hxxp://wsj[.]firstbux[.]ru

Analysis

user interaction
yes
max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wsj.firstbux.ru
Sample261002-mpy86sys5j

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	115	https://shtampik.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a4431541a888e62c	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3748	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{EA5FB61D-8408-4BCB-A93F-D4E2A3FBF488}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4692	msedge.exe
4692	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe
1184	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 4288	1184	msedge.exe	87
PID 1184 wrote to memory of 3748	1184	msedge.exe	88
PID 1184 wrote to memory of 2092	1184	msedge.exe	89
PID 1184 wrote to memory of 2092	1184	msedge.exe	89
PID 1184 wrote to memory of 2092	1184	msedge.exe	89
PID 1184 wrote to memory of 1180	1184	msedge.exe	90
PID 1184 wrote to memory of 1180	1184	msedge.exe	90
PID 1184 wrote to memory of 1456	1184	msedge.exe	92
PID 1184 wrote to memory of 1456	1184	msedge.exe	92
PID 1184 wrote to memory of 1456	1184	msedge.exe	92
PID 1184 wrote to memory of 4356	1184	msedge.exe	93
PID 1184 wrote to memory of 4356	1184	msedge.exe	93
PID 1184 wrote to memory of 4356	1184	msedge.exe	93
PID 1184 wrote to memory of 3612	1184	msedge.exe	94
PID 1184 wrote to memory of 3612	1184	msedge.exe	94
PID 1184 wrote to memory of 3612	1184	msedge.exe	94
PID 1184 wrote to memory of 2548	1184	msedge.exe	95
PID 1184 wrote to memory of 2548	1184	msedge.exe	95
PID 1184 wrote to memory of 2548	1184	msedge.exe	95
PID 1184 wrote to memory of 3368	1184	msedge.exe	98
PID 1184 wrote to memory of 3368	1184	msedge.exe	98
PID 1184 wrote to memory of 3368	1184	msedge.exe	98
PID 1184 wrote to memory of 3092	1184	msedge.exe	100
PID 1184 wrote to memory of 3092	1184	msedge.exe	100
PID 1184 wrote to memory of 3092	1184	msedge.exe	100
PID 1184 wrote to memory of 3300	1184	msedge.exe	101
PID 1184 wrote to memory of 3300	1184	msedge.exe	101
PID 1184 wrote to memory of 3300	1184	msedge.exe	101
PID 1184 wrote to memory of 1096	1184	msedge.exe	102
PID 1184 wrote to memory of 4828	1184	msedge.exe	103
PID 1184 wrote to memory of 1096	1184	msedge.exe	102
PID 1184 wrote to memory of 4828	1184	msedge.exe	103
PID 1184 wrote to memory of 4996	1184	msedge.exe	105
PID 1184 wrote to memory of 5180	1184	msedge.exe	113
PID 1184 wrote to memory of 5180	1184	msedge.exe	113
PID 1184 wrote to memory of 5180	1184	msedge.exe	113
PID 1184 wrote to memory of 5408	1184	msedge.exe	115
PID 1184 wrote to memory of 5408	1184	msedge.exe	115
PID 1184 wrote to memory of 5408	1184	msedge.exe	115
PID 1184 wrote to memory of 5472	1184	msedge.exe	116
PID 1184 wrote to memory of 5472	1184	msedge.exe	116
PID 1184 wrote to memory of 5472	1184	msedge.exe	116
PID 1184 wrote to memory of 5872	1184	msedge.exe	119
PID 1184 wrote to memory of 5872	1184	msedge.exe	119
PID 1184 wrote to memory of 5872	1184	msedge.exe	119
PID 1184 wrote to memory of 6076	1184	msedge.exe	120
PID 1184 wrote to memory of 6076	1184	msedge.exe	120
PID 1184 wrote to memory of 5300	1184	msedge.exe	121
PID 1184 wrote to memory of 5300	1184	msedge.exe	121
PID 1184 wrote to memory of 5396	1184	msedge.exe	123
PID 1184 wrote to memory of 5176	1184	msedge.exe	124
PID 1184 wrote to memory of 3960	1184	msedge.exe	125
PID 1184 wrote to memory of 2500	1184	msedge.exe	134
PID 1184 wrote to memory of 2500	1184	msedge.exe	134
PID 1184 wrote to memory of 2500	1184	msedge.exe	134
PID 1184 wrote to memory of 3724	1184	msedge.exe	135
PID 1184 wrote to memory of 3724	1184	msedge.exe	135
