hxxps://docengadvisor[.]com/?KJtCHvxX/test@gmail[.]com

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://docengadvisor.com/?KJtCHvxX/[email protected]
Sample261027-mszn4stsf1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3036	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{E64DF98C-44FD-4458-A277-62F2D9FF1F7E}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3728	msedge.exe
3728	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 3212	3260	msedge.exe	85
PID 3260 wrote to memory of 3036	3260	msedge.exe	86
PID 3260 wrote to memory of 4820	3260	msedge.exe	88
PID 3260 wrote to memory of 5008	3260	msedge.exe	87
PID 3260 wrote to memory of 4820	3260	msedge.exe	88
PID 3260 wrote to memory of 5008	3260	msedge.exe	87
PID 3260 wrote to memory of 5008	3260	msedge.exe	87
PID 3260 wrote to memory of 3056	3260	msedge.exe	90
PID 3260 wrote to memory of 452	3260	msedge.exe	91
PID 3260 wrote to memory of 3056	3260	msedge.exe	90
PID 3260 wrote to memory of 3056	3260	msedge.exe	90
PID 3260 wrote to memory of 452	3260	msedge.exe	91
PID 3260 wrote to memory of 452	3260	msedge.exe	91
PID 3260 wrote to memory of 3028	3260	msedge.exe	92
PID 3260 wrote to memory of 3028	3260	msedge.exe	92
PID 3260 wrote to memory of 3028	3260	msedge.exe	92
PID 3260 wrote to memory of 3428	3260	msedge.exe	93
PID 3260 wrote to memory of 3428	3260	msedge.exe	93
PID 3260 wrote to memory of 3428	3260	msedge.exe	93
PID 3260 wrote to memory of 1192	3260	msedge.exe	97
PID 3260 wrote to memory of 1192	3260	msedge.exe	97
PID 3260 wrote to memory of 1192	3260	msedge.exe	97
PID 3260 wrote to memory of 4184	3260	msedge.exe	98
PID 3260 wrote to memory of 4184	3260	msedge.exe	98
PID 3260 wrote to memory of 4184	3260	msedge.exe	98
PID 3260 wrote to memory of 3336	3260	msedge.exe	99
PID 3260 wrote to memory of 3336	3260	msedge.exe	99
PID 3260 wrote to memory of 3084	3260	msedge.exe	100
PID 3260 wrote to memory of 3084	3260	msedge.exe	100
PID 3260 wrote to memory of 4924	3260	msedge.exe	102
PID 3260 wrote to memory of 60	3260	msedge.exe	110
PID 3260 wrote to memory of 60	3260	msedge.exe	110
PID 3260 wrote to memory of 60	3260	msedge.exe	110
PID 3260 wrote to memory of 5020	3260	msedge.exe	111
PID 3260 wrote to memory of 5020	3260	msedge.exe	111
PID 3260 wrote to memory of 5020	3260	msedge.exe	111
PID 3260 wrote to memory of 1504	3260	msedge.exe	112
PID 3260 wrote to memory of 1504	3260	msedge.exe	112
PID 3260 wrote to memory of 1504	3260	msedge.exe	112
PID 3260 wrote to memory of 4328	3260	msedge.exe	114
PID 3260 wrote to memory of 220	3260	msedge.exe	115
PID 3260 wrote to memory of 2708	3260	msedge.exe	116
PID 3260 wrote to memory of 456	3260	msedge.exe	118
PID 3260 wrote to memory of 456	3260	msedge.exe	118
PID 3260 wrote to memory of 3644	3260	msedge.exe	119
PID 3260 wrote to memory of 3644	3260	msedge.exe	119
PID 3260 wrote to memory of 3728	3260	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docengadvisor.com/?KJtCHvxX/[email protected]
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff91aa2c188,0x7ff91aa2c194,0x7ff91aa2c1a0
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8690048832725012757,14286038372021054175,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5405540993201082745,11269395286068409440,262144 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,10677655094338279024,5960659193087639695,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,9578845962564470498,17778419516728704468,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,17289114589004448940,3211476648276397515,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,15167645273102638132,13591024479106299987,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,5618532005999956733,8795483207744438566,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5044,i,18141173659956289854,8348242367354839109,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3452,i,8156571249405883915,82023290714029723,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4224,i,15866052582609630903,12260930056132118290,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,9517090527868898182,17066560064957666852,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4478482451190350146,5675196498107294969,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,4478482451190350146,5675196498107294969,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6184,i,9176668189538987046,1418255732201402240,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6056,i,4840304084832425036,5106379306586409901,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6540,i,12886038353244605210,10235706166063921901,2097152 