hxxps://us[.]list-manage[.]com/dJTxywXDtRX?e=1b02972c7c&c2id=e71276ea5fd03e6f63c6f64682b4c6f2

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://us.list-manage.com/dJTxywXDtRX?e=1b02972c7c&c2id=e71276ea5fd03e6f63c6f64682b4c6f2
Sample261027-qmryvsdf58

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{6FBC8938-0260-428A-8D36-D4DD436257A7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe
4720	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 4684	4720	msedge.exe	85
PID 4720 wrote to memory of 5056	4720	msedge.exe	86
PID 4720 wrote to memory of 3712	4720	msedge.exe	87
PID 4720 wrote to memory of 3712	4720	msedge.exe	87
PID 4720 wrote to memory of 3712	4720	msedge.exe	87
PID 4720 wrote to memory of 4224	4720	msedge.exe	88
PID 4720 wrote to memory of 4224	4720	msedge.exe	88
PID 4720 wrote to memory of 4512	4720	msedge.exe	89
PID 4720 wrote to memory of 4512	4720	msedge.exe	89
PID 4720 wrote to memory of 4512	4720	msedge.exe	89
PID 4720 wrote to memory of 3932	4720	msedge.exe	90
PID 4720 wrote to memory of 3932	4720	msedge.exe	90
PID 4720 wrote to memory of 3932	4720	msedge.exe	90
PID 4720 wrote to memory of 1548	4720	msedge.exe	92
PID 4720 wrote to memory of 1548	4720	msedge.exe	92
PID 4720 wrote to memory of 1548	4720	msedge.exe	92
PID 4720 wrote to memory of 3272	4720	msedge.exe	93
PID 4720 wrote to memory of 3272	4720	msedge.exe	93
PID 4720 wrote to memory of 3272	4720	msedge.exe	93
PID 4720 wrote to memory of 4700	4720	msedge.exe	97
PID 4720 wrote to memory of 4700	4720	msedge.exe	97
PID 4720 wrote to memory of 4700	4720	msedge.exe	97
PID 4720 wrote to memory of 1296	4720	msedge.exe	98
PID 4720 wrote to memory of 1296	4720	msedge.exe	98
PID 4720 wrote to memory of 4588	4720	msedge.exe	99
PID 4720 wrote to memory of 4588	4720	msedge.exe	99
PID 4720 wrote to memory of 4768	4720	msedge.exe	103
PID 4720 wrote to memory of 896	4720	msedge.exe	105
PID 4720 wrote to memory of 896	4720	msedge.exe	105
PID 4720 wrote to memory of 896	4720	msedge.exe	105
PID 4720 wrote to memory of 3176	4720	msedge.exe	106
PID 4720 wrote to memory of 3176	4720	msedge.exe	106
PID 4720 wrote to memory of 3176	4720	msedge.exe	106
PID 4720 wrote to memory of 1412	4720	msedge.exe	107
PID 4720 wrote to memory of 1412	4720	msedge.exe	107
PID 4720 wrote to memory of 1412	4720	msedge.exe	107
PID 4720 wrote to memory of 1192	4720	msedge.exe	108
PID 4720 wrote to memory of 1192	4720	msedge.exe	108
PID 4720 wrote to memory of 1192	4720	msedge.exe	108
PID 4720 wrote to memory of 544	4720	msedge.exe	109
PID 4720 wrote to memory of 544	4720	msedge.exe	109
PID 4720 wrote to memory of 544	4720	msedge.exe	109
PID 4720 wrote to memory of 412	4720	msedge.exe	110
PID 4720 wrote to memory of 412	4720	msedge.exe	110
PID 4720 wrote to memory of 412	4720	msedge.exe	110
PID 4720 wrote to memory of 4980	4720	msedge.exe	112
PID 4720 wrote to memory of 4980	4720	msedge.exe	112
PID 4720 wrote to memory of 4980	4720	msedge.exe	112
