hxxps://vmi3714803[.]contaboserver[.]net/bn/doc2/view

Analysis

user interaction
yes
max time kernel
219s
max time network
221s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/11/2026, 07:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://vmi3714803.contaboserver.net/bn/doc2/view
Sample261102-jadgdatw2k

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 7 IoCs

phishing motw

flow	ioc	pid	Process
71	https://accounts.google.com/v3/signin/identifier?continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ifkv=ASSHykp2dAPLuBP5HegpyS1GAwz10dMrK_FdnrtCzVXrzXoVee7DuGeLUMokaAZZUcEpkw7hixwEkA&rip=1&sacu=1&service=mail&flowName=GlifWebSignIn&flowEntry=ServiceLogin&dsh=S-233362078%3A1741544750655901&ddm=1	2996	msedge.exe
71	https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=853637742&timestamp=1741544754294	2996	msedge.exe
71	https://accounts.google.com/_/bscframe	2996	msedge.exe
71	https://accounts.google.com/v3/signin/identifier?checkedDomains=youtube&continue=https%3A%2F%2Fmail.google.com%2Fmail%2F&ddm=1&dsh=S-233362078%3A1741544750655901&flowEntry=ServiceLogin&flowName=GlifWebSignIn&ifkv=ASSHykp2dAPLuBP5HegpyS1GAwz10dMrK_FdnrtCzVXrzXoVee7DuGeLUMokaAZZUcEpkw7hixwEkA&pstMsg=1&rip=1&service=mail	2996	msedge.exe
71	https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1660855103&timestamp=1741545279130	2996	msedge.exe
71	https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-973065299&timestamp=1741545314887	2996	msedge.exe
71	https://accounts.youtube.com/accounts/CheckConnection?pmpo=https%3A%2F%2Faccounts.google.com&v=-1820825297&timestamp=1741545829238	2996	msedge.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2996	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2757962786-3770611029-2102435697-1000\{B4098B44-8F1E-457C-8842-D3D541DFB622}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2757962786-3770611029-2102435697-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2516	msedge.exe
2516	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 2588	4860	msedge.exe	80
PID 4860 wrote to memory of 2996	4860	msedge.exe	81
PID 4860 wrote to memory of 4212	4860	msedge.exe	82
PID 4860 wrote to memory of 4212	4860	msedge.exe	82
PID 4860 wrote to memory of 4212	4860	msedge.exe	82
PID 4860 wrote to memory of 1984	4860	msedge.exe	83
PID 4860 wrote to memory of 1984	4860	msedge.exe	83
PID 4860 wrote to memory of 2816	4860	msedge.exe	85
PID 4860 wrote to memory of 2816	4860	msedge.exe	85
PID 4860 wrote to memory of 2816	4860	msedge.exe	85
PID 4860 wrote to memory of 5064	4860	msedge.exe	86
PID 4860 wrote to memory of 5064	4860	msedge.exe	86
PID 4860 wrote to memory of 5064	4860	msedge.exe	86
PID 4860 wrote to memory of 4736	4860	msedge.exe	88
PID 4860 wrote to memory of 1820	4860	msedge.exe	89
PID 4860 wrote to memory of 4736	4860	msedge.exe	88
PID 4860 wrote to memory of 4736	4860	msedge.exe	88
PID 4860 wrote to memory of 3684	4860	msedge.exe	90
PID 4860 wrote to memory of 1820	4860	msedge.exe	89
PID 4860 wrote to memory of 1820	4860	msedge.exe	89
PID 4860 wrote to memory of 3684	4860	msedge.exe	90
PID 4860 wrote to memory of 3684	4860	msedge.exe	90
PID 4860 wrote to memory of 8	4860	msedge.exe	91
PID 4860 wrote to memory of 8	4860	msedge.exe	91
PID 4860 wrote to memory of 8	4860	msedge.exe	91
PID 4860 wrote to memory of 1144	4860	msedge.exe	93
PID 4860 wrote to memory of 3772	4860	msedge.exe	94
PID 4860 wrote to memory of 1144	4860	msedge.exe	93
PID 4860 wrote to memory of 3772	4860	msedge.exe	94
PID 4860 wrote to memory of 580	4860	msedge.exe	95
PID 4860 wrote to memory of 768	4860	msedge.exe	97
PID 580 wrote to memory of 3784	580	msedge.exe	98
PID 4860 wrote to memory of 3308	4860	msedge.exe	99
PID 4860 wrote to memory of 3120	4860	msedge.exe	100
PID 4860 wrote to memory of 4504	4860	msedge.exe	101
PID 4860 wrote to memory of 5032	4860	msedge.exe	102
PID 4860 wrote to memory of 5032	4860	msedge.exe	102
PID 4860 wrote to memory of 2516	4860	msedge.exe	104
PID 4860 wrote to memory of 956	4860	msedge.exe	105
PID 4860 wrote to memory of 1012	4860	msedge.exe	106
PID 4860 wrote to memory of 956	4860	msedge.exe	105
PID 4860 wrote to memory of 1012	4860	msedge.exe	106
PID 4860 wrote to memory of 1584	4860	msedge.exe	107
PID 4860 wrote to memory of 1584	4860	msedge.exe	107

