hxxps://cs[.]mytheresa[.]com/mix/c3/?tcs=3504&cid_vcms=6590285&ag=Designer&lg=1&tar=TGT&src=newsletter&cmp=ww_37_230913_designer&tarea=02&csf=23350050&user_id=05bd0c24618a266599b6daa44139fa34&kwd=ww&ptyp=pinterest&chn=email&url=http%3A%2F%2Fwww[.]google[.]com/share[.]google?q=N7TvnRYSNCscXRlmN

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cs.mytheresa.com/mix/c3/?tcs=3504&cid_vcms=6590285&ag=Designer&lg=1&tar=TGT&src=newsletter&cmp=ww_37_230913_designer&tarea=02&csf=23350050&user_id=05bd0c24618a266599b6daa44139fa34&kwd=ww&ptyp=pinterest&chn=email&url=http%3A%2F%2Fwww.google.com/share.google?q=N7TvnRYSNCscXRlmN
Sample261026-y2maxsg17l

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
121	api.ipify.org
122	api.ipify.org
125	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5020	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{90C62E90-F19A-48B6-BF40-E2039329A0A5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1124	4968	msedge.exe	85
PID 4968 wrote to memory of 5020	4968	msedge.exe	86
PID 4968 wrote to memory of 3328	4968	msedge.exe	87
PID 4968 wrote to memory of 3328	4968	msedge.exe	87
PID 4968 wrote to memory of 3328	4968	msedge.exe	87
PID 4968 wrote to memory of 3936	4968	msedge.exe	88
PID 4968 wrote to memory of 3936	4968	msedge.exe	88
PID 4968 wrote to memory of 540	4968	msedge.exe	90
PID 4968 wrote to memory of 1896	4968	msedge.exe	91
PID 4968 wrote to memory of 540	4968	msedge.exe	90
PID 4968 wrote to memory of 540	4968	msedge.exe	90
PID 4968 wrote to memory of 1896	4968	msedge.exe	91
PID 4968 wrote to memory of 1896	4968	msedge.exe	91
PID 4968 wrote to memory of 744	4968	msedge.exe	92
PID 4968 wrote to memory of 744	4968	msedge.exe	92
PID 4968 wrote to memory of 744	4968	msedge.exe	92
PID 4968 wrote to memory of 452	4968	msedge.exe	93
PID 4968 wrote to memory of 452	4968	msedge.exe	93
PID 4968 wrote to memory of 452	4968	msedge.exe	93
PID 4968 wrote to memory of 5008	4968	msedge.exe	103
PID 4968 wrote to memory of 2128	4968	msedge.exe	104
PID 4968 wrote to memory of 5008	4968	msedge.exe	103
PID 4968 wrote to memory of 2128	4968	msedge.exe	104
PID 4968 wrote to memory of 1724	4968	msedge.exe	105
PID 4968 wrote to memory of 1724	4968	msedge.exe	105
PID 4968 wrote to memory of 1724	4968	msedge.exe	105
PID 4968 wrote to memory of 4072	4968	msedge.exe	107
PID 4968 wrote to memory of 2336	4968	msedge.exe	113
PID 4968 wrote to memory of 2336	4968	msedge.exe	113
PID 4968 wrote to memory of 2336	4968	msedge.exe	113
PID 4968 wrote to memory of 4544	4968	msedge.exe	114
PID 4968 wrote to memory of 2932	4968	msedge.exe	115
PID 4968 wrote to memory of 5116	4968	msedge.exe	116
PID 4968 wrote to memory of 3352	4968	msedge.exe	118
PID 4968 wrote to memory of 3352	4968	msedge.exe	118
PID 4968 wrote to memory of 3308	4968	msedge.exe	127
PID 4968 wrote to memory of 3308	4968	msedge.exe	127
PID 4968 wrote to memory of 924	4968	msedge.exe	128
PID 4968 wrote to memory of 924	4968	msedge.exe	128
PID 4968 wrote to memory of 924	4968	msedge.exe	128
PID 4968 wrote to memory of 5040	4968	msedge.exe	129
PID 4968 wrote to memory of 5040	4968	msedge.exe	129
PID 4968 wrote to memory of 5040	4968	msedge.exe	129
PID 4968 wrote to memory of 1184	4968	msedge.exe	133
PID 4968 wrote to memory of 1184	4968	msedge.exe	133
PID 4968 wrote to memory of 2744	4968	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cs.mytheresa.com/mix/c3/?tcs=3504&cid_vcms=6590285&ag=Designer&lg=1&tar=TGT&src=newsletter&cmp=ww_37_230913_designer&tarea=02&csf=23350050&user_id=05bd0c24618a266599b6daa44139fa34&kwd=ww&ptyp=pinterest&chn=email&url=http%3A%2F%2Fwww.google.com/share.google?q=N7TvnRYSNCscXRlmN
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff8cb8cc188,0x7ff8cb8cc194,0x7ff8cb8cc1a0
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,9647952320981646767,14099083782473922875,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,17626637253211758252,12867821932648039973,262144 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,12843876085684443172,17731569772819139780,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,1952447009107426245,16229207290884217686,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,12418881064976975365,7837918342307682830,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,6189887199705448356,14767773826974215412,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4300,i,13773946881651346241,18190062523480434750,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,16883261534358570882,8901107273590740782,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,12983424281441569545,14660272938273023570,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5736,i,15732610428971124699,7296986327109580531,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14361118034519758719,17199971891412549042,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14361118034519758719,17199971891412549042,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6128,i,11042372827943728510,6706441972330741993,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1965620181017613550,16380609701836377790,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,6810657828815538097,1681210593865366072,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,17102812514931933746,1130992095296849986,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,13579471628554544237,12694872808814626036,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,17997037721532187955,17003959759506603039,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4140,i,8082438540201834369,10125585337079811851,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6248,i,4196851178504743177,13588928935061178730,2097152 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,18362138532708718526,8290477525838131513,524288 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4440,i,12607082753245876734,14857703231319605020,262144 --field-trial-handle=2264,i,5902195096842533315,14665212625952396901,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