PID 4720 wrote to memory of 5920	4720	msedge.exe	117
PID 4720 wrote to memory of 5928	4720	msedge.exe	118
PID 4720 wrote to memory of 5936	4720	msedge.exe	119
PID 4720 wrote to memory of 3108	4720	msedge.exe	121
PID 4720 wrote to memory of 3108	4720	msedge.exe	121
PID 4720 wrote to memory of 2656	4720	msedge.exe	122
PID 4720 wrote to memory of 2656	4720	msedge.exe	122
PID 4720 wrote to memory of 4088	4720	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://us.list-manage.com/dJTxywXDtRX?e=1b02972c7c&c2id=e71276ea5fd03e6f63c6f64682b4c6f2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff941c5c188,0x7ff941c5c194,0x7ff941c5c1a0
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,9241236657657145314,9952823328313339566,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,16104773144306809737,17339748677007471933,262144 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2388,i,15413398978403041934,4732557562045020627,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3671707695576543573,4351201622373572727,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,3581897112704805428,15915325063310460866,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,9000994457348401235,9982530511949828840,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,4365686063074009429,11101337557213206652,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3596,i,11731028026581919622,8158518231300223344,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,2459390710016877456,3680605253608445876,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,16104802119979137866,14141447399396442104,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,12696359722200293581,13602979387387439908,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,12696359722200293581,13602979387387439908,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6236,i,11805425215202915737,439848188068487621,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6400,i,8412160484085845704,10514009904383733150,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6564,i,10411275347179325773,7719527950602454467,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6616,i,7557883492196858577,17080881944587266340,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6840,i,1561708752141420227,15350694140520040910,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6996,i,11536736488425334484,3511234725158172649,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6988,i,2502821349639818178,12799137833542905367,2097152 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,3328398762375671745,14848447810916560330,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:8
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4232,i,4847483397160314464,15527459617482983977,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,2709681980601328084,6317707504625197681,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:8