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,11584409542512777685,11204722793555094061,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13136269198027939498,15038416552108542268,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,14815948464209530964,823027910130885892,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,16085246403561975959,15480249350526141601,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7036,i,9041007220569776287,13368462792811423723,524288 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6348,i,12811517747269133475,16414084193469387418,262144 --field-trial-handle=2368,i,7525018797159452005,18352612702373098814,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4555d693-57da-419a-aea1-29c33a42e3f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4555d693-57da-419a-aea1-29c33a42e3f1.tmp
Size 8KB
SHA256 7fa384aadfb1fcb5598ce446d644f348c25c873bbb5ecca3461750f0be235db2
MD5 d16099b09723ba595aa8b1cadc6e3afd
SHA1 11a02a30440a7aadae47f237ae4353f2d5b8a835
SHA512 b90b9920b9b40a66d48faa7c301de0b287a2629845026cc04bc6e5e940ea2f0311cafaaa78fc377b62ecbb13473f538a861383c6ca0af0bc2ca6e66423fae631
SSDEEP 192:nUONd6DphqtqQmiUyiq5wGYX59ezSCtORXlLYkIILq5ClU6:UONd61Li5wGYX5EDtOxlLh5lU6
TLSH
T192120A32BDB8AC7B5DD2A554F08735139FB55127EA847F50D6DC2A1C01EF69C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48be4389-820f-402b-84cd-182c8ef271ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\48be4389-820f-402b-84cd-182c8ef271ff.tmp
Size 8KB
SHA256 244c1e7d30c2f7336b2190e3c6898d780fc9559709e0f02a0aca66ce6d87361a
MD5 5fba7fef448413209b84ed0d6e4d3220
SHA1 8d4ec0d061f333cfc2ce01b59e0c56a20e7af16b
SHA512 b8e1f0c48d91d21938d42239c072bf497df50558ed5dc5878f4036342d177a091638281fdf66def687288d2198e1ef49fdba3a09f0431cdc65593569942dbb6b
SSDEEP 192:LJON46DphmqQmiUyHqq8wGYX59ezSCtORX/kk7DnU6:lON4619VRwGYX5EDtOxnDU6
TLSH
T15502E835AD78BC7B8DE6AE45F48B36139FA4112BAA946F44D6D81E1C01D768C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c778ea0-eb91-47ee-a553-9dfda274d979.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c778ea0-eb91-47ee-a553-9dfda274d979.tmp
Size 26KB
SHA256 e72eb76ad68c012a65cc610e24f2f0bc52fff951ac335014352144ed73d30e13
MD5 da357023aa001843cfbec58724909d69
SHA1 59692d7083081181a4332d2eecf17d71af290e20
SHA512 5d58b006a5657b69fc9e3e9db28e341410922ef46985d5b10f6ade2f3f49a2b57513d04dc37055a2d67abdb6d025646f45d5cc1da45e3586ab5a90a595aa3719
SSDEEP 384:UiFzQkUSvvzsNU8TUNTUlIl7HEzi5mXbBGYX5EDtOxlLx5lvaTZcGH2IIlf:vFdL9wgVF21GYuDtOTLxvvaTZcGH2Lt
TLSH
T105C2E7F258E79836C99E5B53A73E2D038EBCD027F9846A50B388591CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dbdb437-2548-4481-885d-8eb20599187c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4dbdb437-2548-4481-885d-8eb20599187c.tmp
Size 18KB
SHA256 bff4a8d0a55a20152470926ead5d31c1eaf7e32d5f62179de135a341fa65f1b5
MD5 6ea238972385d9f9c6d276975dca1b4e
SHA1 f4a7c3443fc7c49a467078c626f614c8de0d6277
SHA512 583f09687f86dc4462c552c5558cce39a920634ed146de00b54e0bb29cfe5b9767856706d985601e20deb6e1cd5a21996decc65b3db282fa71e2539e2ce79e11
SSDEEP 384:1QkUSv0sNc7HEzi5mIbBGYX5EDtOxlLz5lvaTZcGH2IIlf:P0nFd1GYuDtOTLzvvaTZcGH2Lt
TLSH
T10C826D32ACB9AC3749D6A650F14B3603DFB49027DAD46F54E5DC6B2C01DE29C234BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d317e93-36fe-4706-8c18-9ef08dae80a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\5d317e93-36fe-4706-8c18-9ef08dae80a9.tmp
Size 105KB
SHA256 7fbf8b23a13854c0c33f9b9cc9b82042dfb881d0f9995938391cf2da54cfb3de
MD5 f027022507ec94f32265883243245251
SHA1 a21e2e3703475c52ae4b2881bbdf87320a7a1aa4
SHA512 b618f5fec905802eac699560ca9b2bc85f4fdd04e41ff5ea96bbc8db8724a369489826c4b1839db0a0fe4023e73b7e95ac2ee4efdd1fc7f55c8c5ffcbd19d4cc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T1E0B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

