hxxp://url3243[.]email[.]openai[.]com/ls/click?upn=u001[.]IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D

Analysis

max time kernel
898s
max time network
865s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url3243.email.openai.com/ls/click?upn=u001.IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D
Sample261102-e83rpssw6l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{3B74FC02-2821-4EA1-8203-D9C118A07599}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe
3760	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 612	3760	msedge.exe	84
PID 3760 wrote to memory of 1224	3760	msedge.exe	86
PID 3760 wrote to memory of 1628	3760	msedge.exe	87
PID 3760 wrote to memory of 1088	3760	msedge.exe	88
PID 3760 wrote to memory of 1628	3760	msedge.exe	87
PID 3760 wrote to memory of 1628	3760	msedge.exe	87
PID 3760 wrote to memory of 1088	3760	msedge.exe	88
PID 3760 wrote to memory of 1968	3760	msedge.exe	89
PID 3760 wrote to memory of 864	3760	msedge.exe	90
PID 3760 wrote to memory of 1968	3760	msedge.exe	89
PID 3760 wrote to memory of 1968	3760	msedge.exe	89
PID 3760 wrote to memory of 864	3760	msedge.exe	90
PID 3760 wrote to memory of 864	3760	msedge.exe	90
PID 3760 wrote to memory of 1952	3760	msedge.exe	93
PID 3760 wrote to memory of 1952	3760	msedge.exe	93
PID 3760 wrote to memory of 1952	3760	msedge.exe	93
PID 3760 wrote to memory of 4340	3760	msedge.exe	98
PID 3760 wrote to memory of 4340	3760	msedge.exe	98
PID 3760 wrote to memory of 692	3760	msedge.exe	99
PID 3760 wrote to memory of 692	3760	msedge.exe	99
PID 3760 wrote to memory of 2944	3760	msedge.exe	101
PID 3760 wrote to memory of 5020	3760	msedge.exe	105
PID 3760 wrote to memory of 5020	3760	msedge.exe	105
PID 3760 wrote to memory of 5020	3760	msedge.exe	105
PID 3760 wrote to memory of 4852	3760	msedge.exe	112
PID 3760 wrote to memory of 4292	3760	msedge.exe	113
PID 3760 wrote to memory of 3444	3760	msedge.exe	114
PID 3760 wrote to memory of 4976	3760	msedge.exe	116
PID 3760 wrote to memory of 4976	3760	msedge.exe	116
PID 3760 wrote to memory of 5000	3760	msedge.exe	117
PID 3760 wrote to memory of 3280	3760	msedge.exe	118
PID 3760 wrote to memory of 3280	3760	msedge.exe	118
PID 3760 wrote to memory of 732	3760	msedge.exe	119
PID 3760 wrote to memory of 732	3760	msedge.exe	119
PID 3760 wrote to memory of 4028	3760	msedge.exe	120
PID 3760 wrote to memory of 4028	3760	msedge.exe	120
PID 3760 wrote to memory of 5676	3760	msedge.exe	121
PID 3760 wrote to memory of 5676	3760	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url3243.email.openai.com/ls/click?upn=u001.IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x210,0x260,0x7ffa1643c188,0x7ffa1643c194,0x7ffa1643c1a0
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,6845559030359304449,16325491527729966826,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,6224815117197855237,11207234987826976766,262144 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=2876 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2324,i,16301801760882303409,18266675005368020325,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,355176360985498484,15687924631402719169,2097152 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,17433705373604673707,4312529863850980013,2097152 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4856,i,288634691549169674,8520875294015947034,2097152 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5532,i,325608914609606000,3829984271611760797,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,6848091580973136635,5686238908885288593,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,2363518581326708946,15493048936442539816,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,2363518581326708946,15493048936442539816,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6328,i,13803023768584891645,4200259738410740820,2097152 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,11742443683704292148,7811933904597749793,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,5382823328094966696,6741337061901217098,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,8967707030239544703,6492032409136386058,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4952,i,7530895502065855909,14757776657060451314,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5816,i,6603837152824188571,4919977815127616088,262144 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,8960861606503983695,10745742708527509481,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,270714274415087191,2522621924803510455,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,13746912787833886678,1716426573476580485,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,5637093511212461509,11857898518161558197,524288 --field-trial-handle=2836,i,7533915723753912261,12978182827935527584,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5676

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1716

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

04850abb-cb36-409b-a256-cc16d98e23a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\04850abb-cb36-409b-a256-cc16d98e23a5.tmp
Size 26KB
SHA256 b6ea778d0f21144ab74a01c755c7915a7a2ac90c08782885977ff7bae7d50bf8
MD5 9906501f6c6033e1f07ddd4ab128fbd5
SHA1 bcf22401df3eacd8b11ff2648677766bc68580a8
SHA512 482fa3c7f831823ad52406dde345d30a526edec8351b8ac138f3a76a056e995db8a24e575858b7d4c7cbf25866be81cce63f4beacff3c4fc8c09ff2fc09b2445
SSDEEP 384:nhiFzQkUSvJ3sNP8TUNTUlI4GD5mgM0dK2fLBEUD4jiZHRm3D0H7vBEFbgL/7Iz8:IFdJ3ywgGM1BEUJkT0H75ERLI
TLSH
T1BAC24B32E895DEBBADEB8F95A30A3643EEE04253C5DC4AD4D9C95E1C00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

29eb72ad-4546-4bf7-af3d-50a1220bb793.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29eb72ad-4546-4bf7-af3d-50a1220bb793.tmp
Size 32KB
SHA256 f3a21b433fd79ed31f880602feb2f5595586909bc944301bba810c5300717ef4
MD5 dab01b3c54ed50df54a24a06267f2842
SHA1 bbe8bb70f122e0b72de14723b3b32a8500f01f8c
SHA512 7256347fc298ced89bf5a18a8e8bdcaf2fc2f639ebe610fba72d25637840d97c7146cd85e177eaa47bc7c0fba4c46c6b7a3a443236c9217189aa2d279cb0867b
SSDEEP 384:n8iFzQkUSvtQsNP8TUNTUlI4GD5mg4aqdK2fLBEUD4jiZHRm3E0H7vBEFbgL/7II:nFd2ywgGV1BEUJkU0H75ERLI
TLSH
T1B6E290F1A8D78977E8AE4B57A33D2E429ABCC113B5984A90F7C90D1CCC861BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d624189-425d-47fc-921d-b4f938201459.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4d624189-425d-47fc-921d-b4f938201459.tmp
Size 26KB
SHA256 9121d05e74f740cbff6e9bad39208c240c2fa52d0ad9e20963667d2db80d2856
MD5 b713f061e642e9328fa37886fd4b51ee
SHA1 955c90a579ef2d2edad15f8ec4507398f250c395
SHA512 f7dfda8b9a3fa262fd82596d25fa28e2baeb3cd1f789731176416a0f12bd889780f0f7773541f0057a0a814843c76af2907240182dc3063265824bb3e8ea5e15
SSDEEP 384:n+iFiZcI63sNz8TUNTUlIm25mgbAOK2fLBEUD4jiZHRm3o07O6R2Feo5MgL/7IzL:VFQ63CwgSLCBEUJk407TRMGl
TLSH
T176C25C72E894C9BBECEB8BE9B74A3607DEF04163858C8AC0D5D91E1D00DB59D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68079c1a-add1-4f99-be61-10888667ad0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68079c1a-add1-4f99-be61-10888667ad0e.tmp
Size 26KB
SHA256 a826be52fe571f7563ed3e7f77c7e3c2bf4ad9aaa55713c234affcb1a8a7839e
MD5 2c745bc085964a43efb788ba8cda42a7
SHA1 af0851a352db664915c085d33e14246d882e5083
SHA512 09f5d3b8a3c04cc90d8e68cd469478074e440bc72a36557b1a16ab951d1bd1efbff2bdd570e80472c7c299857f9704f83adc666320d814c61fb2725fba9c82d4
SSDEEP 384:nsiFzQkUSv7sNP8TUNTUlI4GD5mg4a0dK2fLBEUD4jiZHRm3D0H7vBEFbgL/7Iz8:XFd7ywgGD1BEUJkT0H75ERLI
TLSH
T1E8C24B32E895DEBBADEB8F95A30A3643EEE04253C5DC4AD4D9C95E1C00CB19D570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