05f0496b-d6e3-4b6e-a6a0-319400d6a12d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\05f0496b-d6e3-4b6e-a6a0-319400d6a12d.tmp
Size 8KB
SHA256 d41361896f2d18afdc2afee6c23dd03b6d2c37add3fbb86d3d3210ed259ce8c0
MD5 0f56f2b042fd1d3087a847ed07ab3c08
SHA1 39088e35f3789f8a136174244c26637b1f708622
SHA512 16d99c47cb8b5b71866a41958259fe515f57c716307756d5d2ead65374637900e95e0ed49e322312c33e7784713ccc49c0441d3e71c518df0f07f16e1bcc8800
SSDEEP 192:SbONW76ySYQmiUy4CS1OCTVght+FdVaoHhpN83UKcqrU6:SbONW76D4aS1OCTVSSdTHVxcU6
TLSH
T121120935A8687C7B5DD3A541F48731079F988277DF863B95E6EC5B0C01EBAAC2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4cc18694-5c46-40d7-b22a-45c2a3b448b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4cc18694-5c46-40d7-b22a-45c2a3b448b0.tmp
Size 18KB
SHA256 f963fb73155ad061ea7076af9a072855891216852d6b33f50b728c1599caac61
MD5 641a78f51ef9a558eb4ec9561683e84c
SHA1 a16c1825a9f71adac464e76a5dc4b1a793bb6b2d
SHA512 e5660c5a53ccc3f28281c2e1b6de7055f603081634510569857c3e4d701bf4f872ffcabc61d392d1f86ca31be09345c3fd35c7e65f0a204d621b80750133d0c3
SSDEEP 384:jLQkUSv0sNCu4mwvGfbU5lSHOjTVSSdTHVfc2IiFMxIIlq:Z0hmEPnHNFc5VLQ
TLSH
T158827C359CA86D775EE7A501F08E3243CFA4D127DAC52B94E6DD6B1C01CB6AC2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