032483c2-0caf-435d-906d-cf19ddab4a5b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\032483c2-0caf-435d-906d-cf19ddab4a5b.tmp
Size 10KB
SHA256 448e246240a6f77d016e2b4024fb793470c0e04f464034eb067f715cfec5711e
MD5 a5127ff6799ef3268ce7c72ae6009b4b
SHA1 57587069dce52e8ee8d4b9313adc18046c6a53c2
SHA512 7fd3f12e78366ab9c864289fc83cd191d074d4d0c9f87b150eb18fe79ecd2f7b6af61f8f27e97f5f7246f6f53d019ff8fc9a1d84c0943da3a1dfce7730dd3615
SSDEEP 192:sxZ25RWWU/fhsBMIdp+/HW6+WNNk7/Yg1BP0IgrJ:sxZ253U/fhsBVcHba/y9
TLSH
T1E422B852AE24A97B8CCBD70DBA15BF53D6F95432A5D11E48AAFC861C04E67CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d97328d-457d-44f7-adb8-330163796781.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d97328d-457d-44f7-adb8-330163796781.tmp
Size 10KB
SHA256 93059e6d05f81840cddd49a25c7a891fab6de28d41f9da13a2b42a6c540c8627
MD5 6723f5eb3743098ee42feb695fbf79eb
SHA1 b448929d9664b5dfa1e9ee3ee2eb469a9eaa09b5
SHA512 4a216a2c2add4aa42f5d280eb00c38efc96bf3aa2279138ffba50f279f0ac6c7f23d125fada0e0c91489efdd1b275755e97a445615839b540a16d2a5a8cf106a
SSDEEP 192:sxZ25RWWU/fhs/lIdpXivHW6+WNKAk7/YgNzP0Ig5NJ:sxZ253U/fhs/WIHbu/kZ
TLSH
T19132B812AE24A97B8CCBD70DBA15BF53D6F9543295D11E48AAFC861C04F67CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d00b874-95d8-48d7-9f06-7cecb649c8d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3d00b874-95d8-48d7-9f06-7cecb649c8d8.tmp
Size 27KB
SHA256 8a731595961d48f2c803192095ec7259c471e878d432bcdfc7f7a674b474997d
MD5 521d53d2cbe55ed2d29f93767f4e82bc
SHA1 b5310dfed2b6589945dccc0ae12341c4d12763f7
SHA512 8694af1ca1adc1751c5fdbd5a15e610c562846996669ba572c99a3a9c8aaf51aa75291c6b0255983ba99368c037017e5dd1c923467d2966f27fa6e89d0d4f0ad
SSDEEP 768:TsichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzsroAi+A:TsichfPWvPZhlu1jan+LKgz3sA
TLSH
T138C2FA7B640CCB7E4FC01A9DDD1A6F9B7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