PID 1184 wrote to memory of 4692	1184	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wsj.firstbux.ru
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa7632c188,0x7ffa7632c194,0x7ffa7632c1a0
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,306628853061838218,10036992454807434514,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,6161696490084068373,4784170702133807547,262144 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,2027624908811353507,2783919686196301207,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,5160083011836114829,15593426684442083682,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3067197027119909846,12569589455376669071,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4738201454693743738,9488375063644404266,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,12075703224318468225,10761994130031689066,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3564,i,5137312770569241554,1468344058170081239,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5268,i,1551476573163430205,17091231385470624797,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5388,i,18414479604077020895,11517214559875112644,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,15198368808075084665,17075019340230352160,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5612 /prefetch:8
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,9927972235919444035,2674401832412324836,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13128581727540486546,1076995468014719365,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,13128581727540486546,1076995468014719365,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5136,i,15765512121555099190,3096912657042797529,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5172,i,6158561114046760793,2522081306358341887,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6952,i,17155138013161400301,15398685366412359567,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5212,i,7930884280953798403,1599147637155550681,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,15173237327543879654,2571489199664303795,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,10606291029687052609,784935075435589418,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:8
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,9066482630577564989,15764939701086499300,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,12826751899730004194,12022219544421657417,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:8
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,4890865408911816943,13252827587954313102,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5248,i,2173961448345877063,7414579347578217450,2097152 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2180,i,15856722624489068949,14000001977028739392,524288 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5560,i,7256475852040431533,16042843946128865476,262144 --field-trial-handle=2260,i,15936002667267829028,6099161959585623408,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07509d94-6f3d-4c37-ade5-4a08e500e039.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\07509d94-6f3d-4c37-ade5-4a08e500e039.tmp
Size 8KB
SHA256 3336fb3f24433a194649b294d4ff94c0df629078c84fca3f635a2f7dbe58c992
MD5 2d6c2aee74cc6db270e0e1bb48c2f398
SHA1 67b260187518f4620bb3bddf90fa10155fddf0d6
SHA512 4f13f279a86e5410e50fa2cc0ea5b0b42bacb9e50e5e683a84f1fcaa4e710dbb6c1df5aeccc7fc0d915c0f0e14bb8f6a7125b721e638b23575ea8d200fb13d96
SSDEEP 192:SON06ygpQmiUy363ttOCTVgLi+FdVsLzPc3VU6:SON06lHUEttOCTVY9diPcFU6
TLSH
T1D002D735AC783CB78EF2AE05F48737179FA4117BE9562B94D9E85E1C00D766C2302936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