539ffdcc-c80d-4ed8-b4c1-5bdf93367827.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\539ffdcc-c80d-4ed8-b4c1-5bdf93367827.tmp
Size 392B
SHA256 799e9f3b52805514d084192f04e23cee19e3a1b6d29004cd8b2affb3cadea0a4
MD5 db6111d2093c10389a52735b7be0397f
SHA1 0398bc2945c3c6d6d55163b59c5ea67685c42ae2
SHA512 8b651cdfd2e59cd34c28817cbe9d84f4bab1620c4defd8ef0bea987fcde9525139b0604191697da62ef31edf2991ed1aede71a2c9aee78e6ecfae4fbdaaded85
TLSH
T1BEE00223D30005F6C018017040936B102693D070118543460D1211557C142002D34941
MD5 SHA1 SHA512 TLSH

Submit Download

e64c4672-9427-422a-93a5-7f4cb6e4a2bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\e64c4672-9427-422a-93a5-7f4cb6e4a2bb.tmp
Size 105KB
SHA256 c232ec974e0782cd13a8942d319d172253ded086c99dd896db4bd09ec5006e8d
MD5 0a841124514bc95bddf295e0991715e2
SHA1 0c7f8d71116903710115f6bcd7457435319e2456
SHA512 f0411e7fb7b1b65af2901ce74beb7aae12751e5f298888551f71344040955011ddcfaae5bc0a1a0e03678f7366a807beeaeeecc467babcc548116b11f29e166f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T17EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6896424a5a3b381b45d285b4cf70ce7e98f33f311d36d19d8d3b3ce510d1fb4f
MD5 0f416c8861efd339d5180f12f5c81c0a
SHA1 34c85e241e2f5f4626ed5826171c2f0f05e68ec8
SHA512 cbf250ad342a0353aed2853b94687d52ccac9cef58d857a8e044f825113708d40d3087d248724d9c0cac9d60ad41fefdc7a127351677073192f4123030ebcfb1
TLSH
T1BAD0807479163DEDC1DE70B5113499C04394DF238101151916530D181D743933851DD8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

0010ea1c-d6de-4598-a373-fb290c35e7c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0010ea1c-d6de-4598-a373-fb290c35e7c0.tmp
Size 10KB
SHA256 d647f23a11f4ec660adf410927b9045585c22c0224d1a78fe0d68237fd8f452a
MD5 379529e49292f5ac0beb3bd7e784f795
SHA1 769fa7483c1bf18fa62f2286ab5ac744b9d5b4fa
SHA512 bd49825d54c08151624bb16aa2b654dcd695e0100c0c3ff78cca51039f798d4bb00676183fc00fe3eb2df804305083f5d935a3a69b5e3cdd0211cc57116a845c
SSDEEP 192:sxZaRpWD/fqsJkwIdpJPH/j6+WNeFIZY/YRPoIFpdL0ZlIg5tJ:sxZaOD/fqsJkRhHgsqY/mgy7oZpp
TLSH
T1E822C856AE28B97B8CCBD21DBA14BF53D6FA503195941E44AAFC961C04E7BCD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45ec3aa2-561b-4998-9faa-257c4791dedc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45ec3aa2-561b-4998-9faa-257c4791dedc.tmp
Size 10KB
SHA256 802af21307ce8b2e9292757f06f6729ffe13de00ed4658ddf5c0e6491430a72f
MD5 70dfa3d7d8b1830d5bf3c63218d9edab
SHA1 0394909fcc047a49b7e83896462e39d07d49ec94
SHA512 56620cb6e2bfbae93a1bea68926b40b1f937e17bcbdeaf4b498f326a88f511d5c73e3ce2c68dbac8a70768c5a508ffea78f3fcb8fd3fa7be3b60727d165d0b08
SSDEEP 192:sxZaRpWD/fqspkwIdpJPH/j6+WNeFIZY/YRPoIFpdL0ZlIgrJ:sxZaOD/fqspkRhHgsqY/mgy7oZp9
TLSH
T11622D9566E28B93B8CCBD21DBA14BF53D6FA503195D41E44AAFC951C04E7ACD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

