hxxps://islam-nasralla[.]com/secure-share/?ref=eyJjaWQiOiIyNUNEMDZBMiIsImNvbXBhbnkiOiJCdWxsb2NrcyBGcmVpZ2h0bWFzdGVycyBJbnRlcm5hdGlvbmFsIiwic2VuZGVyIjoiR3JhaGFtIEJ1bGxvY2siLCJkaXNwbGF5IjoiQnVsbG9ja3MgRnJlaWdodG1hc3RlcnMgSW50ZXJuYXRpb25hbC0gUkZQXC9SRkktTWFpbiBQYWNrYWdlIiwiZXhwaXJlcyI6IjIwMjYtMTItMDEiLCJjcmVhdGVkIjoxNzkzNTcxNDQzLCJzaWciOiJlOGJjOWJmYjViNjhjMGFjZjUyMDg0MWE5YjFjNGFjMjA5MDY4ODFmY2JkNjI0MGIzZGNjNGRhZTk2MmY0YjU5In0

Analysis

user interaction
yes
max time kernel
209s
max time network
198s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 10:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://islam-nasralla.com/secure-share/?ref=eyJjaWQiOiIyNUNEMDZBMiIsImNvbXBhbnkiOiJCdWxsb2NrcyBGcmVpZ2h0bWFzdGVycyBJbnRlcm5hdGlvbmFsIiwic2VuZGVyIjoiR3JhaGFtIEJ1bGxvY2siLCJkaXNwbGF5IjoiQnVsbG9ja3MgRnJlaWdodG1hc3RlcnMgSW50ZXJuYXRpb25hbC0gUkZQXC9SRkktTWFpbiBQYWNrYWdlIiwiZXhwaXJlcyI6IjIwMjYtMTItMDEiLCJjcmVhdGVkIjoxNzkzNTcxNDQzLCJzaWciOiJlOGJjOWJmYjViNjhjMGFjZjUyMDg0MWE5YjFjNGFjMjA5MDY4ODFmY2JkNjI0MGIzZGNjNGRhZTk2MmY0YjU5In0
Sample261102-mcm1dagy6y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4095433250-3121633380-635025574-1000\{1E4214E8-1564-416F-973C-5FD81B61B2AD}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe
3976	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4336	3976	msedge.exe	82
PID 3976 wrote to memory of 4932	3976	msedge.exe	84
PID 3976 wrote to memory of 4980	3976	msedge.exe	85
PID 3976 wrote to memory of 4980	3976	msedge.exe	85
PID 3976 wrote to memory of 4980	3976	msedge.exe	85
PID 3976 wrote to memory of 5592	3976	msedge.exe	86
PID 3976 wrote to memory of 5592	3976	msedge.exe	86
PID 3976 wrote to memory of 3756	3976	msedge.exe	87
PID 3976 wrote to memory of 5376	3976	msedge.exe	88
PID 3976 wrote to memory of 3756	3976	msedge.exe	87
PID 3976 wrote to memory of 3756	3976	msedge.exe	87
PID 3976 wrote to memory of 5376	3976	msedge.exe	88
PID 3976 wrote to memory of 5376	3976	msedge.exe	88
PID 3976 wrote to memory of 6028	3976	msedge.exe	91
PID 3976 wrote to memory of 6028	3976	msedge.exe	91
PID 3976 wrote to memory of 6028	3976	msedge.exe	91
PID 3976 wrote to memory of 3384	3976	msedge.exe	92
PID 3976 wrote to memory of 3384	3976	msedge.exe	92
PID 3976 wrote to memory of 3384	3976	msedge.exe	92
PID 3976 wrote to memory of 5152	3976	msedge.exe	95
PID 3976 wrote to memory of 5932	3976	msedge.exe	96
PID 3976 wrote to memory of 5152	3976	msedge.exe	95
PID 3976 wrote to memory of 5932	3976	msedge.exe	96
PID 3976 wrote to memory of 3524	3976	msedge.exe	98
PID 3976 wrote to memory of 3000	3976	msedge.exe	106
PID 3976 wrote to memory of 3000	3976	msedge.exe	106
PID 3976 wrote to memory of 3000	3976	msedge.exe	106
PID 3976 wrote to memory of 4700	3976	msedge.exe	108
PID 3976 wrote to memory of 3584	3976	msedge.exe	109
PID 3976 wrote to memory of 5308	3976	msedge.exe	110
PID 3976 wrote to memory of 5076	3976	msedge.exe	111
PID 3976 wrote to memory of 5076	3976	msedge.exe	111
PID 3976 wrote to memory of 2040	3976	msedge.exe	112
PID 3976 wrote to memory of 2040	3976	msedge.exe	112
PID 3976 wrote to memory of 3460	3976	msedge.exe	113
PID 3976 wrote to memory of 3460	3976	msedge.exe	113