291b40ef-0ed3-4143-968a-cd0faeab9077.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\291b40ef-0ed3-4143-968a-cd0faeab9077.tmp
Size 392B
SHA256 ed1c50d6d76c8a7977cf9ee73b40f95e68414834143a086a9bd18ef209b23f2e
MD5 38fd5455e350e1da14582736dce0be85
SHA1 09a7be6ced703a65cd24b0501c1108a659fde9b9
SHA512 70099f0a0095bca8bf7b473e420536f24a7436a070dae23b57f80f14318a05d334926ef0d2b70b7f824e932e3c1a13382f2825bd3948486edfdcd3ad529e404b
MD5 SHA1 SHA512

Submit Download

460c41b1-5e8c-447d-ab50-1b427d41e907.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\460c41b1-5e8c-447d-ab50-1b427d41e907.tmp
Size 18KB
SHA256 0759af5f8fbba9e6d61567098487870f0faab7d894cc5f206f014dd3a232ecb3
MD5 ff9e136764c8f80f275fbf29bce20649
SHA1 1e71e72d7edbe61fd65ec7286d95e3b67238486c
SHA512 e5c1e1ecf001b8b1da632d20ace995c4a6dfea74671c9526b05dbc6695fd5f5376ffd4e9d81f17e288b6c514a5786c71766981fc317c771145774537f7eadf1e
SSDEEP 384:AZcIhsNR+UsWwNJ1FYFxiihnuOjTVY9di9rscQtgOIwZOyrFRto7A:+hUT4FuxiihFnS1cQXsmRtgA
TLSH
T16C828E325C786CB75DFBA102F08B32039FB881B7DAC56B94D5EDAB1D01D66A81307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

031b4c7f-800a-4cef-ae6e-c0746834f4bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\031b4c7f-800a-4cef-ae6e-c0746834f4bb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55986469-caaa-45c3-9009-c24766d6baea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\55986469-caaa-45c3-9009-c24766d6baea.tmp
Size 11KB
SHA256 eec64dff9ce74597c2f47c8e4839f6abb27deb066e08eeda53cf31b7d7e37de5
MD5 8d958c93caa7e0723652b69becf70699
SHA1 8269c412696ccb859cf9614c2965b9f31f0a4c39
SHA512 0c1fc07e124733dfd274f305b41a99342d84b2e6d7baafca74e23a174122dcb1436e81bd0c106e2e0a4518999e5e25b600759a21af62e9ba28a07b9b6ffc656e
SSDEEP 192:sxZ380DR6DnKz/fqesK9o73pf0IdpH3+3a3b3NHW6+WNXn3o3hziB3PzQ/YRPE0i:sxZ380DAzKz/fqesK9o735tXwkDNHbXM
TLSH
T19C32C8526E38B9BB4CCBE31ABA15BB17E2F5407251D11F58AAFD8A1C04F67CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86a4ba69-540d-4c0d-a51b-fd880c3e18ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\86a4ba69-540d-4c0d-a51b-fd880c3e18ba.tmp
Size 11KB
SHA256 98e4e095a3b2ea55e8e3071209e55324a782e3cbe9f10fa3b09c5d7395648a3c
MD5 194e63fea0a7b798b8a339173e12d62e
SHA1 ce9939d1bb6963ad8c9a1a549c9661875c60bcb0
SHA512 a74564b7e6475271202ce7a9418b32b294d253e05b191d6c1199605a2f50c4c7620e8d987a5c96aae439ed87f3c6dfa9d63176bbaa7603ce7746aa9b0710225b
SSDEEP 192:sxZ380DR6DnKz/fqesK9o7310IdpH3+3a3b3eHW6+WNXn3o3hziB3PzQ/YRPE0iJ:sxZ380DAzKz/fqesK9o731tXwkDeHbXM
TLSH
T18D32C8526E38B9BB4CCBE31ABA15BB17E2F5407291D11F58AAFD861C04F67CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

