hxxps://omaga3llc[.]com/est/

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/10/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://omaga3llc.com/est/
Sample261007-s9lrgacw2n

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 6 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
141	api.ipify.org
142	api.ipify.org
144	api.ipify.org
146	ipapi.co
147	ipapi.co
148	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4712	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1696934516-3600988056-1840298893-1000\{76E3E191-4AEC-4F0E-86A1-8338E470459A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
956	msedge.exe
956	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 4220	4252	msedge.exe	88
PID 4252 wrote to memory of 4712	4252	msedge.exe	89
PID 4252 wrote to memory of 1348	4252	msedge.exe	90
PID 4252 wrote to memory of 1348	4252	msedge.exe	90
PID 4252 wrote to memory of 1348	4252	msedge.exe	90
PID 4252 wrote to memory of 4960	4252	msedge.exe	92
PID 4252 wrote to memory of 4960	4252	msedge.exe	92
PID 4252 wrote to memory of 5112	4252	msedge.exe	93
PID 4252 wrote to memory of 4336	4252	msedge.exe	94
PID 4252 wrote to memory of 5112	4252	msedge.exe	93
PID 4252 wrote to memory of 5112	4252	msedge.exe	93
PID 4252 wrote to memory of 4336	4252	msedge.exe	94
PID 4252 wrote to memory of 4336	4252	msedge.exe	94
PID 4252 wrote to memory of 4528	4252	msedge.exe	95
PID 4252 wrote to memory of 4528	4252	msedge.exe	95
PID 4252 wrote to memory of 4528	4252	msedge.exe	95
PID 4252 wrote to memory of 1644	4252	msedge.exe	96
PID 4252 wrote to memory of 1644	4252	msedge.exe	96
PID 4252 wrote to memory of 1644	4252	msedge.exe	96
PID 4252 wrote to memory of 4648	4252	msedge.exe	100
PID 4252 wrote to memory of 4648	4252	msedge.exe	100
PID 4252 wrote to memory of 4648	4252	msedge.exe	100
PID 4252 wrote to memory of 4784	4252	msedge.exe	101
PID 4252 wrote to memory of 4784	4252	msedge.exe	101
PID 4252 wrote to memory of 4784	4252	msedge.exe	101
PID 4252 wrote to memory of 1940	4252	msedge.exe	102
PID 4252 wrote to memory of 852	4252	msedge.exe	103
PID 4252 wrote to memory of 1940	4252	msedge.exe	102
PID 4252 wrote to memory of 852	4252	msedge.exe	103
PID 4252 wrote to memory of 2808	4252	msedge.exe	105
PID 4252 wrote to memory of 4136	4252	msedge.exe	115
PID 4252 wrote to memory of 4136	4252	msedge.exe	115
PID 4252 wrote to memory of 4136	4252	msedge.exe	115
PID 4252 wrote to memory of 4964	4252	msedge.exe	116
PID 4252 wrote to memory of 4964	4252	msedge.exe	116
PID 4252 wrote to memory of 4964	4252	msedge.exe	116
PID 4252 wrote to memory of 3472	4252	msedge.exe	117
PID 4252 wrote to memory of 3472	4252	msedge.exe	117
PID 4252 wrote to memory of 3472	4252	msedge.exe	117
PID 4252 wrote to memory of 2044	4252	msedge.exe	119
PID 4252 wrote to memory of 2044	4252	msedge.exe	119
PID 4252 wrote to memory of 2044	4252	msedge.exe	119
PID 4252 wrote to memory of 4388	4252	msedge.exe	120
PID 4252 wrote to memory of 4172	4252	msedge.exe	121
PID 4252 wrote to memory of 620	4252	msedge.exe	122
PID 4252 wrote to memory of 1504	4252	msedge.exe	124
PID 4252 wrote to memory of 1504	4252	msedge.exe	124
PID 4252 wrote to memory of 1244	4252	msedge.exe	132
PID 4252 wrote to memory of 1244	4252	msedge.exe	132
PID 4252 wrote to memory of 1244	4252	msedge.exe	132
PID 4252 wrote to memory of 3340	4252	msedge.exe	133
PID 4252 wrote to memory of 3340	4252	msedge.exe	133
PID 4252 wrote to memory of 2776	4252	msedge.exe	136
PID 4252 wrote to memory of 2776	4252	msedge.exe	136
PID 4252 wrote to memory of 2776	4252	msedge.exe	136
PID 4252 wrote to memory of 4384	4252	msedge.exe	137
PID 4252 wrote to memory of 4384	4252	msedge.exe	137
PID 4252 wrote to memory of 4384	4252	msedge.exe	137
PID 4252 wrote to memory of 956	4252	msedge.exe	139
PID 4252 wrote to memory of 1276	4252	msedge.exe	140
PID 4252 wrote to memory of 1276	4252	msedge.exe	140
PID 4252 wrote to memory of 1276	4252	msedge.exe	140
PID 4252 wrote to memory of 2240	4252	msedge.exe	141
PID 4252 wrote to memory of 2240	4252	msedge.exe	141

