hxxp://url3243[.]email[.]openai[.]com/ls/click?upn=u001[.]IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D

Analysis

max time kernel
898s
max time network
882s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 04:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url3243.email.openai.com/ls/click?upn=u001.IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D
Sample261102-e83rpssw6l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3760	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{07F5727E-A5AD-4C67-8C01-D00E7F33E4D7}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5544	msedge.exe
5544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe
5072	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4912	5072	msedge.exe	80
PID 5072 wrote to memory of 3760	5072	msedge.exe	81
PID 5072 wrote to memory of 1864	5072	msedge.exe	86
PID 5072 wrote to memory of 1864	5072	msedge.exe	86
PID 5072 wrote to memory of 1864	5072	msedge.exe	86
PID 5072 wrote to memory of 4072	5072	msedge.exe	83
PID 5072 wrote to memory of 4072	5072	msedge.exe	83
PID 5072 wrote to memory of 4072	5072	msedge.exe	83
PID 5072 wrote to memory of 1880	5072	msedge.exe	84
PID 5072 wrote to memory of 1880	5072	msedge.exe	84
PID 5072 wrote to memory of 5708	5072	msedge.exe	85
PID 5072 wrote to memory of 5708	5072	msedge.exe	85
PID 5072 wrote to memory of 5708	5072	msedge.exe	85
PID 5072 wrote to memory of 1660	5072	msedge.exe	88
PID 5072 wrote to memory of 1660	5072	msedge.exe	88
PID 5072 wrote to memory of 1660	5072	msedge.exe	88
PID 5072 wrote to memory of 2852	5072	msedge.exe	89
PID 5072 wrote to memory of 5108	5072	msedge.exe	90
PID 5072 wrote to memory of 2852	5072	msedge.exe	89
PID 5072 wrote to memory of 5108	5072	msedge.exe	90
PID 5072 wrote to memory of 228	5072	msedge.exe	91
PID 5072 wrote to memory of 448	5072	msedge.exe	93
PID 228 wrote to memory of 1812	228	msedge.exe	94
PID 5072 wrote to memory of 4516	5072	msedge.exe	97
PID 5072 wrote to memory of 4516	5072	msedge.exe	97
PID 5072 wrote to memory of 4516	5072	msedge.exe	97
PID 5072 wrote to memory of 2996	5072	msedge.exe	98
PID 5072 wrote to memory of 3084	5072	msedge.exe	99
PID 5072 wrote to memory of 2960	5072	msedge.exe	100
PID 5072 wrote to memory of 2260	5072	msedge.exe	101
PID 5072 wrote to memory of 2260	5072	msedge.exe	101
PID 5072 wrote to memory of 588	5072	msedge.exe	103
PID 5072 wrote to memory of 588	5072	msedge.exe	103
PID 5072 wrote to memory of 5544	5072	msedge.exe	104
PID 5072 wrote to memory of 1856	5072	msedge.exe	105
PID 5072 wrote to memory of 1856	5072	msedge.exe	105
PID 5072 wrote to memory of 6028	5072	msedge.exe	106
PID 5072 wrote to memory of 6028	5072	msedge.exe	106
PID 5072 wrote to memory of 5996	5072	msedge.exe	107
PID 5072 wrote to memory of 5996	5072	msedge.exe	107
PID 5072 wrote to memory of 932	5072	msedge.exe	108
PID 5072 wrote to memory of 932	5072	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url3243.email.openai.com/ls/click?upn=u001.IQLfsj4kk-2BK7JhymNusRMvWmnkLomVjgxFpxUVYEkxqorI8ICh1R9gUvwGo-2FHXAoyX1Cja-2Bpu31xJ28JRCCCF0gvzJqef0QT75qbwaBkC7Y-3D8xK3_YZtKzPJkT6oJ9eftnY7AL8BbJbAYMp1TqnL-2B7jTUsNGc2ius9qE5hG46501ZxZtDxiGMQO1ShZ-2Fc3TIzuGDND-2B9X7XBVhASYFnwo-2BioB7lQcYbj-2Fwh8cqAIUPjRKqvIOEtpxbnP2GS4qVhdDjBqivlyvO49BTm6gZJ62GDBVLfQBe51Au0RB2HRa53DaF3rOzRcDfOTp8PFWgVtRspQRDul161ON04yzg-2F9aBtyFeAx3mbParTGaun8UHmqrYXVKJYIKhaaq28-2BM6Y4oMhnB7SYqm0A94gttcgPezTAu71TItUMR-2F1Vm4qTsbcfToFz3fHSRomaHsgtnX5aslrI1ZTHYS7hcH8-2BlmBLrX8sffAknmgb6mbkRYnkM6Juv1NibzVeL0fYg4XGTjYLf92n6QWY-2FvNb5QKkeCHmd6s2FIX4-3D
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ff923dac188,0x7ff923dac194,0x7ff923dac1a0
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,6266127573217459349,11014294896006804097,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1572,i,17557598648214713976,4776174886356349541,262144 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,14130889406455747718,5102493393781957672,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=2752 /prefetch:13
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3288,i,7232209146352067551,14093063907258645781,2097152 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3292,i,872239554262978271,4843805843328223705,2097152 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4876,i,9322832940578443827,3996500243161395463,2097152 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3508,i,14651487836582902778,2672146223957844506,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3480,i,5064726519145706511,5957017379750869109,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,12996705065502155140,16470210251041303264,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:228
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,2891398842039363240,10921994703295986140,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,2891398842039363240,10921994703295986140,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:14
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6500,i,2284348303353491617,18135917279714180211,2097152 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=744,i,1316832467779273433,9520505427366513890,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,5179148150137346329,6333994040435832866,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,882064476784339590,16223007219065282374,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6108,i,9396118294825513254,11492612938127344300,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:14
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,3346470295017313939,11391016601672527078,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6380,i,206458934763376060,10400837656380088183,262144 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,3262503606956418261,17747878813800697036,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:14
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4704,i,15893734890105988164,15784350052244808692,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:14
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3212,i,9908736422763098347,14593194984806364663,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:14
  2⤵
  PID:5996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6796,i,7625799472825675294,1859868134395249087,524288 --field-trial-handle=2180,i,10767375749013009800,6589853613397430922,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:932

