hxxp://gina@lafortunelawfirm[.]com

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
06/10/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://[email protected]
Sample261006-qephrsfa65

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2364	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{0FFA78A7-DBEA-4173-9BA1-B9E8468A16A9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5348	msedge.exe
5348	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4720	2612	msedge.exe	87
PID 2612 wrote to memory of 2364	2612	msedge.exe	88
PID 2612 wrote to memory of 4352	2612	msedge.exe	89
PID 2612 wrote to memory of 4352	2612	msedge.exe	89
PID 2612 wrote to memory of 4352	2612	msedge.exe	89
PID 2612 wrote to memory of 3384	2612	msedge.exe	90
PID 2612 wrote to memory of 3384	2612	msedge.exe	90
PID 2612 wrote to memory of 3688	2612	msedge.exe	91
PID 2612 wrote to memory of 3688	2612	msedge.exe	91
PID 2612 wrote to memory of 3688	2612	msedge.exe	91
PID 2612 wrote to memory of 1964	2612	msedge.exe	92
PID 2612 wrote to memory of 1964	2612	msedge.exe	92
PID 2612 wrote to memory of 1964	2612	msedge.exe	92
PID 2612 wrote to memory of 5028	2612	msedge.exe	94
PID 2612 wrote to memory of 5028	2612	msedge.exe	94
PID 2612 wrote to memory of 5028	2612	msedge.exe	94
PID 2612 wrote to memory of 684	2612	msedge.exe	95
PID 2612 wrote to memory of 684	2612	msedge.exe	95
PID 2612 wrote to memory of 684	2612	msedge.exe	95
PID 2612 wrote to memory of 4156	2612	msedge.exe	98
PID 2612 wrote to memory of 4156	2612	msedge.exe	98
PID 2612 wrote to memory of 4156	2612	msedge.exe	98
PID 2612 wrote to memory of 1412	2612	msedge.exe	100
PID 2612 wrote to memory of 1412	2612	msedge.exe	100
PID 2612 wrote to memory of 1412	2612	msedge.exe	100
PID 2612 wrote to memory of 3772	2612	msedge.exe	101
PID 2612 wrote to memory of 3772	2612	msedge.exe	101
PID 2612 wrote to memory of 3772	2612	msedge.exe	101
PID 2612 wrote to memory of 3788	2612	msedge.exe	102
PID 2612 wrote to memory of 1920	2612	msedge.exe	103
PID 2612 wrote to memory of 3788	2612	msedge.exe	102
PID 2612 wrote to memory of 1920	2612	msedge.exe	103
PID 2612 wrote to memory of 4288	2612	msedge.exe	105
PID 2612 wrote to memory of 5844	2612	msedge.exe	124
PID 2612 wrote to memory of 5852	2612	msedge.exe	125
PID 2612 wrote to memory of 5860	2612	msedge.exe	126
PID 2612 wrote to memory of 3040	2612	msedge.exe	129
PID 2612 wrote to memory of 3040	2612	msedge.exe	129
PID 2612 wrote to memory of 5412	2612	msedge.exe	130
PID 2612 wrote to memory of 5412	2612	msedge.exe	130
PID 2612 wrote to memory of 5412	2612	msedge.exe	130
PID 2612 wrote to memory of 5632	2612	msedge.exe	131
PID 2612 wrote to memory of 5632	2612	msedge.exe	131
PID 2612 wrote to memory of 5632	2612	msedge.exe	131
PID 2612 wrote to memory of 3940	2612	msedge.exe	132
PID 2612 wrote to memory of 3940	2612	msedge.exe	132
PID 2612 wrote to memory of 5156	2612	msedge.exe	135
PID 2612 wrote to memory of 5156	2612	msedge.exe	135
PID 2612 wrote to memory of 5348	2612	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffb5f6ac188,0x7ffb5f6ac194,0x7ffb5f6ac1a0