PID 3976 wrote to memory of 1636	3976	msedge.exe	114
PID 3976 wrote to memory of 4512	3976	msedge.exe	115
PID 3976 wrote to memory of 4512	3976	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://islam-nasralla.com/secure-share/?ref=eyJjaWQiOiIyNUNEMDZBMiIsImNvbXBhbnkiOiJCdWxsb2NrcyBGcmVpZ2h0bWFzdGVycyBJbnRlcm5hdGlvbmFsIiwic2VuZGVyIjoiR3JhaGFtIEJ1bGxvY2siLCJkaXNwbGF5IjoiQnVsbG9ja3MgRnJlaWdodG1hc3RlcnMgSW50ZXJuYXRpb25hbC0gUkZQXC9SRkktTWFpbiBQYWNrYWdlIiwiZXhwaXJlcyI6IjIwMjYtMTItMDEiLCJjcmVhdGVkIjoxNzkzNTcxNDQzLCJzaWciOiJlOGJjOWJmYjViNjhjMGFjZjUyMDg0MWE5YjFjNGFjMjA5MDY4ODFmY2JkNjI0MGIzZGNjNGRhZTk2MmY0YjU5In0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffa5ce5c188,0x7ffa5ce5c194,0x7ffa5ce5c1a0
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,13011308575489176449,14833103553579082037,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,3053667654097050157,12641111811575422247,262144 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,13192925768681776364,7857429432472063486,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,9000722846298641715,11476596046726347423,2097152 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,12856725880967358015,15490244124955177044,2097152 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5020,i,9225186752158911572,12735250375093637327,2097152 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:6028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5140,i,12087910123504394902,12892202180997704511,2097152 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,4833715151060275197,15284625667346524166,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,4504298499132314561,5087340361672253915,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,1858598017424044012,3301820757729135141,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,1858598017424044012,3301820757729135141,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6492,i,4812457438892265224,6065737891718627934,2097152 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,7005075623823834470,5433097821667657208,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,6514861788304985127,6510804789328998933,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,13316406673753313512,1470493868238742761,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,14274536601399148742,13317091041014367251,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,189054504642902673,10163798433648587803,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,10365093648535295165,8461168394242383612,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5380,i,1691410676085979701,12944529965920901554,262144 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4872,i,1799602490688898164,14196453405595540457,524288 --field-trial-handle=2304,i,14796217981225235131,15639121286110709042,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:4512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ba3ef36-1e91-4db9-bce7-fd721c8aeb83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ba3ef36-1e91-4db9-bce7-fd721c8aeb83.tmp
Size 25KB
SHA256 23f1a77d8f4ccd58a95db259c795a2851e6607c0bbea1283adad05ceaf4e4667
MD5 ed074b98fe445b4e1f5594b3d42d62c2