634ddc8b-984d-49f9-b8f8-ae27d4f42124.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\634ddc8b-984d-49f9-b8f8-ae27d4f42124.tmp
Size 11KB
SHA256 9d4d270449b58f6d679a4f335284e1103021819c1db1fbb9ee3f72e6d217d0c5
MD5 12bb6821df8f752ff6602794f9129634
SHA1 be122250a5ade241c97745b87c9c7d54cce0a6a6
SHA512 a76af2191ac808f0aa51e00681aa9d205c6b516f639493c6aa5de0d7a32d8b701aeefa21bf64ab3fb25029db7f428572664fb8c61faa5cacc5df62cb4625072d
SSDEEP 192:sxZaRpWD/fqsZk5IdppZPH/j6+WN0e6nFZAPXYRPPF0dL0ZlIg5HJ:sxZaOD/fqsZkSbHgKSXmFgoZp/
TLSH
T12732EA56AA34A9778CDBD21DBA14BF53E6F69032D5D00E44ABFC961C04E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c3f4d97-5a77-4a02-8d8c-f081da151d46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c3f4d97-5a77-4a02-8d8c-f081da151d46.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8f0d0bb9-f1b8-4924-986f-c51875a7c8cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8f0d0bb9-f1b8-4924-986f-c51875a7c8cb.tmp
Size 11KB
SHA256 50bd17ceb6adcf3ec6e608fda8e00454b5572a3014a8949f796a2b57870d5c14
MD5 1a66a2743720d7008846e1c00b06c566
SHA1 b25015f6c7aef110a43e59f221c6799c0e344ab2
SHA512 f00ac72a2f859a146fc1f6c72bb9b986856c0c3150564e3c1a97ee70b2515d0f7938ee5c1abc7b6dc94baecac3f270e0490e8f9a0396ccb0ca96e30f491d3249
SSDEEP 192:sxZaRpTD/fqsZk5IdppZ/iH/j6+WN0e6nFZAPXYRPPAdL0ZlIg5HJ:sxZabD/fqsZkSeHgKSXmcoZp/
TLSH
T18332F956AA34A9778CCBD219BA15BF53E5F69032D5E01E44BAFC961C00E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3fe4c7e808729e42ffede72e726e40e3cee96caaf90ee1d22537d1047c40a91b
MD5 9ed2f59ec0d66fbb54bdb89176c27683
SHA1 78c83280e82a7a01b3ebebb2bb16f207897371b6
SHA512 79a365edb919c80adf26fea6827a53aeacb849fdf34e5be30f1c34f8735256603b73df7039b9cc3c3424f9fbca2679561950bc6f01770fb16c76d586da0f474f
TLSH
T1D2E026A506CEC32EB60865870178830EC38127AAA2C07A2F1700C6E9750A240A3876F0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 25249801a40f258233b0a0eef9607cf384969df681071eea14a9fe5f61cd46f9
MD5 e8abe8252fd35f16b6b85151b14d3a3f
SHA1 f940e9ffadddd9a69ff76c82386e124cdce7a560
SHA512 42e2ae0e581928adf9f889040ff28ca16a1d3d3d95cfe61216b00ed9c391830313117add108820ac9ea3482050eba77e4acf1d722e5948b51c5fa935bc730c1d
TLSH
T129513F82CFCF50A9F7B59175C7D813BB76382983568F3E530190F97994067C551B7054
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 269d6a9b87f5c19ebb457fbe007da895f97f963a0df7a1c7a9ca3aecf3176a8b
MD5 302487ce957307809a054119d30ba4fe
SHA1 d7eca59c6fe8d628c9574befcb4563445c582852
SHA512 c0121c02d416cf927117804c04fd7aa12c64d83cd219bd2f2c4323b5d4f5e44dac821dff1ebe6b8a63d9f25130a46357b6a7d455aebad96caf1385b6325634c8
TLSH
T163612D828FCF50A5F7B59171C7D813BBB638298B568F3E530191F8795406BD161BB058
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 377d964a3d8d382b69510d75a2b0fe3e425f749da40e1056a20da7d87331071e
MD5 fc598b99adbc6165a73660fe7c1e365b
SHA1 4ae29610ab152e204e3bc1cc361c1b871ab2c0f1
SHA512 862da98680a8db2af8e8c7fa3179f9db9e4bf1282fd80ef4f1f69ead213c58f9d59975424e7af55d124331363dd754a31ef24f2bb712871e9428309629184863
TLSH
T161512D82CFCF50A9F7B59071C7D813BB763829835A8F3E530194F979940A7C161B7054
MD5 SHA1 SHA512 TLSH