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

47bb25b3-3c22-46f5-8c16-b957fcc79901.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47bb25b3-3c22-46f5-8c16-b957fcc79901.tmp
Size 27KB
SHA256 57ab5eeb572c00fd23774e25c86feeb3273aa462065240a1aef73f236490dad0
MD5 aab9613ecea62e481ac1e5bbfc4a82c3
SHA1 787956e434fe18ba595d04100132e7ef7752c740
SHA512 a20c6c85950b97e80a308d3d522f9764002a49525e45d94f647263419d3bfb19d89f5200bedbddfb9d46f0aff26ddfe03818a989ec4bf86c2151b7a65c086299
SSDEEP 384:nFiFoQkUSvk8Nk8TUNTUlIRYNCC7vGcxzyfoBjWz0Ra1TU+j8vAPH7vBEJYgL/71:MFgkPwg20CSWdBS7TUMyAPH75EJ9Lj
TLSH
T140C25B35E894CEBBECEB8E99A34E3643EEE04153D98C5AD0D9C95D6C00CB19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

60e04cdf-7ca1-43cc-a637-706105a55038.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\60e04cdf-7ca1-43cc-a637-706105a55038.tmp
Size 32KB
SHA256 3df3c89020303578b23e390f970012232662ee50cd67a77808ca92096657a4e9
MD5 794642a601c705e13de018197255a8fe
SHA1 27eabbebe3a7433e0453cdcc1c768376762562a1
SHA512 f43f760081606ea569da838d5eddbb393ccbc2201ea1da66301581ec0821c2677c8e977cf641af7063e2df022f7b457cbdb57c1afa6bab01f5d87490d0d855fa
SSDEEP 384:nriFoQkUSvV8Nk8TUNTUlIRYNCC7vFcxzyfoBjWz0Ra1TU+jA/APH7vBEJYgL/71:GFgVPwg20CpWdBS7TUMqAPH75EJ9Lj
TLSH
T1A9E2B3F598D3897BD8AE4B97A33D2D42A9BCC143B5885A90F7C84D5CCC860BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77aed4ba-b8a8-4322-934b-d1289627e969.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\77aed4ba-b8a8-4322-934b-d1289627e969.tmp
Size 27KB
SHA256 d51a13224eac5bfbf6fcedc5303d8b2432dd8820f8b408eef808abbb7d68b137
MD5 c15b893a1db81cbb70d17b0b4546ebb7
SHA1 f89ea4b4b6675937bf0bc996f2c024941804e4b1
SHA512 9b3f0898e95c22622ed98c75b110c281e4ad02f83f65a192101395a4e3e5374c49b96e7b8b467760150f3790195e6d3a843588ea8acb94f84a99866e2c2bd7a4
SSDEEP 384:nXiFoQkUSvk8Nk8TUNTUlIRYNCC7vGcxzyfoBjWz0Ra1TU+j8vAPH7vBEJYgL/71:SFgkPwg20CSWdBS7TUMyAPH75EJ9Lj
TLSH
T173C25B36E895CEBBECEB4E99A34E3643EEE04153D98C5AD0D9C95D6C00CB19D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fabe563-fdcf-4a24-84d9-7354cffcf332.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fabe563-fdcf-4a24-84d9-7354cffcf332.tmp
Size 27KB
SHA256 7ab863f0040b0a2b6964194b8f8f834d5d463ee810eea7cb7c89b1a6646008e3
MD5 fc6bb1d8ae9f77a8daec2a1ab7cc042b
SHA1 fd5becc4cca05831300953a68de9771a3324e66c
SHA512 7b92a92b479f34c96714da63ccf22788381084a3baa4bb039ae99e4c7a5ced326b264decca861231afeb3bbddd97e521d83607e46918bc4ce8cfa2236f93d3f4
SSDEEP 384:nFiFzQkUSvG38Nk8TUNTUlIR0NCC70GcxzyfoBjWz0Ra1TU+j8vAPH7vBEJYgL/J:MFdG3Pwg20CfWdBS7TUMyAPH75EJ9Lj
TLSH
T15CC25C35E894CE7BEDEB4E99A34E3643EEE04153C98C9AD4D9C95D6C00CB09D530BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

985390a9-51c8-4095-93f4-3899ab442042.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\985390a9-51c8-4095-93f4-3899ab442042.tmp
Size 25KB
SHA256 b0dbe7824a74390dc98855658eca3105a37d2132be945f24d1ec7173664e9a4f
MD5 7ce7936e873833306e6bf05d9a56aeef
SHA1 5497382c0be5616c7c7ffd341c3436a6f001b7ab
SHA512 46a1274842f5bb0eb03fabe555c7255d43054036fb4a75cc41447c1eeaa82e67a3ab0430b714e338f4c73cd4d36b528f374a38e2b36ac991e81a90283faf641a
SSDEEP 384:nbiFiZcI638N98TUNTUlIxBCC7J8acxzyfoBjWz0Ra1TEQAFsa+VYId7ULgL/7I5:2FQ636wgCCmaWdBS7TVAFhgzPY
TLSH
T147C24A35EC94D9BBECEB8FEAAB4A7603EDF01153949C5AC4DAC85D1D009719D0307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

