hxxps://go[.]dccc[.]org/go/1142?c0=dcccoct2026em[.]yCAw7t&refcode=em_fr_2026[.]10[.]02_b2_dccc_act1_rtb_bo2_r2b_na-s1&amount=3&email=sblackley@evolenthealth[.]com&t=3&akid=15508[.]21620544[.]bacnBr

Analysis

user interaction
yes
max time kernel
62s
max time network
64s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 23:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://go.dccc.org/go/1142?c0=dcccoct2026em.yCAw7t&refcode=em_fr_2026.10.02_b2_dccc_act1_rtb_bo2_r2b_na-s1&amount=3&[email protected]&t=3&akid=15508.21620544.bacnBr
Sample261002-3ea2lavfka

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL 2 IoCs

phishing

description	flow	ioc	pid	Process	stream
Email address	25	[email protected]	836	msedge.exe	1
Email address	28	[email protected]	836	msedge.exe	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{7346562B-84D1-48A9-9A12-3F07D822C6F4}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{1DB9CC81-43E0-4004-9697-114E112A3596}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 1472	1672	msedge.exe	87
PID 1672 wrote to memory of 836	1672	msedge.exe	88
PID 1672 wrote to memory of 4228	1672	msedge.exe	89
PID 1672 wrote to memory of 4228	1672	msedge.exe	89
PID 1672 wrote to memory of 4228	1672	msedge.exe	89
PID 1672 wrote to memory of 4368	1672	msedge.exe	90
PID 1672 wrote to memory of 4368	1672	msedge.exe	90
PID 1672 wrote to memory of 1516	1672	msedge.exe	92
PID 1672 wrote to memory of 1516	1672	msedge.exe	92
PID 1672 wrote to memory of 1516	1672	msedge.exe	92
PID 1672 wrote to memory of 3728	1672	msedge.exe	93
PID 1672 wrote to memory of 3728	1672	msedge.exe	93
PID 1672 wrote to memory of 3728	1672	msedge.exe	93
PID 1672 wrote to memory of 5096	1672	msedge.exe	94
PID 1672 wrote to memory of 5096	1672	msedge.exe	94
PID 1672 wrote to memory of 5096	1672	msedge.exe	94
PID 1672 wrote to memory of 2332	1672	msedge.exe	95
PID 1672 wrote to memory of 2332	1672	msedge.exe	95
PID 1672 wrote to memory of 2332	1672	msedge.exe	95
PID 1672 wrote to memory of 3236	1672	msedge.exe	100
PID 1672 wrote to memory of 3236	1672	msedge.exe	100
PID 1672 wrote to memory of 3236	1672	msedge.exe	100
PID 1672 wrote to memory of 3160	1672	msedge.exe	103
PID 1672 wrote to memory of 2092	1672	msedge.exe	104
PID 1672 wrote to memory of 3160	1672	msedge.exe	103
PID 1672 wrote to memory of 2092	1672	msedge.exe	104
PID 1672 wrote to memory of 2720	1672	msedge.exe	105
PID 1672 wrote to memory of 2720	1672	msedge.exe	105
PID 1672 wrote to memory of 2720	1672	msedge.exe	105
PID 1672 wrote to memory of 4496	1672	msedge.exe	106
PID 1672 wrote to memory of 4496	1672	msedge.exe	106
PID 1672 wrote to memory of 4496	1672	msedge.exe	106
PID 1672 wrote to memory of 4116	1672	msedge.exe	107
PID 1672 wrote to memory of 4116	1672	msedge.exe	107
PID 1672 wrote to memory of 4116	1672	msedge.exe	107
PID 1672 wrote to memory of 1364	1672	msedge.exe	108
PID 1672 wrote to memory of 1364	1672	msedge.exe	108
PID 1672 wrote to memory of 1364	1672	msedge.exe	108
PID 1672 wrote to memory of 3384	1672	msedge.exe	112
PID 1672 wrote to memory of 3384	1672	msedge.exe	112
PID 1672 wrote to memory of 3384	1672	msedge.exe	112
PID 1672 wrote to memory of 1372	1672	msedge.exe	114
PID 1672 wrote to memory of 4492	1672	msedge.exe	115
PID 1672 wrote to memory of 4492	1672	msedge.exe	115
PID 1672 wrote to memory of 4492	1672	msedge.exe	115
PID 1672 wrote to memory of 5476	1672	msedge.exe	118
PID 1672 wrote to memory of 5476	1672	msedge.exe	118
PID 1672 wrote to memory of 5476	1672	msedge.exe	118
PID 1672 wrote to memory of 5780	1672	msedge.exe	120
PID 1672 wrote to memory of 5776	1672	msedge.exe	119
PID 1672 wrote to memory of 5780	1672	msedge.exe	120
PID 1672 wrote to memory of 5144	1672	msedge.exe	126
PID 1672 wrote to memory of 5152	1672	msedge.exe	127
PID 1672 wrote to memory of 5168	1672	msedge.exe	128
PID 1672 wrote to memory of 5328	1672	msedge.exe	138
PID 1672 wrote to memory of 5328	1672	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://go.dccc.org/go/1142?c0=dcccoct2026em.yCAw7t&refcode=em_fr_2026.10.02_b2_dccc_act1_rtb_bo2_r2b_na-s1&amount=3&[email protected]&t=3&akid=15508.21620544.bacnBr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa124ec188,0x7ffa124ec194,0x7ffa124ec1a0