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://vmi3714803.contaboserver.net/bn/doc2/view
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffb38fdc188,0x7ffb38fdc194,0x7ffb38fdc1a0
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1832,i,835558803842151773,17358875750202667413,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:11
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1560,i,3221363975998011406,4491623322274432185,262144 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17396875160560506158,3235522583828381292,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=1384 /prefetch:13
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,7769474592646572303,1525499446648622252,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,3046080507474880120,15158113536539794088,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,17527872207068156595,10934034504132734787,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,7404465704014915778,5270668363847443990,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:9
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4292,i,12004964780452850859,6366209564749811691,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4360,i,8503878722902253059,8452472977863213981,2097152 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:9
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,14350978265923353604,9797790430183039420,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=5580 /prefetch:14
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,14346228320281979093,9683463340445729976,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:14
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,3726569758079466418,17674218866749123980,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:580
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1100
    3⤵
    PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16516066948024974110,10655966952533021681,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,16516066948024974110,10655966952533021681,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:14
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4800,i,15303360692442070932,4901525198899575332,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4788 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,13365043929863570527,13867570324373111046,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:14
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,5583707637824424583,2499926199154783875,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:14
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4772,i,14669702756563942695,4358750632480346418,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6824,i,3935612374984973751,17154616064319356794,262144 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,3906726675010351144,298414655544841604,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:14
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,4048171453009305936,7450394685432571420,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,5631645923320655179,7747059079797835321,524288 --field-trial-handle=2104,i,15237459976360637276,4181639050135887911,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:14
  2⤵
  PID:1584