758d0465-03a0-4919-b117-a23b07ce357b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\758d0465-03a0-4919-b117-a23b07ce357b.tmp
Size 27KB
SHA256 bea9e3a2ded118352d69425600d9cee973f401dac9bcf2e3d564b06e9701561b
MD5 92f2a2734b3044994d13aeb61de26ba6
SHA1 5f936cc2398096a94e0099defb777b482aef64c1
SHA512 902542d5a7bf362d17e3033180c19e82e3a5d6f1c16671106a8b894897fa17742fc9ddcc6b879229ff2102c8abbb9b1bce4d4545a1077e680724a4bee1e698a9
SSDEEP 384:sxZipA/f9sa66s8qMpRiYnazAW8pZS15posJWeT+17qmt/ba/5voz4Y8GY:sKpA/fp4Mnc7WeT+1eS/bg5Az4YI
TLSH
T169C2F705A924C83BAAC39D19653C7E33EAEC506212C5DEDA56ECCE1C01DE1FDAB47427
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7caa1a28-09a3-4f50-a7ac-2670f3761f61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7caa1a28-09a3-4f50-a7ac-2670f3761f61.tmp
Size 414B
SHA256 af1d98acba8248237cbf6f8254cc81508927ea1fc9cf66c690057ecf08661748
MD5 4a9f30dee2d2af80ca91d2e5bc493b01
SHA1 30fc1cecc65f5fcc5709efa6baea862e9fabb727
SHA512 4ae53c345ceb0d149b751e9890f6a47beced8291256dd473e99d28325f9fdaf2afa0c60b9412c66f7757f1b98c92ec9ae01d6e8121a965afd792f70519b67252
TLSH
T134E022A9C926BC3F28F9076C24605B8AEA5503672A50945B3B3D92098FB063A86C5C6C
MD5 SHA1 SHA512 TLSH

Submit Download

946bba0e-07c0-4526-859d-1f2f8638df76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\946bba0e-07c0-4526-859d-1f2f8638df76.tmp
Size 28KB
SHA256 77de40f0455c2a9d155749086e9d62d1652ae02360f0ecfd95ac161cabb4aab0
MD5 fa256e27e54f69d1568933bcf4804154
SHA1 d0004dc9f8d39fdac4fc60806c8b8eb478957be7
SHA512 78e48c64d36fc9165faad7be8202679ee5daf7815617abea3e0a397e3a27d53cb064cfe57f2e70ae86233bcd74630e53de9f8345f130be76d4296c4910027ea6
SSDEEP 768:AvmgC8Ba29tWRmpbQHL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroXm:AvmgC8Ba29tWRmpbQHLu1jaKHgLpj+s4
TLSH
T105D2093B240CCB7E4FC04E9DDD16AF966EA802D7AA589D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e65f41a-ce2e-4a3f-bc0d-805b9266a92a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e65f41a-ce2e-4a3f-bc0d-805b9266a92a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 205010a961228763342c7892392c8a777aadb4753efe11f3475af7ce70faeb68
MD5 543557c4ec977824cd4df807e0d5a0ee
SHA1 890424a4a0bb733ba5e74dec2197e4609aca762c
SHA512 de539303a3a529c56843fce8e9223977beab78c09a9b3a25b5c0c9dce2f66dcc0f6a6a601569a5dc6bc44c3d2e7d101bd85cf721aa2df1c71f538fff3363d09a