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,17935317716851532674,3567899319397495001,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - A potential corporate email address has been identified in the URL
  - System Time Discovery
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,12477162142755709656,6711326483197027013,262144 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,14592387422134639212,17548573014290823007,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,13286069221849512690,6460864867682019093,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12036634178983539538,608177481264307165,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,9366789445404212938,14729634493695354853,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,5071112163680419845,7439228723323366146,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5068,i,15587160122827155753,9246138475689694294,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,13225085061680363995,7763934506091245046,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,17082591448432888456,12781920737943589270,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5560,i,11181376420329747950,13347796932233942911,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5764,i,3945113736492398448,11209365557995157483,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5916,i,10889146299014674473,12143968597574905508,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6112,i,4763657782127749544,15324719922433478255,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6352,i,6796632362205291435,11124741915479835722,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,9075734737141399102,16594684096249261711,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,9075734737141399102,16594684096249261711,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6752,i,7374175567451265752,5217226644007581874,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7108,i,14194609675803269935,15739150875107700769,2097152 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=7344 /prefetch:1
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7596,i,15183147627599460389,7620779974045566178,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=7860 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7588,i,4758717641907901665,13313051060328771390,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=7840 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,11382009386957292865,9912757921121907862,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,12896136678710900966,7367828283265849568,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,2844844089522353882,13941491274457343898,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:5168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,16384140261964595857,3266699267532473995,524288 --field-trial-handle=2204,i,1384631382604062613,17650500099767053300,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a628f63-8fb2-40d1-bd9b-f44c53253e56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a628f63-8fb2-40d1-bd9b-f44c53253e56.tmp
Size 18KB
SHA256 c3f583bca3400d8d755a5a5e6654ca51b77651cdd5ddb0d10312c70c18b5203c
MD5 02f300b16447d50ac59a2a064fe980de
SHA1 f490c711612992e3c9584bfa57cd745a00fea37c
SHA512 7749dac47cfd88b5d05ba4a5a38e0aedabf395d89a1835d68df486640988e1b29749efd123a9886ad90ad9086be8d4c272fae54e3c2f15ef7fc61f75262af20b
SSDEEP 384:eZcIhsNGE+xpuQ9x9iX5F8+RM2Yob4VZh6DKhHtoD:chXxFPagWj4fYGHtk
TLSH
T196828D32A8385C7A48F6E693F5473A13AEB88167DBC85F94C5ECB72D01EB5940307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3ea79bd0-9de7-402c-a345-1f70ef62ad2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3ea79bd0-9de7-402c-a345-1f70ef62ad2b.tmp
Size 8KB
SHA256 ca425e05f8b3cbca394e326b531b4f5aa0bf36fac50b2a5091c848405ef670f3
MD5 00d1acaa04b3951ff7f541ace69885a5
SHA1 3cd06e5ad5fd1a2a2a62cf290e0e7574bd14cf3e
SHA512 3a0e35255083a5e94b6cdbeb605de573ac594a28a10b2d18ea737713fb8fc797ba9506ca863f91f664d2214e370d294bbab6f2663830c1572f6d489578e19f93
SSDEEP 192:LONP6AmwpDQmiUygdDsiX5F7Y+DFM2PwoolRCq4U6:LONP6ip1TDsiX5F8+RM2YoS4U6
TLSH
T106122D35B8645C7B4DE3A561F08736139EA55227DB886FD4C9EC2B2C02DF59C530BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