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://omaga3llc.com/est/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe280dc188,0x7ffe280dc194,0x7ffe280dc1a0
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,9107058455068513685,11302567173040283985,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,12442573000253786418,1628400951933020806,262144 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9328970562366760974,11979128934317680164,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,13851948397139836280,17374721013816286639,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,150496026679521320,2746751085168801630,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,15492989934674119453,9076567602839121642,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,6958000001837620192,1611310969872584197,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,17944002283574006086,7917488415135315989,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3416,i,10667140885893271504,1869182155645576364,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,10935365582054134983,5523912881850637092,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,1212331569870679382,1919027108691618266,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7012262883544124540,10647007680706114438,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,7012262883544124540,10647007680706114438,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5148,i,16025093237805028922,11207168146371518288,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3596,i,10855629270106849167,7857145545440969407,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5080,i,14753678482903377706,14220798377534172418,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5208,i,5814594826499939940,3948473185521220240,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,3448282478272123508,3211000820160072257,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,10502516597568228200,10069136544972591367,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,1246841505728024371,14298279128720416867,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3016,i,4994778476312636798,406371695612344472,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5608,i,12560699332163683821,10944819338508162970,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,12460206807077282646,7589652462468586416,524288 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3528,i,4679487114642875318,215138403283583188,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6276,i,16802193544134488700,11253650589113594244,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7172,i,3330998857041558734,11975658616200678007,262144 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5424,i,9899229237153197559,5378618543483531602,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6780,i,9729119100511615761,5101478233911740833,2097152 --field-trial-handle=2192,i,6814616853073524552,17663332244087802947,262144 --variations-seed-version --mojo-platform-channel-handle=7200 /prefetch:1
  2⤵
  PID:2240