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Share Discovery

T1135

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

091918d6-af60-4aaf-9dda-18a53fd56820.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\091918d6-af60-4aaf-9dda-18a53fd56820.tmp
Size 18KB
SHA256 1edbd1c35e5655968119eb667b7e5a36be0d7c2936b01560c723dee3680523cd
MD5 88daec2c53a4885c6d18913297e5d9c4
SHA1 ea79b64480add245816a8d2a4052154d59b9df73
SHA512 97db2e50c8647ec557de5f025524932a14ca83f358e4e03e3118f6fba8f0df68578948dad63ada123580402abcf90f6bcc3f4447f0c45a44307cdf4f310de82f
SSDEEP 384:oQkUSv08Nd1M5HGyKmX56b8XXba4YH7vBEfXIIlz:g0H5JrNuzH75EfXLx
TLSH
T1DA827D76B868AD3719F3A555F14A3713DFB4A06BDA882F40C6DD5B2C00DA68C230BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55deca07-1b4c-49b9-a027-a9b3f378f9bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55deca07-1b4c-49b9-a027-a9b3f378f9bd.tmp
Size 18KB
SHA256 355be3e46df7ffae33ecb59c66371dc34589cff59907f5cc85278a1b59c8345f
MD5 8cd3ddfe6dd18168b91f535e73f7e9d5
SHA1 f6fe94e134633061a6adedd9c6d3f2cc477995b9
SHA512 053ece0e4911cfa437aa87c7c0c935922a44ceee1c118f7bb8e1a38651cc99cf606831ae5bed5475166b3a08eaecaca48864b65c7075a59c39562b9906e4ec0f
SSDEEP 384:1QkUSv08NdiM5HGyKmX56b8XXba4YH7vBEfXIIlz:P0C5JrNuzH75EfXLx
TLSH
T1E8826D76B868AD3719F3A555F14A3713DFB4906BDA882F80C6DD5B2C01DA28C234BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f3441efe89f40c49c2eb2faa60bc806081bb2ed5672b81b3317480a16d9defd0
MD5 48af34be1fd83b68e08abd8324fcc533
SHA1 15f0d4791b9ba48b92ee9290ab043242241b1137
SHA512 9687f23e1f8c4b413fabcf01b867bb71849109f11f20aeb0da3a5e1a25b610ec3fa85aa3ce714ace9479c0c98da93c7301d990baf3c243f6c14cc1010ae46a5a
TLSH
T12ED0243073574401C1C0703743C3C3103CC5C505010D515FD0301C103C57055F40D0C1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0653c7dfe0810a5ba2c25399711a69ff5ccfc817819d34f6722ae2f2cd5878f
MD5 7d9ceef5daa4101fd9b28ee948203837
SHA1 ad81e9d42e96e81834610892e0cbe006311016fb
SHA512 5fcae862842c3f4a69612b1563a769c05365d02e6c1981b600f92a8204d1bccef7066e0f30e9f4cd820c979d8be93f5d5f5a0cbcc14e4c67fdb497df535a879a
TLSH
T15DD02230F32B8002C2C0B03B83C3C3203CCACA0A020E20AEE0302C203CAA02AF80E0C2
MD5 SHA1 SHA512 TLSH

Submit Download

0fb36f37-a332-4b6f-bde1-cb392740fe71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0fb36f37-a332-4b6f-bde1-cb392740fe71.tmp
Size 10KB
SHA256 d108403f5d91520b39431fb849b7418c43fabb7da044d7d328becb0a90bae48c
MD5 26bfd245fee391477dad5944bdb18619
SHA1 2f42c6fb9142613a55ec73701cbb9e5ba69cb29f
SHA512 d31131ef521c40dfac24c4d8a82c4ed8d32a2391c936591b18f7b23a9caad9e5ae155cf04eb3d7a992a2c490c97a181778341a97e3a0de5b46f826be9be9cef2
SSDEEP 192:sxZrdR+bYJ/fMsb5V6IdpsC/W6+WNoGkdY0v3l56Ig54J:sxZZSA/fMsbXj/bCd5S2
TLSH
T11B32E8126A34A83B9CC7D219BA55BF13E2F9503291912E48FBFC861C01E77DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f0b7186-d860-41ae-b82c-d1c3747ee584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f0b7186-d860-41ae-b82c-d1c3747ee584.tmp
Size 10KB
SHA256 bd0ed70c62657387f0f1b45e4ce17c1e5ac24270daf001f56b3a506cafc9a644
MD5 5e98a28ec77ab6078ea2da1ea110b010
SHA1 e3b66d98a27d392b019dceb94d0e7c4c31a72517
SHA512 99f0be10d17c014ea274aa4f54484122032c1443aa6699bb8f9b8d5479514558a0d2df095b3c2d68ec91eb99b1bdacc37811ae29f8cbba925006c82a3ae24327
SSDEEP 192:sxZJdR+bYJ/fMsbmV6Idpsb/W6+WNo5HZY0vEl56Ig54J:sxZrSA/fMsb4S/beZ592
TLSH
T13D22D7126E38697B9CC7D219BA55BF13E6F9503291912E48FBFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

