hxxps://etsy[.]app[.]link/DalSwin6y7b

Analysis

user interaction
yes
max time kernel
82s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://etsy.app.link/DalSwin6y7b
Sample261027-dr8e7aa14k

Score

6^/10

discovery phishing

Malware Config

Signatures

Legitimate website abused for phishing 1 TTPs 1 IoCs

phishing

Phishing

T1566

description	flow	ioc
HTTP URL	107	https://panel-deploy-443f429a.us-sea-1.linodeobjects.com/vault-access-5095-1793065724288.html

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	46	https://dhadmobile.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a50e89ebe9bbc616	1

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4412	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{F0FB466A-3501-49ED-A206-8B266F04CE02}	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe
3224	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3224 wrote to memory of 968	3224	msedge.exe	84
PID 3224 wrote to memory of 4412	3224	msedge.exe	85
PID 3224 wrote to memory of 4940	3224	msedge.exe	86
PID 3224 wrote to memory of 4940	3224	msedge.exe	86
PID 3224 wrote to memory of 4940	3224	msedge.exe	86
PID 3224 wrote to memory of 4348	3224	msedge.exe	87
PID 3224 wrote to memory of 4348	3224	msedge.exe	87
PID 3224 wrote to memory of 3536	3224	msedge.exe	89
PID 3224 wrote to memory of 3536	3224	msedge.exe	89
PID 3224 wrote to memory of 3536	3224	msedge.exe	89
PID 3224 wrote to memory of 5096	3224	msedge.exe	90
PID 3224 wrote to memory of 5096	3224	msedge.exe	90
PID 3224 wrote to memory of 5096	3224	msedge.exe	90
PID 3224 wrote to memory of 4428	3224	msedge.exe	91
PID 3224 wrote to memory of 4428	3224	msedge.exe	91
PID 3224 wrote to memory of 4428	3224	msedge.exe	91
PID 3224 wrote to memory of 3360	3224	msedge.exe	92
PID 3224 wrote to memory of 3360	3224	msedge.exe	92
PID 3224 wrote to memory of 3360	3224	msedge.exe	92
PID 3224 wrote to memory of 2240	3224	msedge.exe	96
PID 3224 wrote to memory of 2240	3224	msedge.exe	96
PID 3224 wrote to memory of 2240	3224	msedge.exe	96
PID 3224 wrote to memory of 2956	3224	msedge.exe	97
PID 3224 wrote to memory of 2956	3224	msedge.exe	97
PID 3224 wrote to memory of 2956	3224	msedge.exe	97
PID 3224 wrote to memory of 4184	3224	msedge.exe	98
PID 3224 wrote to memory of 4184	3224	msedge.exe	98
PID 3224 wrote to memory of 4184	3224	msedge.exe	98
PID 3224 wrote to memory of 3956	3224	msedge.exe	99
PID 3224 wrote to memory of 3956	3224	msedge.exe	99
PID 3224 wrote to memory of 4012	3224	msedge.exe	100
PID 3224 wrote to memory of 4012	3224	msedge.exe	100
PID 3224 wrote to memory of 876	3224	msedge.exe	104
PID 3224 wrote to memory of 876	3224	msedge.exe	104
PID 3224 wrote to memory of 876	3224	msedge.exe	104
PID 3224 wrote to memory of 2276	3224	msedge.exe	105
PID 3224 wrote to memory of 3536	3224	msedge.exe	106
PID 3224 wrote to memory of 3536	3224	msedge.exe	106
PID 3224 wrote to memory of 3536	3224	msedge.exe	106
PID 3224 wrote to memory of 1076	3224	msedge.exe	112
PID 3224 wrote to memory of 1076	3224	msedge.exe	112
PID 3224 wrote to memory of 1076	3224	msedge.exe	112
PID 3224 wrote to memory of 1456	3224	msedge.exe	114
PID 3224 wrote to memory of 4552	3224	msedge.exe	115
PID 3224 wrote to memory of 4220	3224	msedge.exe	116
PID 3224 wrote to memory of 220	3224	msedge.exe	117
PID 3224 wrote to memory of 220	3224	msedge.exe	117
PID 3224 wrote to memory of 220	3224	msedge.exe	117
PID 3224 wrote to memory of 4144	3224	msedge.exe	119
PID 3224 wrote to memory of 4144	3224	msedge.exe	119
PID 3224 wrote to memory of 4144	3224	msedge.exe	119
PID 3224 wrote to memory of 3356	3224	msedge.exe	120
PID 3224 wrote to memory of 3356	3224	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://etsy.app.link/DalSwin6y7b
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffad3ec188,0x7fffad3ec194,0x7fffad3ec1a0
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4849611344003791589,15318187619777926233,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15519287130874865952,12379191303013589447,262144 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,1981342109825660783,17548383753368409227,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16803784438946525475,9351977632722249354,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3500,i,15937261125953224696,14811243349541427994,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,4002774364889263694,17529566434882277725,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4340,i,2718508979067712969,1797513738890353094,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3536,i,4304985593471680748,13780918771890371330,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:1
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3528,i,803382516399577162,7095309160373942240,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3664,i,12075398099327714795,3031405101563102306,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,1753515167108802476,3181147685822372591,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,9342948876574431086,1008310759603178544,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3036821445722777350,7196345787863465912,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6176,i,14343584237880627563,4671685374144553228,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6048,i,3036821445722777350,7196345787863465912,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6340,i,12462412099448745256,18078002320877499018,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6872,i,17543698674305711928,16369493921900246760,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6920 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5626605278307292709,3510072367053620329,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4528,i,3879767537790160383,8044839310159401007,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,3653365486802361719,1429744979392223538,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4516,i,2044000382143810937,2188325007577056387,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3608,i,10246294313478118272,15571677354962437869,2097152 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,1638596057941308536,17445586898121470193,524288 --field-trial-handle=1976,i,2012768079618297331,4422244141362211648,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:8
  2⤵
  PID:3356