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4637270315692594162,13543356799640875606,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,17711710808736996188,14876622328910059436,262144 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,15990504381054192992,15136798827777543995,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,3569161079386155454,10904599778599777387,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,16597002636061226181,5459135699620525730,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,13831841642579745528,3999632989940364548,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4240,i,6095577967693986132,15062105176196213081,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:2
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,5146157206610662202,16620450610838409971,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5260,i,1332964873037272763,11554054497901380678,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5436,i,8516675860517920793,17569935627209307476,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,655512385771720524,9462300231291935687,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3670990782939312999,585856684497768146,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,10096200991709473433,4574571438998519919,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,10096200991709473433,4574571438998519919,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:8
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4656,i,1030035452249059091,12238947647281112103,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:8
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,2759496252756032623,11317559168996181354,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,2869594401252216502,7483217398999467782,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:5860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,2400963256687552808,14345363451785569716,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=560,i,11598955167698663971,16801705998682467004,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5512,i,10104708624003268359,11827546698725527582,2097152 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,4834888268866532351,7054997163088279127,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,13263314006847442195,1490527232414970107,524288 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,12929594024220129358,10109281213602659233,262144 --field-trial-handle=2268,i,8044866568001170500,1911941741246442776,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

453c3290-9f6a-459a-891b-78a65666a157.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\453c3290-9f6a-459a-891b-78a65666a157.tmp
Size 8KB
SHA256 e04bde81dc957d76693f177f2d814a28532fed0d964b15abadd83fe2074597cc
MD5 d2ecebc528a5b056c18b488500b4480a
SHA1 f04380f9a200fc114c73a0fabfdf222cd29aa18a
SHA512 5d628bcebc76c4b0d27c5eed6623e40279b67d9e89e2d85288a5bbdbeab0b0da5fb02d2a55529a4571fb1b6f99d9463f736a23e79072a19d040873fa3b8953eb
SSDEEP 192:SONk6ywQmiUyO44bOCTVgKIOO+40YMjbj1Ef3UVqRmUU6:SONk6TlLbOCTVRIOtr5bjqs2mUU6
TLSH
T150121A35B8786CB75DE3A545F08B32039EA44167D98A3B90D5DC1F1C02DF6AC230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e1492a8-2f31-4534-a992-aab96718a8c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7e1492a8-2f31-4534-a992-aab96718a8c4.tmp
Size 26KB