447cf6be-7a46-4bdf-8b19-6b3875993f1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\447cf6be-7a46-4bdf-8b19-6b3875993f1a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c9a0078-11db-4345-9240-1db440ce6d66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6c9a0078-11db-4345-9240-1db440ce6d66.tmp
Size 10KB
SHA256 bd00a6a581942e9f95733ba1c34b8f0669294535e1881d7c6b4167e375aea5db
MD5 e4dce7279c7f77a3c71df1faab4af118
SHA1 8e93c662c4cd09cf2d01e3dab9ac1025028435c9
SHA512 47651c87eaf9de6254d41d24486e27ef112c619690b201130b393ca19302c35ba54c2f5ebe53bac620cc4daa621dc7a8280131e3f9e9b032162d102774362c4f
SSDEEP 192:sxZEdR+bYJ/fMsbhV6IdpsM/W6+WNo3sFY0v+l56Ig54J:sxZiSA/fMsb/l/bbF5D2
TLSH
T10D32C7126A24697B9CC7D21DBA55BF13E6FA503292912E48FBFC861C04E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

872a88aa-1243-482b-9d75-7c55d8b39af2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\872a88aa-1243-482b-9d75-7c55d8b39af2.tmp
Size 28KB
SHA256 90391e1ddf1b8c0cc103b1fae09e7c7d076728ed7e3b3a9f9d7a470b8dddc17f
MD5 e2303329626e20703a047c48968402df
SHA1 74033f98e33e78d438f8b108e8a30c066d6783ca
SHA512 f37ff6395a599a39cb9c3bf62cef6570b94e96a0bf3371bdb8542640cd291a92214f639a74e94254cc5271c0947a1ca0b152b3b5fe214d6d3980e946e512faae
SSDEEP 768:5LhnP8y32tFWRmaeQwe8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3olLl/9v0zk+rotp:5LhnP8y32tFWRmaeQweu1jaKolLp9Mzc
TLSH
T198D2F92B244CCB7E4FC05A9DDC566F976EE802C7A6688D4047FE894C02C77EE512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98939acf-8be1-4972-a335-604d1c94fff7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98939acf-8be1-4972-a335-604d1c94fff7.tmp
Size 9KB
SHA256 bfe8055d92675e19fab10183dba758cdc1d382ed53277abdfa4054cae666b402
MD5 6e6f67c40155254d2a0a78d6f1962f27
SHA1 1ce56870af506df6aea0d4d3465b20d1572a0423
SHA512 9ba78a61cdb8e1ec5f7332887da9afee577344e7b62421b9d251b28f18716efe8333894cee244a4d9424facdda0f003ad961a28587f529a4bfc4dde2d53566fd
SSDEEP 192:sxZJdRHbYJ/fMsSmV6Idp6b/W6+WNocY/Y0vR656IgrJ:sxZr9A/fMsS4M/bw/539
TLSH