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1d2b1bd9-3139-41eb-8abe-28df99e498f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d2b1bd9-3139-41eb-8abe-28df99e498f1.tmp
Size 18KB
SHA256 34ecf92c7672169abba610bb4c3c884b09449d9891e7e051f2038b32a262171c
MD5 a4380e721c2e3d71c607abbc360aa89d
SHA1 070c10fd524612ce941a4cbe929ada427387bcb0
SHA512 dedb56b587e3286e346ef782cee171fac81f38d8130f518e178f91f0d7bb82d3d986043803932782455d9121e064a2dc1de12cc731575df784fbd7c896a7afea
SSDEEP 384:JQkUSv0sN6nfmgc2p5u8iNLOZvaTZcvHsIIla:r0XckkAZvaTZcvHsL0
TLSH
T135826C31AC79BC3B5DE7E660F54B3603AE748167D7C85F84D5DDA72D02EA288230B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b20af5a-aa6f-4ab9-8ef4-9a58149f3c30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3b20af5a-aa6f-4ab9-8ef4-9a58149f3c30.tmp
Size 8KB
SHA256 a2a25da9842eeaffa937d069caa54a17c06ed7be86655a39b59d726d9fd34853
MD5 d01e13f77ff84d1935c5b2da9bef9d5b
SHA1 50421578ae1e82d1bfa8e8e2bc6c9e79b709945f
SHA512 b969f4a79a49b67f8a317461f4a89d8eaba3464219530551d58e580058e0334167b8cbccaa718facfadb6c066c0d483e8e720d566159a28293053295e8096022
SSDEEP 192:1ONT6iDLQmiUyGE5q5u88PNLbetGuZgqx9U6:1ONT68q5q5u8iNLGZU6
TLSH
T1BF121935AC68BC7B6DD3A964F48736139EA4416BD7896F84D9DC2B2C01EF59C130B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46d57e67-a297-4eb3-a055-558bca22e720.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\46d57e67-a297-4eb3-a055-558bca22e720.tmp
Size 392B
SHA256 2620adeee964bb472bab106cef436098ebd99334ad676c129f03748b738dacb3
MD5 88e7f10f4c28032c2ccaa11fbbf2c831
SHA1 dd1ee7b3162d18413d714202c635cb36d5e237ed
SHA512 2a65fb7b1b7a121e76e0781a76aea71f207a51b48cb813111528c5d1fd6830c5e1e67193171213335a6723b3980b86860a59bfcc783866e52375223c5171c1e1
TLSH
T18CE00203931401D5C0340734114B5F501FD3C130167103870F3055EC2C333083D10B40
MD5 SHA1 SHA512 TLSH