SHA256 96e45526d7ff88a62d93544055ab8e5b0b6254d851672d1b01678826321144fc
MD5 dedd6b0b3f795c0f3dc5fc3abc2f302d
SHA1 482aec33bc6dbf46b01d752fc02c53305961ba27
SHA512 48d7524d485f8c4f393a9771e7f53260be828c9640f3ac4f661173d44f64f1fb8cfec1d595072f3c434c7fcb4a256f32c2b7d3cc4261a07e993c2d0b89ea09ea
SSDEEP 384:GiFiZcIhzsNL8TUNTUlIlz+weTwI1UaZOjTVRIOtr5bjqC2mUVZh6DKhH9oE:tFQRGwg9aTjUnwOTjqC2FfYGH9n
TLSH
T150C218F258E74876E9AE5747E77D2E038EBCC063F4856690B3885A0CCD961BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95264f3e-8feb-4997-bde1-24963240485a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95264f3e-8feb-4997-bde1-24963240485a.tmp
Size 18KB
SHA256 4e580e6f272b211e947e3b02ae5e50eb3a88d4ee2e08bd22184feccb0362a1c5
MD5 b98434af765cc54781ae27c2914e3369
SHA1 5f4b4930de2ae806b0f9cc9fd07f0de6feb0b576
SHA512 5d0d2370370d95c02cba0c7cc72bda6149374d36b17061c595d5c413213244dfe47ed358a88abae1c229753a6864d7e55c9eaa6bb81b9cf093459bb5ee565c56
SSDEEP 384:VZcIhsNpz+weTwI1U/ZOjTVRIOtr5bjq22mUVZh6DKhH9oE:thcaTyUnwOTjq22FfYGH9n
TLSH
T19E828D32A8785CB66DF7B146F44A36078FB49063D68E2B94D1DC6F0D01DB6A82307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9961b626-f291-464b-919f-3b4fc3884e3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9961b626-f291-464b-919f-3b4fc3884e3f.tmp
Size 8KB
SHA256 ab6c46dec178f5948c46790e7a9d3ac3bc97616b623534db5daaae74be79afb4
MD5 22dce0c4fb494a3a0e661b8b31a9eb3d
SHA1 1ae596b60f161d5fc6497b360c6838a3fc427e6c
SHA512 c2c306ab3fdcd7e11203dd26ad2e2f8405f09573af72f90b75720b289a3b8b95774b189f112cde90ab760ff6688d89572c35af0d6b48da836df813caffb7f833
SSDEEP 192:SONJ6ygpQmiUyT4tOCTVgKIOO+40YMzPBDU6:SONJ6lHdtOCTVRIOtrzVU6
TLSH
T12202E734A8683CB78EF3AE46F48B37179FE4106BD9912B84DAE81E1C01D765C2347836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed2488aa-8305-473c-99aa-f3ee8ee0608a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\ed2488aa-8305-473c-99aa-f3ee8ee0608a.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

1661661d-79f2-4111-9727-66d6c4e73c7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1661661d-79f2-4111-9727-66d6c4e73c7e.tmp
Size 10KB
SHA256 23b2b35b8ed91b2da66f4fe08d731b0c4db27e2c6f06ded493281293c706e821
MD5 80efd609141b920ad21b153772dde738
SHA1 ba0e0f2985ec2096f172dc156057742a76d91fd3
SHA512 ff0fb321f2f233e6448eed2e76139773efeebb33ec1b98e8c056a896325c831641737e913931b0643c0846782240c2f481feed8527e58b0058ad2946281dcdfb
SSDEEP 192:sxZsRWne/fTsmeIdp2DHW6+WNbFidYRPC9CIg5hJ:sxZs2e/fTsmPcHb0dmVd
TLSH
T1DF32D9126E34A97B8CCBE20DFA15BF53E6F9503291D51E58AAFC861C05E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c8345bf-4abc-43c8-8072-383217a08c68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c8345bf-4abc-43c8-8072-383217a08c68.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

557c3d3a-30ae-4525-8aa2-9dc249243861.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\557c3d3a-30ae-4525-8aa2-9dc249243861.tmp
Size 10KB
SHA256 2ef15098e48dc82f54beff7d9e8ace33b94becaa804afac1f6a9aa7205ee9208
MD5 bb2c3f9a7ae4bb5b22a91a3c64702a99
SHA1 d76e52bd019203b4d282f475fc10573cf08bd403
SHA512 faf15df11ab47388056c1731d5894b2522dadaeaa8a78717fa2685511f6bd0f707a2c89f1da53541ecf7f6377b7d83fe9aa27e929332e9c512efa0036de99bca
SSDEEP 192:sxZsRWne/fTsmeIdp8DHW6+WNbFidYRPX9CIg5hJ:sxZs2e/fTsmPmHb0dmcd
TLSH
