hxxp://plexusx[.]lol

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/11/2026, 13:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://plexusx.lol
Sample261107-qrnf8sys6k

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1552	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-338007942-693956180-937915117-1000\{BF3A8DF4-D311-4C66-87D8-D4A423E2097D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3176	msedge.exe
3176	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2160 wrote to memory of 4040	2160	msedge.exe	81
PID 2160 wrote to memory of 3832	2160	msedge.exe	82
PID 2160 wrote to memory of 1552	2160	msedge.exe	83
PID 2160 wrote to memory of 3832	2160	msedge.exe	82
PID 2160 wrote to memory of 3832	2160	msedge.exe	82
PID 2160 wrote to memory of 1288	2160	msedge.exe	84
PID 2160 wrote to memory of 1288	2160	msedge.exe	84
PID 2160 wrote to memory of 1652	2160	msedge.exe	87
PID 2160 wrote to memory of 1652	2160	msedge.exe	87
PID 2160 wrote to memory of 1652	2160	msedge.exe	87
PID 2160 wrote to memory of 2916	2160	msedge.exe	86
PID 2160 wrote to memory of 2916	2160	msedge.exe	86
PID 2160 wrote to memory of 2916	2160	msedge.exe	86
PID 2160 wrote to memory of 408	2160	msedge.exe	89
PID 2160 wrote to memory of 408	2160	msedge.exe	89
PID 2160 wrote to memory of 408	2160	msedge.exe	89
PID 2160 wrote to memory of 4764	2160	msedge.exe	90
PID 2160 wrote to memory of 4828	2160	msedge.exe	91
PID 2160 wrote to memory of 3340	2160	msedge.exe	92
PID 2160 wrote to memory of 4764	2160	msedge.exe	90
PID 2160 wrote to memory of 4764	2160	msedge.exe	90
PID 2160 wrote to memory of 4828	2160	msedge.exe	91
PID 2160 wrote to memory of 4828	2160	msedge.exe	91
PID 2160 wrote to memory of 3340	2160	msedge.exe	92
PID 2160 wrote to memory of 3340	2160	msedge.exe	92
PID 2160 wrote to memory of 5340	2160	msedge.exe	94
PID 2160 wrote to memory of 5532	2160	msedge.exe	95
PID 2160 wrote to memory of 5340	2160	msedge.exe	94
PID 2160 wrote to memory of 5532	2160	msedge.exe	95
PID 2160 wrote to memory of 5692	2160	msedge.exe	96
PID 2160 wrote to memory of 5968	2160	msedge.exe	98
PID 5692 wrote to memory of 5876	5692	msedge.exe	99
PID 2160 wrote to memory of 1492	2160	msedge.exe	100
PID 2160 wrote to memory of 1492	2160	msedge.exe	100
PID 2160 wrote to memory of 1492	2160	msedge.exe	100
PID 2160 wrote to memory of 5948	2160	msedge.exe	101
PID 2160 wrote to memory of 5948	2160	msedge.exe	101
PID 2160 wrote to memory of 5948	2160	msedge.exe	101
PID 2160 wrote to memory of 5764	2160	msedge.exe	102
PID 2160 wrote to memory of 5764	2160	msedge.exe	102
PID 2160 wrote to memory of 5824	2160	msedge.exe	103
PID 2160 wrote to memory of 5824	2160	msedge.exe	103
PID 2160 wrote to memory of 5824	2160	msedge.exe	103
PID 2160 wrote to memory of 5780	2160	msedge.exe	104
PID 2160 wrote to memory of 5780	2160	msedge.exe	104
PID 2160 wrote to memory of 5780	2160	msedge.exe	104
PID 2160 wrote to memory of 5376	2160	msedge.exe	105
PID 2160 wrote to memory of 5376	2160	msedge.exe	105
PID 2160 wrote to memory of 5376	2160	msedge.exe	105
PID 2160 wrote to memory of 5628	2160	msedge.exe	107
PID 2160 wrote to memory of 5628	2160	msedge.exe	107
PID 2160 wrote to memory of 5628	2160	msedge.exe	107
PID 2160 wrote to memory of 2768	2160	msedge.exe	108
PID 2160 wrote to memory of 2768	2160	msedge.exe	108
PID 2160 wrote to memory of 2768	2160	msedge.exe	108
PID 2160 wrote to memory of 5320	2160	msedge.exe	109
PID 2160 wrote to memory of 1804	2160	msedge.exe	110
PID 2160 wrote to memory of 4920	2160	msedge.exe	111
PID 2160 wrote to memory of 6008	2160	msedge.exe	112
PID 2160 wrote to memory of 6008	2160	msedge.exe	112
PID 2160 wrote to memory of 6008	2160	msedge.exe	112
PID 2160 wrote to memory of 5640	2160	msedge.exe	113
PID 2160 wrote to memory of 5640	2160	msedge.exe	113
PID 2160 wrote to memory of 5640	2160	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://plexusx.lol