Submit Download

4e47b293-2704-4747-ad57-392f418b6d31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4e47b293-2704-4747-ad57-392f418b6d31.tmp
Size 8KB
SHA256 14db345375629e7e567f705947537659d934cdbf376711ad08fb9f39fc34ddf3
MD5 e481fb53de02ca54a9c2fdb766373803
SHA1 3266d0b826af4dcbc023a4be915e365669aaec3d
SHA512 3ba35cd1f51f6dd8ce67b35a00b93259be8f1e7801add74a1e9b5a0d0e403c27778a94d797f6acb9eab0eed62b40dbe5b39abe763c7b64c89f58487c484dd0fa
SSDEEP 96:PqONkwQsjpfwDISp5ih/cIPURHl8h4otop5gOmDgBfPGxvw45RxmJm78lFOxVeYz:SONU6iDCQmiUyeEHq5u88PN0SqMBxsU6
TLSH
T13D0209386C787CBB9DE3AD05B5473B179F94113BE7942F84DAE8161C01D764C1307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8fbaca30-a3be-4943-b42b-bd3ed5daa911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8fbaca30-a3be-4943-b42b-bd3ed5daa911.tmp
Size 26KB
SHA256 672f551d8982c6c6946c0be206344a94cf622cf6a544356d783baa761fe5485b
MD5 0f15fafbd4f72034758ffa11bb02794a
SHA1 91991c48fb0d47dd861d794a69e486af39639d89
SHA512 cab8b8e3452bc94d9670ebd9e8aee0d3b853c2c92204388240feb742381c38afb1b6e6da08024b0740b7953ed5f3b42045052715ef3a692c47358a5a8e070753
SSDEEP 384:niFzQkUSvCzsNC8TUNTUlIlnfmYc2p5u8iNLpZvaTZcvHsIIla:iFdK7wgFckkbZvaTZcvHsL0
TLSH
T13AC208F258D7983ADDAE9713A73E2E039E7CC063F6845A40B789551CCD9A1BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a11b3e1-4791-4fed-a446-5b8a1634a5f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a11b3e1-4791-4fed-a446-5b8a1634a5f9.tmp
Size 18KB
SHA256 2cb0725f5630a16880be4bcd1f7fe02699007de182bf45ce802cd015886ab174
MD5 0b7bea81eb1c0e1c5b19569c3a7db641
SHA1 adea61ea2ece17835e58b34477b9ff19410bf8d4
SHA512 b71dedd44b2f04b436373c486e994652daa966783a0cf7f3af166ee41b81be3b0738c92182355f54fe1d57f374660f947929a4962b867a8a1df113fab5136459
SSDEEP 384:+QkUSv0sN6MfmGbp5u8iNLOZvaTZcvHsIIla:u04DkAZvaTZcvHsL0
TLSH
T1D9826C31AC79BC3B5DE7A560F54B3603AE748167D7C85F84D5DDA72C01DE288230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

0de82753-bd9c-49a4-9b4a-a1d59b6540b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0de82753-bd9c-49a4-9b4a-a1d59b6540b5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42ede4c7-aa31-4950-992b-2012aadd225a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42ede4c7-aa31-4950-992b-2012aadd225a.tmp
Size 11KB
SHA256 f074520166a1f7de4b70906f613dd416fb73415f0b203e300930158e2e870b92
MD5 2effd0276cea94f58ed687fadb03405c
SHA1 e4d86e7c85bc5b6076cd487727b6c82864f67aa7
SHA512 d599d96312e5e4747bb534dff35998b7ab31d9d21c8955e19ed3ee4cd8d7f4153e15a1b00de303c3deb96ab7ae648bb568491debd5dccf49393a2959d04c5eed
SSDEEP 192:sxZNR4WT5/fRsdqGdKIdp7VHPuSL4HW6+WN+0IkD6w6E1q/YaNHqRIg5AJ:sxZNdT5/fRsoGdDwHbQ06l/E+
TLSH
T11C42C952AE38697B8CDBD319BA15BF17E2F5903192D11E44ABFCC91C05E6BDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fbf9528-fdbb-45a2-a0a1-bdeb3f448af0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4fbf9528-fdbb-45a2-a0a1-bdeb3f448af0.tmp
Size 11KB
SHA256 b46a51d9f8022be6fedc8301dcfbc5429757c13226579308ab52b1e2931ec717
MD5 0f2117d264bd8e603040c32db4002d85
SHA1 242fa680d6aa45f282c649a8353675d595c8319c
SHA512 4cc6f54d27c206ac92631103c7d4e083012be5013af0a2f3c5c557cd6ac09b172d6384e12297c584e5bc68b70e04d8eabdf598711966d3954602f4f1a01f7f35
SSDEEP 192:sxZNR4WT5/fRsdjGdKIdp1VHJSL4HW6+WN+ukKE1q/Ya44qRIg5qJ:sxZNdT5/fRsFGdDRHbvFl/oU
TLSH
T15E32D952AE38B97B8CCBD319BA15BF13D6F5903191D51E44AAFC891C05E6BDD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

