hxxps://click-notification[.]capitalone[.]com/f/a/INL32CQBJ-WiH7N2KXTITw~~/AAAAAQA~/RgRnlmsLP0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmWxC-azZSe3FdxSEXRhbW15QHRmb3JvZHMuY29tWAQAAAAA

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click-notification.capitalone.com/f/a/INL32CQBJ-WiH7N2KXTITw~~/AAAAAQA~/RgRnlmsLP0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmWxC-azZSe3FdxSEXRhbW15QHRmb3JvZHMuY29tWAQAAAAA
Sample261027-vtmpyaey3s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4788	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{FF3D38A5-ED3B-4D99-B18A-DC835538EB49}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4292	msedge.exe
4292	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe
4120	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4420	4120	msedge.exe	84
PID 4120 wrote to memory of 4788	4120	msedge.exe	86
PID 4120 wrote to memory of 5076	4120	msedge.exe	87
PID 4120 wrote to memory of 4520	4120	msedge.exe	88
PID 4120 wrote to memory of 5076	4120	msedge.exe	87
PID 4120 wrote to memory of 5076	4120	msedge.exe	87
PID 4120 wrote to memory of 4520	4120	msedge.exe	88
PID 4120 wrote to memory of 1568	4120	msedge.exe	89
PID 4120 wrote to memory of 1568	4120	msedge.exe	89
PID 4120 wrote to memory of 1568	4120	msedge.exe	89
PID 4120 wrote to memory of 3020	4120	msedge.exe	90
PID 4120 wrote to memory of 3020	4120	msedge.exe	90
PID 4120 wrote to memory of 3020	4120	msedge.exe	90
PID 4120 wrote to memory of 2436	4120	msedge.exe	91
PID 4120 wrote to memory of 1064	4120	msedge.exe	92
PID 4120 wrote to memory of 2436	4120	msedge.exe	91
PID 4120 wrote to memory of 2436	4120	msedge.exe	91
PID 4120 wrote to memory of 1064	4120	msedge.exe	92
PID 4120 wrote to memory of 1064	4120	msedge.exe	92
PID 4120 wrote to memory of 3244	4120	msedge.exe	95
PID 4120 wrote to memory of 3244	4120	msedge.exe	95
PID 4120 wrote to memory of 3244	4120	msedge.exe	95
PID 4120 wrote to memory of 3912	4120	msedge.exe	97
PID 4120 wrote to memory of 3912	4120	msedge.exe	97
PID 4120 wrote to memory of 3912	4120	msedge.exe	97
PID 4120 wrote to memory of 4288	4120	msedge.exe	98
PID 4120 wrote to memory of 4288	4120	msedge.exe	98
PID 4120 wrote to memory of 4288	4120	msedge.exe	98
PID 4120 wrote to memory of 3104	4120	msedge.exe	99
PID 4120 wrote to memory of 748	4120	msedge.exe	100
PID 4120 wrote to memory of 3104	4120	msedge.exe	99
PID 4120 wrote to memory of 748	4120	msedge.exe	100
PID 4120 wrote to memory of 4380	4120	msedge.exe	103
PID 4120 wrote to memory of 2996	4120	msedge.exe	109
PID 4120 wrote to memory of 2996	4120	msedge.exe	109
PID 4120 wrote to memory of 2996	4120	msedge.exe	109
PID 4120 wrote to memory of 100	4120	msedge.exe	112
PID 4120 wrote to memory of 100	4120	msedge.exe	112
PID 4120 wrote to memory of 100	4120	msedge.exe	112
PID 4120 wrote to memory of 4836	4120	msedge.exe	113
PID 4120 wrote to memory of 4836	4120	msedge.exe	113
PID 4120 wrote to memory of 4836	4120	msedge.exe	113
PID 4120 wrote to memory of 4940	4120	msedge.exe	114
PID 4120 wrote to memory of 4940	4120	msedge.exe	114
PID 4120 wrote to memory of 4940	4120	msedge.exe	114
PID 4120 wrote to memory of 5212	4120	msedge.exe	116
PID 4120 wrote to memory of 5220	4120	msedge.exe	117
PID 4120 wrote to memory of 5228	4120	msedge.exe	118
PID 4120 wrote to memory of 5368	4120	msedge.exe	119
PID 4120 wrote to memory of 5368	4120	msedge.exe	119
PID 4120 wrote to memory of 5736	4120	msedge.exe	121
PID 4120 wrote to memory of 5736	4120	msedge.exe	121
PID 4120 wrote to memory of 6064	4120	msedge.exe	122
PID 4120 wrote to memory of 6064	4120	msedge.exe	122
PID 4120 wrote to memory of 4292	4120	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://click-notification.capitalone.com/f/a/INL32CQBJ-WiH7N2KXTITw~~/AAAAAQA~/RgRnlmsLP0QbaHR0cHM6Ly93d3cuY2FwaXRhbG9uZS5jb20vVwZjYXBvbmVCCmWxC-azZSe3FdxSEXRhbW15QHRmb3JvZHMuY29tWAQAAAAA
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x20c,0x23c,0x240,0x238,0x260,0x7ffc878fc188,0x7ffc878fc194,0x7ffc878fc1a0
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,1560252185851277888,16285549009601107300,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=2988 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,10896647570282330945,8682937660983806667,262144 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:2
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,7458131796795557427,16374490398172381487,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3926630191813726930,3857221697498712136,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13449326573479864384,17852431975828565301,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,10864027801654855212,30574844006392003,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,17821467443315543337,13595772294445701725,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:2
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,18424981304907484763,15338528695555683293,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3508,i,9222659582639036453,9385827971764022462,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3632,i,18182794345805295404,10305909136104851936,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,15199213933223016378,682423828338981366,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5588,i,2307813189030476302,12125375209887383357,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13914232938097912606,17834458942758667053,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,13914232938097912606,17834458942758667053,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6588,i,2398888523410731584,5242450507830295038,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5272,i,7795451835815022612,17110062987340442289,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4444,i,17956903203365092940,18228705546994604206,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5380,i,15363572606805984605,14844851376095206032,2097152 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,15927397632582246264,5557721634826311491,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:5212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,13793890348728600737,12815902672038956968,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,3493678439566879994,4754673065498177962,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:8
  2⤵
  PID:5228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4396,i,5139045193167230473,12368053324449815227,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=4024 /prefetch:8
  2⤵
  PID:5368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1269074241938568103,1655336318511356133,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:5736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,2810559788911585506,14195120751184230598,524288 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,17713547087937531312,16953069822963940514,262144 --field-trial-handle=2952,i,18080194807645100139,16818371583397272948,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

067aaa50-2fcd-4b38-a096-5541ac1c8462.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\067aaa50-2fcd-4b38-a096-5541ac1c8462.tmp
Size 8KB
SHA256 70ed809b80892d49175e4cc12174c711cb516cd60be512485ea3b17afb88cf04
MD5 cf0cff16ef092f4c1fdd5ef3ecc832e1
SHA1 c503e2af4ee6f26d589f0200419a48998e23e5b1
SHA512 8fd16d655a472b471a70ef32016d474781988bd3595c4eda5309e102609936f97dd5e8b4d995393b13a54522dc4dba53151e2fb93799849c5aa69f6f5712e83c
SSDEEP 192:aIONOj6wlDtAQmiUyQfQpaY4X58gZ9OK8JGvet0q+AU6:jONK6keAr4X58E9O/JJOAU6
TLSH
T178120931A9B8BC3B5EE6A544F48731039FA5512BE7896FD0C6DC6A2C01EF66C130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16b3b000-2683-4eb0-bea3-839e7c5a9922.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16b3b000-2683-4eb0-bea3-839e7c5a9922.tmp
Size 18KB
SHA256 9eecdf23f868dd8ef3d00dfaed112c291f4a4fce114b676ac327a28ebe1f7e06
MD5 e6ef86015ccc7081426936a7ae709dde
SHA1 2d1cbb0f8f42aaf2285a36b6fe6f8b3d898fa657
SHA512 79ae46108939c06006cc135618d6fdfb88bfa96d2b11f7527f7b834db6b0e27c98c57e5ce68ec9a2263cd3b011636ec93c738a6364ae460539575c0865512a72
SSDEEP 384:+QkUSv0sNvxdoZJDJHX58E9O/JPOAvaTZcOHDIIlf:u0jDda6O/JP5vaTZcOHDLV
TLSH
T177827D31A878AD774EE69650F54A3603DFB4A067D6C82F90C6CDEB2C01DE29D234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

392a5e6c-8058-4164-97e3-7881ce6f9a46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\392a5e6c-8058-4164-97e3-7881ce6f9a46.tmp
Size 18KB
SHA256 899fddbe9e8392fd9b851ee25a34c031a2dbc60f7a3cae6d2b2d9d05d83d081c
MD5 65fedd8ec773b69c077527d90bff02ce
SHA1 fb6366dd8ef19def6447cba3733bf0257a6ffbc4
SHA512 d7e6a41e887c8cecd8d94642839a90e8a9f50c50e08bc8ef08298a462a006ebb13a49cec65b466f985e0373ed0cbfaa68c65b6a9f602863fed952c83fb0f41c1
SSDEEP 384:hQkUSv0sNvkdoZJDJHX58E9O/JPOAvaTZcOHDIIlf:T0kDda6O/JP5vaTZcOHDLV
TLSH
T18C827D31A878AD774EEA9650F54A3603DFB4A067D6C81F90C6CDEB2C01DE69C234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

81cfa119-a5d6-4dd9-8cb2-9f80290952d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\81cfa119-a5d6-4dd9-8cb2-9f80290952d2.tmp
Size 8KB
SHA256 ffc83ebcb89df88c9c144486f08f22d364194033d6f258fe371d8e58f71f356e
MD5 5981a5b4ee680056d86439068fd33a1e
SHA1 95f68c461615864e63e86f95e68f238ac1985db2
SHA512 2abdf84fea3c2474b94d1d0ada9635b474f22815aaa206644e590d2daf6cf4ac8331390cc359b1aaf41b9d0b9cfc562aa6580da24acbf2713dc49e29defddaf5
SSDEEP 192:1ONr6wlDgQmiUyQcQpW4X58gZ9OK8tDlt8XhU6:1ONr6kgjW4X58E9O/jSU6
TLSH
T17802E834ED687C7B9EF6AE49F58727139FA5206BE6852F80C6E81A1C01D765C1307D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

11566761-e200-4e6c-bdc9-f32ee17ded6f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\11566761-e200-4e6c-bdc9-f32ee17ded6f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dfda724-22ba-4dba-b734-bb6d3916d14e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4dfda724-22ba-4dba-b734-bb6d3916d14e.tmp
Size 10KB
SHA256 18b674179ef75ddfe57a7c2354f9ff0f326a94034671f1caff6eb1a9ba643fb4
MD5 219410cf9f18b35f26d9f186296c0564
SHA1 31bb0ab1c43b37d93bdeb518d55e481452117c40
SHA512 54ff3a6f8ecc1b3c08650f74339edaecbcf004f9ee524c74f21c23f7968480cb873e4b410a0e3e856637e1ac549f694b82dbc82c8e34c736a4ff8be33bea43fe
SSDEEP 192:sxZQrtRz9WDZ/fjBsDAPCQFqIdpSQdQTHW6+WNLQ3pQ7s1/Yrl3QZGTVWfIg5GaJ:sxZ++l/f1sxWuHbgf/lB
TLSH
T16932D7526D34A97B8CCBD609BA15BF13F2F9503255951E58AAFC861C05F77CE230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cf304a4-3d4d-4eae-bbc4-1fde1160b775.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5cf304a4-3d4d-4eae-bbc4-1fde1160b775.tmp
Size 10KB
SHA256 1eecbff015e3a80fc51a2db204cff25d0844bd19767b448f9037b445ad9fadbe
MD5 99e2d7ed7cc8aee797f532c5ed2a4da4
SHA1 718d98db454c5ca977ba753f40c54eb06852bd61
SHA512 66dbf2429b9df52a0d3739b52055c0de5dab40c3a686d66e0d08a6b553775c005b92bc4669620e2f2fe8a2674e1aab8383ec510ef398635894fd5b89f03aa0d1
SSDEEP 192:sxZQrtRz9WDZ/fjBsDAPCQFqIdp4QdQTHW6+WNLQ3pQ7s1/YrlxQOGTVWfIg5GaJ:sxZ++l/f1sxWEHbgf/WB
TLSH
T1F932D7526D38A97B8CCBD609BA15BF13F2F9503255D41E58AAFC861C05F7BDE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77f019fb-aae5-487a-9d49-55daf27be9d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\77f019fb-aae5-487a-9d49-55daf27be9d2.tmp
Size 27KB
SHA256 b5f117a963965c3c7cc0a31137efdfa144f687a88e00898e979229ec5c7de13d
MD5 9669a792a615fa221081297e5ee6cf18
SHA1 26e55e38be42b2b384bd21683a1dd6fc0fd221c8
SHA512 4e82dab98e2bf1b65ea59fbd4b7a271b682110170bef82e046f31c84b7a403a1085b04756a10c254ed22c41c0a5d53782f5d1f05b4c269c639eee5d514e3f721
SSDEEP 768:khy4J/DWvbtJh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbrroRzXD:khy4J/DWvbtJhu1jajiLm0bYJXD
TLSH
T179C20B3B644CCB7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

805889a8-b6ac-4736-b117-a3081a57bf50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\805889a8-b6ac-4736-b117-a3081a57bf50.tmp
Size 10KB
SHA256 bc824d60794467633f40b5983c0f8be27de6236eda9fb24710a4815eace45654
MD5 77cc9b922ec49b9eba9c72081621be52
SHA1 41b349cb6cfc246c82bff6bb77ef24bce765a6ef
SHA512 266f51a19c5c52c14be4d9dbcb9fbf62cb68ebc800c1cbae0b8c8d1849e91394d4f07e4a00c4d0f512ea6663d6e5a7beb802ff0874cdc0bd217456dbd259b722
SSDEEP 192:sxZQrtRz9WDZ/fjBs+CQdqIdpSQdQ2HW6+WNtQ7s1/Yrl7QLGTVWfIgrJ:sxZ++l/f1snMXHbr/r9
TLSH
T10C22C7526E24A93B8CCBD209BB15BF13E6F9503255D51E58EAFC861C05F6ADE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e800ccba8f6da39be3d418d1172d971b62845ae24c8b594f012b1d678b1c9e7a
MD5 26892eaf684dee663016db2fe4a3b967
SHA1 0d00eb25c12f2770e381e0c4037e114991f3f220
SHA512 f190c41dac7db7d2a97532341668b9ac70283dbb4e20c27fb4ebd49b7fb68bdc07674efa4462e059573d99cc2620c0f6c3db20a974462317273a010f2a3ab8fb
TLSH
T1C4E0869405C9C36FB24C754701AC534CC791265B97C5AA5E1704D9887647554B792690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f16f5ddaaec9eb0aa551e328bdc395f4c4e0fbd040ffd56516f08702fab162fe
MD5 3aadd09e851a579a8d5df5c9802dd45e
SHA1 e49370b547a50c9003073b5b20616e692c299fa2
SHA512 613b729ad9f5f8e8be5e510670897a83775f1904012c4a94f40405c68b366fd626362d3c9774782cfedbcda6bc7bcc4bcac813c00f2572b3476d294d17152a4d
TLSH
T17EE026A504C8C36FA28F645B016C570CCBC1366B92C06A1E5708C68C7287240A7A2691
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 6KB
SHA256 5b942c71b64b016dbc1cac42ce9a5428537d07249dc7220ba6a9dddc87b5633d
MD5 dcc4dc45a0497d62af5e44d0d0007fbb
SHA1 cef40cc640b7e11b3a7ea5a19ea2780642a5d8ea
SHA512 1f41f566083e6cdf4e2ec12338222afff14917500529e66816b61a1e68df63a6488e1298513af658097942f703251a61973739926f50c688825ec75ed7b7c33d
SSDEEP 192:L/xiJ3ABgTtSYKPiL5tDQybvMj7ew5uhdJyAWip9JWCtYXnYLPf:L/xiJYgTghPiL5tDQybvMPew5uhdYNkB
TLSH
T187D1AA4A94813892FB2031746AE00CAA37360BEC6677CE9D5BE8E934744FB6F7475D80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7dfc4913730c154b6dd15f3f5bd87de5240cf9e4b6a374c3413449b18c288d2d
MD5 448c54f9e626847e4a2a7e536d3497c4
SHA1 fc114382169c7fc3eecea0149ecb41be5d10a356
SHA512 a02382bb891eba1107b1ade0e0898d167d522435700171bc02b8e2ec4cc5b2bf8eff1c6820d45fc9116f702a4d85f0c43915bd59b786ad6192d15fc6befae06c
TLSH
T1C761F78A89833CE9F76011747BE109CB337618BC56B35F4A2BE8CD38B84FB084500C14
MD5 SHA1 SHA512 TLSH

Submit Download

a04898e3-4adc-48fa-acc5-ac44d9dbfeac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a04898e3-4adc-48fa-acc5-ac44d9dbfeac.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6efea2a4-6bda-4944-b16c-999cb5dec1a2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6efea2a4-6bda-4944-b16c-999cb5dec1a2.tmp
Size 9KB
SHA256 93c357b6377cd21cda31d5fa3eb4aceea9e492d37e990e889d0d1b0ea29c6c66
MD5 2b2e3551d1fb7df04aa19af482c2d59e
SHA1 98cb4d200595c823e1456813d457f0be49cafc31
SHA512 ece8b8a9f2a7faed0922bcd2799f5fbefc8376067a3bbbbdd404859563e4947a1e4701646baeb4d114f35ebfc8c56fc97604298a59e0700cfbec09a51228f260
SSDEEP 192:Dub8RkvenKeiezeVwesezKxDl/ZvhBsAuq1l7hhwsrvC5n1b+6YuoRglcwA+OSiT:Dub8RkvenKeiezeVwesezKxDl/ZvhBsI
TLSH
T16A125EF7C7F4862ECD1152F09B247E1ADF2D2924026C3C6785D9DE86A7E2072E141A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

828c3cb7-ef47-4ea4-acb2-349e2d058b14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\828c3cb7-ef47-4ea4-acb2-349e2d058b14.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

890f7053-9229-473d-b631-4048edd68d8a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\890f7053-9229-473d-b631-4048edd68d8a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9120e7d7b07597aca9018004e6ebe17a4fb107ce985472d2a68e29ec680e377d
MD5 aa1a7eba35aee65670b0b046f2f79aa5
SHA1 d411c192f549f3d3a8c4921ca39cccbc3b44f07f
SHA512 0a26b82f9f3c32152151795d711f426e2964f82e1bc572a56ebe9d2151bb2929958e7cf2733ed76f31cfdea59dbfc433a1979ea20e230686a1fe1a442b48a1f0
SSDEEP 48:KIDI1Ks04jyLLuvL1t31I1KuAw3y9bIVKgswO:KIDCKs0+d1eKuAi+b2KgsZ
TLSH
T1B4912E4435BA4700397D3A4B50A4892A125231B77158E9BFBBBA85F25E2BF040EFC9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b705f5d9-0354-4d6d-a2d3-39608183e350.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b705f5d9-0354-4d6d-a2d3-39608183e350.tmp
Size 10KB
SHA256 0d3e5609d82e4ede039922ee897f1d7091580c27ac006ac60f06f0b1ef673b77
MD5 811800fd3b2e44f2a5e4fdb62a2e19ea
SHA1 4c35a5bf81b0b8a41fb58d5e3c4741ab0da42867
SHA512 e7d4796bbd4959435b0785dd79f62349c910858441d0b6fc28216272acdd6e40a367cb292cd229347d3ef4ccfc10ed8bac601dcb436c7a14c48a2a5981e9ed1b
SSDEEP 192:sxZQrtRz9WDZ/fjBsDFCQFqIdpSQdQTHW6+WNLQ3pQ7s1/Yrl7QLGTVWfIg5G4J:sxZ++l/f1sYWuHbgf/r/
TLSH
T1F722C6526E34A97B8CCBD609BA15BF13E2F9503255D41E58AAFC862C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d8c150c-bcfe-4291-90c1-f452a97be789.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1d8c150c-bcfe-4291-90c1-f452a97be789.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c1dd53fa-dd2a-462f-80e1-b9eb4380c1c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1dd53fa-dd2a-462f-80e1-b9eb4380c1c1.tmp
Size 26KB
SHA256 95493ee05ca32de811df87e3409556130e019e70727e236fdd6709b56d8ddfb5
MD5 cc05b13eb62b17966c6df43fc3f6b884
SHA1 93d9f541886d6022738c1110571deb82d95abaf2
SHA512 419966881b75ff815353db9f828a83513ba36be755e84b12d1e4f7407378674aa105119609bbae72a0272d4ba8cb0ea98f12f906e304144820ae70f9d7516fc1
SSDEEP 384:YiFzQkUSv3qzsNR8TUNTUlIlkdoZJiJHX58E9O/J4AOAvaTZcOHDIIlf:jFdyswg3ida6O/Jd5vaTZcOHDLV
TLSH
T1EFC229F258D7993ACAAE8B43A77D2D039E7CD067F5845A90B388951CCC9A1BFD346C01
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23727be9-ed0b-4e7b-80be-58656f550648.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23727be9-ed0b-4e7b-80be-58656f550648.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e2f454cd1be2869cd3278541bf29aefd8adc61d54afa6367d6faffc5ed45d1c6
MD5 d1feac27aa2d06b80f2e0168df52b54d
SHA1 492ffcd48aa556366d8fc841784418ad7b33529e
SHA512 32c12d34db1146160390b8974b44a48b9c116571038883854ed839c16debbbd7735641662e262b6d9459442d711c14bad3e0a9b083781eb34a3c658eb2da99be
TLSH
T135412B59A6F91108B3B77E56ABF2A86D847E79372F0BD45D10010D4E0A67B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download