93f306a2-a002-4037-a01d-14714e235ada.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\93f306a2-a002-4037-a01d-14714e235ada.tmp
Size 10KB
SHA256 3e0b75582509170c0d9bd86829a285b162fddee181ebad7add99a65fc257c843
MD5 0a114b395fc5cf442e7bc40bbb32db88
SHA1 a179e1547496c2d243ab9b73f07994e1e9d108fb
SHA512 99d9cca6e0dadaf5c418e9f6e15d716c41009f393f353dc823d380206095e337b75a42c474a76f57c33d67ff5990fe31539de5b25476d9c20c4387fe46b0c5aa
SSDEEP 192:sxZ380DR6DWKz/fqesKH7310IdpH3+3a3b3eHW6+WNXn343PzQ/YRPEhibl7dIgx:sxZ380DAiKz/fqesKH731tXwkDeHbX3+
TLSH
T1F132D9526E38B9BB4CCBE31ABA15BB13D2F5003291D11F58AAFD961C04E67DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9df8d695-2dad-4d46-86b7-60ec4c0149b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9df8d695-2dad-4d46-86b7-60ec4c0149b1.tmp
Size 10KB
SHA256 326776fcf4854ae4a420fc6e172d16f8d62b9f192bdc121e0bd3532297e0a4bd
MD5 6601b0f867fe6592fbe7578ee5204f20
SHA1 746c4566eaa30c00e2c7de5adaccd2ec74c72f5b
SHA512 f2388170aaf1f25038319ac1508a7f9e4af72d9c68d6ad71206c3911d77a43f0a789c973d7156930e3c5f3dbcb21ad8eb0a681761a78700082dab393a8202459
SSDEEP 192:sxZ3LDR6DWKz/fqesb73N0IdpH3+3a3b3hHW6+WNXn343PzQ/YRPEhibl7dIgrJ:sxZ3LDAiKz/fqesb73NtXwkDhHbX3abd
TLSH
T16722C8526E38A97B4CCBE31ABA15BB13E2F5403291D51E58EAFDD61C04F67DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 35KB
SHA256 26a0510fa55a9afd9007779cc82d655333e788cac89a9d02e25250d1e89b25fc
MD5 1a0af0cff7a82f1ab154b5a272051401
SHA1 9b207d21f35b2985b7217d83e1418a38f35b56b1
SHA512 c5b215e3be1ab5d062228734857eb05f39a7bc2e641a9222516a91fd70c8982ff5b0bdba29c12aa830d04e74545df250232c9ef7e607fea4560d548c1a2bc631
SSDEEP 768:2h8/7dMVZb+mtjfpt5yIL9HRlyQQwMs3NEaWlwj3s:2h8/7dMVZb+mtjxt5yw9HRlyQQwMCNE1
TLSH
T14DF2824E66F710320197A43F6FDF81487671C1873148E91CBD9C46486F98E29CAFABDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 680ffb7e6ed55575d2df70b092266110ec5c75958ae6340d1ab0c8c31a639746
MD5 67d9aec298f3751cacd54a17c97452a4
SHA1 a059692685a0320270d383ed61427962d67d6108
SHA512 32886485df156f9b40e9d2ef2744a8055094ba87b3961df1950d299f4c4a3bc4b9db664caedcff15bdd32e83e26e947d8daa5250267fb207eb502d98539a1998
TLSH
T18C71C508A5947B4CFF68873398D41D8B7F344DF349874F2A0864D4396ACB3B610D13A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1bf8d9eaebc5829821403f1dbc39282331107ff06b4aab14f3523faf0c170b9b
MD5 f8a6d9f32c14e5bc3d88e4e8b4669858
SHA1 37b6bdb087e2898527efda9591bdd627547be92c
SHA512 0d3c23e52c623d3afefda33264a5145ef31b7f75023f18e725ba623bff2c0514dd268634f4a33a7c25ce9f52e330e4cb367b25df5058919864a3ede6967edab3
TLSH
T15761A34465A07B9CFF68873398D42D8B7F344DF319835F290868C87A6ACB37550E03A8
MD5 SHA1 SHA512 TLSH

Submit Download

7ca3371f-c125-43c6-a194-7a8680b46445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7ca3371f-c125-43c6-a194-7a8680b46445.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