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a9a72f7-c51d-40f8-8f9f-8c809f654705.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a9a72f7-c51d-40f8-8f9f-8c809f654705.tmp
Size 8KB
SHA256 776daf523e4ca0f74995cfea47ebe1baaea52e36f62bc11b0d5fa3c343ceee9b
MD5 230d23827e073d9176e61be8d7c4f686
SHA1 9a914f2a0b0f2bcfadb5b9db4cd7fe5ddd4a6b07
SHA512 fc3e9f5cbd46402ae9d6e06a18bb36d291091e8bfe3604584e6d881af746fc9ac64e4b6064ab01959ee19f3d39d41be4dc0319be3bb17ac7074dc49e2ad6c95d
SSDEEP 192:LON86AmwpQQmiUy29sCpsiX5FbyhjkzEe+frlRBPq2U6:LON86ipQd95psiX5F+JOYTU6
TLSH
T154120A36E878AC7F5D93E564B04735135E684167DBC86F94C9EC2B2C06EB59C530A823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1904a08a-7221-4384-a24d-747b13d39ebb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1904a08a-7221-4384-a24d-747b13d39ebb.tmp
Size 26KB
SHA256 012fca4c20025209821b5e8143714ec4f62b3b6df5f7b34f6662b0def3b1fd3c
MD5 b1a11a455bab50574c89a40f9f33396a
SHA1 e087c04eb9da83c52886efeca05ed7ae24f01b04
SHA512 728d3a852bf42c8edefeb3f619aa2993cf9219330f5d5ef4ff3895f1519f597643939199b387f9c41d58c69b00aa51e4576a6bd3a5caef5838743c2f7996b5e8
SSDEEP 384:KiFiZcITYsN78TUNTUlIlCDf40puWVE9Gr9iX5F+JOsTPJAxJ+DzoY:BFQ0OwgsBoGJaiJhTPkJ+fn
TLSH
T12BC23BF248E7987AD9AE8713B73E2D038E7CC067B6845A54B7D85A1CCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c5cdd21-f6bf-4bb1-ba84-bd8eb5e74646.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3c5cdd21-f6bf-4bb1-ba84-bd8eb5e74646.tmp
Size 8KB
SHA256 4c8347a82713205839f2978874cafb9be4ec7054bbe945ba19549a6a3c2d09fb
MD5 da5cb82a3eab8f3abc44f8595c263a20
SHA1 c6696d4694104b6313bed5f692856884dba24152
SHA512 6304350acc54d449f5696ea328def2de559ce7ba7548dd68490d51602aa12d7fd9e8aa6dfe8b2bdb22651d11206d25d43233b2bceaac147d718d008b00997876
SSDEEP 192:LON96AmwprQmiUyWC6siX5FbyhjkQJiBXurU6:LON96ipd46siX5F+Jw2U6
TLSH
T11202D935EC786CBB8EF39E19B58676136FA9116BDA946F44CAE81B2C01D764C1306833
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5421c8b0bf6e5f37422a05b412b233cde63f1db63aa71d65c91c5b31275595c0
MD5 07f616e3db8597d59ea940f94c1abb0b
SHA1 eedf28342bbff8c4cae798c2980ea6953992f1b2
SHA512 30782b7b7d8c6db47a40bc15f968f35fca7939aaa4b83a8a19c8f5a415c745b54c161abc0037d24bad8ebf15d5deb4134f24e357c1b5869f1598fa22619302be
TLSH
T163D0243C7F114D50D40041710530D50435D3CC1740D015050C354C074C101C11305CD0
MD5 SHA1 SHA512 TLSH

Submit Download

1f08cc18-a7db-4f6b-a991-da192fe25849.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f08cc18-a7db-4f6b-a991-da192fe25849.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

22a60993-57c9-4aac-873b-1b862a5b6982.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\22a60993-57c9-4aac-873b-1b862a5b6982.tmp
Size 10KB
SHA256 2e742a70e67233ff20445468b28b93ec3fd948b0106a026520122a7cdb47041e
MD5 2033ca381e6121e4088113e995ce5c09
SHA1 fa0bcfb757ab9bb13335e9a41d368624d1665d19
SHA512 82447969b2315ed3cf893d46da13a4d13cd126c817fb8bb85c85310093755d70ec0f44b2772992f1f5ca6786c01aaab28d8a3e8b68d75c48c7bdd4d7ac57dde4
SSDEEP 192:sxZnR+Wb/feXsNA/IdphT3HW6+WNepmXY32Z7Ig5UJ:sxZnzb/fIsSw1HbBXz+
TLSH
T17F22A7526E38A97B8DCAD21DBA15BF13E6F95032A1D11E98B6FC851C05E76CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