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ff9428ac188,0x7ff9428ac194,0x7ff9428ac1a0
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,10237327290130648159,9119068576559030417,262144 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,8386801696201250236,11618133179154702424,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,4942690005277679253,6194718853559052615,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:13
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,9235380975481724301,2821676870906623934,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3512,i,15432739449590263663,2903765473531317102,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,8122862709940356969,6752018606431413854,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,6074675811381894497,18144533064294619534,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:9
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,10047779640605464566,10148719944876880159,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4232,i,9051512617911862822,3577807182774193763,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:9
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4392,i,8655289256530902507,14084411037440123394,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:14
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,14744576568437895583,12628569706432397574,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:5532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,10933385469880085591,6118307167871715756,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5692
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1132
    3⤵
    PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,7368248264693137256,6569917535457034593,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,7368248264693137256,6569917535457034593,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:14
  2⤵
  PID:5968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6472,i,1518803119541663984,14804851190896520922,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3592,i,5513384617251107420,11745736838230659523,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,6604568388065204070,14478746325820420087,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:14
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6628,i,2164336062121143333,205566516984035242,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:5824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6704,i,13178784156368468209,10753751720898965068,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6552,i,13728914025754958063,12451896642092432760,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:5376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3636,i,4764724025052447352,9430003596952249703,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5200,i,16597810110715674248,1115510757948439362,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,179331251296313413,6259747244653315505,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,7820593697630719562,14490638199676096891,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:14
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6980,i,12819819624954904565,8094227091700482323,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:14
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6832,i,5625795949641367507,444036247702066381,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=5056,i,10225108570798133775,2234584094306237378,2097152 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6772,i,593389410238375049,4273346237265098899,524288 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:14
  2⤵
  PID:648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,17986740221000057567,1493601790382092873,262144 --field-trial-handle=2232,i,9607591728689873322,13711059512287962652,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3176