T17622C8126E34A97B9CCBE20DFA197F53E6F9503291D51E58AAFC871C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9649a93a-672b-47b1-b1d7-322197bb2bc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9649a93a-672b-47b1-b1d7-322197bb2bc8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 45c1e032b629a08aa2d2e5f4e5ac9736ca3d986515e7f6a27d53fbb918f01630
MD5 b551b2001f518b0d0af831c49c59b31a
SHA1 6f5a4f38196537e5f221c6d8613ba5a3371f96fc
SHA512 1ff94a09e483b4d04287329c3ab35680dbffc593c0d264cb260b6abcd9569433fe37958161b3b513cf86b96277694e0c75c6dbe7a8bfb785d70a735d32886a35
TLSH
T112E026E509CAC22EA3C8A44B4168530CCB8176DF97C3791E2B08C6C9B84E044F3827E0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 95KB
SHA256 c113f0be56a84a4a13f1e782a2c4b6f952ac7887d182351227e02f35f744352a
MD5 94726ba8ce16e8266f929b204eb2e80b
SHA1 3d927aa85081e9d968715d2c31c60041346562a4
SHA512 7751219d811e2f8f70bc88e2e6540e597d996295a4d0662f5d2899a8b56a545a9fff19b0ce58f701662b84d77b827a853edf3d7e2ba8cac49c515e70cb69bf2e
SSDEEP 1536:diSSXWfZiZVMHdNeULof7KdECGuCfX83YsiWQe6DQAc3Taa7476eJg2JhJCkr6Tg:diSmqsETLkKdE9FXdfRe6Nc3GaE7f7Ui
TLSH
T11BA313D4DD63AC46B7EC98C91906A46C4FDB84F921F75BBE44D0148778AC1620BF7349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 42KB
SHA256 1404ca348bd75ef836f4dd8b6f2cc719458642d1237c368296b2fc652dca47dc
MD5 665db5e157d2138835c4037c971ff3a4
SHA1 41ca6b7e4818eb81531d8006ff7ddd971c640879
SHA512 6c999466673c9873b1b112d6ab95c7cecb99467ea156e3e046b54c5f3d109c3845b05cbb2a0245d178430c7b2ceacd5110f7d8faf7e041100f44852b0c29fe9a
SSDEEP 768:tMTmVhyXCrekkraPAjrWMMWD3UJmw0FRwoglekm+hQ7//geceSF/mEQBPMAmDu5:cmHkCrHvPAjrWMMI3UJswogl4j7/hSlW
TLSH
T1F9130231EB70EE59962C903454E7FDA9433B1457D731ACA80E99A1CE6F8103454FACEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 245KB
SHA256 4925a332f86773a62d440fb86b71cb95e9b4d0baad1c74c67bd4d4476e03286c
MD5 8df5c34469d69fdfe134295d8ed94b39
SHA1 1d34dc10d5ae222ebf89f44fe2a9774c24012f6c
SHA512 4b6e174172e24c0a8ff4e97cb2242288cf784c118a89d572e33f1db42b68da050224622c0c8da5f6744d1b3a572b8d897ca0d72aaf22a2c3c909b34689c11527
SSDEEP 6144:VvhXfo5VYWwx8cRNI4exPzgy0QOc8Z92KpWVxbbk1TzFJniGYG5rjM9+DALt:VHVqlP0QOHpWVtkJzJYarj1DAB
TLSH
T1D93422D533D2E7BFE86AE565BD7D01806F60D6E8390E4C9FDDC5C124A7122B02D5A704
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 83KB
SHA256 c4fa38acaebc0b66c762ed5b15c153b8e5721e0f56c017d808d45b10cec62d09
MD5 29272b29a8aa0244f3375e073bf69a14
SHA1 34e591e3b2d2b1341f9a612b22ec43097bcff004
SHA512 8c72b7202347388846c445ba3f12e24926fe3fda8950484720c4d31df2d29f4572bee984b6f6f0c4e32bdb04b7ea91de2de538c352e673e28e42894ee91ef0b5
SSDEEP 1536:27pZE6DNFjgjMqbfjrYiQQre9ay2FQkYrsmy5IGFLsZht60cvEsIj0DfPf:41bkjMerr+QrNFArvaOhtAvXM0bf
TLSH
T1F7831220C329F4717BD8AD8EB75CCFD696FE22C5044A89151196F972FB06B0CC798E61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 dfe4fb8492344be3cc60fe6113e0428bcc0dda755c84cc048327eb0cee83e105
MD5 5a778452f77b4d4b522060433c528420
SHA1 2a3576547f2748754d2968bb58e4300291db8b45
SHA512 ddd0369c6ff2a392d9dd658b2964cdaa5014b4b736f6da7aff79a065f4d2ed9d83637dbe10a6cdae4f766d5d17e4adb1eb5423121287f0bb3b24e30afcf3e657
SSDEEP 96:1d+4OCeCe6TA7O8ydzjeb28sQnYMAMf/tkwq:1dQ9Ce6Tz8yZ6bvQSte
TLSH
T1B691A54602A0C1AFD755A3B049E30273B53878B805832FF2DB99EB397F36B2A950C064