473f362a-c684-4277-a98b-5072cd03b2bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\473f362a-c684-4277-a98b-5072cd03b2bf.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54210974-1145-4fcc-b2e5-5dd7c8294135.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54210974-1145-4fcc-b2e5-5dd7c8294135.tmp
Size 12KB
SHA256 03147190b12286dbfd5011e737de3ef36271ca8bfe3c7ba69dd92187a414a90d
MD5 e5c575c6bbb88b78d66d692b18850a94
SHA1 8a2e6c0b4bfb2555aac5c775f096f2c7f2e03b61
SHA512 bbdcfa4689694d328ae3ec2b485302cab5037a6939fa0a2c54ee3aa3bc053571ef1febe7351c6ad50563cbbb04462b0a1e1b0d70c7701b66f133265376cf385e
SSDEEP 192:sxZ9RVWb/feXsgAfIdpz0TAkHW6+WNt/aweRR1RPdY3/Z7Ig5E2MJ:sxZ92b/fIsLQmHbLiXdCXw
TLSH
T16042A7526934A9BB9DDAD21DBA14BF13E2FD503291D11E88EAFC891C05E67DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5afaa2cc-2e2a-474e-b03d-2e5c4a6ce3df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5afaa2cc-2e2a-474e-b03d-2e5c4a6ce3df.tmp
Size 11KB
SHA256 627a21683fae8843a3bec39de9476ac719c899531518b2cd15a3041717dc06db
MD5 741a3ea8b5a2fbf3bd1e77768bcaeb5f
SHA1 59d4e87ed5c90efe9e638018eff0e30fc5b1a3f4
SHA512 b038276cffa5523eb70d0a3db2958c32a9c6e4398d984a4a21308217572a678902a7073d5de64dabd0b21c251bff45562a8741f7ca0d7ed8ca37eb85a453f6e3
SSDEEP 192:sxZuRVWb/feXsgAtIdpz0WZHW6+WNhDJGHY3HZ7Ig5ENJ:sxZu2b/fIsLOBHbqH2E
TLSH
T1E132A6526A38A97B9DCAD21DFA15BF13E6F9503251D11E88AAFC891C05E76CE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a9113e8-75a8-4ea6-bf95-7614cf896868.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a9113e8-75a8-4ea6-bf95-7614cf896868.tmp
Size 11KB
SHA256 ea5be7afdc03dd9b684e683e6649fb156e87751542d94ff723dec620f4bb213f
MD5 5118f55a6e20626cc44ce868348c4624
SHA1 59e505f22a9c28e89817c6dc989442c542759724
SHA512 6d572137c8345dd34bdba205fed69226cc381c8537cc1db16b89eda54d1f2199d03c2ffe6d8979a9da885fcd0377901011145cf5d8d61f4d282dba75900591f2
SSDEEP 192:sxZ5RVWb/feXsgAsIdpz0oNZHW6+WNxLGCWA1JGHY3AZ7Ig5ENJ:sxZ52b/fIsL1THbjWH7E
TLSH
T17342B85269389DBB9DC7D21DFA15BB13E2F9503291D11E88AAFC891C05E67CE230784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9597c3ac-0c2d-443c-a839-c248a68e0164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9597c3ac-0c2d-443c-a839-c248a68e0164.tmp
Size 27KB
SHA256 f199af91e03158c5a8ddef13bb5f9fda182a53a83ad81600fadbe29bf4e1fbd2
MD5 9b6f4833a23a005c347cb077d9f409ad
SHA1 9e1dda660616575600c323acd588828373635ea7
SHA512 ba125f4c50b0d4bd4e7092b29e4df2c17ca1c147fa8c09868d9e8cff663257288425aa365a8dd5cc1cb83e6a2f70ebf59e1b3d8b8ba04c0b606c4c7fa1ac589f
SSDEEP 768:Rb30AbSWvS2998F1+UoAYDCx9Tuqh0VfUC9xbog/OVGmLlLJ722rolZM6:Rb30AbSWvS299u1jaLmLZ12Nl
TLSH
T117C2EA3B640CCA7E4FC01A9DDC6AAF9B2F9C02C796648D4447FA984C02C77EA51274DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