613c6317-9e35-4a55-8784-44b6fad5c153.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\613c6317-9e35-4a55-8784-44b6fad5c153.tmp
Size 18KB
SHA256 c705bc0bbafb3f3b8ea06b90b65d3e687c2d13a5b72bc3c8cfe0852b040b9fec
MD5 4a962688dd1530da5e820f39c2a8c8f5
SHA1 71dc722042b5a4c5adf18ab1810af652a9cb1008
SHA512 94739cf7a4489d40c6a7d9364e13eef0e7b7370f8acc91e53d971a6a64135bd6eb0c64d82b6762ddab6038f6b62c2850a8ebe69f002b480a18c7914e16e67482
SSDEEP 384:KZcIhsNGN+xpuQ9x9iX5F8+RM2Yob4VZh6DKhHtoD:ohixFPagWj4fYGHtk
TLSH
T1F6828D32A8385C7A48F6E693F4473A139EB88167DBC85F94C4ECB72D01EB5940307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc7ce340-b8f6-4bc3-a80b-a1939de0a67e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bc7ce340-b8f6-4bc3-a80b-a1939de0a67e.tmp
Size 105KB
SHA256 33216cc8094343b1e673d6d0ce51864cf882b00961e3411c47b6a0cf1488a291
MD5 67f6e997d9180458e1a8c1eb8facdbb8
SHA1 ba71d9acfdbf5ad19e98c71c4ff3936488e5302e
SHA512 cc39dc134ebb79f6ba88453b88057a692c89209ccaada0ea03ca92512d41d4b9cea1179950cf85647315f4dd3a45c3553a403d01ea2891cbdb3b8df87cb294a1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7z:fwUQC5VwBIiElEd2K57P7z
TLSH
T16AB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a9e2856f7b8bdcf4e651903050a9f78a4dcadbc91b2bacca38c04067256642f
MD5 8eed843072749c683b08c3e5dbce9bd8
SHA1 87464a0b34e45a134ed6f01b613378b3b1c952ad
SHA512 ce7dc7d95703c8a1e763fcb3eae4091d89a746632583bc1fc73a8c189a11f08c6f50e2ee328053aab1da82c11d6f5f81942259c5654861d13f267c34e76feb7c
TLSH
T199D02B6CBE989EA0E40210340231910431CBC8178442200648B1065708003C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb29521835d0887aef733d211fa43d2903333bb5e86e2580dbfe7db3b16bb1ca
MD5 ae441104cfb514988d8468c296b33f4c
SHA1 1de1bdd3ad0b87ba57d165cd0d5b72d99a1a48f2
SHA512 4178d6169908ca49fae4773c8986a0c9d71a515b2fb4d7ce8fb9bcc8b10c415ac00698c7add7cc45f427547535401a518211221bcfe6dfc2bdc0f71f62b0105f
TLSH
T150D0C028AD78EFF4F021113C0330400031CF88138642210A58610D174C302C30380DF0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 221e3dccb30d516b1b3c2d51c604a308dfba3aa3dbe8e11c2d09e185e21df465
MD5 7c97d945db36fde78f76660ee3165916
SHA1 fa851b1197f5a5f6ba4d935baba30b0465e8ad12
SHA512 73a256bc0b95a0662925ed2ac0e1668d7a760da5001e2b32fe139724419020254e080420b21ccad1896c60c44ca2663c2a3d2eccb8cb4180b6b0ad628c68d676
TLSH
T14FD02B6C7ED89EA0E80210340230910431CBC8178442210748B1065708013C303448B0
MD5 SHA1 SHA512 TLSH

Submit Download

01110655-7106-41bd-805d-28df0d779f4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\01110655-7106-41bd-805d-28df0d779f4c.tmp
Size 9KB
SHA256 a15c2b2e622be01512fad6e53cd621c29297780ea0388ba0b1574144a6cff871
MD5 bd44530e8fd8a70b47eed8a8d404d85f
SHA1 984c95ee3e5d5d35b3a10fdf523ec27e727c027a
SHA512 017aea8f042c5ec395a4c70cfe5b9454731682743ff568039e3574fc1afdd5134469c946354a5bf3e5bf1ae107d94676024a68baa867ed5578860bddf5d50a4a
SSDEEP 192:sxZJRFWC/fBszXLIdpcaHW6+WNuNDc/Y3A1HIgrJ:sxZJGC/fBsDU/HbV/F9
TLSH
T16E22C9126E38A97B8CCBD21EBB15BF53E6F9403291D51E58A6FC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