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,10987674829410939857,13009492723904320509,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4756,i,8718036986168373291,9146946357156488932,524288 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5236,i,9151059835034857563,8390962568321953521,262144 --field-trial-handle=2328,i,2896734505400653070,868051319982338355,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5e9c7ed3-7c14-46d4-9eeb-8fcf770115d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e9c7ed3-7c14-46d4-9eeb-8fcf770115d3.tmp
Size 8KB
SHA256 23949a3359a59542757d2b335c0e1d41b1104341cc359208aa1a5ccfb0dfb5a0
MD5 06a29c0f9598813c0d43a54f674aac21
SHA1 339bd13c416fb7db32376b76a8e27f945c389756
SHA512 572cfae583cac642f2f235cbaadd3bd2a144d9a125e387cf99dccf3bd5a90dac39ca173b6d19fb277425b856e3eea9293139cb34d30e69da313acb7a49e857b9
SSDEEP 192:EONI6nnHGQmiUyZvQYcX5hQDP1fjzorLoaMc6RU6:EONI6nC6QNX5+DtH80CyU6
TLSH
T11702DA35ACB87CBB8EF76D45748622139FA4216BE5952B80D6FC5B1C00D769C2316933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aa6d267-9c5f-4402-86c5-f08c8780f36a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6aa6d267-9c5f-4402-86c5-f08c8780f36a.tmp
Size 18KB
SHA256 c95cd7ca80be90e83de60eb4f9b7925de9a8b44998189e84fbe6a6e07c7d5ce5
MD5 c25b5281da5d88fb673f830245276f82
SHA1 452e16bcc074252be108a5aad957a96aab9537af
SHA512 74099faa4dfbc756de457778e8c12c7aa106ede5561f2d9bdcb1fde5c859f88096faeedf6fe00ab3b3051eac2bb42d4c0c123dacb82e6d5774074fbe9a9af210
SSDEEP 384:NQkUSv0sNdJF9Eshpilf4QX5+DtH80gXmTP9vaTZc3HuIIly:30cEKpgrkD9QkP9vaTZc3HuLE
TLSH
T169827D32B8B9AC370EE7A561B14A3213DFB4D067D5C42FD0DAED9B2C01DD69C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c1d24032e322bda4aa4f943eeee5c1be2eee903b8fa00c6e40c3ae3aab1d6e57
MD5 cf18b86051311e5d4cb3435637b32441
SHA1 81808c10d3ea99d837ac73ca978bbac4af2b14c3
SHA512 d8f6d4f7cc0a9a322acccdf645cd0eaf7d236c68d82f2fd25c2d01e1e6ce323c3d584edd204b1c68ced260f3cf67a5be22a62de64511401735df9213129ac8f0
TLSH
T1EFD02B02FE898A6CD4921C34012E811D36CDF40049027041C0B023974C04701102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ba460c9f5a00478279781ba3317975fb747ea7519f30b24bac67a94df77c22d
MD5 be02dc26a22f37196d8a2ed1f90604b5
SHA1 0d4f49e0f6b152530b0ff133dac678914194c470
SHA512 74fcddf19d34dc2b1dc8ec59c0f57f326e68c7c9b62fb89494b07e2bd52522d6f7662a05f91a2d0787fba43ac2646fc3214bc591a45f14862aa715bcd9206f88
TLSH
T1EBD02B02FEC98E6CD8921C34012D811D36CDF4004902B142C0B023974C05741102CC64
MD5 SHA1 SHA512 TLSH

Submit Download

1dc95a1e-3aa8-44a4-86cf-da64ce8ab3ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1dc95a1e-3aa8-44a4-86cf-da64ce8ab3ee.tmp
Size 10KB
SHA256 f488206d534f379efef9d93d252d0a11c06112aef61d5ece7d1c7cd1c09a8686
MD5 92e6d24d4929a0cbebb69fbf25c4c04b
SHA1 9dcee6187702228512f12f944f3ff54626ba28b1
SHA512 064df45eecc0886c4d57570e4770b58930546f8d0aa2d5527682a6cda54d5b60a313faa5a011cc4ef0dfc6f5ec976dc3ca2ccb220855afeacf3d2a881e291074
SSDEEP 192:sxZaRXWR/f2sD9BIdplNHW6+WNp2YXYYBdGQYWIg5FJ:sxZa4R/f2sD8bHbTXfXF