61155187-4e69-4ae6-ae66-194b9074a2d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\61155187-4e69-4ae6-ae66-194b9074a2d5.tmp
Size 27KB
SHA256 1eee0bd03f2b5aaf7446a0aaf8114f4417da7a6fdc9d3fd74a51b94adf43c62d
MD5 a142bd7c4f5b35f68941e0bd729cbb03
SHA1 b57776e7dc5b25e9fce729e15a58a14a29dd4732
SHA512 c1f9338a3372d8fdb97be8f8ed696a4abf73d64db6d2b45500d3c6894b45fbb92ad929e2a82538ab72c8a28858579799c672590f2369037fda6e51cf208b6ca4
SSDEEP 768:NWyQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3orofNZpf:NWyQRbrWvvlRZu1jaXKLf33TlZpf
TLSH
T1B3C2E92B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b3c1a44-65e1-458c-b861-afe3419eac27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b3c1a44-65e1-458c-b861-afe3419eac27.tmp
Size 11KB
SHA256 5fde45516c0977919917e7ae019c844b030bb9c1fb5d48f5e979cd5d5e100a92
MD5 d6dbcdc8b25bdcb14aa3da7a599a8d51
SHA1 ce496fa15d4c44958677784637e1d3f8efbc6b79
SHA512 a33f799b952198a974a65e441af85400b8a65694a806e17191215a6646fe2cb95fe21d9bd5eef9d48e2b698766797fa2033fd87e4d200941261e8bfd44ca485e
SSDEEP 192:sxZNR4WT5/fRsdqGdKIdp1VHPuSL4HW6+WN+0IkD6w6E1q/YacoqRIg5AJ:sxZNdT5/fRsoGdDiHbQ06l/K+
TLSH
T1EB42C952AE38797B8CDBD219BA15BF17E2F5903291D11E44ABFCC91C05E6BDD220B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d3c660cbdbe7edd0ee6a886d96a3c7eb821bbd9cd1960be8b6437fdb5b6d40cf
MD5 7447617584a3e6fe55c111ebc1f29fba
SHA1 d892c2939ddc687aea3708426b98cae5b84e7266
SHA512 be1011e58d03dde8707b9a8cfffc2439ea5e91d95b7da6557506847dc0b635cb3a1200e1de68bb9457692822a12446c3670dc59ae2c6d59dbb1d610ffd9695cf
TLSH
T1F861FA4545A00F5BFF98003892F672BF3674A88288C3DE6E30A9F8795C5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 078004d89998b4160d0ec42cc038c357e558cff51ee92346e111eb453634cc03
MD5 6160846dae66b67689311503aba2543a
SHA1 cb349e3d3ffd248dc47536fb8e02f46a95cb8698
SHA512 318b1f9684ad9717ac9539282812bd53619a967fba362203484a995894fe39e506f009934760ec5b9c35076af7bb5827a52d0e099c92bcad6e8059eaeba7c792
TLSH
T1EA610C4549A00F5BFF99003996F672BF3674A88688C3DD6E30A9F8795C5674863DCC0C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ca756fcce670acff22a6185379f267ee053df7db13698d57cb0577d92e6543ae
MD5 e5d8b0bc57486aa77db410ad4153a01d
SHA1 745939a3f3f15ddb78f8391a3769be1c01df3d6f
SHA512 20a59060767cb3bbd71a22162ce5c044b1704465fe061ee6664fbe01fbdaaca6c5f4faf1c91e41f0b325bc4e7cfbff56a6f9c37b5686ade0739bfa94a1ac7646
TLSH
T13F61F94581A00F5BFF98003992F672BF36B4A88288C3DD6E30A9F8795D5674863DCC1C
MD5 SHA1 SHA512 TLSH