206bf58e-af0b-498f-b251-39f22f464d68.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\206bf58e-af0b-498f-b251-39f22f464d68.tmp
Size 12KB
SHA256 fb7f4840ea1a7c31585b377725cdec1422bca47a9616f9ea766b954b502abf6f
MD5 e2f10587a82df8f7964baa7e29c3f348
SHA1 089e1fec624e371f84645a5a7655be7aa9104b5b
SHA512 28e3088e544f856430f32350903e527ac9cfee8e7e0e7f5864f800c24f589eec714cadb58c88ea277f230b4f480a17b6fccd7b0049f9c29e90df4fad28f25b8e
SSDEEP 192:sxZ8RAk0/fBsZQZZ7fzodp1ViHW6+WNB3p1/YbIUBWYah5YIg5rxcJ:sxZ8F0/fBsZOZ70KHbp/F9YK50Ju
TLSH
T13942D755AE34A97FACC7D21DBA15BF57E3FD503290901E44AAFC8A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

30baf3be-616e-4e68-b78a-962749be967f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30baf3be-616e-4e68-b78a-962749be967f.tmp
Size 12KB
SHA256 04e377c53915f8681ac08343af0f3060527f13c82f0c25660829bdb8dd47d4c2
MD5 a926294d55eaa271e670b0424bbccade
SHA1 1606587b6f813ad47422051bcd94e59e6a02aab3
SHA512 03437c72e90740a66e1e12abe1ea44bb56b8a7a89c97dd04914ef8102f01856fe2319dbbe8e61f6a3ad9a66a2b22c7eb95b7460fb9099cb3be4199949aa46558
SSDEEP 192:sxZ8RAk0/fBsMQZZ7fzodp1ViHW6+WNB3p1/YbIkBWYah5YIg5rxcJ:sxZ8F0/fBsMOZ70KHbp/FtYK50Ju
TLSH
T19642E7556E34A97FACC7D21DBA15BF53E3FD503290901E44AAFC8A1C14E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d02b261-b499-4f1c-97be-8b0ed0e15c8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5d02b261-b499-4f1c-97be-8b0ed0e15c8f.tmp
Size 12KB
SHA256 1e06a8a43ee5c6dbae09e804e39436a11368f68708ccd6ace3ed597cf1e1ac06
MD5 3c3693c718b080b9e5c774e0be38c157
SHA1 7fdf2f965ec4d0108cc23b2c2f8533171906377f
SHA512 3cbcb3254f6f003b98e282c833d706facf597c6a3fcba6f53773ff9b3ed3b426a9ac7f90d34506c45e677bd1084e4e60d1fb4d4520f87728aeb87b4dbf8f9117
SSDEEP 192:sxZ8RAk0/fBsqQZZ7fzodp1ViHW6+WNB3p1/YbIUBWYah5YIgjxcJ:sxZ8F0/fBsqOZ70KHbp/F9YK50ju
TLSH
T10942C655AD38A93F9CC7D21DBA15BF53E3FD503290945E44AAFC8A1C14E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8433f428-b533-4a56-a9ee-33d015713175.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8433f428-b533-4a56-a9ee-33d015713175.tmp
Size 26KB
SHA256 101b28934610eb04f1d936e0bf5631c8eca1fd9af8b9b1a8191f9eab6c7c63bf
MD5 edb5e71c34a60fd66d9ecb99d73269e0
SHA1 700e79bb5d42360634f6e5cf55fc114365f54750
SHA512 2a0a6cb80bfa9512a3f8f1f43c8a6623fe4f1380535ec4f0d0cc902d7d25bd455d15210c9bfaaf01c78e32eb65e09158e75c57b14357ec03a910e0a23aec9aa6
SSDEEP 384:sxZ8F0/fBsY66s8qMpRiYnazAW8pZS15posJWeT+MOZ70KHbp/FDYk50Ju:sEF0/fn4Mnc7WeT+Ma/HbNFDD51
TLSH
T1C9C208059924C83BAEC39D18653C7E33EAEC506251C5DEDA5AECCA1C01DE1FDAB47817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d90c990a89978e45f1e9ab9022ac3f8ec8d2486d3c854d53ad8f95bfa22359db
MD5 9e61d6ab9ea87058fc6d3ac0cc39eb75
SHA1 5f55ad3b8bc23d675a606960d6d1b69f1e568700
SHA512 82e1f0efbdb95432e7284ddc2483dab8a18b9e985bf696b12cd3b98faf321f4eac18f0ab121a31b286922ea0cc115e29533479a4244f10e5c4bcc8b8eae8e749