TLSH
T1B322B7526E38697B8CCBD219BA15BF53E6F9503251D51E88EAFCC61C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e60dbd1-c8a6-4bdb-9ad7-75ddf7b29866.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4e60dbd1-c8a6-4bdb-9ad7-75ddf7b29866.tmp
Size 27KB
SHA256 831628f67536c0b878c04ad1a8ddbaa811b3c059220c79b002d18d86e6f7dc32
MD5 aeba4397e4aa57785ce13025c70eff24
SHA1 a547dc806ebdb313533a333427b9660ee3be43d9
SHA512 9fb27ab12bf3a964a3c5a8643fcfc631e0a7b0dd83a5c6d66fdc65c70b50b514cc72def23f12abb490616b4329c2cf851c4fca1b35d5b5b68755bd1e8ee1b68b
SSDEEP 768:RGyYR7jWv3NRB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXCrop6I0:RGyYR7jWv3NRBu1ja/CL8OXZM
TLSH
T16DC2E93B640DCB7E4FC01A9DDC5AAF9B7E9802C796548D4047FA984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65f5eb26-cbf2-4532-a056-0e58a802301b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65f5eb26-cbf2-4532-a056-0e58a802301b.tmp
Size 9KB
SHA256 4dd0112a76c7bc2038610bb91c47f517b50b0dd3709f6c7653e788f0193dad85
MD5 bf0442851720054f50ad2e07068406ca
SHA1 b1691e3c1f70b66bf0ff79130720f1e91ae7a6ad
SHA512 e30ba7c29e0631eef0665f043c5de40113f1da54b93ee40238691df43505287c000756f2ea3ddd9d852f03da3ab9f67ffe72f26cc5c5345498dc2ecc664535d5
SSDEEP 192:sxZaRXWR/f2s79BIdplNHW6+WNpAv/YYB3GQYWIgrJ:sxZa4R/f2s78bHbm/f59
TLSH
T11C22B8527E38A97B8CCBD209BA15BF13E6F9503265D41E84EAFCC61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

70212f3b-db0d-46d3-83de-9c1b2ae47e12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\70212f3b-db0d-46d3-83de-9c1b2ae47e12.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e253e82-08d8-44e7-a802-0a1cbde2f623.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e253e82-08d8-44e7-a802-0a1cbde2f623.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5585fd2baa2bb21af5dc2a142db80a2973d7cd5bc185c6a705b1925390d017db
MD5 d6fafc1338ee7ebb25e7e597149ea3f9
SHA1 63eaf4285fc505d2d172bc2a9149ecc5add73f8b
SHA512 e5dd9218f1303f905261053bd19abcc4ab933cb48eaad49c671ccfb4ed8c5801b11bea10ed0bd40098df172b90a4af679425c714028ecb99cfd37a4cfe1ae555
TLSH
T186E026C504D8C32FBA08687702EC634DCBCF365B96C0AA8E1B08C585738B858B782790
MD5 SHA1 SHA512 TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 81KB
SHA256 78d7bdc4a9aac70470323555d026f0f178eb4831ccc71134cfc391715b809b25
MD5 e1c3f101bcac22dea71b96cb4c07178a
SHA1 46ddbc20d85b70b9e0063eb56687ce448aae9662
SHA512 7cb751baa7995757f76fada6a0204d1aed67792daaa97a4bfa069e63be8709dad368292a5cbf94a802e08e7373d2b08ac6ac66751b9e6e8935b9ab3bddac14cb
SSDEEP 1536:doQDKWARkc7nyoud6B9bsphijX0AHIPcKvDWP5Vem2/nR5dPvUE3dH5Oqixb2:dsWknunir0Afqm2zhvU0lMxb2
TLSH
T17E8302B11C8BB174A3E92D7CF7B4436B47AB81865A067C8FE80C582F46DE279533B950
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 74KB
SHA256 70e4d628843c8aa128f28b04653deba8bc351b4b868d4d6e9ada67a3e2cfb400
MD5 5c1cb34c1dd3766326afedfbef9f4aab
SHA1 da51bf4e974c86eddbca6e3b7e07967b21a08367