Submit Download

d4e2f61d-f122-46b4-8fa6-da12b14d36eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d4e2f61d-f122-46b4-8fa6-da12b14d36eb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6dd2b36d-0eaf-48c1-8110-867f2bf21162.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6dd2b36d-0eaf-48c1-8110-867f2bf21162.tmp
Size 3KB
SHA256 97ef2a6d694ed425173b31ed507a203b2975855f2203d17010802a51f1f8877d
MD5 f79968471fce5e8eb2a4e3fca3dda030
SHA1 f7e425f0579e9f1397e21f054b1d326c58852a12
SHA512 29932a86917ddb15ba412273a0a4bdc2f81ae2b397557ebad3318334ceaffa3b5241a7c7bf8e50574ff0aafabdc803232985149c51a51b1d9539515696b72a53
TLSH
T12A718CB2C7F58A5ED91197F05A18AE2ACE2D0514431C3D1AC5D8EE4BA3F35B2E14164F
MD5 SHA1 SHA512 TLSH

Submit Download

d68922f8-13a3-4285-9a4b-0bd613773e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d68922f8-13a3-4285-9a4b-0bd613773e4a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e56765c8-c0ea-41ea-86e3-ba81e53ae225.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e56765c8-c0ea-41ea-86e3-ba81e53ae225.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 6732b90f8e4d058bb6bac5966ecbdb1ee4b0978ed32f0fea5d84ba71778da27b
MD5 28a4065fc7d46e1c8269125963d0cf96
SHA1 ca67f95f0bba995e7ead082e75695ca0109a16de
SHA512 800acd8d4ff3eb8756bb271b536922d24f4482e07a2530bb84b78f4d431b3f5becc4d647fdf91b7234a7ef67e47ff50486a3b9ab7d589723053bd0c6ec945593
SSDEEP 192:sxZNR4WT5/fRsZjhdKIdp1VHBL4HW6+WN5kKE1q/Ya44qRIgrJ:sxZNdT5/fRshhdDGHb5Fl/o9
TLSH
T17822C9526E38B97B8CCBD319BA15BF13E6F5503191D51E48AAFC891C05E7BDD120B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 17f15967c523dffeef55f51c7d75de2d9550a11764ad487f3a44e7c5c9579488
MD5 86376312f6cafba402cd24a2913050e2
SHA1 10895647cc4abed12a9a794d7aa63ceacc7b6618
SHA512 8bdc30432fc2496c83127b151d875c195e145752d8c08a006317d8061e803a3a454b96950d0cb93b00e3e26d0cfd5c55c23e9c8da8c079ab213df00a0dc5ee40
SSDEEP 48:K0Nsh9P7/gbTmzIS1gK911XgxlwY23ttyL6lI064I5bkjUISMiI/Krq4Xy1TIRKm:KkyAKvqe2d6iUKrqqmTqKm
TLSH
T19A91251430BB421039BE755940A4866A435235B33534F96FBFA942B39E6FE044FFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ed6263ce-e8b6-4009-8d9a-1da63f74ad60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ed6263ce-e8b6-4009-8d9a-1da63f74ad60.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 108eb5b994b6de52319a6d819c8dbed671c2c821dc6dcea7a99101d007c3071f
MD5 d0860b4493bdbd4691745453b67e58f3
SHA1 2231fc95122dde19f732f4b8a81c96c1c3c337ed
SHA512 8197790e5e22adcc6c237b04f6e49324ae292ef0a01e5cf9a7ccbea168f4910728e994afa05153c2af379013aec86188585d21a40bf6dd09350a7bc762f445c8
MD5 SHA1 SHA512

Submit Download

26586710-fe6a-4585-8ba6-9f8ba2d62f16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\26586710-fe6a-4585-8ba6-9f8ba2d62f16.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 078a3209162ef6017d9431f21abcf0c2d6fa5f64f3c0c0eb631206959958592e
MD5 b69c1e02476bd17e3dc27e9ceeec12cd
SHA1 962f1e4d5662543508c06912ab79732ddf8ed978
SHA512 cb10e6c24394e1dc53a1e1476d7edfcd626c4075f8672713321765da9ff7febf30486d68412ac07c972f3610c71ead5dcd899f1cd67de8cdae2efd0c9286d1b0
TLSH
T14841145CAAFD1148B3B76F5AABF6A86D487FBD732E0AD05D00110E4E0667A01C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads