEP 384:nWiFiZcIVtsNJ8TUNTUlI4raKMd1WB2w2f0BChCAQPwuXsMwtgOIwZOy3FgL/7I+:9FQ74wgdBKjBChFQYCsMwXs8J+
TLSH
T141C24A72D8A8CABBFCEA8BC9A74A7603DEF01163959D9AD8D9DC1D1D009719D030BC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e211dceb-3dfb-4179-82d5-e8668f3b6e89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e211dceb-3dfb-4179-82d5-e8668f3b6e89.tmp
Size 392B
SHA256 1c23861da62bea9e9f660a4027000a701e89b5ff7367caea121c501037d4f8c7
MD5 a09a84c929d522ef0b50a2221228c1bd
SHA1 6ddbd8d10abc44d38329b4711e0ebc49f5ce39eb
SHA512 fd1a6cdb663ccdbb0880ffa1200ee81c11f4df603398263e910c5e8cf0428cb6d8d730517c5e3cdf43eb13042cc610cb020c24e3c02570bed6abdce262c0613b
TLSH
T1C1E00113970000FFD13C233000872A3029E3843102F2064A5E2452645E233052F68FC0
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 526ba8f3665ecf2f43709547e721a89b9f99d700f5f78740cfe90ab2e6c91150
MD5 b9d8f70825f94f820c0483bea617a690
SHA1 5faa30a36f598257923cc1cf9f3071d6f0b27a46
SHA512 a51689fbec23f048edfbd9c1f4f43fe54cd1ccbd1ef160227590e0f90ba696efbf6fae6ad355630e5d0e730c90c9e30685d9407d55c16f968dde00a35a4a91b2
TLSH
T13B41175CAAFA1048F3B76F1AABF2A86D487FB8372E56D45D10110D4E0A23B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3964-291-0x0000016095AE0000-0x0000016096AE0000-memory.dmp

Download