SHA512 a42ca1fe34d594fa550c9f806022d3c3674a7f03ccf0359b1bf623883b807fad668fdb2a05e89e4335a98a88bb94a8f9b47423e22f2bc9d882899ed6ff26de5c
SSDEEP 1536:sl9xog1rbd61Os/oqNREWWFkSXI0SlxUbW8uIl/7SpLP/v9:s5Fp6l/RvWFkSu/d7Il8Pd
TLSH
T1DB730260BEEE2E1A9C337F0F5D94C9852562FE9B60CF16EC4FE44D98D15C1E682402A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 22KB
SHA256 0e8a1dc2693ce3fcf4d091bc3621300748a9339dc8911b6a46ab61dad35cde09
MD5 b260eed5a6a1ec2cee49831938ca0f65
SHA1 82704222f3b866c1e4188ddaf78162efd6cb378a
SHA512 98d09553d5722c22f0a475872add4bc693c1de0cb450ff9ac62c10fba26ade04282e27e59b5a894e5bc0c27f0de5e25558615a964266625a6492173b7931b0d9
SSDEEP 384:LVv4OD9AM98YMA17oE7G4wG4+YKjzBrQEWSfPZa63:Jv4OD9frMA3G4eN69tt3
TLSH
T1ACB2E0C8AAA451FE62CA6955BE65C805F0ACA07C853BB1120EF84AF5C333E6E1B35158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 20KB
SHA256 732bee4e6e3c895899898f42b62f93f14ddb2ffdbd012ff9a35428717465717c
MD5 a880ba47a8072f24d0c6b26a4d153582
SHA1 c0fac7a1d8b8a05a2e22ea560428cc61d418caef
SHA512 ec300e1e4d16fc4b182a3202dab3ec713b4488344b692527cd904eb6954269c39e65731c80ecf40aee55144d57485c1aa83d0122d865d972f7605474cf604b4a
SSDEEP 384:dH/uUdcAEpNmCdcQmTfFTM5zjjn+UrIxYOBDbKvxFKEzjDkMELsRfzGTvxr+u/kH:dfxxE6CqQqQj6U8xPDO553DkjLZTvx+9
TLSH
T15CA2E0913C37CABCBF10ECA0B359BD15A7CCB7C58466097D59AC6C29943BA42B11F4B8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 24KB
SHA256 f9074ac7ced776e010599f95c47c4f0306f31db29414d5dd9d8b80a844ce009d
MD5 bd9541be6af68e4dcdf4d9363ac06f26
SHA1 8b648d53599ec344fa9790f8ad2ed045194d5e1d
SHA512 7cbab524ae46f03f742908ba800e3e1bcfa992c10e0da189cd4fc81c22760ff2bc37acddafe54b87cec1142ce4196744c1104bcb7a0592ee6b2f5bbd2051a58e
SSDEEP 384:jWiPFVfdUiuti5OjtUfdTvsHUhVnp3tHjK3ieS6+NZoWZrM/q6Cb5hkNC1bMT:jWePlEZijskrDK336NZoerM6kNCVMT
TLSH
T126B2F10342AEC9B5EF4D02CB64947A97F00BAFD831EB1541545DAC9B1EB1232FE181E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 20KB
SHA256 b2a38a886df8c68c4c7920e99e8d2f83a2d6f1e8709165113c81e85d2d409208
MD5 ac7629695e92ae5aad629f6b058dc92c
SHA1 9e3b28512a5aca9f81a3ebd1e59a7f200f6aa339
SHA512 ddb694f8fc18db36300c7f061d7772ea1a281ac329c237464ad1bbef029befadd1aa568e6ac511e9474f6a2315dea09247765d1c8015c91bee9717fa166ef02f
SSDEEP 384:YsKXUdcAEpNmCdcQmTfFTM5zjjn+UrIxYOBDbKvxFKEzjDkMELsRfzGTvxr+R/o:jKExE6CqQqQj6U8xPDO553DkjLZTvx+u
TLSH
T126A2DFA53C37893CBB50E8E0A7EC7C0A76CC7BC8C9190535A8692C27906BB45752F979
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 df36bdf2406af5b60cf4cc9a358a7e88082c37475b93edce4124b070aa4358c4
MD5 8db93a219f2d64c259c8a4e3031e9c06
SHA1 ab4fbbc9e529f591ee29ab4b55687041d48623b9
SHA512 4545737bb8f588dcaa5abb8d68dd413b5217c679d54e96fa6a87e0077ca72fde75fae16219a8ed429f9dc649842fe80a5b08899d8239062f229b1c11fc23d034
SSDEEP 96:S8Cuvp5Eodzs8D/Vqx5JMOvS+0phV+3m0bvL:S8CSpWqJD/Mx5q2S+JbvL
TLSH
T1E791EBBB54AB5400EBBFDF7086CD196AB53063F8665B3E7395AAC83493A33C58002C0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 bf03015d6d908fbed2b43610fee332847f4db44ce0f76c63ce313b36442d6012