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0afe8e62f9de2d8e4bfd79ad2f57f92b7cd7251f7399ff6130f3a3ea61ebe101
MD5 a3e1a00b73c5b50c81dfedb1f4619e8f
SHA1 22d47b82b68a060b942ca8714d87e169fdb9c02e
SHA512 69d2f89c26ffb1d938910861fac050272352329a1ca7fda7d76e2ea9d677603e40a82331008caf2f9a82bfc6575e5b71d9187f8873670c2156b079d37bad632a
SSDEEP 96:BImDEMCeCewUA/DHAO8ydzxU3D5l8sQVYMUzbM4hRXwx:BImp9CewUADHb8yZi3D5aCJts
TLSH
T12FA1EE4516A2C06FCB55677008D34523F534BAB90543EFF2CA88DABABF22B5BA44C264
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0d0d0d18572bdbb1989ae6463b0581d166a68acaf0c113477929da63029ec2a2
MD5 413f6fd3b20fe47a8b45fe9a32ac40ed
SHA1 3d65889b8c844fc2513af411e9f567d45e33a51a
SHA512 82ca75d2fe663789390938c9a44aba2c0b4c0f1a766deeade5f95fb0f8588ef7a43d56ada0553e318eb3b7f69f240ab2dc7d3232a2a9ab4fc9bd2a066c7fd1b9
TLSH
T15361858A1740C0AFDBA863B051E70177FA3575B804836FF2A998EB7A5726F1BD04C074
MD5 SHA1 SHA512 TLSH

Submit Download

d1e46954-e2b1-4dce-9a35-de51aabf329e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d1e46954-e2b1-4dce-9a35-de51aabf329e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

581de4cd-05d4-4e20-8145-9c90834aa012.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\581de4cd-05d4-4e20-8145-9c90834aa012.tmp
Size 5KB
SHA256 354e49fb313ebf252dc775d7614c88cf33f7a408983302d11e16b22cce1030d3
MD5 679c29ee2a9fb27f59f23fba28061216
SHA1 7879661f996a8dc953e037ccbdfdd5848e8ec259
SHA512 d7c3e50b71b462268c30b1c4759dee2d0ccda1504ba7ca985fa0cfe78d60f3198b555cb2797faa30d5d570243444e238b4de26c2936a44d0a03bd39e9d10ed69
SSDEEP 96:DdOgvV8oPzB4i/UiLM1cpYMGhw7Hm58psLK44882:DwgvV8oP14i/VLOcpYMGhOHm54sLD48x
TLSH
T17CB1B9F383ED8B2C996195F05A192E2ADF190896035C3D6AC1FADE1EA7F1430D141B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7cc24299-9d5d-47e2-a309-9c41a4d9a6b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7cc24299-9d5d-47e2-a309-9c41a4d9a6b4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a9c589d1-9d91-47ec-a620-d187adac5226.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a9c589d1-9d91-47ec-a620-d187adac5226.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 674582479e6198642c8e07b365f57be50c2003412f6d801aea88832795fca91c
MD5 57061e5c8444e5d6a844c3ffb1d055f2
SHA1 2cac516658c3a17ffa36b79eef1d134107079a70
SHA512 ea5ef7b85fc231051d07d39b311bfbd8a2820c7479dce81c4e8b3a4a299a98321807983c63577d8ccaabea484be8202fa58b0437115f3b9ca73d0843408f96fb
SSDEEP 48:K0mImXaDX5ZpCbBsxISnCK9n1NCxHSYE1XryLI5IIIVIpIzI3ILIkbI3ISIPISIM:K0mJIwKROuevqKg0/4gKJCl
TLSH
T12B913E00707B520038BE395981B4875F528231F3742AE56B7FBC54E29E2AF084EFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a8b592b4-d32f-4166-8c5a-6660323559fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8b592b4-d32f-4166-8c5a-6660323559fc.tmp
Size 10KB
SHA256 f05713041c79f0984f85ca95cadc5ca531abfc3699e33294e9a9ebb5fc4b2b7f
MD5 5996c9da85616c0f67cda8d19babe7ac
SHA1 348512a47147c7a22af5d03e42eadb5fab769b7a
SHA512 5644438529f71f09150c8dec0eb26ff5893148fc6920236be1f9c2498ddda2af0b8cf26e37570ad921b11e64f5327b775cd028ebb2042483cee8479a4f43c7f7
SSDEEP 192:sxZsRWWe/fTsm5Idp8QHW6+WNba5ZYRPM9CIg5hJ:sxZsTe/fTsmSdHbEZmnd
TLSH