TLSH
T193E07DA956CCC22EF64864D741F8630D92803B1BD3C0AE9E1780CC8878874C0F6CE7A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 443052f1559f3f6fb755c277326f70760f01bdca90f5eac6ffb29cf110d39b1d
MD5 2c9eab5b54e686c3fe6778baa2a454f3
SHA1 9ff267d22be22bb1de8f6ae9749b1318c1b3e7d9
SHA512 d0db899a436f2140e65a2446465294442c8d08bb3f8e3be3e5585c652e901537edcf0ace2ffc7cd488baf89102f3a08cd5f4482dec37b0947941e23128a41a6e
TLSH
T1A9E026E504C8C2AFB608AE4703FC830C82A0371F93C0B93E673CC8887442841A2E66A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6aa8665298a2ceb123f5f9750b5b21e2318f7f477212b75d2d0562079a17757c
MD5 dee5427ddddd0aa88c56eb6c392eac00
SHA1 91bcaa1f0bb3a6dc4ed40116724dc5dfe9a26972
SHA512 5ab8055827e6395219f0c099a83799241ad477cf20951839c903cfd49cc7c7fc94a1d39525b2472dc2830b266b3d47d87ae08693a4e14322c2a1a8ebc6e18029
TLSH
T10FE07DAE4ACAC22EB748E45B11FCC70C9A803A1FD3C0AE1E1720CC887801040B6E76E5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 08deca7bb77db22cedef391d0ea35d859b36aceaff242839501c7334ed5d9dc6
MD5 5b11906fe869341efb3f0d3b5ab8685e
SHA1 e4cbb68cbc72f43f3b8c7300bdccc53106a27fb3
SHA512 b2552b620860e7dd9c1d94ed6125479e691c12c8dddfa38be4143ef58934627f7c583512b85c37dd9dae6895ef889666630aa3de30b6ac417986117cb4064cea
TLSH
T161E086EA46D9C23EF248768703EC534CC690371B97C8F95E1724C9DD7582584B2B76E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 d393f1d29d4c96947ab9b0a86cf27d21ef7514c41b88290bea81351e02a7b2e4
MD5 43d0b3721450857d948823d615b39716
SHA1 57760196a19e3e0a2daa6a919ec8435aac83a5ec
SHA512 16dab207144b7ad48a429bd03dfc9012f1f9532ec8f4bea06fad702620ab3e29954737d57a1b3b43133229fb189d1243f0d5baba47400ef742b6c72ee371467b
SSDEEP 96:L2hwtpEYJdwZr3mozXEnnVxYbip4+lpVvhOQ7rFcYsqD/mAwVIqA8dXSd4yn6biT:aitpFJdQ3mozXEVxYeJlpVvhOQ7r2YsY
TLSH
T1C6C1C6DCB4154654F77A29BF70E928CBBE3A4B447E5FDE8294B6C6FCA84635350060E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8e1ea187ba9af95889700275a944d813dff8ffe45da969e82cd8840b0f37364a
MD5 705c8f3a52340fad9852958f15799f6a
SHA1 9bf438caae58a619dfcaf3105e92f05d1a4e7ee4
SHA512 d17a7c58e185aef127f4551209a21a1e1ef3752742a8d4a7911bcd2e21296235a19781fe421e37ce00beb241e99c164b765d025cb2e0a2ae16e0efa5b566b0e1
TLSH
T17C613DDCF99984A4E7A4347FB1F92D97363C5590BC839E83D1FADBF898463579108040
MD5 SHA1 SHA512 TLSH