Submit Download

b13d4973-22d7-4660-8f1d-f1e6290382f7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b13d4973-22d7-4660-8f1d-f1e6290382f7.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

b4738fa7-994a-412d-9501-dc48298c308c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b4738fa7-994a-412d-9501-dc48298c308c.tmp
Size 4KB
SHA256 7318a6566a3dee7b8bde93f06204c1eaf36026d3e7b75be575a10637d53f1f5f
MD5 22f7afeb7de755d8ee9f6848456914bd
SHA1 1929e10d825b4010489f92a0789ad96cfbba4255
SHA512 2d1067ab81ce45d289a2150ee7ebe1b95969bf3a1a5fdec48c2346b5c79f2decb50af00d34d6fd9d72f5b1476804e6de1cb2bdf3a210fae7c94c5705416897d8
SSDEEP 96:DaOgSexPoFtlZiRzOWNZO/O3NhJBsZkwBSBiqIz5/qNo3:DJgSyPclZA3NQ2LJgkkSiq61qNS
TLSH
T17591EAF783E4856DCA1193F59A14AE2BCF2D0926431C3D0AC9E8AF4BA3F2070E11165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c41e9670-9e9f-4ce9-b11e-17237efd92a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c41e9670-9e9f-4ce9-b11e-17237efd92a5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