TLSH
T19CE086E60ACAC26EF308754702EC434CC6903F1B97C4FD5F1B24C89C7581584A6A7AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c67c617163b7a4aa4837eafe00e09aec915524943c6069863939e778bc5804ea
MD5 8dcf82a3d95eae39fd82c6958a37b763
SHA1 0b448cc0167e1f279d572e54d8cd82fa1958f954
SHA512 7cf56b2d4d0d0df0fbe8e674eb734384875726b9af61bdd5a69cdb67c9711810bedcda3d3d2572085f3b5b9974c0be257546ce4d8ad28161674ad43d9d6c2d16
TLSH
T123E07DA91ACCC22EB208A89703FCC70D8E903E1FD3C46E1E1704EC9C7401440BAE76E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2fac30a3afabd29b45c6b578592be42cd77cbbca9479f6b8a69e5342fa55bdb7
MD5 e6407edbcc55d0ba2272774b55a71d81
SHA1 eda1f9d6a9c772e76065013a8f0ce3f130f7d337
SHA512 069d63856d01f10518ddea53206d774ef72df8e0881fbe16a96fe222dbddd764221eb8a8bf705f1010faaba2a87eb079ab0cd8d1ad86aee7cbfade854c2b820b
TLSH
T13DE07DA916CCC32EA64864D711E8D38CC2B13A5BD3C0AE1F1F80CCC97481040B2F67E1
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 3e000691990df046a87cdd1c2487f2c9706a922caf347fe581e626b58d78a5c4
MD5 54ef6421c04ed508d2a9a496e6920f68
SHA1 530cc0445811d2bf258fe1d82e7703a5ae605716
SHA512 100a057e81168cab38cc2113ada34686842a80c37c54ad99a939a46b8f13bf6eaf37aadfa2006dd4d9fcb2c44efe697e838e05fcc2dc4c02bd0211724341df22
TLSH
T1C2E0E5A9CD36AC7718FC0B2850540645EA5113872A80944AB73C910D8FB1636458686C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 d442ea983358cf753d8941173cfb15c64e53e5b63217ed3d196d26b8e7294709
MD5 693c064d8c522cd881466b8ea6e4bbac
SHA1 1d3ca1a10832e9daa9ee7050e5f918bdf559e15c
SHA512 d1244ab0bd50ba8afd434ef94977fb5f9b3e906c18774ab80c7b6420ae6eabbeb902a7c73fcf1f137685e85e8eab0608f70d7e8a615b4b2b912370cad2ca93f5
SSDEEP 96:AkZAJdl0+rG5qZD4D5auzTA6FpJ7wbrI4SkRknchQf5NrD9v0:AkZEl0p5Io4uYEwA4Wche5NJ0
TLSH
T12CC1BCD17289529BF77E25B84AF160433D3207AA5ECFAF9984B3E03D5C5D793D242124
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 c1f54f708296d0926874cf5a031f80a0f75e0fc7ce15ad8a26c010a372359573
MD5 d43c50031ad78dee5c7517114c446a44
SHA1 8d4b4ca36cdcbadacd227f957f52522d05dba665
SHA512 58e1da897efdf43dcbcb3b7defb7123c8eff828f49ecd1a2a9a9cb1bfcbdc4f85849e404171439381174ae00678dbdd110f11c01b8e25f450b7ea35d903c16d2
TLSH
T12C6183E1600964EBF76839B443E1B047393005FF5587BFAD00E7F47D6C5ABA69380208
MD5 SHA1 SHA512 TLSH

Submit Download

91f3f862-e84e-4c5e-90fc-f6a96de06653.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\91f3f862-e84e-4c5e-90fc-f6a96de06653.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 033015d57f4092e64f29fa65e616a5f2e0a486daa31f6e4ddee6eaf326f142d6
MD5 096f9749ac41716567e84b3992b39927
SHA1 94b073695ba74d13beb1db65e36505947f47ec73
SHA512 c01b2956a930983f80946f95a2a2d13bf7fed1b30a230ab8282388aae242551fb62679ce9056eadeed7e71df7ccca304a29e3a216c56aa82c89802622894cea5
TLSH
T15AE0D87889CAC11FA12460E616647B0ED6D3260B9BD8BD491F92CC187482089F06F6A1
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

