hxxps://nodejs[.]org/en/download

Analysis

user interaction
yes
max time kernel
898s
max time network
873s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/09/2026, 10:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nodejs.org/en/download
Sample260925-mxfrssde85

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2544	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134348070641232990"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{390867CB-E248-4E19-99B5-C080D1431073}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1848	msedge.exe
1848	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe
2676	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1680	2676	msedge.exe	87
PID 2676 wrote to memory of 4944	2676	msedge.exe	88
PID 2676 wrote to memory of 2544	2676	msedge.exe	89
PID 2676 wrote to memory of 4944	2676	msedge.exe	88
PID 2676 wrote to memory of 4944	2676	msedge.exe	88
PID 2676 wrote to memory of 4584	2676	msedge.exe	90
PID 2676 wrote to memory of 4584	2676	msedge.exe	90
PID 2676 wrote to memory of 3288	2676	msedge.exe	91
PID 2676 wrote to memory of 3288	2676	msedge.exe	91
PID 2676 wrote to memory of 3288	2676	msedge.exe	91
PID 2676 wrote to memory of 4224	2676	msedge.exe	92
PID 2676 wrote to memory of 4224	2676	msedge.exe	92
PID 2676 wrote to memory of 4224	2676	msedge.exe	92
PID 2676 wrote to memory of 760	2676	msedge.exe	93
PID 2676 wrote to memory of 760	2676	msedge.exe	93
PID 2676 wrote to memory of 760	2676	msedge.exe	93
PID 2676 wrote to memory of 5068	2676	msedge.exe	94
PID 2676 wrote to memory of 5068	2676	msedge.exe	94
PID 2676 wrote to memory of 5068	2676	msedge.exe	94
PID 2676 wrote to memory of 2368	2676	msedge.exe	99
PID 2676 wrote to memory of 4292	2676	msedge.exe	100
PID 2676 wrote to memory of 2368	2676	msedge.exe	99
PID 2676 wrote to memory of 4292	2676	msedge.exe	100
PID 2676 wrote to memory of 2272	2676	msedge.exe	102
PID 2676 wrote to memory of 1884	2676	msedge.exe	114
PID 2676 wrote to memory of 1088	2676	msedge.exe	115
PID 2676 wrote to memory of 4520	2676	msedge.exe	116
PID 2676 wrote to memory of 1888	2676	msedge.exe	124
PID 2676 wrote to memory of 1888	2676	msedge.exe	124
PID 2676 wrote to memory of 2972	2676	msedge.exe	125
PID 2676 wrote to memory of 2972	2676	msedge.exe	125
PID 2676 wrote to memory of 1112	2676	msedge.exe	128
PID 2676 wrote to memory of 1112	2676	msedge.exe	128
PID 2676 wrote to memory of 1848	2676	msedge.exe	130
PID 2676 wrote to memory of 1048	2676	msedge.exe	131
PID 2676 wrote to memory of 1048	2676	msedge.exe	131
PID 2676 wrote to memory of 3292	2676	msedge.exe	132
PID 2676 wrote to memory of 3292	2676	msedge.exe	132
PID 2676 wrote to memory of 1348	2676	msedge.exe	133
PID 2676 wrote to memory of 1348	2676	msedge.exe	133
PID 2676 wrote to memory of 4636	2676	msedge.exe	136
PID 2676 wrote to memory of 4636	2676	msedge.exe	136
PID 2676 wrote to memory of 4860	2676	msedge.exe	137
PID 2676 wrote to memory of 4860	2676	msedge.exe	137
PID 2676 wrote to memory of 3528	2676	msedge.exe	146
PID 2676 wrote to memory of 3528	2676	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nodejs.org/en/download
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb5586c188,0x7ffb5586c194,0x7ffb5586c1a0