eee975db-9c4d-44db-aaac-c403729389fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\eee975db-9c4d-44db-aaac-c403729389fe.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f9e225e8-590e-4e7c-b580-14f12b388635.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f9e225e8-590e-4e7c-b580-14f12b388635.tmp
Size 3KB
SHA256 052594e6625a6e92c4f0473dc4b9111e5cbd391a03159a0a00a15b3eedfea692
MD5 c17d156e51e851a5d8a07559b747c4b9
SHA1 3c17776bf63aaf7752bbfc8bc6baf7295968f816
SHA512 7b67b00b0a0b95e4d1fc0d634f7edf3fbd15064ef9507a030b11ccf491ede15214fcd0659764ad2ba012fd579cd31ede1ddf03c231398e4399a9b720840c1a6c
TLSH
T14171CCF2C3D8856DD90157F19A146E2BCE6E192A431C3D0AC9E8AF8FA3F2430D21565F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2ad4769f74460bee710ec5de7b4d98b997bcca740709708f7ee33fa3b72d5b86
MD5 25db413813c71995c54a14e14bddb09d
SHA1 e0fb3ac95a1650a7bd866429cab738404b5970a2
SHA512 acdf3dd910b4a1c5e6ff74fb9a797919ef5545bef98ea2089ecb28a7f1915b4f61dd919d91820c0e0410229e4419367ca0600e05a2b1587bb8a7c17426374edf
SSDEEP 48:K0mImLuvL1ttOb9wVISrOK9715OxjeY4JbPyLcLq2EGqTba5iISuTK9K1oTxMDYw:K0mZ84KRiy+byKIwau1yKOAu
TLSH
T160A1E00571BB062478BD394C80B49B5E968231B33518F62BBFBC04A54E6BE484DFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a00fc232-8317-4be7-85c1-be3cff8ed234.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a00fc232-8317-4be7-85c1-be3cff8ed234.tmp
Size 10KB
SHA256 9fc5cd6b87c7a5a54eeac9ebddafd59a159301908e093977da1873e10b73b4ce
MD5 8a60dce649441d10eec3a527b184917d
SHA1 4bbb2044c1ee9c41ce1e459ad4319a2ed49990ca
SHA512 7c49c873cc997fa109a9abc2e71a5dc12f5e716abfae6450bc5a89433d12cb6865652bbd9985cc36d47062e79c648f1dc732d20ae3c5f7a267bb041c5477448d
SSDEEP 192:sxZaRpWD/fqsZkiIdprZPH/j6+WN0qAPXYRPdFfdL0ZlIg5HJ:sxZaOD/fqsZkL9HgGXmnVoZp/
TLSH
T1C632DA55AA24A9778CCBD21DBA14BF53E6F69031D5D11E44A6FCDA1C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e19135f3-695e-48dc-b676-c9fc51b25eb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e19135f3-695e-48dc-b676-c9fc51b25eb2.tmp
Size 11KB
SHA256 218b7434616078df28c932b660c96f8ae6f0b28df6be0433ba24d0ecbe6979ea
MD5 9264bc6fc9e970f01ee976807248f129
SHA1 fc759e5e3b246feb70bd1d7d995c7b3a071bc03c
SHA512 384884ea6c44770017eb238b1a07aaddf8202980f83ee8f483152e340df02037741e5d6901fcb235cce91d16001ff80f5b526dd3579ea05641931b624a5b2e91
SSDEEP 192:sxZaRp2D/fqsZkPIdpJ2Z/FH/j6+WN0e6nFMiZZAPXYRP6AdL0ZlIg5HJ:sxZaOD/fqsZkg6HgKvSXmjoZp/
TLSH
T1F042E956A934A9778CDBD219BA14BF53E5F69032D6D01E44BBFD9A1C04E7BCD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec8823d9-280b-4265-ab7e-4f261d83b2c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ec8823d9-280b-4265-ab7e-4f261d83b2c4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8d5023b-6c3e-4fb4-bd5a-87536e044bd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8d5023b-6c3e-4fb4-bd5a-87536e044bd3.tmp
Size 27KB
SHA256 df5bfc3ae4686f90b0d4868237247e741a4b8626f42b2ef4e8800e8f66ed3af5
MD5 07e3b7ee32ae5e82af0d77fd5e435ea1
SHA1 527bf28770403cbcd94924de12a90ebe8fcf39f0
SHA512 7c43fd030076f94b54bba7c78a1feb13bda61362013ce43b1e7e53563994b15f22b5e29dad878378c04f7e701ea39bfca14d9a1c30f2a6deb95826ba7f8ca2c3
SSDEEP 768:isK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3Rroz+Rv:isK9uzYWvcQWsu1ja0HL7Q3qz+Rv
TLSH
T106C2093F640CCB7E4FC01A9DDC5A6F972E9802D7A6684D5047FA944C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16275107-0da7-489e-a8c6-a093d6d2f77b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\16275107-0da7-489e-a8c6-a093d6d2f77b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 3fd9af327b60787d0409fb7fae036abf65c4abb9bb404fafbdc44c8b07460580
MD5 d9c1633653c5e2c6f19498ae65ca26e5
SHA1 5468ba8a0f89e30a9a6abf839e44f687c2c1d60a
SHA512 d1558c6ca2429e6db92a182d7a1c144a93281d055b7281972bb6b0ecb6e3236b45d9a2a3a41a03c5b1b87a6bcb8972d13952aa2076e8c9407a24eb3339ed6c6b
MD5 SHA1 SHA512