Submit Download

5152fb54-feb2-4c2e-a5bc-54ec64fe187a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5152fb54-feb2-4c2e-a5bc-54ec64fe187a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb\LOG.old
Size 343B
SHA256 72055390e8a7909f094889de386ca58138f4ea3ef39d6054b4c82b45c1df30bc
MD5 b535f5c7de64726a7f94836a00887433
SHA1 4e00d04981dad77fffe070bebf567baa0c1279e7
SHA512 f07e2426495f8fa55847976bcda9b119389a6a37f38d10a4ba99edb9c1fd78c2b30424db76282807c3b99fef197dd2ff4339fb851d5ebca48d4d4fbac9f8fd73
TLSH
T18EE0C07C80C8C13F622421E211347B0ED5D32A0FDBC8FD470F85EC18B486089A03F650
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_chatgpt.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

0ee3b27a-3e58-4de4-8e2d-14de00d91a24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ee3b27a-3e58-4de4-8e2d-14de00d91a24.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

791bcd81-e2b0-4908-ad3b-e59a8a99dec1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\791bcd81-e2b0-4908-ad3b-e59a8a99dec1.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

7bcfeb8e-24f3-48ed-a1f3-6c8051b784f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7bcfeb8e-24f3-48ed-a1f3-6c8051b784f9.tmp
Size 3KB
SHA256 6422ffa6ef50fa89cd50934dcfc36964610ef4f7de121c71ab7d9467a8dd2610
MD5 8dda5bdef12628d4fd99c5a0620689ab
SHA1 f6ebdda47aba94ffe2e77c17599dbd217a44b992
SHA512 a517779bb5f0bdb354d4881b77b4edd538979533d6e53d99b46bb97736a9208d034acb261d9415850d9b6d51cc264ea6434fc1a066c45018cf52abf072eebc45
TLSH
T1E8819BF783E5852DCA515AF4AA18AE2FCF1C1510432C3C3A89E4AE5793E3572E10175E
MD5 SHA1 SHA512 TLSH

Submit Download

d0c29eea-3ce3-4a8d-b66b-0a1bac80b4a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d0c29eea-3ce3-4a8d-b66b-0a1bac80b4a4.tmp
Size 3KB
SHA256 46cf74982aa462ed3de8e09c418bcdf4a416ace395bbe4202cb2dbcd7d3f2aa7
MD5 667103900c5dd73f05d2029bf81fdc44
SHA1 918d4e859af747f0de7ef5404727ae4729d6836e
SHA512 15cef1671d76f1058798cc90a97aff673a3f3d02b6133ee0b591f8ec6d0031658c12b8dbe61184f83e0a86c9020f36a99babc21dd79d04b92efde26c6c8e45d9
TLSH
T19B817AF783B5826DDA1199F4AA18AE2FCF5C1510432C3C7A89E0BE6793E3572E04175E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\temp-index
Size 2KB
SHA256 ba86f655ed28c6eb425526aca2eb63b00e94bef1d87f6775f18151696f7094bc
MD5 225ccfb2c88ebfe7909e8fdc213df32a
SHA1 076c1c99325e4afcb0de808b08cab673cf238c0f
SHA512 53866922a29cfffcf0d31f80e6c4c9cc63e31d87a707b7aeee494ecabc23e5c64cc184b6f5a5c519d616b85914f2f6fb49af57423f6d712e08eab51296a739ef
TLSH
T15C51A54F4E031F2BEDAC227214B9248A333495CC26982E2769FD8135ACC37185C89A64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d3bb4403-4629-4f95-9275-60cde5062f6d\index-dir\the-real-index
Size 2KB
SHA256 a91d3e9bc7a7ae138b6cbcbe65459b1d0b4bec57973657ed4975deacce2ed9da
MD5 c144c7885aa56f038a6eb0f9db2eeaeb
SHA1 658f3495076cddc91f840ac1da8eae9c5f154011
SHA512 135047845851f38e125bdc016a8cf77d20aa2fbadd2fc127d2c0b59230d170248feaab30cd69aa4cca43aacf0c6386827aee5ffa275cdc3b73aaa855b0405759
TLSH
T1585172565D034739E884127309EA58963739A14487483E0F31EDD132ECC279CBC9ABE4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 fcd6806212094aee0f83ad21da47e21b9832e8cfca19823cc86d8e5a9adb9be9
MD5 b8f0c9dd7911156f4e701571663772ca
SHA1 3c1998aa77d11f3fd0233e5ada9f83e86b4a9a7f
SHA512 41597dfc3efa3af1c9ccfa6757dd3172091ea326e4a69fcb839be744cb1e484c74cafd9b3734f432c8f90c5801d89dc785a9e36650cac1327fdbf70ba1b2f656
TLSH
T19EE0C0F72CF709249CBFD7D634724465401EB86C9504BE0E501992C350F03993095C21
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 0d000da6bc2f611baaa08384fd27db8da84f825f87ea8541309bc7dc33ba3e37
MD5 2aa030cb77085f1427d530bf54b48ce7
SHA1 cd4490b34edad728c7f44a080629c4621d796596
SHA512 f1251eccc00fb8d3db62a26de077985803bc8025d869ab3053699c392bb63490cbb20f964f206ef2e3cbba6b7d4365d30269217755f296aaf100c1b55c5d02e0
SSDEEP 96:K4JaKygi+ZSKiIX6cKTKE+9eKOUV9eKukoWtGKEgrhOKKQk6QgKFKWDCK4AiyAgy:ohdNdBzXXFPXgRbKvtp0JlznMl5C
TLSH
T140B2235131BA12583CBE390890B59B2F52823573711CE62B7FFD40A68E6BE481DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a1afd89f-97f9-4b61-b540-cfa48e3fc86a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1afd89f-97f9-4b61-b540-cfa48e3fc86a.tmp