T16322B7527E24A97B8CC7D219BA25BF13D6F9503291952E58FBFC861C04E66DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 940a7561a723ee95ac83312c24cadef3986e623201c2a9b6161bc578b9837e9b
MD5 1dbad986883c83a5722d4d625187490d
SHA1 fa1db2fd49ff15a53b3ea3c7d054bdb723160f55
SHA512 329dcea7efc443cfda68be6df4f45b25d9ba5a7cc1e7fa009ecdb1e052d41bb03cf0942ced416c1ef322174395ae087230ef2378dd5f4488a787a44df0f982a0
TLSH
T148E026F554CBC23EA61C744701FC430CD280365B93C069EF1720C989B001E40A7AABA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 2e8852969fe9e95e49dd007b41df085e39de967071ba2c70a1413c9ac10ba7c0
MD5 f1b527866ba20902cbfc93cd42fb1e15
SHA1 5d1853fe91df10ab9b06d2d86339604c014fae33
SHA512 0ea89f3df060bf6a1f9a2fd07f3d940f1fe798814cf88530acf1b595be24b37168034bcb1764ee5d43206cf33fb4499333fbb0a58b42c0887883520fd471314c
TLSH
T174619643053A08E7DFA83271A2E679CB393863853A836D110494ECFE5C1EB6B175284C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 a9232629c0a89f8c6c6355cae5ced4845b2e90bfaabb1bc321932d382e9cf30d
MD5 930e5f5791f23d2d351c27d2f5b4dc9d
SHA1 3e02563466a7a372e61663a660f38a9addddc7a8
SHA512 b50f1417361248fbf4ae6aa00410984b923aad8f8ab2bbd7afe32c6df76b0067362886b6e5d28466c41fec8ec630a1f3858c34ad45c73bdb6bc039f98cab7aa3
TLSH
T15061A643453A08EBDFA83271A2E779CB393863853A836D110494ECFE5C0EB6B5B5284C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 96beb2dfe887249923d5029505318abb0a84d1e8d6f88356c47dfd71d89c62e0
MD5 4bc094ee5e9aec4d67f0e15893f65362
SHA1 af5bdd6f134b0474fd901492165f6ce802469200
SHA512 5f988a496daa5c87b153c09fbdb64458db6fed994c902ad8338532c2d4f00ae85a55d6ae7e309d39962ddcb5c62a6a5e42fc22c1e9bbff9fb96e86f23e7dde81
TLSH
T16A61C943013A48E7DFA83271B2E679CB393863853A836D220094ECFE5C1EB6B575284C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 90c2ba780e3fdcda1998b743917d606df42a931722951eafa700e1871a2db0a3
MD5 4161e41413082b3b26b29c9592b71970
SHA1 d9bf9b77e5f099ba0ec6d4977929ee7c3ca88076
SHA512 4ace1be825bb8117f18dcc2a8c0630ec33f2fd1e2f9f104cad0ccd11affbc9697584fbea1052f1631a672df11630bcc2f329bf03b7272ada416d2f69993e8ed2
TLSH
T14B619647453A48E7DFA87670A2E339CB353867853A836D120454ECFE9C1DB6B0752C4C
MD5 SHA1 SHA512 TLSH