Submit Download

ca7f9ccb-ea0b-40eb-a64f-203792378aee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca7f9ccb-ea0b-40eb-a64f-203792378aee.tmp
Size 26KB
SHA256 cd3dc816a311d44ddf3bf99e2e29d920253a1ce84d15b9ffa5037bc3c7dfd486
MD5 737b865a307353d3d3513664af1b391e
SHA1 ba64fca4042ad5d57492db6b640efb09025d68c0
SHA512 67f9da4fd972cfe23a7eee97dfb8094168c8a18a9db7185902e07c17a981ad0445bbdd3677db93b146f237097a96ab8af4456576e04fe0fa7ef208e8c9fcfc92
SSDEEP 384:F1iFzQkUSvFzsNC+8TUNTUlIlZmwvGfbU5FSHOjTVSSdTHVtc2IiFMxIIlq:KFd9Kwg7m8PnHN3c5VLQ
TLSH
T1C0C207F688D7593BD9AE5703A37D2D038EBCC067F9856A54B3895A0CCC862BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5c0a8f7-6b83-4b0f-b86c-0ab5efdb0dbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5c0a8f7-6b83-4b0f-b86c-0ab5efdb0dbe.tmp
Size 8KB
SHA256 f1c6e1337bb6470978f34a6bc76a629813f29348a0528c4c308e964986027a93
MD5 ff7ff8588c7290467f25b80ac00f60f0
SHA1 b35f232075b7806810b5c5a564f63753e6f84fb9
SHA512 3e0dea1cdd4e5ccaeceb2d3e93485dce8f7b3e14a88879df16cd1d1586669bca28d7e4b2eceb6035edcf247e484c4b9d81741995d51fbd56d6ea1d65a7d065b8
SSDEEP 192:SONK6ygpQmiUytCtOCTVght+FdVaotzPKDvGU6:SONK6lHhtOCTVSSdThGGU6
TLSH
T15C02D834AC687CBB8EF76E45F48726179FD8117BDA962B94D6E84A1C00D776C2303836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1904098-7386-4247-a848-310da7b35c11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1904098-7386-4247-a848-310da7b35c11.tmp
Size 18KB
SHA256 ef6d99709192661060e43d3c81353735e30b2b6e72882d27fcf0737312695866
MD5 792657ed7697a3c1501ba261673fcae8
SHA1 9f30791ae535e18c014352f3f681d8916538132e
SHA512 bb19554e63a66f503d0dac5c8c3a4ab18f713b75b6501515d5b5fa7ebcb90312a8efb8d21e49f2263206ab959c2140805a92c1fd7f35c31b07d27c51c05eb325
SSDEEP 384:NLQkUSv0sNCuZmwvGfbU5lSHOjTVSSdTHVfc2IiFMxIIlq:f08mEPnHNFc5VLQ
TLSH
T1EF827C359CA86D775EEBA501F08E3243CFA4D127DAC52B94E6DD6B1C01CB6AC2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f957c17a-e618-4dbc-b5a1-371dcee45811.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f957c17a-e618-4dbc-b5a1-371dcee45811.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 23a0ae5b70496cee73e9c160aa3c1688e676a47a1ae7cf3bcfc0513a27715290
MD5 5710a9068844e6a79c6734ce504cefb7
SHA1 8ed5f6fdcf122c7d3c9294b2ce7e76cabbfe114c
SHA512 2db7343af1a79728608c9b2de75233e92bc280646b25d41b90ba8401a6e472fc3795e7afa1a3d2740ea4b2579eb17c76b67a86899c141a510677477e839407a8
TLSH
T186411A58B6FA1149B3B76F569BFAA86D487FB8772E0AD05D00110E4F4926A00CD71737
MD5 SHA1 SHA512 TLSH

Submit Download