Size 12KB
SHA256 e796e3817da881619c792ae4ff4118cd85a1e5e35f8ff5035d7dbc116dfd0c39
MD5 c05ee6e7a6a3947289ef498fe5bc967f
SHA1 85b191540075ea74f3b8fb677d87a5d4af22936d
SHA512 21057e2bde48f501ce3ab7c9e16b0f0b5b45c8228e1fff131d77876d70d9530f08f5a25a0d4f47a38c877616bba15fa9d687bd822aed5b9e156cebe63dfcfe90
SSDEEP 192:sxZiR9FA/fFXsRI1ZqMq9zodpyLm/W6+WNqAFy/Y0g6bkZVuRxbIg50UJ:sxZipA/f9sW7qmt/ba/5voX41GY
TLSH
T19642D8566E24693FACC7D61ABA55BF53E7FD503290811E58A6FC8E2C00E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a9d0c1dc-ec3b-4f50-b042-bc896fda818c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9d0c1dc-ec3b-4f50-b042-bc896fda818c.tmp
Size 12KB
SHA256 5fbf037fa8202b1a4ce9c02b1ad3fac039fc746df08fc37e251e5ac5a25925d8
MD5 335c1d5d38d87afa8e29236f97749393
SHA1 6abcf28981ed60b94f7bcb5682406792b0810d52
SHA512 54216095f4f5c270b0132c82f647f8d2b096205d5f722525e1189c9552bd44ecf868e9d087bb63ae133ada69a2f81e957fede0b48d3405a2fd721406add493d3
SSDEEP 192:sxZiR9FA/fFXsyI1ZqMq9zodpyLm/W6+WNqAFy/Y0g6wkDVuRxbIgjUJ:sxZipA/f9s77qmt/ba/5vZZ41jY
TLSH
T19B42D7156E24693FACC7D61ABA15BF53E3F9503391812E58E6FC8E2C10E76DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2e391f4-21bd-45ee-8cee-3d6f098632df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2e391f4-21bd-45ee-8cee-3d6f098632df.tmp
Size 12KB
SHA256 8bf9ec1b4f45cd5d86a9b8f47d059e35561a1f23ec82e5b710c7763204774929
MD5 3728b4fad8609d5a47e1b4241d4d2ad8
SHA1 8fdd3dd024d5001b9643d23cb7fcc9feeb5997be
SHA512 d90575112a161f87778f519d648fdb2adfac6bd2bf313dc8fffe73aa9b0254d1f3919d3989a8b6c8fe7c91c9515b0ac5af58741b7e72a935603a2177f6361930
SSDEEP 192:sxZiR9FA/fFXsCI1ZqMq9zodpyLm/W6+WNqAFy/Y0g6wkZVuRxbIg50UJ:sxZipA/f9sr7qmt/ba/5vZX41GY
TLSH
T18642D7156E24693FACC7D61EBA55BF53E3FD503290812E58A6FC8E2C10E76DD220381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f9957430-8f82-46f4-960e-df8effae3729.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f9957430-8f82-46f4-960e-df8effae3729.tmp
Size 26KB
SHA256 af03345ac2ce7809877b267bebf35b5898efd0ca4955186f0e2f3f03b37e6709
MD5 beb13b04e3379345c635ff27c830c722
SHA1 78ba6eb7fc5a8b71dfac0d5b237d1ceca70371f1
SHA512 f11ac28c20697d86d12c09f857c11a44d24a07750569d72555d696291e196fe38d7271409d82098694afbf63f47ae6360cf58ac22005e1f410e11bf02c1b2090
SSDEEP 384:naiFiZcI638NA8TUNTUlIxBCC7qVZxzyfoBjWz0Ra1TU+j7vAPsa+VYId7ULgL/c:RFQ63fwgCC+7dBS7TUMLAPhgzPY
TLSH
T18FC25B36EC94C9BBECEB8FEAA74A7603EDF44153958C9AD0D5C85D5D009B19D030BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/448-405-0x0000025900000000-0x0000025901000000-memory.dmp

Download