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,16687649313481400692,11362616685376940764,262144 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,1211980916257562880,15056502258685719420,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8569425769274338704,447145892645648736,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=2480 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,16704318833851350369,9113634012515129047,2097152 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,1670209591076743040,9404723253722813070,2097152 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,10478298437061714665,6931614175572105717,2097152 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,1745110984832828271,10897629113505327639,2097152 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:2
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,3096528115378192315,5921306985221006664,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,8104714524699027724,4635604860619905470,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4652662496898684607,1015477286773283949,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,4652662496898684607,1015477286773283949,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,10990812026033354901,6657169448593883495,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,11308216924613725004,16238506452074602004,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,16330930877244010636,308946608010954085,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,2484906011045743991,7940587058943248445,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,10358364607875502852,8241590588926551990,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12418284437003917697,3508470026896094339,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6672,i,13921018908993374791,9768442207887097283,262144 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,5267044528249777198,8590117644697805459,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=3272 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1992149284591172420,7276510765357223948,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,12444769709338592009,8573372934349357096,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1512,i,1941775676256417108,16682658360077340060,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7675364017241508608,17293996213584745175,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,4046956531701435024,8314856032813318557,524288 --field-trial-handle=2332,i,11349843805540548361,16345202172128765847,262144 --variations-seed-version --mojo-platform-channel-handle=1004 /prefetch:8
  2⤵
  PID:3528

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 affb72577052bfa2eacfe18d8fe3bddf8d1edb6f0c8dc0b120581a4c713111cb
MD5 fedd41f041509bbec775028219e23c75
SHA1 c32345fb94dad6413182d5df48a0e45c7e21f174
SHA512 cd9c8ba5f4786b26f61375d4ee67c2191a5395437e821843751a745ee97ee175fd4f4ce66a94298a28c21ce1a5470eb6f372b82c4c04beb065ebf78d30a7ea2d
TLSH
T1E7E0268804D8CAAEA344B84B417C6B4CC780370B93CCAE5E270889CD7405958AA9B6AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9838d2ccbd4d55b1d1af8743a4fbc696ab704a73f36ba9c2c194aefe9a791535
MD5 1bee06b134757676c27d975223ad0f20
SHA1 cdecdbf06faa6c1aa86f99b943c400630d04cec5
SHA512 8dec5718d0ef5759b75675a6f00989ffbc6dc0433691d9653e6b6ac62691f83c45a79ccd2619d9f27aeae9e6b26023779992d183affec5cfa7b846d10d41af52
TLSH
T1E1E0268809C8D6EEA3406887417CEBCC83A0370BD2CC6E1F370484C87607448ABB66A6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1bb7a63b8ba99f2a6997f21628c63651882c0a96412db04511bb1454b84378c1
MD5 1180f61e5ae4cf7193ce417ef9ba168e
SHA1 c6460ea380cc8c3a3991204d2b2b5cf9feadeada
SHA512 c583ce61379f3403457c3362c8a669c5b5ab4e352dff459fd4aacb12e27b4295940e310ab3ef961f005be520a3b3e853edda39f99a8cc5ce1ba50b61de3afd6b
TLSH
T1DBE0268C08DCCA6EA340E587417C970CC380370ED3CC7F5E1B0485CB7005048B2DA7A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 11bbd3b085f302e94d4fd1cad3706322f6aa4fdd55272e231912a87c56ef3cfd
MD5 32282c9997614f6366304d52209d21a9
SHA1 66920b692e732ebc90405fd693a6e8b0e911bb8c
SHA512 b427025ec99f48597b4a10cfb3e07ece77ec2c690dcef1fcc0e5284a6463dae1d5b90540e0bc6f4f33ea9409baf710a15a5f51ee27851696ebfc72c36802c597
TLSH
T1E5E0DF8828C8C22EA3A0A48791BC670C8280770AD3C8AE5A1700C4CAB065848B6D67A2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 31b86ca3357c4edd381a51f72e22dac2bb64295f818d70965e25813df2cc234d
MD5 fb1be929b15b733177a1357274278d49
SHA1 0b81743a4a186a4d22e79aec24ecd165306e0ae7
SHA512 ceb08947eb5637998bd3e15802b1d1a503203fc11e5efeeb68a38f6fc79ecd432e47693e1a77825e365b8b1451bd2f54a1c03ff0726a63296d917f7b9438392b
TLSH
T12C4165898C904471FFABF13D88D1158F3A366A58BD531F223CAAEC38EC96347E931604
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b28a675-4967-45e7-952a-ae1ef3c2b9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b28a675-4967-45e7-952a-ae1ef3c2b9e1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 efa7be7f03ba0972b5ce8d929ed0cb67f09ae3889016b97e32a66853362f6cc5
MD5 b7096116d67e726199309fb6676131a2
SHA1 ab5172314ff946dfb9626119c47100d521565053
SHA512 db13364bcf4f9a68bb08c1560adbe95112c1ad641629377528f6d69c8c0727b0140a4e15a2a44b046a02c00d46328d09cd6ce3bd9afe9d361de910af1efbe6b4
TLSH
T183219DF783A0856EDA1156F09A14EE2BCF5C0115431C7C6986D4AF1793E3071E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 25dc240e5dbb09e23f508f03379a0be7c437d4ccf793d68efdfa957a29a4b75b
MD5 155318bbea3a7d9507118576cc763f67
SHA1 9bfacd3ae79fe52c017c949075704a9a2001e12e
SHA512 6c36967db3bfbd730577daf93a67c4286831413f3ce7555a2fe961d2183f958ae8a926edd1d504e99d45907aa26d9b4ef2336b2e536c0bdb0f09ef1a65185bc7
TLSH
T156214CF7C3E5856E8A0156F0AA28EE2BCE5C0556431C7C2986D4EF2793E3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 d48eb803b5fac77e8a6ff04b914ca3ef5faab5f34702d4066eaf540016b0953a
MD5 a7d1bc75ad825baee877d158e094e36b
SHA1 f4397be0a38a617e7b2275bc03ea1b52a415aafa
SHA512 87431333a49f153ad1b2ff72b242558d04ab99a7339bf937044ed88adb03a9847e1a3097abdb1f91b9705b4de649e91439a919817ad1b681bca8f0ddf398c15f
SSDEEP 192:sxZ9RdWN/fZsrZH1IdpeIHW6+WNbGWip/YapC2J2gIg5jJ:sxZ9+N/fZsrZmPHbE/7T
TLSH
T1B122C9566E38A97B8CCBE20DBA65BF13E6F9503351D11E58E6FC861C04E7ACD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 559c39ab4d799f170d3cd531a2e55e71096f043b454c1866af56379f9c2ab258
MD5 d2463a9e937fdb859e1bd9294b334b0d
SHA1 b58b5356e87ed9cff7de2949a2651c2ce5c30a6f
SHA512 fb3bf2502286810a0405696f7109c24bf6507a066c55f3c1370334c73d4dd715542dc293e310a22a60878c845c4f802d7366eddbe3a3ede11f852ef27fe6d950
SSDEEP 192:sxZ9RdWN/fZsrZH1Idp8IHW6+WNbGWip/YapCQJ2gIg5jJ:sxZ9+N/fZsrZm1HbE/pT
TLSH
T13922B8566E38A97B8CCBE20DBA65BF13E6F9503351911E58E6FC861C04E7ACD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 33307b0ec1dc669f5b7312826b0eb7274785beb7af289337d4733c98dbc4cf97
MD5 469bcec0f55e38ad0062abe41669dfcf
SHA1 1d66ec2c1cdcea6befadccaa89fa8ba2e388f18e
SHA512 e6a47e268256e3ca78906d09aa7cdd732cb52480d0bc1efb6a3a78cbc53428075c53409d30a6ce26fd6e7046427900eefec0b37a07257fc2baf2e320c0945ef7
SSDEEP 192:sxZ9RdWN/fZszfH1Idp8IHW6+WNbGWip/YapCeJ2gIgrJ:sxZ9+N/fZszfm1HbE/t9
TLSH
T15F22A8566F38A97B4CCBE20DBA65BF13D6F9503291D11E58E6FC861C04E6ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 24KB
SHA256 e2770b1284aaaf9d43476065a61ed69813d963bab49d7e49f71c95daef90ab9f
MD5 9e00d627c97dc8e31e347752d486be80
SHA1 e88f2c6fb2af835407eb310e9ad23f7aac137352
SHA512 1693dddcfc523441c142275767d687e49697064b18c6d32eff61a627bb2886a1202a6160a764306f7f0a0ec8e6373888376c60ec105d55f0d0b834d4b7fbd89c
SSDEEP 384:sxZ9+N/fZsrI66s8qMpRiYnazAW8pZS15posJWeT+9mPHbE/qT:sl+N/f2I4Mnc7WeT+96Hb2M
TLSH
T1F9B21809A924C83B9EC3AD18683D7E33E9EC506212C5DEDE56ECCA1C019D1FDAB47467
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a99afa86e601791d47a226e296498d616629d0a7ce249499ed8025cf13bafba9
MD5 d02fe6b0d6ebf4b06f5d53abd5956e63
SHA1 a40c1ffa7aa156a7551558ec5140d85798b3f6c1
SHA512 fc130d9b5c0a8b109332cd0fd2ab1ce66415fbb5209f9dd1a8164fc52fb626b93d26cb2e46512159419392f2ecec7c1d16d6c08411b930a69922bc0234c3babd
SSDEEP 192:sxZ9RdWN/fZsrfH1Idp8IHW6+WNbGWip/YapCeJ2gIg55J:sxZ9+N/fZsrfm1HbE/td
TLSH
T17F22B8566F38A97B4CCBE20DBA65BF13D6F9503291D11E58E6FC861C04E6ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 06bd27b121178dcac7b1392dcad0a693ed7c24e75b38bb22dcb023395ed59ebf
MD5 8e5d5a00f534d01f2ba6a4451d7e971b
SHA1 f751343a1c1eab3cdb2e2b6c9155bb455a5d4f7b
SHA512 488a83271055030d7b6a310d1f937a5fc3bc412d6a907aea23be7728a7709ba1ff856adebc01bda126c89652149ef4daae6ca2afb8e2980b9e239846131a22b0
SSDEEP 768:22WPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Nro4JSwmRy:22WPcLKWvKeceu1jaClLiF7m4JSwmRy
TLSH
T18FC2EA3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 271B
SHA256 86792e2a43b2ddfd46d4d5bc2cee0661e2413eaef0e0b11aaf4c2ffc651d56a3
MD5 5af1bad19b06f4a0604e10e83c2214c7
SHA1 73d400905ed896f418c19519d4ad3b0726d334f6
SHA512 0a0ae49d3a1ffe8fdca25902c23246348f9b879cf9b89433720a50a0a52ec29f459e2d6432b145fa5cbf32299b080ab6955c6320e2a5ac778816823fc5ce5ef4
TLSH
T187D02BFB2D961450DD6F83D54472946144407C90D944AC8F209992DB30513513813D20
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c46a292c9e83b95a75552a6c87a91d34dfad05683c1fe37914918ed40f442c33
MD5 73ee3196553b6c5b42d2d98963a87dcc
SHA1 f7518fe9147cb0aa9db481a9af28b97f346a0e33
SHA512 9cf0fcc69a10b5a34984d0b306c4bb95f8dbfa8a7dbfd1e697be8bba362902808a7d448b825b835372c691eda4e980e1b7d20cd5eb271da98601a02d1e9eb73b
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLtMBdvbfAbzGTISVAK9V13AxFQYWXD5:KgvaK0w6im0KjS0uUKLaec
TLSH
T1EA91411171BB02007D7E654884F08B1B46813273B158FA2BBFBC4156CD6AE091EFEEDA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59a946.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59a946.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d02dfce7b0fdf905473828c460e1f5bdae67c7f595e551428f55375b4cb92cdc
MD5 f816fc7eab4b088efed4a9d98fa4424c
SHA1 8cf254181f4d6043fcf822e4a7d6853b5c9aa4b1
SHA512 cb202ebc365f6636ca0db7247de4abacccfb1490304286b3ce80f9a64b2d91f87450f929555b5cb089dcba093cf66c8314063010eca9ce0cbec0584a95fe54f8
SSDEEP 384:/ZcIhsN86I1PO1zIGmQw+WUwJiXltgOIwZOyCo0:XhDM5/wZbiXlXsXj
TLSH
T17B827C369CB8AC7BAEE7A540F8873A134EB89127D2C99F90D4DD5B1D00DA298030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 7c74514ea3288d36b64679e2a7382ca16e5c90caae2ab3db40c3eaade4a384d8
MD5 8b0ca694bcf29ad28b99d46841d10964
SHA1 9e361aab165c4d0114dc18cb4199e21419e0c4f6
SHA512 802254beb9ba5feb55ec82c56bcc472da6ee4b7422af8662f3e8474c29a8913cb4a0470827a1f47acee8360e7dc9e8a5c8c85238ba7b341bc8e295b98194de04
SSDEEP 384:siFiZcI7zsN08TUNTUlIlfI1Pv1zIGmQw+WUwLaiXltgOIwZOyCo0:XFQvZwgmJ5/wZBaiXlXsXj
TLSH
T10FC23BF648E7987AEDAE9B43A77E2E134D7CC013B5859A50B3C8560CCC961BFC30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c34f4e26d0766cc1713cd40414246c45837312fbeb7f11cdb1a36750ab6de3dd
MD5 039b7a6761571e633b1de591721432f0
SHA1 fba4c42c09b370a29f685515d525d12218819bd0
SHA512 55bbfe27c9dbbd6011bd9278254f8c4abc64238d66af309b9988a78bcf9af6fefd6b56f3541206062a013da8f230ecff97369bbd341b84f964957929fc36779f
SSDEEP 192:aONj6IE7QmiUy2yTPuIGmQw+fC7sXW7U6:aONj6DtAPuIGmQw+YsXcU6
TLSH
T12002F939AC787CBBDEF36E05F4876B235EA5112BE5952F84D9E81A0D00DB24C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 3e15578cca009f33fd8b989f9656517fbf9e69e47014485a6ed165b5d862c0ba
MD5 75ed150d48acd07d9f87acc704b55be2
SHA1 fb96b13e8d7476ca38477ba5036288c3752e1d8f
SHA512 f4ca9f283eeb5b5c7f53d373863c18f4b59391b31c8eb043cc81c995bae5852035f0d077d827b1e65e43515247a846f61196a45dce0ef1d8da8a87e098a712d5
SSDEEP 384:LZcIhsN8fI1PO1zIGmQw+WUwJiXltgOIwZOyCo0:ThAM5/wZbiXlXsXj
TLSH
T1B9827C769CB8AC7BAEE7E540F4873A134EB89027D2C99F90D4DD5B1D00DB298030B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d4b207e1e6b3039dea0b09d050259017167104b35c89b3c5f3b83857162c2ac7
MD5 2770aa52dcde132490cce2a9f8225cea
SHA1 0726fa7858a1bce74fa796c14397e8f88dbcb86e
SHA512 208f6463c1c5a7e49d5e5b90c832da7d6e02fd58eed9e756e8fface293eb25dbb5bc4b0f5783f11575e86ec58214a936d5ad20b989243f0a59171115e164a888
SSDEEP 192:aONd6IE7QmiUyoyTHuIGmQw+WUwFJH27HXt/PU6:aONd6DtAHuIGmQw+WUwgHXlU6
TLSH
T18A120936ACB8BC7B9EA3A984F4833E235EA55227D6896F90D5DC1A1C00DF25C130F916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3df151b7-6dd1-472f-ad77-aa9fa5ae2e95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3df151b7-6dd1-472f-ad77-aa9fa5ae2e95.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e298adb594fad37cc74d6c0e866ed0d7e90af7f81da4c3d0a2eda0b38c811d0b
MD5 32397950af114e6f0c1bdf68d6ac2c60
SHA1 b6a0b787cc7521afe01db3a81e3ebc4f36dd4880
SHA512 67f85e29cc045f83832306d3c6bb8f73b197ca8d90c34098f424a501be3f0603bb867aca74f504ebf2e1e5fa3a66d31083177df1edb63f0d0992194358e3691e
TLSH
T1F1412858BAEA1158B3B76E1A9BF6A86E443F79372E0BD45E00010E4F0663B40CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download