MD5 b8625b4e8802a3c2b90320dd1a38a348
SHA1 06b3f4ac8666c2f33a0e924b068cc3d0e1b7affa
SHA512 14309c4f6df910139ad9766ae1498541e43c0d7666e3502d896e52ede78eadc98fdd8efac0ab64fa2fb852b22e58d7ec25cc551ee5a301a2bb6eca5495387527
SSDEEP 96:4k8Kuvp5Eodzs8D/Vqx5JMOvS+0phV+3m0bvU:F8KSpWqJD/Mx5q2S+JbvU
TLSH
T1CC91EBBB54AB5400DBBFDF3082CD196AB53063F4664B3E7395AAC83497A33C58002C0C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 19680fd1ee5b7fa9820e153880d7a96f1cb0bbac3ac907b69808c8c8c257464e
MD5 a3af6e3a2eb57d1945dfe6ad72f65536
SHA1 b18981c82f6a83132979985295e2b41fc76af641
SHA512 9698b5673ea59a90f3c727ef81b9f7861ed9506632b3961ebfb9b56ebe39875c9d4fc4b46a140cdcf5ea8cffa3dbfa09e0860936cd66cc25d13bd9259e1c62bb
TLSH
T1C15191B908AB6451D77EEFB093DD22ABF63097F177937D03A6AAC574A7373009145044
MD5 SHA1 SHA512 TLSH

Submit Download

d588a05b-453a-4b33-94ae-336f344973d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d588a05b-453a-4b33-94ae-336f344973d5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.pharmacy.biz_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_www.pharmacy.biz_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

0c671905-10b2-4523-b546-daea6afccdf6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c671905-10b2-4523-b546-daea6afccdf6.tmp
Size 16KB
SHA256 8748f0dd21715a27c16f8e962329d62924f7edd9d40effd1cc498b58392fe1b7
MD5 24838219a6dd51e4477c8e0ece9718cd
SHA1 f556976c18532d805dc59260fd8fec148342eba4
SHA512 f36f553428a14b5814a5307f29917c92a3b3f1ba5385681981bd8505217085859db9152cb5e21df2f82c874b15c8447f9711d108d462988835ea145695ddb12a
SSDEEP 384:DiMN2Te7ebTzAVOe0+J4JSJHe1x/HstThY/AtBIiDBchVw3Ok5NG+lUBBhhBVBe/:Luof/erFzdl0mQ/NyE
TLSH
T14572AEF783E88D2DDD2355F05A582E2ACE591C28135C3C2689DDEE8EB3E5072E20355E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b522e27-6159-4c10-bf2a-901a3bc72c1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b522e27-6159-4c10-bf2a-901a3bc72c1e.tmp
Size 17KB
SHA256 482aa73db0402d83e044636393332b7ca26fc23d7828651b7bf195af53ccddb5
MD5 30631ccaec80e3afda21a79be4d9ddf8
SHA1 2ce270d1d9b3ae7f17fb8f00cc8086f10c365cb5
SHA512 987d8093b654013655722646d8ef599e6d7cbc9e09e24fcb5a10dd05bd453b3c383b5d70ed08984b288e4910c88238b79bf07f72027fdf596334ae442c73b954
SSDEEP 384:DiMN2Te7ebTzAVOe0+J4JSJHewIx/HstThY/AtBIiDBchVROk57+lUBBhhBVBetX:Luot/ebFzdl0mQCNiJ
TLSH
T146729DF783E88D2DDD2355F05A582E2ACE591D28136C3C2685DDEE8EB3E5072E20355E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d312b30d-9ffc-4c99-af0e-f49006221f6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d312b30d-9ffc-4c99-af0e-f49006221f6c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 96B
SHA256 cd9c9e7ab8f780320fb0f02fde60e008ae176db0e0f1693c326936aea7972bd5
MD5 f4cbe0599586bcb4f5e8e14aca63e67e
SHA1 7c2e4ce43bc743a3cb6f74bab69dfb352299610b
SHA512 ef2098a16f3f0f008240f7518489906d41ea8608d3ac3582551e677b5eaa05bc3f2f4dcda74b841e21ae0d2e6fce34f2c5e7c8fd2b417160b09b8ae92b52032c
TLSH