478a272f-53e5-4f15-bb74-906654900c77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\478a272f-53e5-4f15-bb74-906654900c77.tmp
Size 11KB
SHA256 e2fcb6aa5b89aa24df491cb13802e9453701e661c5c8e9ef976f6fe90fe68b2a
MD5 a9f13afdca806e21a1a32f35447dd005
SHA1 22ff304646063aae75a02b4709e1e90f65c56cb3
SHA512 4dd191ebf258bc8216ada2e2b02fb7e43b0e2f60bf473c653a2c9aa556b92d02684654d2cf782e7d2c576d140f03ef5e9d5dfe35c23fde44ddd7f32d87a34ddb
SSDEEP 192:sxZ25RWWU/fhs/lIdpRivHW6+WNKAk7/YgUwB0Ig5NJ:sxZ253U/fhs/WmHbu/4Z
TLSH
T1BC32C752AD38A97B8CCBD71DBA15BF13E6F9543295911E48AAFC861C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6fe4e3c3-574a-440e-8869-a607af021dca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fe4e3c3-574a-440e-8869-a607af021dca.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b3f7a810817dce2611019c87884fc5f15d0fd618b105fa5c92378f400f80a44c
MD5 9fcdf05d2efb3a33e6667203f4c44442
SHA1 5972ceada00710790941440b6d069d29ef27d1fb
SHA512 e8fba0e18530f62f57741a3852d44c79bcbe5dec30d8271992d9454cfc61f6783a4a5f854d5507adb639d652fe159f574cb4e6f17fe4fbff325e9d7f96994ef3
TLSH
T18CE0869805DDC22FB218664752BC635C8B923A9A96C4AA7F7704CE8472CF544A2926D0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 1699a64178573142ba68e6ec31cff2d8689b66c59a0d0247fa45d5517dcb53ed
MD5 095d60126963813874fe71c36fbdc0a0
SHA1 d14e5e9f2dc163e73e4e254267065e7191eefb5f
SHA512 f9bd99b2c5496a7190600f829d5807ebdaac0e96225c162b2ee62356fd9b7125032a3c8c250aa1378e7edac87dd4247900ea854a492ac0c44c2c93030fd94c43
TLSH
T163511B90BAE0C045F7B493B161DD3EB73232E96D45731E2211B8D5FADB22768498A3E0
MD5 SHA1 SHA512 TLSH

Submit Download

3d01787b-3213-4a54-9df3-f784de314133.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\3d01787b-3213-4a54-9df3-f784de314133.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2964ca1b-4f99-4a2c-b21c-798c73bfd959.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2964ca1b-4f99-4a2c-b21c-798c73bfd959.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4890a206-2126-4b08-98e7-17721c6e12e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4890a206-2126-4b08-98e7-17721c6e12e6.tmp
Size 3KB
SHA256 23e2aafc87d3d28c7734a7c0b3798475e893283ea47c4590246a6daa54b007d7
MD5 454933fb368126901922c5e7a4a937da
SHA1 c0e45576880248410efbdf08863d1d9a3f56e956
SHA512 b19dbb1819d12237353a3d7fc87fa96a0b0dddcbc3871c47fec42da40fce7a20aedcae981c08f598feb7fce350c8dcba2cf41980e1515f06e026d6b27bb25ce5
TLSH
T122816AF2C3E4466DC90166F06A19AE1ACF2D0919539C3C29C6DCEF4FA3F2561E14254F
MD5 SHA1 SHA512 TLSH