SHA1 598e046295f0c3270d4bb3e3ed41acb134e4e020
SHA512 426eef4fa564cce93bd2d4acebe5da9931fcd23bff59e09569fe8e3e786320ecf5b506a8e90e4595a70d6903e6640f68122ff20088a26b902ab444449f6de8b5
SSDEEP 384:nRiFiZcI63sNM8TUNTUlImkrjh+mtAthfPf8O6MfGw337O6R2FeokqgL/7IzLoD:4FQ63jwg59itGW37TRY0
TLSH
T1DCC25B31DC58CABBEDEA9FDAA74A7A13DEF40163859C9AC4D6C81D1D00835DD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25bf54d9-24da-439c-a440-09899b2e58df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\25bf54d9-24da-439c-a440-09899b2e58df.tmp
Size 26KB
SHA256 4323ac2e0b29d0c49971ccf39ac401308685928ac3cfa65ed4129c8c99d7c4e4
MD5 206d836571aa809c3a23d46acfb668bd
SHA1 196e017730394b9891b8eec0d7bdae6337d0170e
SHA512 c8921df79b3ef33fe94645022cfa0a82835cbbdef7b63f5e20bfe6d5930b7352bd057e27d87c2140676eec066c8879d15cb71b493b921cf5a7806377a00d15df
SSDEEP 384:nWiFiZcI63sNM8TUNTUlImkrjh+VrJthfPf8O6MfGwzX3+jtW7O6R2FeokqgL/7h:9FQ63nwg5iptGY3MtW7TRY0
TLSH
T19CC24A32D858CAABFDEA9ED6A78A3617DEF44163C68C9AD0D5C81D1D00975DE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47768c15-ea91-48c2-bdfa-a4820010b597.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47768c15-ea91-48c2-bdfa-a4820010b597.tmp
Size 31KB
SHA256 a33430d855732a5b8dab5ce4cc10a43ec6470cb02d6101b75bf943247ec88671
MD5 78b602ae5a1b6723aa5dcd7c987401dd
SHA1 522a4c632fa2c6c19a194b741a46397ec4d40149
SHA512 34c8aceb0bf63fe0d47d8da6bbd27eceff8473beb8eefbc62448a7d50453c9ab46f5be2b25b2c2164ce3d0d9a659acdbd68b1a49889bce0a6ab813085c5efffe
SSDEEP 384:nkiFzQkUSvw9sNA8TUNTUlI4kLjh+eZsthfPf8O6MfGwzX3+j44WH7vBE5tlgL/t:/Fd+XwgbRutGY3M44WH75EHULP
TLSH
T1B3E290F198D78977E9DE5B97A37E2D029ABCC153B5885A90B7C80D1CCC860BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9346f9a8-3cd6-4b1f-8cff-eb2cdef8b3d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9346f9a8-3cd6-4b1f-8cff-eb2cdef8b3d2.tmp
Size 26KB
SHA256 a3468665e0200d41609be969ed31039ec7fbe93806c6870965fab41e23f485a9
MD5 f751b5396d1d44c57680259f298c308e
SHA1 5aabdd6aa41cd2437cdde428c1df12f7ef5fb56a
SHA512 42b93070fc8bc6f038df8cac0871740845f3f574c7c8d2f27e2d8d038cb064a880b4c25a20a882cf5ec98b1aa2b3820b7780ed96007eb96a181749b0acb52538
SSDEEP 384:npiFzQkUSvGsNA8TUNTUlI4kLjh+eZsthfPf8O6MfGwzX3+jnIWH7vBE5tlgL/7R:AFdGXwgbButGY3MnIWH75EHULP
TLSH
T129C23A32D859CE7BADE79ED5A35A3A53EEE08163C98C5AD4D6C81D1C00C71DE170BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27341f426aa0efd6c484bc21b43d92cf90ca72c2333c8e492f256c83fd880a23
MD5 5e7e3b8030681bdf6022439fe49f75f8
SHA1 0ff916bc55fa603e71947fca76af181bf6a176af
SHA512 f028e8f02a0deeb001818c82b1b058d78b877b08dfffccd53e7636c6b399cea4a3f75d2e7d48b81a7bd267b29da417e86f7b980e8764b264d26bc3942cb86bac
TLSH
T192D02BA49AC8C8C0C84120361358420831C8D23448A3404244E00254CED126216A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35bfe8411fef5cfb5e836a009d986a443cea8a767a24a62c88b76fff1445d4fe
MD5 7a1868737ff3b37a41fb1012d04e5317
SHA1 68663bf5d3a6b7b5ec10929aab80449de703c46a
SHA512 aab22617c95c8283d6909703835f5f8c127f54c6ca8c76ca1dca713266b8bbbd7738adc47493793e9dfab0c295fe255b678ea1be77229fadf2f3ae7ffbb01d31
TLSH
T143D02BA896CCD8C0C85520361318420830C8D63448A3404244E00244CE9126212A70E0
MD5 SHA1 SHA512 TLSH