T11FB02202B0CC8023C8220B30B08C028C33F20CB003023E3028E0E8F8BE023C08302A80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 8bec10062f85f257670924c678945484dbf22a3e32e5326f2c775135da5bd0f1
MD5 e9e0151ee318c8ca4a5c28ffaff385d1
SHA1 a836222fe2fb139d7eb61003b182181ddcc847bf
SHA512 48df3c7e29d5d1534d601126b6fb87890cbb2207f08f9ec8183cf28599eb968cf9458cae7a1f49e23333916cb134dacf658fd1dae36ddec9b7e50864acf30d58
MD5 SHA1 SHA512

Submit Download

0bc608915a168042_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\0bc608915a168042_0
Size 63KB
SHA256 dc56963d46d8e31ec20469b3ea0bd18cf03329ef8d645997dc8038af35c7bc1d
MD5 0c51cca39187ad751f407105618d4501
SHA1 a3018094ec8f3deaec8205387439f7e36edee458
SHA512 bc6139077cb2eaa144f0e4fcbf834df1144c936c4947dd89221deba3177b0f045298c478b51ee0c58c0579c23cd7ef0d27054b05b11a091e9d8f8b494ab8fdbd
SSDEEP 768:SDMU85A/wcXAX2TE6WhrJTiJqq5ApKMiX6DFO4MFTqEQ8V8eGw3KQx2W+uBtm3Bt:HuQXhviJzqpSfN9Q8+enx9BI3i
TLSH
T14F534BDA736164B3437BA0F1505F170B713BE1A7F448C4A4B198ECE15E94AAA0277FAC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 2bc4bb4aab544755df28a44823b2513f53bd58aacc2e045ba2fa8c671c9f8de6
MD5 7297ba3d9acc1ef784e8de077613f118
SHA1 e82bc90b4c17fc5eeab6e4d5a852800e8e07a0b8
SHA512 7dd87dc91286036c659bfb5fe4edd7838562c72d5ff54f3632d36b0c49803cae56edc213d16ad5924d3670dc64c4adbfb9c553dde1bff74030e24064a40bbbbd
TLSH
T17CA0021521500141D1850B712085A34023287C145121423175E43C56DE651525201524
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 e4d956f6d90346e028eacc969d10ece211104e6c571a6322dff64eae0637ad6f
MD5 65a94378b4e4da3d3c19ae59f0c3121f
SHA1 ac677e65d72739f805b2b7deeb8698efc99d588b
SHA512 0db634c37fef7ad4b271a581e8f3fc61c7bf693b812c7559ca1fa6ffba834fdfdb126a9cb98d2148bd8dec69e00af1c8795c643440ecb4c0b70680ed95d8a74a
SSDEEP 48:KgvSbvRxRqbpkZIS/qK9f1VqxP6YcdfDyLVUplXD34brOrIS94K9d1P4x9oYePlq:KAkgKdaOiKMK7KkCEKTqKOJqKiIs
TLSH
T13CC1025036BB165178BD299885B58B1B124232B77119F63BBFBC11B19E7EE040CFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dd3adf63-19e7-4ba3-8b03-dbf5740fbbb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd3adf63-19e7-4ba3-8b03-dbf5740fbbb4.tmp
Size 10KB
SHA256 0d6e4cdd92dd974480234f8b1953bc9a2cf243a460bce067a9ee6828998c2029
MD5 6548293a1023fe906d705dc9c12b6809
SHA1 54394a4d92a910a846079420074a212e3566f204
SHA512 63a65159c684b2f6f9e9129bd585faae17f578d3e43be62135866c976f0c4e7f2c105ff8f9a1f480ca2e9126a91d9140db16a4d15a3bfed9ea1172abd0d00d64
SSDEEP 192:sxZaRXWR/f2sv9BIdpLNHW6+WNp2YXYYBezQYWIg5vJ:sxZa4R/f2sv8BHbTXfdr
TLSH
T12822A7527E38697B8CCBE219BA15BF53E6F9503251D51E84EAFCCA1C05E76CD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e83d9d80-489a-41cf-acab-5e6b853a588f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e83d9d80-489a-41cf-acab-5e6b853a588f.tmp
Size 10KB
SHA256 80bc43b96af81265f54be0f2facd738cd7428ca60fcb1a6860d4b57a6d7969d4
MD5 95da5f3ac343fccfc12919066f5a8075
SHA1 e7adbde71bad61355c87f640c462525aaafbdcc4
SHA512 cb82000160df95ed0142d27d293dc0d115522c97bd77ee1e6ea4c16e3040dc833df79bc33e3f1bec4ea6c2ab782166f7a6a35af6511491d55ed5d6aff125cb4d
SSDEEP 192:sxZaRXWR/f2sv9BIdplNHW6+WNp2YXYYB1MQYWIg5vJ:sxZa4R/f2sv8bHbTXfxr
TLSH
T19422A7527E38697B8CCBE219BA15BF53E6F9503251D51E84EAFCCA1C05E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1c5407a3-71c6-4068-aadc-993aea84151d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1c5407a3-71c6-4068-aadc-993aea84151d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b1b3eee6-4740-4b69-8b1a-10cf865f0135.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1b3eee6-4740-4b69-8b1a-10cf865f0135.tmp
Size 18KB
SHA256 c08341060a64bf9cc470db8b773037d3ae4b399a98a9e4fee66b388c51e59eb7
MD5 af433a9cfa8cbf8844a4387459913a22
SHA1 682fdd1e32cf316e5c47b2b79f5ab6a20e837ac6
SHA512 fafb4bab6508d6c4bc7c0ad4626dff5c6f67cdf97cca903c6febad4de68cef8a2fc19d2b7352efeed1da3d06961b6cbdbca28dacc609a5c86fa2ffd24c7894d8
SSDEEP 384:ZQkUSv0sNd8F9Eshpilf4QX5+DtH80gXmTP9vaTZc3HuIIly:70bEKpgrkD9QkP9vaTZc3HuLE
TLSH
T173827D32B8B9AC370EE7A5A1B14A3213DFB4D057D5C42FD0DAED9B2C01DD69C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5661a3c-7847-4beb-b446-4ca6db36ed18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e5661a3c-7847-4beb-b446-4ca6db36ed18.tmp
Size 8KB
SHA256 ab248cdafb2582ebe9533543542fd6d15ae93d5d1f992d679662adca75ba9c9a
MD5 6ceddf9001ba7393fc364972c85ab909
SHA1 9fe33173a54996f9afb7faa3077224512c79e99b
SHA512 c09bb7ad4eb28a0e4163af378a0596b097756e6b8cb46cc53cdae4371183f2a279f6bb4fd377ac88aab3d40c5907a020e7a44708500bd986ad9847a73e3bb261
SSDEEP 192:4CONng6nnHZKQmiUyAvIYcX5hQDP1fjzorLogXXbKzg30q59U6:FONg6n8lINX5+DtH80gXmoP9U6
TLSH
T157121C35F8B8AC671DE3A595748731139EA55127E6897FC0D6FC1A2C01EF6AC130A923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e70f29dc-f58c-44ba-b74b-2834eba472da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e70f29dc-f58c-44ba-b74b-2834eba472da.tmp
Size 26KB
SHA256 e2aca6a1ef826920877ea40d170a0549a1da7ba4406e5be1f9c4db133ed3c3fe
MD5 a15b3f7331274069725c685325ea1855
SHA1 ae13cce16cde3d1c2a68952a526edc12dc002da7
SHA512 d087897007ddfb2a04b1e74ffdf933bf9c247833be975f2b659ac87267107cfd2571a4f8e6f7232e42b1d09fd1bb401da8672d4591b7fa212d7346ba97b934e2
SSDEEP 384:ZiFzQkUSvBzsNn8TUNTUlIl8F9Eshpill4QX5+DtH80gXmvP9vaTZc3HuIIly:wFdxSwg2EKpurkD9QCP9vaTZc3HuLE
TLSH
T1A6C218F268D79837D9AE9B53A73D2D039EBCD053B4846A90F798591CCC8A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0d97675c-048e-4beb-b25d-1db6bfd8eda3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\0d97675c-048e-4beb-b25d-1db6bfd8eda3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 059f13f5ec535f41e7e916dbde09fa33dca083547931242db8b20e4dc1126906
MD5 c8f7d0157afb0aa3a740cc9878209902
SHA1 1fa82cfe467d17bd542dc800222ca6ff61622c82
SHA512 0d953e6f78d9ace7b0134ef4139d4e7b0fe80030a4d28ee88a72d6912c916027c8cfcbec72bd40a784c971edc374dc4296717d95faa395898bb60bb8509a9c40
TLSH
T1F5410948A6FD1108B3B76F5A9BF3A8AD447B78772E4A946D10110E4F0A26B04C971737
MD5 SHA1 SHA512 TLSH

Submit Download