967839a6-1b1f-4458-b716-c8f9ab65990b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\967839a6-1b1f-4458-b716-c8f9ab65990b.tmp
Size 10KB
SHA256 28eb3634852b802a2211bdfd25b5225464184c4e7b7c39d0a1001513195890d6
MD5 1c9045e41df6622ac55fda8ebea116c8
SHA1 1f7b5ca232aaa61cc78fa863701f98b5bf39f138
SHA512 eafe6d7ec1d9fbfebec7977039c97ed2bfd7c6ae925df3ffb3a4cc4a0b73013f95054b87e4acb41c664edabc110a7e040e36fa0d4fd3736b0401817bd1041301
SSDEEP 192:sxZnR+Wb/feXsgAcIdphbZHW6+WNeondY3LZ7Ig52J:sxZnzb/fIsLFPHb1dms
TLSH
T1BF22A8526D38A97B9DCBD21DBA157F13E6F9403291D11E98A6FC8A1C05E76CD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fb4d8432df5b3cba21559fd9957651e7d4777fa34c3f16d7c0ee35c003e52532
MD5 efd9441fd3f6bc935542aa150d88a857
SHA1 9dd6735d0e20dd4ebc611b08fd764a8ff5bcf4c5
SHA512 672e39c1fdd6a1dd590bebd5fba8209b43e952924f3948a8ad56fb4b75bb8b4fc30caad53dc6fdc51e96bb68326125c558b28ab6920222290a0813994aa245a8
TLSH
T193E026E489CAD26FB20874C7127EEB0CD3F1371A92C47ACE2700CD84764B544B3CA6A0
MD5 SHA1 SHA512 TLSH

Submit Download

f_00005c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005c
Size 24KB
SHA256 3b1e3099b1ee60b9b0976b7d9b99eb83f01978ebb3178c233eef3ef9b559daf4
MD5 71400443e47d877886ad361f204980d1
SHA1 5fd00804272e932cab4230df99ea23c91a2b23f5
SHA512 c0e5a9ebf4ff0b37316c5d84736699e748923e75f477d02adde20db4f82a8c995581adc18b018e1dd45bde36d415a1a10bfc8fb12638760325bc00f2d8ca3176
SSDEEP 768:irF+RLHFrI7+Z/Gi2csofu3ora0BE5RKv69OcX:AFIHFKWGi2csoffgs1S
TLSH
T1FBB2E17C95DC50E22188A5AF2D9BD741A76FE290B3D6313B14301BC8C1A2EB5D63CBD5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005d
Size 53KB
SHA256 9e33da2892e8e4ef57a249e9ab37d92c2e096ce164a304ad9542f4595712535a
MD5 16ce0b14dc3ebafbbe7357eddc38c6c9
SHA1 b4560d1f45245e20d3146c0a847649e015578cd2
SHA512 bee43001a65288698398dfb211c61553deba8dbd9f9fea01f8736e53def97e17f5e8a59b9bdb4a49833a026756a0e825c046a2eac12e657f39ebad3cc103fa37
SSDEEP 768:dsj6Vbztt/BygIUOOprkCige+mcVQrKwbhSO43szrQGcBgexThYgPYITYCdUbCTi:du6njy3UOOWNgeGVz5QOlx/PwOjNg
TLSH
T1AE3302E28DA08F0E8701925BE399BDE75B4C139BC0D614F5A504A4AFE3ED162F4D2562
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 1.1MB
SHA256 8575e9b4d5ad6ce1fb333d23f401cc710c9dd54ff50b0ffa42b55bb774c39722
MD5 2af7fd12f1937bf6cadfe89a77ee84b2
SHA1 f87c3e6cf748e075fcaa3506406effbd14abdec5
SHA512 aec75a63ef916d6832443d6ff6383c733e5832f743c8c9d1dcf53d0b0ce9dc9d9a26e564ad04e2605b5a51da3ccc961645fa1412c095ad87b0ee2e35be1f3bad
SSDEEP 24576:LxwZcPKIihTZq0QMhEP5x6opxRitlg99CPlq+3QVjt/7ypiZKP1:Lxvgq0dGeoxiHHq+3QFt/Wl1
TLSH
T1CA35338C3ED345A78EFDA87A498879929A757135C9BF60F08380D45CD1881EFD8385DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a3388e63394e465a88bebc92aae0d3096f6967db7939e6eb2ce7a4420be6e8a0
MD5 e6e417106bb6cdb971a4d30e978f18f9
SHA1 a81adb1483ee9ad61a5f1d9ff576ea8a91a948b0
SHA512 bd89087fa5f4a8fc1dabfde5c4ad8150c6dde4f496fc3b974973b5e01d7dcb4b697b72ee372dc76a002b7ce5c5900eb968184edf6b46d714e29d7de6eb2941a3
TLSH
T17F71B567F1D0801AFBD83DB88BE12593707CD9C1DB83EF910519D43DB86AB90AA750D4
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 455b761cc6cbceb8b16f286768bc4e6e3358488f749ffb25d422b110705b31d8
MD5 4848243ad529472421c6ba551f37ef57
SHA1 e3e5f822d92eff0a88a6f28f66d38b0b4c05506e
SHA512 9b7596537108cec21cfbbd665c3172769c91c0d61fd9e79821d3db579fa2ee58411abee8bcc7c7d7ffd7727da3d9376293e38f63564b5b6186f5cddb0c9ca7e0
TLSH
T16971C763F1D08019FBD83EB88BE12583307CC5C2DB83EF810419D43DB86AB94AA340D4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 70fa0c382a6b760f0a3afc2de5d0d868cc193c786522394a529bcf803d7cc6ba
MD5 6c0c7db9737b8e66fd8f56a1642d6509
SHA1 625b90036e5ca6386f36b1a591e4ded758fafb41
SHA512 314243a875e254484ab5ae41ddb92f9ee62d761ccc7697d8096aeb63c2069a53a3bcfcb038170e079f478794316325ebcb25082fbfffb167fb8614dad052a675
TLSH
T19871B763F5D08019FBD839B88BF12583307CD9C2DB83EF820519D43EB86AB946A350D4
MD5 SHA1 SHA512 TLSH

Submit Download

794aafd3-3f3f-43f1-9e61-fc1f870a99bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\794aafd3-3f3f-43f1-9e61-fc1f870a99bc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c71dcc45-0a6c-4938-ab87-4e874991b5a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c71dcc45-0a6c-4938-ab87-4e874991b5a7.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