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

32bb07ae-fee7-4316-a3e7-3b2437dc5bcb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\32bb07ae-fee7-4316-a3e7-3b2437dc5bcb.tmp
Size 18KB
SHA256 2cd0852b684f9313f0f64d39e126ce9d71c70fa8d4af5fe83678656f041f93f5
MD5 27d73258106121e8ebeee47518050c1a
SHA1 d29c75042c7c978b5ac5ee0789203e589f90f914
SHA512 419c63c69731f4d870d915a138c47a4e154354b30ca5a595adf1fc92f61bfb69221dd3b754e38c2c4d6d2677a917721514e4feee1ca2da73785eae09fe8bc68a
SSDEEP 384:QQkUSv08N/Y3/rr5029ckX5mV83utOJrNxH7vBEnFNIIl0:40j0lsAOuIhNxH75EDLO
TLSH
T1AF827C32AC656C3B0DF3B515F15A3A13EEB4E11BD6C81B84DADD5A2C00CB69C234BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47ad55c2-6bb5-4329-95ed-e637cc43f1cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47ad55c2-6bb5-4329-95ed-e637cc43f1cd.tmp
Size 8KB
SHA256 f048409fcc2bcaf7c0215946c5e4b683418150407dc35e59f8285f6329f742ee
MD5 da1fa4d8e67d4b52396253fc2c9eb1d6
SHA1 7fb91215631a754e5ffb73a714eede607cacfe4c
SHA512 b496b02b46640c34dadb87b0bdf5dcfcf2effd99ba6dfd2ac7534459a35d13099c11f371affccb0a56943607949e9913ac6338f95096cea04da4e4c019397c7b
SSDEEP 192:AGN16WLkQmiUynm/LEbnckX5m9r83Vmy4l3o6U6:AGN16a0ImLQckX5mV83a3XU6
TLSH
T19202E835AC787C7B9EF3AD49B94736175FE4212BEA856F44CAE81E1D00D729C2306823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5eec13be-0edd-43a1-867e-00cf361b9aa3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5eec13be-0edd-43a1-867e-00cf361b9aa3.tmp
Size 18KB
SHA256 0dc299195dc876ca3dcfdbb7ef57c949c78fb67e2285435e78ae9be03ba8513f
MD5 ea8b8a3d914061c4de9fdb48805a5daa
SHA1 668dae5ec91e56430d280fb8a5b5200e7e12d7b4
SHA512 d30756988b9fe16a7de8d9fab925ce84e88f80f5e04e69baeff35e36c08a8e64ee45f7bbb49e0d2d0822f5efe22e848c32842d527b38180ed4f915cee5fa045a
SSDEEP 384:lQkUSv08N/h3/rKuT9ckX5mV83utOJrNxH7vBEnFNIIl0:/0oSsAOuIhNxH75EDLO
TLSH
T1A8826C32AC756C7B0DF3A515F15A3A13EEB4E11BD6C81B84DADD6A2C00CB29C234B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86547283-7506-4550-a279-0d3bda5cd75b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\86547283-7506-4550-a279-0d3bda5cd75b.tmp
Size 8KB
SHA256 a0ab463698f5b96c1b0f2d62257459fc882f482cb29b911df75b2bcc3b8ee2bb
MD5 86d5f03f0a471c4ca920d4b75423280c
SHA1 1e53ec8bb315c20f2d3a022db830ba824a0f8e65
SHA512 9cb97d6bf942b0658777d1dcfa0d32adb695ac90ea345ae47f4eb7bacdd46056587c7e38be988b9fa645cfef0a1896d7b5bd3fe7073dbd083baa70f0c28a6865
SSDEEP 192:SGNK6WL5QmiUyJ/BEbnckX5m9r83Vmft7SJruMezqKU6:SGNK6aX2BQckX5mV83utOJrwxU6
TLSH
T1F5121A36AC78B87B5DE3B454B4873617AEA46117DB896F44C6DC2A1C01EF29C234A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c88d78d-3bff-4286-9713-72de53b8ea7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8c88d78d-3bff-4286-9713-72de53b8ea7b.tmp
Size 26KB
SHA256 9cc90dad107cc65b2e5a5cfdab5f41fe9fc7fa599081cbe522932e476493f4c6
MD5 4c55358e235de83898651f8b4e3311e7
SHA1 2f68574fd9c6b880e6f9fe550e8ac5b7f9c694ab
SHA512 55bdf80f74200a7c0524b0ae6f3875e246352e54278baf4614c48daab43be2a1af07990517451580c05b230d2a2e685bf27e624be9f6485cdb0efafdec8ba2d5
SSDEEP 384:qiFzQkUSvQ8Nh8TUNTUlIlY3/rrw029ckX5mV83utOJrkxH7vBEnFNIIl0:hFdQYwgH0lsAOuIhkxH75EDLO
TLSH
T1C3C218F248D7583AD9AE9B07A33E3D039DBCD017F5845640B788591CCC861BFE34A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3ac6d06c818694d314fd7e1c8585b8fed5f3f436c22dad65d4d99f6c08dbd429
MD5 2ba269f116715c306bf5080c1c6521f2
SHA1 be2370d904dca815a45076b6a5423deaa829d096
SHA512 f7e6b5701770ad9b5ee570b961252022942870c6f4ace7d03c97456e604ce4904f5b9f5a58435bbd4a2a83081cc35c2708592f41df42cc24e05850cf5301a4ec
TLSH
T11ED02BE4EE7811DCF052203C223B17283944810050830001D49001EE0C443D312BC034
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c3d6e1c303999af0d8df13a878ff81ae1d0a4b0dbd87e6e8d2a4b14b845481ea
MD5 eee62502b43458b13946c8ca96c885fd
SHA1 ea588ca4d4a09f35814349e8f76ec45d1492164b
SHA512 7c618563bb16a7574d927489dd738711547fcf3c086ee853a238d1a7bb12fafffd84da5082c7561413c8f0e3687f89713ccfbe58b46b221ce21121a466383e88
TLSH
T18BD02BE4EEB815DCF452203C223B17283944810050830002D49001EE0C453D312BC034
MD5 SHA1 SHA512 TLSH

Submit Download

1322fa85-254a-4dfe-ac85-5625fec26526.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1322fa85-254a-4dfe-ac85-5625fec26526.tmp
Size 9KB
SHA256 e1e4ece54a2251a5c8dedc0d0ba0655a6e4448835c1af2571a734afca29dbc25
MD5 c0be7b890fd19ebdbd1a0a030ca0aa24
SHA1 0fa110c35c711fa87a6faa965fe846a6d6d71401
SHA512 e5f8fa51a5f33f16f787b8b9354653f1fa2aab104c5d7cb8b74aedbd37b9ca61836b2d0f040e498c61ad8cee0f71afd3be9da303fb337f0b9a12a608d319e579
SSDEEP 192:sxZPRoVbR/fXsNLivIdpr32/G346+WNGY0HnX2JtlfIgrJ:sxZPCR/fXsND6/wG5mpf9
TLSH
T13F22C8256E38A97B8CC7D219BB15BF53E6FA503291D41E48EAFC961C04E7ACD124780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

155899a6-eac7-404a-bcba-91b8df35e76b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\155899a6-eac7-404a-bcba-91b8df35e76b.tmp
Size 13KB
SHA256 87bc06eca1e7d42acaf84bc2f774343c0691932cccdee0eb87f4d4f3b05addd5
MD5 7c92d625b839e3daf4084ba00a0bbad7
SHA1 48c4f050f64c8241d32cf6a841721bde87deeeeb
SHA512 6c8eadf52f381e6a97953d117283daa1c9f7d5e9f28c47815635afe400b9bcba157fbcb742d767415c5c0f3feebcddd77b68ce4c96925508902273f94d5061ac
SSDEEP 192:sxZPRoVHcBzR/fXsyW3iwdp8i3N+K/G46+WNqbnH+s/Y0HEJ2JtlfIg5BwwJTlH6:sxZPSmzR/fXsPnL/Ayl/5PpflK
TLSH
T15852E9666D24D9B78CC7D219BA35BF57E2F5403299951E4CABFCC91C00EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26e82dee-ddc6-43dc-8e74-9908f7ef9871.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26e82dee-ddc6-43dc-8e74-9908f7ef9871.tmp
Size 10KB
SHA256 118138194d2509e27699a8f7dc6f55044d8cca9f09f05d6da338509f048a336f
MD5 0dfd16dc01abc1fe8c0c413764baee10
SHA1 4c2f446ff30ad31a0af88a858f7be833a7366b20
SHA512 d49b4d67f239df9a570e755ab35d3877ed6da9876e9b63b187b856eecdda26504ff51f8e58767913770fe9236aca49aed2f9b31b99fc825e16ef9c121c03fb33
SSDEEP 192:sxZPRoVbR/fXsy2LivIdpr32/G46+WNGY0HnX2JtlfIg5BaJ:sxZPCR/fXsbD6/AG5mpfy
TLSH
T1C322D9266E38697B8CC7D219BB15BF53E2FA503291D41E58EAFC961C04E7ACD124780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b61ee05-2b17-4ae1-898c-e1b933e7beef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b61ee05-2b17-4ae1-898c-e1b933e7beef.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6524d811-d03b-47d0-b4f5-0beb0b46cd43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6524d811-d03b-47d0-b4f5-0beb0b46cd43.tmp
Size 28KB
SHA256 f81da85a4072e1ddbac86f4d038bd09aaf75428a213dc4567b167ae8556b437d
MD5 f8c70c7a14594c2ad7ca5956152460b0
SHA1 85dfc0051550f5cc3f957674d28a642b4bfc00c7
SHA512 babbc0db9248eebc026c5f7841689d486ae0927ae6bde920c11414bfebb76e74d52d2e0563dc9cf9be347b01293b18cb4023796e2213e38148289c357f2a9140
SSDEEP 768:CbY2I87M23TWRmjdQVx8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3NyLl/cu0yAJroIu:CbY2I87M23TWRmjdQVxu1jaKNyLpc3yZ
TLSH
T118D2E93B240CCB7E4FC11EAD9D5A6F976E9802C7A6688D4047FA994C02C77EE51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

704bb488-0b80-4cb2-8ed6-4d6cdba1c167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\704bb488-0b80-4cb2-8ed6-4d6cdba1c167.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

9306b09c-02d0-4357-8141-a4cf39df741e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9306b09c-02d0-4357-8141-a4cf39df741e.tmp
Size 12KB
SHA256 288dd14d231a3b1b90260938b6c68cbf0fda00ae1b765dae42b2ed1a09cd3e05
MD5 41f74d1836dcf861836971ddc3a49cd2
SHA1 5ad823282112f66a9b611343b8fc245c8c4b09ab
SHA512 6120dae10784e189aa6db065e7d993f5272c49513b4328c8c24181519d23ff67f7b877cc70c8606c1cbd5db5770c4da22f0b72124d97d594f9985b189170e0f1
SSDEEP 192:sxZPRoVHcBzR/fXsyWoiwdp8i3Nc/G46+WNi+s/Y0HNJ2JtlfIg5BwwJTlH6:sxZPSmzR/fXsPe+/AU/52pflK
TLSH
T1AB42F9666E24E9778CC7D219BB35BF53E6F5403299951E4CAAFCC51C00EB6ED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 68KB
SHA256 2033d4c0dcdab8b765e78c9c1845742d2589b0f1c56a06b701e91f536035f85c
MD5 047bb9fd0930eca58ce326cdca8634c0
SHA1 b9fa0a8cc2fe5e274bb20d28ba8581139949cec1
SHA512 c4e022dcfd4e98313189200eba4b545a65163a7365107d082085b4c49a2f57402fc1480c95984acbfbaef179dbdcc11895dc7fea875d3783a7c5d2a99743b07d
SSDEEP 1536:7WiFK/+t3/ZhLVxdengIiVyWT2tiuwqVMfNidV/yd2db:7MMZhLVxQnqVyWTVfNid5pdb
TLSH
T1C8630262AF4CAB7E25CC41839FD2A335D0E8DD19481B407C36549BCFBA549712B39E63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000077

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000077
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 39001bfc53d1e9f848ed6681b3670926c5a741e7835ed009b0c74b167bd83619
MD5 88688561b017950e36da95c118d48edd
SHA1 0ae9eb6e8c59a1855657f0fd7758e2d4546beaa0
SHA512 40ccdbdfd44317a320b51240e05c970f5020a7664dd6bf23f9043a699f13b4df3105b605c474edd9382c1bdb358748b568756f5072f000aad185966160fb9897
TLSH
T1BB516FBE643792D2D3A49C7C9AD9008B3B3AB0917B932E93357CE4F858D631C90E5030
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 2766f672198d72fa6f703d7ea14ddc293eb1095315fdae3620038aa4d3818030
MD5 962ff36511069147c1a10635fe12c6de
SHA1 9b0b934708b583aac607fedb15e5be9955a00d40
SHA512 e2c78050f8edea13d5c1543d52a3cf404bbb266d013c4588c05bf4528ed3ec6d0393323b89a50118b9cc6fd35aa5b0a65ee37cc135c5f0978df1a5a44609dd54
SSDEEP 96:35mJqFRElc/c9ZX40jxcX80hJXAbw1wc4Zz:0Jqwlc/c9lnKlhV3wc4Zz
TLSH
T1E1A171AA242F72D1D764583C4DD77482FB3BA0323AB31F47F168D5BB789274953A9020
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b897591528b9866033baaccb0ca80e8c62f991ad296201d16292bf82caa666e2
MD5 b798f550629744f6e3f2f7c55ec31de4
SHA1 f1fa0c3256dfd06bef1730cb06f0aee27dd47b25
SHA512 5763e517fb4a3b500e17ed7a93a402c25f1e2eba02ba981f1c8e39de98824794caaad6a7bd37c3ac89795aa857b873dfb8fc7081cfe235e07f0aa97da0229976
TLSH
T19E516FBE653792D2D3A49C7C9AD9018B3B3AB0917B835E93397CE4F858D631C91E5030
MD5 SHA1 SHA512 TLSH

Submit Download

b60f1832-5808-4e0e-903e-007436528ac4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b60f1832-5808-4e0e-903e-007436528ac4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

615dcde6-797a-4666-a4a5-d88030383a7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\615dcde6-797a-4666-a4a5-d88030383a7f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

af628451-5fbb-499a-8d47-57c7a81d11c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af628451-5fbb-499a-8d47-57c7a81d11c1.tmp
Size 2KB
SHA256 8e45d02e2b414dfeee7685b6e4211db8e4a585e5b3647539d44791b51ca15d4e
MD5 f426d3f2481141c3a0b8c8304a621f01
SHA1 ecfa9cc7498db4999798904741c293c625578325
SHA512 ab44ae405ee6520b336fe3015e3e778a54a29a4d0c495473fa7f17ea4dad656887662f7057a7583f3083c5ea572265ec39f8bb64f22bbef63420995881703aa4
TLSH
T15141BFF3C7E5862ED81156F09A287E1FCE1D0946821C3C5AC4D4EF1BA3F2471E181AAE
MD5 SHA1 SHA512 TLSH

Submit Download

c3bcde73-8cc7-4ce8-8f1d-54806a57c5c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3bcde73-8cc7-4ce8-8f1d-54806a57c5c4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

dcf51053-b357-4cf7-a634-909d2839303d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dcf51053-b357-4cf7-a634-909d2839303d.tmp
Size 210B
SHA256 812c5f94b3dce324102e2f557c94fd8ec17e624b8857b79040c24936a7027852
MD5 f6d596856722138920a90bff510256fe
SHA1 73112881083430f0daff8241277b254f248db59f
SHA512 752cc2f7352d76bcb62d07c0367ee96d5ac04d8243f4b4237a7c837b8e84ac02d91b44bba778b5a44ece8d049b4a9714bf7987efb887ae4e6d4593ec05caf3b4
TLSH
T1A6D022336240B1B58268399A302FEC8EE37A00280813D2D850D8F5886AF6C7E0A0F0C4
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0b158e2a9eccd52117857d32fbcdb0a36ed4ed5607980af8453e23c2707f0c2f
MD5 e6af816792501843465006185b0d2e98
SHA1 8fb5f5d9a01424eb6485318d01cbdbcbb36ff225
SHA512 3bcde460d3c21f78a3bc957dea7e69298feeb74db0a0bb26b8b10e560e9e05bd9ef2da8be9ae666235d0caf48d25e69037862d62077cf9b121f6afb779dced38
SSDEEP 96:KsPiDvNll+v14l3F0hlHPP+lfml3F+KvL3D+bNF+zVf6egKnKIj6KYgl:UF0hlHPP6fm1FFL3DWNF+zVfXCo
TLSH
T1CF91404130BB069038BD291C8579876B624171B37018E62F7FBD69A24E37E1C1EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62be1185-fb0d-4629-92fa-e6bc4cd8d74b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\62be1185-fb0d-4629-92fa-e6bc4cd8d74b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

98e9e6c1-7d5f-4719-b347-a959eb648e78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\98e9e6c1-7d5f-4719-b347-a959eb648e78.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download