Submit Download

ca64442d-0981-4638-8053-8cff1115aae6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ca64442d-0981-4638-8053-8cff1115aae6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5fb93ab3-c211-45cc-bc55-a19fffebe5c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5fb93ab3-c211-45cc-bc55-a19fffebe5c4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

67f02d01-bd7b-4d21-a745-54fda3e7efa7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\67f02d01-bd7b-4d21-a745-54fda3e7efa7.tmp
Size 3KB
SHA256 84284bea9204c88d8fded74d29607882cea97d0403db20b00bde31adcf7551f2
MD5 792b873be05cd08df69069650aff7b78
SHA1 06730935cd4fbebbbbf6a5abf386eefe13be77b0
SHA512 f0f3a4a12dce7f8b31e35dcc921e8c2335429b304b639b4670f81f5edf583f061a77d8cf8dc974bb2fbb4a2e1c56ed9170cf4ed08b9655f45f4ebd48f51539e0
TLSH
T1D6818BB382E4817DCB1111F09A146E2BDF2E05A5837C3855CAD8AF9FD3F2971E152A4E
MD5 SHA1 SHA512 TLSH

Submit Download

8116de40-46b7-4d9f-b8be-b83aa53c11bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8116de40-46b7-4d9f-b8be-b83aa53c11bd.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 456bd303cadf250e6f54cb90f1e589bf75ac2ccce0b769f0a77fd60265e59482
MD5 43fc75acf72fa273f4cdd0859a144ada
SHA1 0012fa81ae872acaa17744c6138d36076f63da11
SHA512 fc8f22bbd24fb4be3d054038f6abb69f66b6c4bc444be1d20015e9fbff5b23d1aa8bae5b87499ae62efaae22fb74c17e50dbed7b41b3a6a506b07bc5f9cea961
TLSH
T12D61ABB382E5817DCB1111F09A146E2BDF2D0594836C3C59CAD8AF9FD3F2971E15294E
MD5 SHA1 SHA512 TLSH

Submit Download

add44db4-e5a2-4199-9651-9de0daf08441.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\add44db4-e5a2-4199-9651-9de0daf08441.tmp
Size 10KB
SHA256 6f9d505c2a827b7e55ed2980692486c28c5d196c4449b5af967d86efbaaf4f71
MD5 98a1195e91ded4003de398c31f0c8571
SHA1 98035af89f11c4a7431171d3af928576f5c5b15f
SHA512 1300e7fd7515a8ec08974a9395c5a44ed5ada03b1ffcc1a8de2bb1923b0afc9d53af6cf5a83fe2668209dcb38f9ac1f74c9c765a9ef74b8b91b2d07ddad3fcd4
SSDEEP 192:sxZJdRHbYJ/fMsbmV6Idp6b/W6+WNocY/Y0vpu56Ig54J:sxZr9A/fMsb4M/bw/5H2
TLSH
T1C822C6527E24697B9CC7E219BA55BF13E6FA503291912E48EBFC861C05F76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be407aa3-5486-46e8-b31d-4826957026bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be407aa3-5486-46e8-b31d-4826957026bd.tmp
Size 10KB
SHA256 58279aee3ac9d412370e20121af1c571aa810b65806f87dbaa6f5eafd38f279d
MD5 489887a3f391556e6b6e4955429e4192
SHA1 1ee7cf1f958ca10055d0b9466bb75aef8fd0d326
SHA512 b8ac71b0b34eff37e82cdd877e42fcf01a6fd2f2f1b26a5a59b163083a7c520b1c0d62ab370e76bdefd2461c5fc37e3fb4c87494a49af02f89c13ab86a2e15fd
SSDEEP 192:sxZidR+bYJ/fMsbdV6IdpsR/W6+WNo3sFY0v+l56Ig54J:sxZkSA/fMsbTw/bbF5D2
TLSH
T1D132C6526A24693B9CC7D21DBA55BF13E6F9503292912E48FBFC8A1C04E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fea1c5cc-5098-4c7d-aef2-f592488dccf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fea1c5cc-5098-4c7d-aef2-f592488dccf7.tmp
Size 10KB
SHA256 815a3af109ac80e09b5052226cf786f5374012541ddc997f2ad247a79d92348c
MD5 a493d1f4988141e06e72950e95bbeda7
SHA1 2887c8e03fd9b278f9281fb28be8557c8677758c
SHA512 f740e5b00a78bd42b1c92cbfc152520c4ea13adebb3523661d125cd848e24e5f9c64256bb088ffd687353d5bd2a8e4ba57777dbb8f7c0fb80fda3101f599931f
SSDEEP 192:sxZJdRHbYJ/fMsbmV6Idp6b/W6+WNocY/Y0vR656Ig5SJ:sxZr9A/fMsb4M/bw/538
TLSH
T1A622C6527E38A97B8CC7D219BA55BF13D6F9503291912E48EBFC861C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6517b17c-604d-46d8-ba1d-d371a87aa586.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6517b17c-604d-46d8-ba1d-d371a87aa586.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 a99afd0873e681d5f661eb4b4e3dfe9e2c6e31efbe39eefb5e996246be8eeb98
MD5 e138f82359dec6301461cf4c91a9f117
SHA1 346b58ef9f45376b61e539cf278f757e09adfd52
SHA512 3ead65829f16140f6edb0c678228c0468733a2645459a3a42fb386e8c73e46da5f1deaef4e2e15c2053f94888321ae0d451302f802df99babd39e55120042a5e
MD5 SHA1 SHA512