cf1b4fea-cb28-4532-8815-73a4ed52f95e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\cf1b4fea-cb28-4532-8815-73a4ed52f95e.tmp
Size 4KB
SHA256 3b6de27e71d49adbb9b88e60a46c9d89765e24ba49d7ddf492d75c3305c2ca72
MD5 c3620567204ccc7ea0e7349db37c5c28
SHA1 bfb7e2a2abca7365af48ac5ff1c775fae2f219c3
SHA512 d35066902f729e19fb0dc3316afeae320ba3cb56438ea3923ab6421fab8e172f2d907080ee83cc86cd6d153241048915dec50d1230d4f1a53d87ad145e3fa321
SSDEEP 96:DeOJ0Ao+uaVVzw0nmj1/H2BwBjlzplmLFuM:DNJ0Ao+fV80nO1/HOkjVpALFx
TLSH
T1B09127B783E9CA5E881256F06A14AE1BCE1D0A19821C3D7E8DD5FF4BD3E3471E14264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d74b0907-8f7c-4883-a36f-3b8012aa083a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d74b0907-8f7c-4883-a36f-3b8012aa083a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 be19d9ce3e7e78b3f56e1354cddc88bf43eaf95a956e330d2dd710834ab93d88
MD5 fbed0278ea97efc44ea962f02896126e
SHA1 bc0ca65be6414557752266c3ca9cad6a73a12bc9
SHA512 df80c5d24a83c383a5aa34489138c81624c0c01edd416644974a16772df8044726da0d4e34b66d1b295e70e03f7777f8fb73ce7490705d0fb124e8dfdefed94a
SSDEEP 96:Kh4rk4iqqOI6FViYOK67i+OmAYdOIPPZY/DRT/zIveCiLzK6qitzmJhW3OnaK4kC:AdXixT
TLSH
T14F916F45717B02113CBD2A4C41B59A6A026235F33109F76F7BAD45A65E2FE044EFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a185bae2-f7a9-4893-b14e-aa244c4f134e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a185bae2-f7a9-4893-b14e-aa244c4f134e.tmp
Size 9KB
SHA256 5c7a0c3d866e0779846a2e352fe5c9e57ef6cd6952274ed08e9ef5b400558f08
MD5 e647304cb5e0431d4fb49b06ca0e9f76
SHA1 79441815a0263dd93ef97cdbbb7c6a64a3a724e6
SHA512 912f0f574eacdfcabea392570e37e23f6313304d58bc05a6d3e4a374ce7f97ebf31e7cc8ce6bb2d2e895b21b4373e863d252ff78b06baf8a3cd9ba4f9195e6e0
SSDEEP 192:sxZnR+Wb/feXsaA/IdpJaHW6+WNeJN/Y3WZ7IgrJ:sxZnzb/fIsJwAHbO/z9
TLSH
T1EC2297526E38A97B8CCBD21DBA157F53E6F9403295D51E88A6FC861C05E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c75bdf0a-3efa-4263-a35c-4fea804d28d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c75bdf0a-3efa-4263-a35c-4fea804d28d3.tmp
Size 12KB
SHA256 3a5cec73c1f4729717bdc8695fb50a139d3451e20d4e68118715134c9efc3ce1
MD5 7cf93e7093b2c0d0f44b79e964c9411e
SHA1 b1321df1c88bfb1f0d109c24f3212b3932de57ad
SHA512 14b4f2e0b250dc6ab0f4129f07c17d2a856a0104e54a4baaa5d25d7e3a04098b44d62e14f7e699222d885b0cfcf0277981f0db52a353189aebe2836516c32c62
SSDEEP 192:sxZARVWb/feXsgAEsIdpz0iNRHW6+WNwuGCWA1JGHY3AZ7Ig5E26J:sxZA2b/fIsL05HbRWH7X2
TLSH
T1D242B752693499BB9DC7D21DBA15BF13E2FD503251D01D88AAFC891C05E67CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0facc07-457e-4d72-94b9-cca8e63edf70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0facc07-457e-4d72-94b9-cca8e63edf70.tmp
Size 10KB
SHA256 292a364e6f3b3664030064a8879031569365273dc1c1efb32439ab8de0d690d1
MD5 a3fd18f04dc27ff7485bcbbad964ee56
SHA1 866d2dc6fba370f55db54da295be5f62fd4dabd4
SHA512 519e1df0c05a0476ab42b95da0be7b066d586693a0ddf8dab811d80f6651a81e306fac23e6da1903653c5ca0fb9d6ce2ad3fb5cec15336116efecb1a8c49f5a7
SSDEEP 192:sxZnR+Wb/feXsgA/Idphb/HW6+WNeondY3LZ7Ig52J:sxZnzb/fIsLwVHb1dms
TLSH
T18822B8526E38A97B9DCBD21DBA157F13E6F9403291D11E88A6FC8A1C05E76CD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