abd715c6-cf09-4e5e-8d84-9bd4f01f53e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abd715c6-cf09-4e5e-8d84-9bd4f01f53e5.tmp
Size 5KB
SHA256 f65efa8c6136c8bc903fb12aa7de81f3f199aba002f48180859c3235c149c73e
MD5 20262cac582ff8c75128c9a9bf3a6081
SHA1 0d63f25039fcdbaa7537f0d0da6c4539cb3afb23
SHA512 79f486b8c261bff62676c33a3fae8839b70f8e29186835da5a6617f9b19cd8054e77b90677a30ae0947f6552a251bec1a4a183caf7edce9e3ecf2a8ba2f7f60f
SSDEEP 96:D+OuBu5uvusHXvuUzouf41uzuAqsB6wBRJ1Ju7Ji:DtsSezHXvuUsE416vqsB6kRJfAi
TLSH
T130B1A0A2C7E8876CD92116F0AB193D2ECE5D0A58521C3D7B89D5DF1F63E2471E201A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1737e14-1d44-4e87-80df-94bba3f6e41b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e1737e14-1d44-4e87-80df-94bba3f6e41b.tmp
Size 5KB
SHA256 a31810b259d53b8fbe13aa832f94c22f3f736bdfc57cab4a6efa0123bff87e78
MD5 96d6ad95d4021650ac771a1db3c1d864
SHA1 ffd0e8470968544a1cadd490b712d212eb6b0b88
SHA512 06051b3f851f4a36b8ba2cf91a07385a0981f5dc1bf478fa0166caf68c2ba5e5d993d478bfe76065c4f524d0e9d8c3dccce1914f06b849a2e3f2878b01146583
SSDEEP 96:D+OuSu5uvusHXvuzgzou+1uzuAqsB6RJ1Ju7Jvwyx:DtLSezHXvuzgs316vqsB6RJfAvrx
TLSH
T14CC190A2C7E8875CD92116F0AB193D2ECE5D0A5852183D7BCDD5EF1F63E2471E201A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f873f475-1a1d-4a10-9b97-8976d6e28ee3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f873f475-1a1d-4a10-9b97-8976d6e28ee3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ff8e36ff-2406-4b34-80dd-a05063bd2cb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ff8e36ff-2406-4b34-80dd-a05063bd2cb6.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e7d70efd8e04e3b976da573b6f18f7bd7d9343504e37710439cc2680f75f1108
MD5 32e0195c41a5fc91707f91c852536013
SHA1 698473e4d3349db7c72f4d122503841b2247883a
SHA512 0ced79f37ea33397c8b329ebd601ddb180f3fa64d1e95098c9168b557eea3f21689fc4f2f2d5056146150794e1728e26851dd5eb6768fade88558975b1c872b8
SSDEEP 96:K0m5owKVmK3/yR1/hBx8VssaNxKC4afxeXvkNELOK0og:hr3/yR1/hBeVsRND4afUXvkNXl
TLSH
T1D2911F12367B175079BD292884B58A1B529231B33018E66F7FFC94A14E6BF0C4EFC8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

cf5a0c96-ec6b-4a3f-bbc2-ab75868d1992.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf5a0c96-ec6b-4a3f-bbc2-ab75868d1992.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ff4b8bed-d291-4cbe-b6df-4cbd9f5e1788.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff4b8bed-d291-4cbe-b6df-4cbd9f5e1788.tmp
Size 27KB
SHA256 6d85d617d75874f585128c5c06f62c032f4ef78927d9e7a78daf19aa46294edf
MD5 5c747baaf3e991e64b8d2ed46070a45e
SHA1 348271c9c2fc8212829f820028f06f6c36ebf2ce
SHA512 2ca03c69b673fe3d419857522fad3a980f1556a1a4524309912c353de1845e226230f040ed2facaab913f66f4487e97794bfaa38a8b209fdc7cf5436f088847e
SSDEEP 768:5jKmK9uzYWvcQus8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3K8roW+Kh:VlK9uzYWvcQusu1ja0HL7Q3CW+Kh
TLSH
T15EC20A3F640DCB7E4FC01A9DDC5A6F9B3E9802D796588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f60725df46600d373fbe8b5d95f6839a5c51c426c2d63174cab4b2cf698efb86
MD5 dca433f3b28493dd9fc1b1e4ee5e822a
SHA1 2329bad9c3831861fde5552db4d28177bf79d191
SHA512 b94544f1c95d2c2d2ca88d7e2d979a656976c3f2098a1ba85c445c2091ece832f07af85792848e204d4186ad2a246a589c2a865fdc6aabad19048a3c59db00ed
MD5 SHA1 SHA512