Submit Download

2907d010-90b7-472d-927e-91a1990cc380.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2907d010-90b7-472d-927e-91a1990cc380.tmp
Size 12KB
SHA256 b2c0eccde3d11400b11966d5a686f94c575b4c3e5c44cbc1f73d1be4f84e480e
MD5 5926c4c3ad86eb61a7018421ce1ba864
SHA1 db73161eafc63565b4b9bff8d0b16d241ca9301b
SHA512 ab89f5bc6e8b67fec4d44136536a65a3f342163ef760dbd4a59f097ac55dd8804f3a391b301538ac7c5872e08a74ddec202f723a3b695e2cc6d6c3082b57b286
SSDEEP 192:sxZ4R9ku/fMs4uHXszodpT01HW6+WNmAoUCEoQJYC3s0d/0TIg5bXJ:sxZ48u/fMs4CXvgHbP7LJnUx5
TLSH
T12442C6566D34AD3B9CD7D219BA55BF53D3F92032A0D12F48AAFC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5dedc9ea-4635-457d-8a0f-1ec377c140f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5dedc9ea-4635-457d-8a0f-1ec377c140f1.tmp
Size 414B
SHA256 381e2af3afa9b1a2b009a65650bfb7f7939ce2c80415a4641678a25495a7e663
MD5 8a2b19548da0f2033b4602411444d2ce
SHA1 30587dd8c6e1b8ad9c0196bb041d3956b3638990
SHA512 93692d9d39d58a8db2dcb99c15ed4b1535cb102dcc38d2247cf0bf8b4167b2031c894f83422a8c2a04ecd9c61084ba109b8718dbef8a0a207b118726492952dd
TLSH
T1B8E02BE9CE21BC2B18FD07186095074AE79103873A50594F3A3C4108CFF963746C687C
MD5 SHA1 SHA512 TLSH

Submit Download

8ca586ad-9dcd-4823-9d5f-d2785f40bd6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8ca586ad-9dcd-4823-9d5f-d2785f40bd6c.tmp
Size 11KB
SHA256 d95df4943f1c8ffca3f0955dd3bdf7781bad9a13dbc03f4ff252fe7a8264eb17
MD5 6b3328594071fe8b16ec12a976ad07d9
SHA1 35a8b4128fe7a95e8265a28cbb1a9efa2a740e6d
SHA512 d53ac72f1386635525963b7e4803cf818cac3ea833491973ae0c854b89f30cdbcf67e247b6c8b9ba8c6745c2d10d25747e0a2d1acbb14f554fe863d6e9826b42
SSDEEP 192:sxZ4R9ku/fMs4TXczodph1HW6+WNIoU/YC34dW0TIg5bXJ:sxZ48u/fMs4TX/HHb8/bUx5
TLSH
T17832B6566D38AD3B9CC7E219BB55BF53D3F91033A0911E48A6FC8A1C15E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a94e04b-f6a9-4979-9bad-bdd1742db492.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a94e04b-f6a9-4979-9bad-bdd1742db492.tmp
Size 27KB
SHA256 a3c0dd094bd95ae39d71c189ff9ab8c81c02de11d490dc8328156e348fe37e7f
MD5 2003a47f3b61ad35974063c6e3776179
SHA1 1107e3ecf6c46baa8a7aff37203e3aac94a0b2b1
SHA512 0168f530c2f248656f8355d19d5f0022498009a5111e094398303cfb818982bc05955fb0d6a35ab65b5fb3c836a884f5d1bd71491cf2e7e2f746ce974c0e185e
SSDEEP 768:d8+S3v9WvhL3b8F1+UoAYDCx9Tuqh0VfUC9xbog/OVcwLle4ZvWrohMYUF:d8+S3v9WvhL3bu1japwLQ8vtKt
TLSH
T131C2F92F380CCB7E5FC01E9D9C1A6FDA6D9802C7A6588D4047FA994C03D77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ef11417c79b4a6eb9f69a0ec237358fb629e40a129e56a36375a0ab6c69c3e18
MD5 95d6e614920b81525b693c04b6214f67
SHA1 79e1cd45a28761fffb0b4cc1ecd605a71644df18
SHA512 bdece0695936bd8dddca44b40296b292ccf989ec18ac92a905d4dc2de33f34bd2b20d7e38eb5bfdeb2c413539ee003a09c72195a379f7027905640b305927cab
TLSH
T10AE078D908C4C61D5154E56701DC570CD590372FD7C06D4D1744D459B00144076CF770
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4f3c811f1969b142993ff4d22bda2d73a9fb664d2108164ac641b079d668ff65
MD5 5dff29887982e5cfdadb81f27b138478
SHA1 e940328982460ae98ae7f3aa3143bf4cbfaa1007
SHA512 7ae2ae05f2d8027aba3909151a434a0e7db616d321b728fa918f629ce3c8c6fcf39bd016d9b913e0ef386d993906641c1279b3cff3fbd6ee9988459eca397f2c
TLSH
T1A5E0268904DDCA6EB248689741B9E30C8280365FE7C0690E3740C9CD7006644BBB6BA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 cadad0adf534f25dc9ac48614a0f0a20178c213c6c7de7409d2768dccb62a28e
MD5 d3839a295b3e052b11d23687d018b548
SHA1 b6ef5569982580ec5005dc70bcee49781fd43b18
SHA512 fd9b56e6a85e17a5496d46defead11efc902bab31866d0910304b1c55c37f7ecc37ccf12e5ddabcb0d61c5ee7b0f85512652385a96f8cbc261dc2b201eac9ab7
TLSH
T11861A50899BDAF50D7BB417CA7D4A8B73634B1B05CE31D2E9CB8E4B867CA31749D4401
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5868717c043d0cf1281292dc0eab8dd4e7595abb7ce1c438b5b32e2049ea25e
MD5 5f63086911a182944029c9edaa53ade8
SHA1 94d1a79b82037bb6732ae61c2ab3bd76c34544df
SHA512 b6b21b4547d64b7d374972ae10aa55c5746c982b4b71350e3b7863fc2caf38abb5f0abdd9cb4c23cf3627bd7bebbb1164b728b54fa279a1d3b41762050557c02
TLSH
T10E61A40899BDAF60D77B417CA7D498B73674B1B05CE31D2E8CB8E4B86BCA31348C4401
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 217d99f4b080d7c9e448e7ef60269487cdd028d7f2d8fd29a5d675af292ab4bb
MD5 96bc4f98b6fb3c612f0db0d9c6d7770c
SHA1 11c1ef9e1f91f641e24faf840f30b600979caee4
SHA512 04559b9453325ff3dfe4ec0ca6a660e16e3fdc437a6fdf220a2d5682f185adede0d2db6be793f83d836482a752a9dc0461379312046c4efb8b394263bfdd8430
TLSH
T14C61840899BDAF50D77B417CABD4A8B73634B1B05CE31D6E9CB8E4B86BCA31749C4401
MD5 SHA1 SHA512 TLSH

Submit Download

bbeedc41-25d6-4da7-b417-d26a3f8cb7ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bbeedc41-25d6-4da7-b417-d26a3f8cb7ee.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5d292652-1818-4176-b981-4cc397b18de0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5d292652-1818-4176-b981-4cc397b18de0.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6418c0a7-60d8-4418-b9fb-9943a9b6e9db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6418c0a7-60d8-4418-b9fb-9943a9b6e9db.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

85e53500-4084-45cb-b2a8-a9dc4624d733.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85e53500-4084-45cb-b2a8-a9dc4624d733.tmp
Size 4KB
SHA256 47d0cf03aaad8b3f9e4fef8bb234c473960001b1715f91cf1c1a826fcd06fe43
MD5 e7ec6f8a93ca46dfc96e0fc868f5671d
SHA1 d5f4376697e66c63fd25ebc15a8b58204400da7a
SHA512 677721b30b398277bfa4378b3dffcc2f372bb464bcd552b5379ee8cee4ac4cd523ffb39e66d72d9e877ec9066db2ccc3dcf03132a4c66eb5a980f5af9ae52ada
SSDEEP 96:DbS15UObkbGbZFYaagzEbybcgb4EybVmB5wQ:D+15fbkbGbZFYaag4bybFb4EybVmB5T
TLSH
T1378190F7C2F9866D891196F0AA186E1FDF2D0914431C3D5ACDE4AF4BA3E2170E14164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f0145a91-8a16-440c-88db-4758a3c39415.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f0145a91-8a16-440c-88db-4758a3c39415.tmp
Size 5KB
SHA256 b0d6befc84313158118dedb83a808fbf35f8a637eaaf0b54e1404d8d05972d34
MD5 222081cb627d4cd2a8896b7915dd12b4
SHA1 d3c86454e2cc185ffd00600dfebaff4c6ab157ba
SHA512 6a66dc4c332f48ad2f8b82592f6553d8d8021db88e9f5422500972d4dbe24922ceb5fc2ce4a69fbc5b148d8fe615a73863e4bacfd6e9e4ffe1db4c783dd84e25
SSDEEP 96:DbS1UObkbGbZFccP/b7UrBaagzEbybcgb4pbrwQK/smb7hJwg8ux:D+1fbkbGbZFccP/b7UrBaag4bybFb4p6
TLSH
T1BDC193F6C2EAC62DDD2196F09A196E1FCF1D1925832C3D1AC9E5AF4B93E2070D14264E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 76d7ca664b86f51e51c1a0f72eb01f1ab5f30aba8bef49b35076c47dc9ab3add
MD5 f00c89871f265b576ddcc817a8b56136
SHA1 10f9f68265de8b006029e936e25f391e51347df4
SHA512 a8ba7a9dfa49a1ac00777e44bbaf3afeed9301c1e3372b4f2e3476c2a67a94e37d520652463342beecb7b7cafc2cd5fa3675b37d8013a6c6e67ad726ec38a3e9
SSDEEP 192:yjNB/XORbkJNlzjk517HNRZhD/N3d4v7dq:yZBvOFk3lPk/7tRjDFP
TLSH
T1BAB2161571BB0200387E2D0C81B5876E9A4272A37068EA7B7FBC04A6DE67E055DFDCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a1e64d5b-b71e-49cc-b922-4ba955bb2f73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1e64d5b-b71e-49cc-b922-4ba955bb2f73.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

da08c3ad-2d5a-4e09-aa2b-e6a5db6155cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da08c3ad-2d5a-4e09-aa2b-e6a5db6155cf.tmp
Size 11KB
SHA256 2fd7c63c1124ed69adceada6377e06ac9455607a5ee08d53c4c61957a56ef48f
MD5 1cabc708714a2538798eb8795fd2f9c7
SHA1 fc98bf439834f651369cf473119d93b67847cd8b
SHA512 4950c09f3169d0edce232315f01cd00f440aa72732a7621d58d407445fe415da94f5a26a43c1354887f43b5b0260199906a688018146f5fc8b00b86008ed50a3
SSDEEP 192:sxZ4R9ku/fMsaXczodph1HW6+WNIoU/YC34dW0TIgjXJ:sxZ48u/fMsaX/HHb8/bUj5
TLSH
T1F632B6566D28A93B9CC7E209BB55BF53D3F91032A0911E48AAFC8A1C15E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f8c0959d-d19e-4c10-a87b-0ffa8494154f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f8c0959d-d19e-4c10-a87b-0ffa8494154f.tmp
Size 11KB
SHA256 a5307b35c2c9925d751c94803980de6ed2931f8206b95c21cf3cf63c27b6f362
MD5 65f87c291d4b8ed00645f498a1ba6219
SHA1 f886f2253fdd61052e8464ac00b4fbdebcabd933
SHA512 80a07f95fd43594b681deda2dab73f972b5421ef788f89d384de66894dd81a1140a7230e9747e1849b3d683f792cc5e4559328204ea9dfffe7fc889c9b67decf
SSDEEP 192:sxZ4R9ku/fMs4uHXI6zodpTP1HW6+WNmAoU/YC3A0dW0TIg5bXJ:sxZ48u/fMs4CXiZHbP/yUx5
TLSH
T1EF42B6566D34AD3B9CC7E21DBA55BF53D3F91032A0912E48AAFC8A1C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9469e42fe58cbe9159dfac63b7746e63a3da48f1bd246066cfa853fbadb3d7ec
MD5 b5203eecee991673da72667c3623090e
SHA1 e8f0a0ed899bd5427ef8c3e6fc61e85d746b8a90
SHA512 dc3380f3a3a8622a4b2cb8bfee8f749af3837f89b4cc0b89d5676d5c74916f30f7361aac51dd3bf6ca75fd7324279bda32a52fc9be74d037afa37706158b4ee7
MD5 SHA1 SHA512

Submit Download

b31e8749-bac7-46e1-a685-669509257ebc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b31e8749-bac7-46e1-a685-669509257ebc.tmp
Size 392B
SHA256 21518bf8292e7894b079520835cff6dd2adb965e52d2b25cc8ff551440ad5d2e
MD5 0bad5d484b3edf37af66ec9655123d3c
SHA1 228df2003a36dc5a003834fb28e325c5660f9ffb
SHA512 05ef72eeec460f9fea8cdd88b3cb1cc550acb0099ff53a20435bb7c98b5540163aa131a2c86158d2b877a37efc1f02a7d922a037cbd56d5d11a3dbc5b15a7945
MD5 SHA1 SHA512

Submit Download

dc52ab53-f677-4815-91e5-4bd342e1bd47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc52ab53-f677-4815-91e5-4bd342e1bd47.tmp
Size 26KB
SHA256 6571cfd79551cc2b9ca26a059ec455230785239ad94a8953fb65b06c04b0af10
MD5 675e4f662e94d0310d36e10ed1a4d8ba
SHA1 75a233180a0d7db71aa33fefc9879cef90f9d929
SHA512 43fef0d87aada9b1887a743f05f23918e9c431003f5daabedbc3282d339d06586c5a3082d145c6597df2b699423ee44d29972bd00bf7f25e52d067d6ba81b531
SSDEEP 384:nriFzQkUSvGsNA8TUNTUlI4kLjh+YZsthfPf8O6MfGwzX3+jdIWH7vBE5tlgL/7R:GFdGXwgbbutGY3MdIWH75EHULP
TLSH
T1D6C23932D859CE7BADE79E95A35A3A53EEE08263C98C5AD4D6C85D1C00C71DE130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b40e1289168959731afa43039b45efb4e7a0df1c807e5749b0cfbe8782bc53fe
MD5 a2e2c160792cd759fbc179a12d1edc59
SHA1 54d7b57e5f4e5fcb0949685eef71041897940d88
SHA512 79a4e5a07739bfd4a808fd19b877b941d36a1c50a9472c6582f82d81fcd30f850fb89a2bb174f936a27fd31092f34aac30434861e1264777452974110329e0be
TLSH
T182410659BAF91158B3B76F5AABF6A86D483EB8332E07D55E00110D4F0A23B44C872737
MD5 SHA1 SHA512 TLSH

Submit Download