409972f9-3b2f-4057-900c-8c807969c833.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\409972f9-3b2f-4057-900c-8c807969c833.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8b739e63fa47ee236cf3bcf8c0391c6385fade4c0600688ee4b898bbf983cc59
MD5 60ee6f1a8178157ecd8098a5f6a17eeb
SHA1 b88f58e154ca46938008e3fe10c7c6cd17a9dadb
SHA512 5b87a804196c9a135d1353cc1a916da33f7e3e8c5e0cd4743b854c9e975d93bf35b3c5852f6511aa86c761677e2501c2e6dadc34685914de94a54adaca807ea9
MD5 SHA1 SHA512

Submit Download

b4d30400-20ce-43f3-8c0f-090cf9f53e0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b4d30400-20ce-43f3-8c0f-090cf9f53e0b.tmp
Size 18KB
SHA256 695ef08632f66efb7538d56b781f46409ecb07ba794e6fa1ba83fc8e6b5f67c9
MD5 a89954102219d451fd09456d7b8cabab
SHA1 61572a01868f80b022d8f2052d7113b52a35344b
SHA512 0e8196c7dde1f6479bb9723d7d08b06d629d76e5c9bb3bf601d7e72c946307a9e904c48c49543a4395622dfb2ec90bb547b88552917c9a1b7bec15193620dcea
SSDEEP 384:7ZcIhsNZCDf40puW0E9Yr9iX5F+JOFTPJAxJ+DzoY:jhBBvYJaiJeTPkJ+fn
TLSH
T14D828E729CB4ACBA59A2D225F54735039FBC9027D7C86F94C9FC6B2D05E65D80307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e69e06df-cd9d-4a83-a256-8b3effe1b1c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e69e06df-cd9d-4a83-a256-8b3effe1b1c6.tmp
Size 392B
SHA256 ecf02212e69d34157cea34fc4f141a4226914f2ba776dfbf6111c04526eca19d
MD5 d0bf92003215de2bcab4cb61c541b847
SHA1 48a7d8a9c088b01cbf115e519dd88e732aa9731c
SHA512 ff8240b570da4ec8bf2cb2164977179b475c45ca5f2dd080345fcce5a8c26356d11306f63949e26f6be948624a76dcac8354ef80a1af50c97f1464b5bd2d3116
TLSH
T139E002525204117FDA2C433401836F1029D2402003A201040B7211690C323043D20B90
MD5 SHA1 SHA512 TLSH

Submit Download

4ccb5734-f258-490e-bfb8-f3bce7182859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4ccb5734-f258-490e-bfb8-f3bce7182859.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f152469a-9e3c-4641-b6d3-c51c59f23cef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f152469a-9e3c-4641-b6d3-c51c59f23cef.tmp
Size 18KB
SHA256 a53474fb2a6e76143a34a8fdfb931b4cb713b35ce07ca79ab13514def8e93cde
MD5 ae255890b842fc059f7af8bf86abd44f
SHA1 9905b75402812907d71c2ee66a3af1101e0198ff
SHA512 24595938934e74345b2e09e475ccfc7672aec6c7ee5b5f57d64370916d6e57d5e123ba668ddb9b6bec27106cee65ad51d4af02643fc700001f8360bc2b4fe294
SSDEEP 384:pZcIhsNZ/Df40puW0E9Yr9iX5F+JOFTPJAxJ+DzoY:hhaBvYJaiJeTPkJ+fn
TLSH
T1EF828E729CB4ACBA59A2D225F54635039FBC9027D7C46F94C9FC6B2C06E65D80317827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 de4da6a3a384b6c6b01ff1334198226dcc71e686ae03a10ae107b2e9c23c96d0
MD5 23f861a0ef7c96df70cf0d4e348cdc3f
SHA1 c2269e55a79fd629a69cd1002859d8085c06838e
SHA512 04a7786a02d201047dfd8c38cf9b8570026647a8ac95bce62c0ce34042170e745ea45e42031dad236062a21eb1c7c883aada54da9789c872a6ba61db95ca1a99
TLSH
T187414748AAE91148B3B76F169BF6A86E487F7D372F06905E00110D4F0627A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download