T1AA22B8526E28A97B8CCBE209FA257F53E6F9503291D51E5CAAFC861C05E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d6ee1a07-30cc-4f39-9f0c-fa403e3c06f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d6ee1a07-30cc-4f39-9f0c-fa403e3c06f9.tmp
Size 27KB
SHA256 b83d2cf52e2c7f8cf58492c1851ddb638730ee8e92b78d53ba9f8aab0d8462a9
MD5 8065c00af401742af4d5c5a3d42c47e4
SHA1 7025e98fda1f7395cf33befb9cc14379420b22c3
SHA512 8cab4ffe703e7ca9f48ada2ad33d0a3de686986a19487f3f540681c7f326d15ad3dcd3ec4d4fe5e4ccf341e76824339633cac640132dd0cfdb5a00cb81198544
SSDEEP 768:XzK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3AroR+5n:XzK9uzYWvcQWsu1ja0HL7Q3LR+5n
TLSH
T144C2093F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec8613bc-8758-4aea-9ee1-581a06d218d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec8613bc-8758-4aea-9ee1-581a06d218d4.tmp
Size 10KB
SHA256 d9a5d5871009c402684783ba6d6d294b8c06bcdeb6f28c2a3741dc42792720db
MD5 64f51b56b1fe3aad0303d8bacfb03ec9
SHA1 c13538100086ce2b377b0944e22b3497b4fc9b5e
SHA512 403ba4665bdf5561b569fa48b438a30ae5c608850e5562133786884cd782dbc0d6d3f1fd3ac36de577f3af8eb8ace5cdabf466fdc56f5cf12567b5dbf40e4e1b
SSDEEP 192:sxZsRWWe/fTsP5Idp8QHW6+WNbedXYRP19CIg5TJ:sxZsTe/fTsPSdHbkXmyb
TLSH
T1E122C9126E34A97B8CCBE209FA25BF53E6F9503291D51E5CAAFC861C05E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6e717a6-c95a-40ae-9be6-b012c2f8ec27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6e717a6-c95a-40ae-9be6-b012c2f8ec27.tmp
Size 10KB
SHA256 0444e650961caa50fac61eef666af0eba8bcd0fdf6b6d6b3d04459e6883cb1c8
MD5 fc7806d562ed86ebaf36bf6445480099
SHA1 de977d108307f13d1f7f1f7a0fb33761ab30384b
SHA512 aec14c84f9eebc3651f75c688ff43d7510657074f0110f6f726434f6ff347c2e61f98ab9f0534fb0528363adc6342e1eb6dfd3aad4765ec65a8f86dd635e0465
SSDEEP 192:sxZsRWWe/fTsr5Idp8QHW6+WNbmD/YRPZ9CIgrJ:sxZsTe/fTsrSdHbs/mO9
TLSH
T16222B9526E34A97B8CC7E209FA25BF53D6F9503291D51E5CAAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0cb63912-f98f-4402-8f63-cb9b46f24b53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0cb63912-f98f-4402-8f63-cb9b46f24b53.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce57d2e0-bd87-4552-b1a3-84a65e7bc417.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce57d2e0-bd87-4552-b1a3-84a65e7bc417.tmp
Size 18KB
SHA256 d895f5fb4d97965199ed2b5df4c98b141b24c582b25bda3c5f7fbbd557869271
MD5 3bc2304eef266f628b30c0dfbdfd2901
SHA1 8fc65bbf662294c62e3e5d038998ef2297aee78b
SHA512 ca6abcda3c3973b24cb7fde04004a1524beb701a4a6910dd3b86c6f09c999c64882ae2c2b85ec2992a235c2dff6d504971e63069bcbd65a8bccb49d14d0a85a0
SSDEEP 384:2ZcIhsNpm+weTwI1U/ZOjTVRIOtr5bjq22mUVZh6DKhH9oE:khLaTyUnwOTjq22FfYGH9n
TLSH
T14D828D32A8785CB66DF7B146F44B36078FB49063D6892B94D1DC6F1D01DB6A82307D2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

517661a3-c9af-40b6-8269-2eb2eb29e87b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\517661a3-c9af-40b6-8269-2eb2eb29e87b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fdbc90d52fe706d17a9c1143291e856b01a36907800ec5302a57c8b2db5f9e31
MD5 c6247a8a493310f65b1274ff2427270d
SHA1 691f9032c8543564335258665947878631acf2e6
SHA512 c7397b530dde108a4e59ad84809f22319e2e5c66b6d2b14e885f341dcac4606f9c3105a8f342a05e2a16e66e3fee484f06c71b719302730d47546c9f98f2d56c
TLSH
T1E2410958BAEA1108B3B77E565BF6686D847E7A772F07949D00120E8F0A37B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download