Submit Download

a38631d2-b1b3-4f53-b19f-05a89cfdb9f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a38631d2-b1b3-4f53-b19f-05a89cfdb9f7.tmp
Size 18KB
SHA256 584bb75731703ef901be8615cb909f2c63e21fc8b90411bade651a474920b217
MD5 9e247f61ade847b0e328985e3d64809a
SHA1 dce0ae8dbda90b24747cc25fcf3808a484964f99
SHA512 06fe0c881638fc2d7523c25abf7343e3c261db94a385ed90e202757bdd56a5d99bf2d8e27dc60cbf9dd6cbd9dd66762b7eb47b58b64934b5ff16a0178516d26f
SSDEEP 384:tiZcIhsNR+zsWwNJ1FYFxiihnuOjTVY9di9rscQtgOIwZOyrFRto7A:tQhUq4FuxiihFnS1cQXsmRtgA
TLSH
T10E827E325C786CB75DFBA202F08A32039FB881B7DAC56F94D5ED9B1D01D66A81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e9532feb-18de-4587-b5a2-8cb4258065aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e9532feb-18de-4587-b5a2-8cb4258065aa.tmp
Size 8KB
SHA256 f3b96b53d429a3405f0fcc69f0edd14f17ec7e164a2def7dd66542f0c867d80d
MD5 7cbba41ea2461b8767eed84d433aac47
SHA1 fba0563af681396c292a641abf343a43f2592d63
SHA512 6f2c8a08f62d55a777d3c5494a891573c46411494d6ffd83b5e6e642d1b50c4cc958f6bc88d39435b74e96d1c0ff45c95bbeaef741c329024bdc33ce4d5d1067
SSDEEP 192:SONVL6yhZQmiUy3o3thKOCTVgLi+FdVs9mQNd3UcJqNU6:SONVL6E3UKthKOCTVY9di9rucQU6
TLSH
T111120935A8687C674EA36541F08732079FA482A7EE867F90E5ED5F1C01DB6BC2307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95b3c298-b616-4055-ae5b-30e176710b6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\95b3c298-b616-4055-ae5b-30e176710b6d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f521fcb0-e291-452c-82b2-89fa4a6a78b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f521fcb0-e291-452c-82b2-89fa4a6a78b5.tmp
Size 26KB
SHA256 939c77dbbd5431e819f98e225cdfc63bb5730b41b9501c988efeaf929a5f3ebc
MD5 90db34e477208321ece588dc30aaadcd
SHA1 e5a85f822988e21297e0f2ff8a4ffc756d0bae1e
SHA512 a6887baa5d9a8d71b1648a406c0d969a74f2320d6d9581b024f7f0b89083b94b625af48272b73106da279ec63490dc14bd7d7b3676cbed75deee75e6f3e0a4a2
SSDEEP 768:1VzMFQA/UOwgF4FuGxiihFnS3cQXsmRtgA:ly4oXscP
TLSH
T189C23AF248D79876D9AE5703A37D2D038EBCC0A3B585AA50B3D99A1CCC961BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6f9bf4aa05d5d2f5731451a9f79c462f0a19dbdb946636f44e8df2464f997af2
MD5 2d3e80e471c394f73594a8f747f15c94
SHA1 2fcecf5691279cbdbba671179491aa15375045db
SHA512 5ad2815472f634a5be98b6898855ac7e1a3ba00d0724a3433a81e8f975a4c04d40e4b6e1146628d060a7f3d899b834a964e7d381bcf62a87099438e29437d3ee
TLSH
T1F7410658AAFD1158B3B76F5AABF6686E487EB8772E06C49D00010E4E0663E40CD71B37
MD5 SHA1 SHA512 TLSH

Submit Download