43c8e1a7-43c2-4a33-8474-6429e31317e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43c8e1a7-43c2-4a33-8474-6429e31317e0.tmp
Size 4KB
SHA256 b3ec2c07e89498d2b4bb9ff80aa462b4f602394b76b39ad59b6f63c0440caebe
MD5 e75c684c2a31239f88ac4b86e0a98143
SHA1 f780077275694e751f1339b0e10abbb5b1f14df2
SHA512 0c1cccd335a53842e7c69de9198403a6c3f72c931fa7b7a694338f42f174ccf56b3feb2ee74586a06c1fa1d083adabf98347af4ba7a80e66ea9c268ac86735cb
SSDEEP 96:D1WOt7rt7pt7QuU5Nt7gaait7rzBuUgOt70pt7QBt7Et7WOt7Tt7fOwBt71uUVqy:D11NfytN2aaiJ1RipeW9RckjpqGj4Py
TLSH
T1C891AAF783F5821DCA119AF4AA18AE2FCF5C1514432C3C7A89E0AE5793E3072E00175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa0ed55f-c5fe-4a2d-946d-4854760a742d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\aa0ed55f-c5fe-4a2d-946d-4854760a742d.tmp
Size 3KB
SHA256 df549adb53993c058cedeef8d4b77c3717311769bfe775a1d0c777a77ebf6cea
MD5 7aacc328a406ea0d442f98232c8ea680
SHA1 1bf025dbd2289f614c934d4ae393e67f3ff77f79
SHA512 47c335f43b1389915032be26047f68181ae29f9754bafe9bef56577af3c046d37807d86e2b7bf108ada819049c88a05c8fd09a7feef09aff2da3f9c8a94fbdcd
TLSH
T1AE819CF783E5812DC9115AF4AA18AE2FCF1C1524432C3C7AC9E4AE5793E3571E14175E
MD5 SHA1 SHA512 TLSH