Submit Download

a2cd2e8f-89ab-4755-83a8-82249fb6d97c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2cd2e8f-89ab-4755-83a8-82249fb6d97c.tmp
Size 8KB
SHA256 1553683cafee005415f9cb4dc7c7befb157dbe52d7a590ba56a0c086e2a4b3e8
MD5 313ccb6877de000317fca3e85e6a9861
SHA1 ed9b66d71d61319448efbb67d96298f63b47bf1a
SHA512 ba1d50a83cd7e79a915922d035fe74f0d18d8082e414eab823508d8b20fd0a45eca812414af62b58acfa479c18fdf8f6a109b793402c0917d828ff479c6ac159
SSDEEP 192:GGNQ6FPDQmiUyxCWLX56rjzoremjXbIWU4nqa8U6:GGNQ6/HWLX56b8XXbK4YU6
TLSH
T19A120A36B878BC372DE2B485B18632039EE55127EA487F80C6EC1B2C01DF65C530AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5d432d4-b368-42d0-854e-0e63e82ea1ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d5d432d4-b368-42d0-854e-0e63e82ea1ba.tmp
Size 8KB
SHA256 8a1310d9682f15ec5badee81aea28f9e9106658ef5d6e96a32037ddd40cb3c9e
MD5 a1187bcd8c097a4b99b8b951b541a06c
SHA1 507de7d79ffedcf494198b01ad3a24a785b822bf
SHA512 0fbf07def7a7603d583440b8eb9f5ea181144376ccde9973865769556eeba37bf9305d6f94421abb5061e6347d1aa9a9ffa4c8cc870b9c9abe13be8d3d776a32
SSDEEP 192:mGN+6FPhQmiUy2kC2LX56rjzoremSCPGGU6:mGN+6RJJ2LX56b8PpU6
TLSH
T1C402E834ACB87C7B5EE3AE46B5862713AFE5107BE9542F84CAE81F2C009765C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d84de8d3-91a6-4e6b-9e3c-06d03d1e9526.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d84de8d3-91a6-4e6b-9e3c-06d03d1e9526.tmp
Size 26KB
SHA256 5ef899f3f7f56dea7e6b83fb0bfdc0167648ae6b5dd72ff4c1510a4c534db7f4
MD5 111c0c6eda22d4639dcf1f3ef7389c05
SHA1 1267c7ca492c305302aa5739bc92364239ee7fc1
SHA512 d2389d17a1e2564925df3c8417023186c8faa8e3426f8c861d860a7a8a2107eadaca170b07d0f78d2410d4f299f7e6b321501822246390029df9cca3cdad8b19
SSDEEP 384:diFzQkUSvR8Nn8TUNTUlIl1M5HGYKmX56b8XXbC4YH7vBEfXIIlz:UFdRCwg05LrNGzH75EfXLx
TLSH
T1B7C229F258D7993AD9AE9743A37D2E039EBCC067F5846A40F788591CCC861BFD306912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df4c445a-4a90-4650-8e7d-e68dcb021fa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df4c445a-4a90-4650-8e7d-e68dcb021fa0.tmp
Size 392B
SHA256 a21ae3dae93569ab7acedeb79be89c61c3b40487d31ea47ed43268bfcabbd7ca
MD5 b2871df0537bde88bc2b75696e837c8e
SHA1 0591ec33fc9e7ce167b7d1cd3e5cf736e31020af
SHA512 39fdb51ead295d8fb87f6e01f05e2c8c95c4fe08bee4b3fcb35ded97a6ad2092f8c8e74aa62b3ee3d61766e0cc28a932f8e5d131e86dcbf73dc04d2d14285548
MD5 SHA1 SHA512

Submit Download

ac178bc4-2d07-4742-96f4-3dd8ab58b201.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac178bc4-2d07-4742-96f4-3dd8ab58b201.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download