Submit Download

af5199cf-b6e6-492d-a9c9-b7352332eb40.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af5199cf-b6e6-492d-a9c9-b7352332eb40.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 716f4e029c2c82e1af9c2c364b4d37de1bea3b8f829e1df2ddc6a25250455e6a
MD5 b2ef4e6092329fe11cde4b0979907269
SHA1 17f2bb3c68716e1a432d0038ad6a2fd3943fb4bb
SHA512 b2192aff531aacdc6588bbdc60b4a4b53d391f998e00766125ad5c8d10fc00f9b8483bd56f66daf92c80ea0dda7c9da85a8ad271f10cc282fc2fa7453ffd43fb
SSDEEP 48:K07+/bldd+bNglIS7+K9L1J+xTuYIZrfyL4N4s4h494P474/4gb4T4m4zIS414gO:KEIQKFW6WruKAs3bWKQMi+BiK64lz
TLSH
T166C1FF81307B064638BD254C80B5872E564231B3316DF6BAFF7D48A28A6EE445DFF8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

bd4b484f-8abb-482f-8bad-88c02dd4c2c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bd4b484f-8abb-482f-8bad-88c02dd4c2c2.tmp
Size 10KB
SHA256 21f16b4a4a9de48307b4ea09cf899553596c73e818fd837fe1b7c488e0532ac8
MD5 63cd83a7cb4d19757860f2e3f5f5c70b
SHA1 0bb7c5e1fa8bc2deb04a81e15cfe7367ac43b5c4
SHA512 f22f8b8c7acce55b8e16576798d0b761faae44494be221c138578e79b0d657b49086f8b9337268be4f18582ff40a0b187e7fa4b3d325461d4cfc9b2720be0c8e
SSDEEP 192:sxZ25RWWU/fhsulIdpXivHW6+WNKAk7/Yg1BP0Ig5vJ:sxZ253U/fhsuWIHbu/yn
TLSH
T1F322C712AE38A97B8CCBD71DBA15BF53D6F9543195D11E48AAFC861C04E67CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7bf931b-3cca-474c-b342-c289b42f5855.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7bf931b-3cca-474c-b342-c289b42f5855.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7483d6c5-1390-44c4-a7e4-804a4597252e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7483d6c5-1390-44c4-a7e4-804a4597252e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

e81d1891-b837-4e7b-a217-33ba32841419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e81d1891-b837-4e7b-a217-33ba32841419.tmp
Size 18KB
SHA256 43a90f1eb0346c6014d57ce4593b13456a333e0a8e00250027730d632e99d648
MD5 3f64e266e569b5d141264ee7a2ed0790
SHA1 eccdef33683b073e46efa5af00eafac3f47f24ce
SHA512 d98146952ab8d885a4cc01706e91db8fb5f41fe45b4e916b7609ce0de9e2fc91ec95dbadfaaf5e26163ea0297b99a16645a3ceb6f87b76ede169515be642571d
SSDEEP 384:gQkUSv0sNcqHEzi5mIbBGYX5EDtOxlLz5lvaTZcGH2IIlf:I0wFd1GYuDtOTLzvvaTZcGH2Lt
TLSH
T1F6826D32ACB9AC3749D6A650F14B3603DFB49027DAC46F54D5DD6B2C01DE29C234BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5285ce15-c763-4a8c-b6d6-69a85aa2a172.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5285ce15-c763-4a8c-b6d6-69a85aa2a172.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 66a20af278cb0fb3eb250657de450c427dfd6acde6374a0ff9c7cd9fd5af0993
MD5 ca754f010b1af49612ebe6f73494a7bc
SHA1 1d120f0872838dde9cb1a69db9aba7877b337b7a
SHA512 8a782c591c262e4dee96e1fff38f651ba803b29bef176232ead9de091964baeaf89f00c4868311f3514795b1a72fc6fe684120d6b47f2c16804bb62a2e9bea55
TLSH
T144415D5DBAFA104873B36E5AABF3A86E447BBD372E06945E10110D4E0766B40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download