Submit Download

d0e8ffab-29bd-4a5b-a445-eb44b3a89d8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0e8ffab-29bd-4a5b-a445-eb44b3a89d8e.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e9509d05-6e4d-4c01-981a-2d4a8d7c7a5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e9509d05-6e4d-4c01-981a-2d4a8d7c7a5d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ed713f5e-5398-4831-b8de-3852e31d721c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ed713f5e-5398-4831-b8de-3852e31d721c.tmp
Size 4KB
SHA256 4f61f867494380914755121d8d39ba7cb3426ac565563ff98c15ff11ba27dbec
MD5 73f597828d2d434d21ddd5790b7e4f54
SHA1 86dc4db040a5d42df1fbe40947a6cd7018f91a09
SHA512 2a48775744ec012ceea73a3b2d6c880c39defba9e7b58d1671dfc7f60a33a35a418d70d23767d9f8a1dcb5f9b784618fab8af90e943909b736de55ab1554a87f
SSDEEP 96:D1WOt7tt7wt7at72uUBaait7rzBuUgOt70pt7Q+t7Et7Wut7Tt7fOwmt71uUat7k:D11jWE81aaiJ1Rip5WVRczjOnyx
TLSH
T16791ACF783E5821DC9119AF4AA18AE2FCF1C1524432C3C3AC9E4AE57A3E3572E10175E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3321dcfb-0d98-4640-a7ae-3c74f1b8c150\index-dir\temp-index
Size 1KB
SHA256 924b63e034010d268ac3bcf3b6559e1f96ddcb311b31082d8c2e5f5575623da5
MD5 ad83ab11dbbdc5e1a05ab0306967ee5b
SHA1 9a5f872174dea4c72e9c329106c4e8d5de78ecba
SHA512 e7a12b46109afc5947a69718b7d5db9beb6466fbff8e8a1698f2c31a0b30ecd18007125a741fc1ae1413ba5fa225d1a6d50ce7fb6be68a323897ea1a0f97bcf6
TLSH
T1B12165824E426F6BEE646278143D2456B33097CC13947A0F53FDE1399C97B44BD45994
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3321dcfb-0d98-4640-a7ae-3c74f1b8c150\index-dir\the-real-index
Size 1KB
SHA256 2475aba37c2d36653a80ae4ddeb05402a4dff1e1e121831256ad743ba045c21f
MD5 1b118d1562905be6b534c11c23169e51
SHA1 ca7f1c7d81689c470c9247f3f6d921ccf0b6e203
SHA512 197b32d5e7755b9f581f87b4b5acbda9d30a6348490dc7e1cb5f76b077a6cb685deb073dfbc61b57ad4d84cb6bb00854616a0511651609e582ff4cbf8f44e431
TLSH
T12921885201631F67FC4423B6456D58933335E5085344774FA3E7E13ADC81B44AD86DE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 1f7a80c98c250ed379324890071f56768a8ca25ec9eac3fba9889e2cd5806612
MD5 14b49a007936167e4f75fb0a53471b5b
SHA1 0383a07e6911e746605c1487cbd9a91fff4156f6
SHA512 ad609edd919bb304a2370a6d742ce25a8d3259022ba03423e1372b1eb9ac44e86d7ec304840692a95132145a937e0cc1b3b7be43296ec029b93ec3fb16994ffd
TLSH
T178E0C07F28F32E20FCEF83F518B0416600123814C405BC4F502EA7D791F1381B84AC21
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 99b8accf610b3ed9357b860fead6d17a951be1ba2a64b03d1ede039c68fea7b2
MD5 8037f9e7ab06adea1c3cee5f0d7cb0a9
SHA1 b683441297f1035ad79792cf5a74e0d2dde27800
SHA512 380893df7203736ac08b8954041deffcd65f8b4d4cf968e232670ba8d40050b95ae243b79e6b2fada8422056362972acc56a4d07fdec778af91c79bb598941e1
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXmd3B:OtfFvpopPxrB4RhfmdB
TLSH
T1FCB2341471BA021038FE790881B5972F064232B33259E63B7FBD55A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad9ebd9b-5f53-491b-8100-c70c713a9ba0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad9ebd9b-5f53-491b-8100-c70c713a9ba0.tmp
Size 27KB
SHA256 9c96c636b82d86bbdb2a11cc00577c970a5d4a847b819cff6a4e50e7334429c3
MD5 b8af9ee24882a62aa26f99aa952807b5
SHA1 40fb5f7bb1991cb5064598df778f6eb57f29216a
SHA512 eee71f56a430d2f0d594b3d7775d8f51c347bd4c94e7a06915af9698228f8e2c9c0727c58f062b6e80508328710468dc3df1a65a32eaef95009b8ae01fcb7a97
SSDEEP 768:0RyktrnWvDBtt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroG1K:0RyktrnWvDBttu1jaLWLywf0G0
TLSH
T19DC20A3F640CCB7E5FC01E9D9C6A6F872DE802CBA6548D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b6da2fd4-89ef-4ada-a5a9-bb2676d0c080.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b6da2fd4-89ef-4ada-a5a9-bb2676d0c080.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 60a517f1e8d75b9840f24e4d61667251787c8b7628ac3f1b9360edb3c9286efb
MD5 91c818327f611f5fcfc1de18f8bea83d
SHA1 f05af5b86a11ba99bbc7a309edff0ea03e1d913d
SHA512 2a6ad03e0382dc4cfdbe7eb42fd8385137688801e9620fafce655775d1568778db75ead1616263b09983fc98ae55929919c6c3f30f416439f8a90babb4e514ff
SSDEEP 384:nOiFiZcI63sNo8TUNTUlIm25mg5pnK2fLBEUD4jiZHRmBDQ7O6R2Feo5MgL/7IzL:lFQ63NwgSa3BEUJkBDQ7TRMGl
TLSH
T13BC24B36EC94CABBEDEB8F9AA74A7A07DEF01163819C89C0D5D91E1D00C759D1707C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 04a0699b346105e78e03e64a4d86a945770c4aff4685f390a4c9d75d9edae11b
MD5 f55e692f100dbb7a5ab6c7a022a80929
SHA1 786c0b56adf82192ccd9b7bbfc01f79fdd6f9945
SHA512 115a75c2ddfcd50f3ff39263d8fb68280209e32bbe6345482678d68a0b3bf41900b3bb763bdd13fcc79055c25ba7312979fa265dbfa82e8507461b001c4363cc
TLSH
T1D0410B5CBAF92108B3B76E5A9BF6A86D487FB9772F06C45D10110D4F0A22B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/2944-414-0x000001F546F00000-0x000001F547F00000-memory.dmp

Download