12099575-0c77-4a3c-b17a-8c26b683fd2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\12099575-0c77-4a3c-b17a-8c26b683fd2c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6838405f-2106-4c97-bd86-17ac42e0c0ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6838405f-2106-4c97-bd86-17ac42e0c0ba.tmp
Size 10KB
SHA256 9fd34ff4eabc31e4b71d12a777d4d8539d9548f6562baf65f86445e64679d301
MD5 cd7cdbde36ea178b08dae9cf66415c2a
SHA1 f64f69450511acee03ebcef52ccf544eb7fec6e0
SHA512 d93cb30ba6c9e991dd4a7b38b5ce318a6c2fabebd7ccf9c9aae465441718172d7bb4bbda63fddd0326b027f07c0daf449f0840369e01571eacdc372937af9b83
SSDEEP 192:sxZJRFWC/fBsvXLIdpcaHW6+WNuNsIXY3l1HIg5sJ:sxZJGC/fBsfU/Hb8XSO
TLSH
T17322DB126E38697B8CCBD21EBB15BF53E6F9403291D51E98A6FC961C04E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8dd2fa48-e4ec-4e13-bb1d-36a2d34cb507.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8dd2fa48-e4ec-4e13-bb1d-36a2d34cb507.tmp
Size 10KB
SHA256 78844627855bca71f20d882702eff8aa26f133fb5f8e0e4a2453990575b64e23
MD5 98d13e395bc71fbde0ee1f904583b14c
SHA1 cfd9f626e8aa944946046d5adf28425bbbd1df7a
SHA512 49caf44e241b429102d210718836a8510e2414ed73b467695a67f97117bc7993e2ef6d4b44fca2d125be1a08a0e507ad4fb59e071b1e6a3b13b98b8e1d0d2c0f
SSDEEP 192:sxZJRFWC/fBsjXLIdpcaHW6+WNuNIMdY3K1HIg5eJ:sxZJGC/fBszU/HbwdR8
TLSH
T1CC22E8526E28697B8CCBD21EBB15BF53E6F9403290D51E98A6FCD61C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 97KB
SHA256 099d6a3f8697c1dff370a89807b4175106c41792f8302ee3bcd4671c55fce28d
MD5 f3c6fd7c232be665c97cefb4c5ac9574
SHA1 cb6a6c4c09df6c7ac428ae11165f8960966aec6e
SHA512 f97ed14749281af2b0d8794b82a8fb29a707b7873d0bcfe953839f1ecf4f9743ea2b9926c593ac9e2dd92f85f862c6a540dff0045dd976a9c4b55bcad413c5ca
SSDEEP 1536:1sFLyHUDnU/ikSZJMdB0Bucvc8gUSU9zhmRd+nTMJMTmmtQhnC+EggyTnRS+cSfe:1d02+Jw0LcfUp9TlKTEHyTRSrSKri1Hw
TLSH
T1E8A31261C3C7075FD66A0CA70EDBD02C2EE7D5D2A7F71C820A864C80D70F6AD81D9865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 65KB
SHA256 7a2ebeab9cdcf1368b1deab4281827c19d00d429d12faa0c4648c8ab406d5a22
MD5 4fd3e0fe15813ace69729cd0fb1a7e51
SHA1 0fb4910c010ae55ae2c7141423aaeb63462dadb6
SHA512 f368ee1551004356db8ad67684840e5d5df7e943aecf67a65d54510f1ccbb3b14aca3f71d688b727b3fb3e1e2c6a93a16c0331fc26feba0cd13f2bba124216f3
SSDEEP 1536:MBSaffFc3z9Sm4AOEatV61v4THISps+Villpaz5aiFGwO6lyHjRxMM:MBO9QAOHI4/s+AoskdO6Ozz
TLSH
T1EC6302B5D8D8D6979CC216EA7F9C9A4FFA0B88DD170C53266C1280907C0DE2367466AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 413KB
SHA256 09acfb6d3ed5b4b3596f9a7390f1338a75e24f04841a123933ad1b2533732f9a
MD5 deafda8098ff6b4099dbf06f8ee963d6
SHA1 fffa8520ec874f2184a95a9b2ceeefd15f14ddc8
SHA512 cf52f3c666bd7629d56ebd6bbc03e423faba86d6e5a021b28efbda9023bac71744cabb0068f09b6a15cb80c299cae6e88274495fabca612241c9364c1bd10330
SSDEEP 12288:E+Smo5MbH0mek8mZe5oVA600TS84BFBrBSNmDkO:Epm9bH0mPZeaVZ/G843FSNkkO
TLSH
T12B9423CABE13A5DA108521DDDEA8A8B7C21E7127C53DA7D413C15AE0643DD4B6C3DF82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 443fc1f96f46794ee4ddec6ef944c87615edc1ebe46f757b1169a4954ee7455d
MD5 4c19998ccb770b4bfbcb0fabcc5707c0
SHA1 9c66fd70f19036a87383fac709c7120d741bbd55
SHA512 688dc040e33de053bce50eafa8e2384f8cbac589b42e2a24ab7729f2eeecce1632be3d16e9a36f26c8f5b393c3425e0d289264f2d50be38ab431b219e32ca1c8
TLSH
T16C81A5C95580445AF7E84131B8DB1E9F36F4886DD6A31ED20556DE31BBEFB610040FBA
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c8311ec940681782208425d1845c8207d6e4628e26c94976e989f0d6dfe4a3a8
MD5 3e118c6eee4c42173e5e62e007550aeb
SHA1 67089edd6b7d9a22630603b93b3b2ad5f2e06754
SHA512 1f0e930ceb9ee75678a742e6cb3beb85279f887f9c6f83381f8c87c43e1caaa2f9a709323db24e7ab82704ac16eb9c1c54cdc400fcfdeb7f4fd1dd7d9585e143
TLSH
T13E613EC9594040AAF7E84574B5DB0D8F3AF4899DE6B31ED205A4E634FBCFB560040EBA
MD5 SHA1 SHA512 TLSH

Submit Download

64728fd5-508f-424b-a1d3-aaa01722394b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\64728fd5-508f-424b-a1d3-aaa01722394b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_secure.actblue.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3dc62d04-c7cd-4deb-a95d-e32751a5147e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3dc62d04-c7cd-4deb-a95d-e32751a5147e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ae0ad2c9-2013-4988-afe9-3ac753fca44a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ae0ad2c9-2013-4988-afe9-3ac753fca44a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9ba136be5d116a4d9211236419aabea29ddb727529a00d1943d8097e4077ad7b
MD5 d6f0edc4d708a3cb16f296366c5e787d
SHA1 6fb4089f1b2b41da56bd5dc7f15d83a67c921f7c
SHA512 a740868278f9b64af16975ebc2d73e4c6959e6ab82ce39632fb8291a1c42bd4841ef3186128b8a309b3d7ece776838e6e81acc10aabe7626caf0c2af4ed463ab
SSDEEP 24:KnmVbE7konimk2ioQPIhQkKcHhkGk1aI0SIayrCI5yXBGhWckIxKah41aSjgDcHS:KgJIdK6YQ3yVbIxKM4Mk9I1KuI4fyO
TLSH
T160910B1576BA5310397E3A0842B4862A665235B33019F56E7FFC44A38E6FF584CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\51a0b5ab-2630-4489-9d80-825d4ff631ee\index-dir\temp-index
Size 72B
SHA256 846b92bcd7d22ace8d3002261dfbac11873d7c486f4178f4a56c664d3b3e5d0a
MD5 68395113f87d43b9fc2d2aef05c1c3e1
SHA1 c2d82e19b1c232751df4b1cc81c7cb17ebeec3e0
SHA512 0374180186c728fcacd7980840dedb923d2201c29d4211c4b445068cef771cb6b35745f0e4dec0ffe5f6aaa2c2aa92b295cc3a7c091a0fb703029aa32fc7a1ac
TLSH
T1F7A002E083E51441D0542A7490591BE17350D8A04A010F034895058C9CE02C89919016
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\51a0b5ab-2630-4489-9d80-825d4ff631ee\index-dir\the-real-index
Size 48B
SHA256 e2d95a20bf2bd91a338832059bf1af368b76d317f478383e5fa45b189e341566
MD5 e0a804441ae03460fc4233610d2b0b2d
SHA1 3e23ef3be787a233128c9e482b93d527df2cff15
SHA512 d20558b6708053f3dcb0e82df02bbe71b4d4c00d17bc5bc1c3b4fb29dd82ee0cf1e2a6e46e851e79642261795bdea7fadd9e3113730f26fbcca427d936ab5e03
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt
Size 178B
SHA256 cbc3f6e42f569cf6a88ce86ccba48fa781f2e8ba165a91e0e3299dc7e269e394
MD5 67bed1c23af0214507083e199727bb17
SHA1 ad15b00426abcd3ebe0be50bd6f0d5abcd3ac690
SHA512 fdb8e08b81d22b9f771223596af4d1d91a6cc32f0923a18510d0a54c9f4984040beb7252d5affd46968f0d9ce172a74c3d50eed340ef4699c047423d0835a88d
TLSH
T127C012772455A5E23F6255D7415131C8D93A3FC88D84D54C885135497AB0C771451928
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\CacheStorage\index.txt.tmp
Size 91B
SHA256 fe8d3c61ba752f0d6508c03b1a3995f9c974a7e05509b9b0c79e33e591e88532
MD5 59e6d2963b94f7cc9c7ff7ecb82a7dcd
SHA1 b67844922be29b13d5c19eaf700f9239ab5696c4
SHA512 13d15bb3d5e96d80fedb25946daff459ca7e35eddccefab5e7e4fa608e22cf1dd5eb6711b4b279be997cd04d3b4e5a60197303d7595ebd40e1727c3c9b56996b
TLSH
T1B6B002BB144259D66F7135E7005531DDD46633C8DD80DE9C8471645976109BF1001D34
MD5 SHA1 SHA512 TLSH

Submit Download

aebe8140-5f6b-4068-85d4-66777dfef65d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aebe8140-5f6b-4068-85d4-66777dfef65d.tmp
Size 27KB
SHA256 2f0c62df78c29cdc4dd898e8b7362728859b87c8b89758ab3168a2552a5c6b7a
MD5 4077cdc65193098402ab6cc412792d02
SHA1 464e6a94ced05f62a334543fbf1997d5745512b9
SHA512 7ad2e0373fdcd669a54295ae156ec384e7a5eb70c74bef068cb39205c74350a84364442b70ac8f4658acfbfee38a04d07a9e35275df4a05cc0d4ca399e392f74
SSDEEP 768:gU30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ72vrolZMz:gU30AbSWvS299u1jaLmLZ128w
TLSH
T1FDC2EA3B640CCB7E4FC01A9DDC6AAF9B6F9802C796548D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bf07e518-2a71-4e27-9b42-3f106cf1a628.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bf07e518-2a71-4e27-9b42-3f106cf1a628.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b999e1a4-ae13-49f2-b08f-c77be79f4f44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b999e1a4-ae13-49f2-b08f-c77be79f4f44.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b20628a7-a34a-4468-94f7-79d5bf5bb075.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b20628a7-a34a-4468-94f7-79d5bf5bb075.tmp
Size 8KB
SHA256 a3f8da3c55a0b0a956e0fef2b363217cf16833ad857d2704757a3273f1dbc10e
MD5 4a37113344d304cf219da16a21bb50e2
SHA1 dfe2cacbcdf2d20ed9353ee8e4e8e914567ef2c7
SHA512 cb95a481632eec9b10d218cd23aed7a472397df4287b34edc7674e31fd3285b24c73cdf3f0373594c3b8c5c585d34ebcc5fcda3f7f09c23e8824fa2859e1a0ce
SSDEEP 192:LONy6AmwprQmiUyjd6siX5F7Y+DJJiheNU6:LONy6ipdu6siX5F8+ScNU6
TLSH
T133020B35AC686C7B8DF3AE55B58B37239FE5116BEA942F84C9E81B2C01D764C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9781491-d30c-4676-b750-c93f9d95fa92.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b9781491-d30c-4676-b750-c93f9d95fa92.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 be80b9613de57c813545fa3ec5c76c2e2ead5ded9506461b17e0e0878f2293ab
MD5 31b44999c764a0955f857a8ad24d2bd6
SHA1 d4f29270994631f0e2ba009a98ee30203365e346
SHA512 e2e99b2ad999e24c7b3c7f16660c2851c27669c9b89bf071e088ab976f9e3ac879bf6da38ef0b007a992319d252d587ede77e8a3da01079c3f1e67031b75eb6b
TLSH
T13C413858BAED1148F3B76E5AABF7A82D587B79772E06C16D00120D0E0667A80D871737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads