hxxp://wuv[.]education

Analysis

user interaction
yes
max time kernel
269s
max time network
268s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wuv.education
Sample261001-ypgvnsstdw

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
57	ipapi.co
85	ipapi.co
55	ipapi.co
56	ipapi.co

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{C9FC0544-1F3D-4824-82D3-CC019EC4E8AD}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-524788801-3318743092-4051225893-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe
3832	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3832 wrote to memory of 4356	3832	msedge.exe	85
PID 3832 wrote to memory of 440	3832	msedge.exe	86
PID 3832 wrote to memory of 4272	3832	msedge.exe	87
PID 3832 wrote to memory of 4272	3832	msedge.exe	87
PID 3832 wrote to memory of 4272	3832	msedge.exe	87
PID 3832 wrote to memory of 2520	3832	msedge.exe	89
PID 3832 wrote to memory of 2520	3832	msedge.exe	89
PID 3832 wrote to memory of 4636	3832	msedge.exe	90
PID 3832 wrote to memory of 4636	3832	msedge.exe	90
PID 3832 wrote to memory of 4636	3832	msedge.exe	90
PID 3832 wrote to memory of 4308	3832	msedge.exe	91
PID 3832 wrote to memory of 4308	3832	msedge.exe	91
PID 3832 wrote to memory of 4308	3832	msedge.exe	91
PID 3832 wrote to memory of 3316	3832	msedge.exe	92
PID 3832 wrote to memory of 3316	3832	msedge.exe	92
PID 3832 wrote to memory of 3316	3832	msedge.exe	92
PID 3832 wrote to memory of 4916	3832	msedge.exe	93
PID 3832 wrote to memory of 4916	3832	msedge.exe	93
PID 3832 wrote to memory of 4916	3832	msedge.exe	93
PID 3832 wrote to memory of 2612	3832	msedge.exe	96
PID 3832 wrote to memory of 2612	3832	msedge.exe	96
PID 3832 wrote to memory of 2612	3832	msedge.exe	96
PID 3832 wrote to memory of 1228	3832	msedge.exe	98
PID 3832 wrote to memory of 1756	3832	msedge.exe	99
PID 3832 wrote to memory of 1228	3832	msedge.exe	98
PID 3832 wrote to memory of 1756	3832	msedge.exe	99
PID 3832 wrote to memory of 4688	3832	msedge.exe	100
PID 3832 wrote to memory of 4688	3832	msedge.exe	100
PID 3832 wrote to memory of 4640	3832	msedge.exe	104
PID 3832 wrote to memory of 4508	3832	msedge.exe	118
PID 3832 wrote to memory of 3908	3832	msedge.exe	119
PID 3832 wrote to memory of 4776	3832	msedge.exe	120
PID 3832 wrote to memory of 2984	3832	msedge.exe	122
PID 3832 wrote to memory of 2984	3832	msedge.exe	122
PID 3832 wrote to memory of 2924	3832	msedge.exe	130
PID 3832 wrote to memory of 2924	3832	msedge.exe	130
PID 3832 wrote to memory of 2236	3832	msedge.exe	133
PID 3832 wrote to memory of 2644	3832	msedge.exe	135
PID 3832 wrote to memory of 952	3832	msedge.exe	136
PID 3832 wrote to memory of 2644	3832	msedge.exe	135
PID 3832 wrote to memory of 952	3832	msedge.exe	136
PID 3832 wrote to memory of 636	3832	msedge.exe	137
PID 3832 wrote to memory of 636	3832	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wuv.education
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff8cb8cc188,0x7ff8cb8cc194,0x7ff8cb8cc1a0
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,10106284177778445106,6104814208402982235,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1836,i,12123418964554942739,5101048243792855821,262144 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,7205305004313558770,1744150614897589088,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3388,i,2528219489566561453,4619401022468423450,2097152 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3392,i,2883641900366830757,10750941025424081495,2097152 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,18349286060189372304,6014589397773263327,2097152 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,16949300471484704394,18400740528444629845,2097152 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,4333319624661791052,3107733572577902830,2097152 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,14561895987903784844,6299430905665820752,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,10518475947953534792,10565099510265933484,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,18344930620496297036,16477804874599872332,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:8
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2623294863878432884,4265353833046039519,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,2623294863878432884,4265353833046039519,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6180,i,17888425208180194639,16217531998884668167,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,7943858303190637244,9184013751602676025,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=4664 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,9651623803703580265,5393312005172568433,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,18300121519291715167,18133066393048400710,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,12136035822131626065,18182281214817438552,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6408,i,11399893873211958023,16736227095579964443,262144 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2856,i,11733321797534689988,17914486435996145791,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3928,i,15807476767599291096,2419754321482166306,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,17738322938110205946,11621706522848247116,524288 --field-trial-handle=2288,i,502561497066936127,16648658741307561977,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:636

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c3ca2e5-51b8-4e9f-ad9e-9a72f77ee7e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c3ca2e5-51b8-4e9f-ad9e-9a72f77ee7e6.tmp
Size 392B
SHA256 40a6bbc6967789211f90450b060cbd2faf612258d2e16a115870fdf69d567f52
MD5 377249dee02997336749f6c22b6a74ba
SHA1 ff35dc7781672c96b64c1fad20d39ec070e470f8
SHA512 4b0d4349153a483413b242cdb8a66ff269238b3df604ec13f1a61cfd6118c453b0aa4aece09f8245ae2530b02ac56bf8b35b2df083a85d77afa9f8f672e19594
TLSH
T169E00202530000BAC01C5332508B17635FEAC42002F313476820026C1D273002D39F51
MD5 SHA1 SHA512 TLSH

Submit Download

220f1bad-7745-4b32-8bc2-e0afc070faa0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\220f1bad-7745-4b32-8bc2-e0afc070faa0.tmp
Size 392B
SHA256 9762a8fe6dd8f809767d5c5a4209b8391990b9b5adfe9375005870590348063f
MD5 6c6a2ef7cfafaf925a2bad49c26ec767
SHA1 4113231587c77bbb4f475a36604658e009edcbab
SHA512 23eee002922b4b1bcb47fa9e27aa50c333f06b91f5f0adb00d956796d309e068636bf6ee22caf67aaebd13e6e761b19591d5f9b67a8d93088194a04c8310a17f
TLSH
T1DAE00202530000A5C0185332508B12625BD6C42001A213466810025C1D123001D28B51
MD5 SHA1 SHA512 TLSH

Submit Download

54d28149-deea-4b4b-b723-0d140ffa6268.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\54d28149-deea-4b4b-b723-0d140ffa6268.tmp
Size 18KB
SHA256 a5cc311e1853e59b439ce56d58358085e6df10326b90cf06f65ae0b711443d5d
MD5 035f904edd654982f07adfe809769089
SHA1 61d604212cdec2710fc2cd1e2d7cf4f5d4499fb5
SHA512 5ce492f4b78640fad68d7ec090d150c9e896517127c9157f16028e3b06dcd5ac10060afd99ac45b708c795c1ed52c6bd8052184f5d51902db9e848ead71270a8
SSDEEP 384:ycZcIhsNs6wDSFddOjTVSSdTHV7eVZh6DKhHYwo5:fheQnHNBefYGHYw+
TLSH
T1CD826D32AC786D7A59E7A145E44736078FB8D063D6CA2F9491EC9B0D01EA6B82313D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

611b5b10-de68-43e3-aa9e-95e7cbf76c01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\611b5b10-de68-43e3-aa9e-95e7cbf76c01.tmp
Size 392B
SHA256 5b6fa1cc3ec271961b24d237cdf805969dc441a0144b010c92bcec826c315767
MD5 36ee2466d5b227b6d3ba525466362849
SHA1 26d4c22d53b18914cb1b9fde92a4adb7d50bcc91
SHA512 7b3fb8da63d1638d9b363be8ec39edec70c5a5eba977dc733b2ec9005935db12769935873922df3c7210cf3b2ccb4912c9db3a0f7338de55a538493d31722242
TLSH
T142E00112930400AAC00C5332908B17526BEAC42402F217476820026C2D273002C39B11
MD5 SHA1 SHA512 TLSH

Submit Download

6d27cc2b-9110-49dd-9f7f-301c8f7e8914.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d27cc2b-9110-49dd-9f7f-301c8f7e8914.tmp
Size 18KB
SHA256 63ea92a4f39396bc64e076ffa0efa550cb8ed207a64a7cb411be63ffad9f61be
MD5 da063333e581f206e7fbb48b587c1082
SHA1 1398242ca6ed1c348422362c237d331c9b07b1da
SHA512 6e9a920608cffe7d08fda4f2ad9d24bf6c4170d808d5f752d67cfcf199efc105071c42cb461a206ae3808458b2d8f76607ac7fb34647e2d52673b32d1b48fc94
SSDEEP 384:ucZcIhsNsPwDSFndOjTVSSdTHVFeVZh6DKhHYwo5:jhDQnHNTefYGHYw+
TLSH
T1F4827D32AC786D7A5DE7A105E44736038FB8D063D6CA2BD4D1EC5B0D01EA6B82313D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a52d9c7-5346-4e95-bd55-c3ed68dbad44.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\4a52d9c7-5346-4e95-bd55-c3ed68dbad44.tmp
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f6bff0f027b4593220ead05713bffd7b3d5423f6191a2524fd76dd83ff0eb23f
MD5 30591b0f3de624921162fd3a45ebe21b
SHA1 1875648c4ccd30a3e9006368fd4fa2368d87828f
SHA512 597d1be49f44efaefee912dc403509ac948d2981ce2a8c8038290e6f3e098f8b373930b866b23d4fd25432dcc9ac6f1d6e1bb26298fd76bf73c91db3821a921c
TLSH
T108D02BF899C80510C08230792137824133D9E6108103200990E107040C103A31200460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c02af0b53b7fa79987f046aeee8ae8328d6e30eec401b85fb659fff3686e22d9
MD5 60b4515826d1c9f4b017a7d286115708
SHA1 91a906bd437f5276b450fa960823a1d8884f5b5c
SHA512 49ec0ba508a1c4d76e366cceb731579d594d5a8727c9089704a8f0f492164a13db6579377d36e91cd39359f1ee2ac85e2aa9a737f1640db34a67d8a1c0d408df
TLSH
T176D080B49D685AE4D0A5307D1335454173DD97529603210D65D10A150D743D31551CE5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7ef3b734c787633afe5b1c08a8ef08bde9d8879f31c826caf2e652aa614df86d
MD5 f6bf3c2e07439d9cb62d723d60e7ac3a
SHA1 572358d019a9f66b124eee416f35ea7195ac64bd
SHA512 f50fcdc5af36ec0684d7e4bcb343b9b713dea31b4539d18b949e37972279e41e6475068981ccee1ded1bb56eabade7faecbd57382d87939c090e6bc1fe3826cc
TLSH
T1CDD02BF859C80910C48230792136824133D9E6108103210A90E107040C113E31200460
MD5 SHA1 SHA512 TLSH

Submit Download

2e4462bd-7d0a-4eab-90bd-a2584cb8b4f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e4462bd-7d0a-4eab-90bd-a2584cb8b4f5.tmp
Size 9KB
SHA256 9c72c1ee332a3984b5c3adc2b5feed2d45d2a1f73aef3da2d38003fcc6255db3
MD5 7a6a4d1c96e9bd840da5cda537eabf18
SHA1 7dc4c570cda6c22152e5b5adeae25eee914f8933
SHA512 f2d9d1de6d950e26fa5885e24ee1f93a1d7734664245cf2e801ebbd2a5d3c38d1047eeebf0ea0bd5c090b84583e3954d5b7f25269e1bc1cb387f2f6e05091a28
SSDEEP 192:sxZ+R9WZ/fas2REdppvHW6+WN++U/YRPZcYIgrJ:sxZ+KZ/fas2aFHbQ/mJ9
TLSH
T1B322A8526E28A97B8CC7E20EBA25BF53D6F9503291D51E48EAFC961C04E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

506257d8-41b0-4b4e-bfd3-f3c28fd7cc39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\506257d8-41b0-4b4e-bfd3-f3c28fd7cc39.tmp
Size 10KB
SHA256 a11543879e5348967183a97f3474df665cfe291cd379f45f18909465d354e1af
MD5 0126661b23bf18421be3954edeb4d3be
SHA1 d555dcd97c5a007eb878182c300f863fa7830cdd
SHA512 70f3c917a901727867688563ae8e68c34c45831495bd6e58c091234c0cb4a1c1484cf26393a950dbf66248ed01717bbbda60a7c4c51818b198a22b12ce773c4a
SSDEEP 192:sxZ+R9WZ/fasg5IdppjHW6+WN+stdYRP/cYIg5oJ:sxZ+KZ/fasgSxHbDdmra
TLSH
T19D22A7526E38A97B8CC7D20DBA25BF53E6F9503291D51E88EAFC961C04E76DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

627030bc-4831-4fa2-a9a5-4bb5935600fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\627030bc-4831-4fa2-a9a5-4bb5935600fb.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

798700fa-2083-404b-b9df-efab06b550fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\798700fa-2083-404b-b9df-efab06b550fd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a672f63-23ab-4f1b-a283-23e229c57d00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a672f63-23ab-4f1b-a283-23e229c57d00.tmp
Size 10KB
SHA256 08c131567876a3463ff046c57467cfa371e95ac415de021228f23102ec12b615
MD5 1655560de35db83fb9a865c56b6e8567
SHA1 414840d56e00b39c6e6ae319c8a6dbbf3d039b71
SHA512 3a48009c8921f281750236b36cc623c7134601d5a88c31cecf2bba22c9391b7fb73d9fca4fb6d9fea78c6b6e25c18e647fc2464f9f9d1902ec78ac4a651d96e0
SSDEEP 192:sxZ+R9WZ/faso9IdpvnlHW6+WN+6p7nYRPPcYIg5KJ:sxZ+KZ/faso+NHb5nm7o
TLSH
T10C22B9526E38A97B8CC7E20DBA25BF53E6F9503251951E88EAFC861C05E77DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 4f0d19a2798c08d9c25c246c49549f30a94a02eae20a0c432276fc9a66767dfa
MD5 fd7a821a7615c947b0b6a1213847d7ea
SHA1 96b5ba5e5d8b2731542062762572c35d9ad6ecca
SHA512 f65fd44913c7464ae65e4a9fceeb360e826a16afb9bedb5bf08382e99e3f09cc7552bf223f937d8bd4cb5c5d1cb296f9c52832791314b38bf6180059905b57a8
TLSH
T1E4E026E526CAC32FB60C74C74378530CC399361BE2D0790E2F00CE8C7545840A6D3AB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 36fe44da7c412db3c2ad11055121e4bd556cdf054d1186d8bff77f048f41065d
MD5 4f7c7e137e712a9e45587e927988e7c9
SHA1 b262eea0108b246ff79c5425f7f7a54b1a0c7c69
SHA512 aece88d8215e215dc8183276c7cfd8b30921ead1c7dd2dd8af14398de060aec89912f0b06c778c60a272a31ad68c213b65697674d987be9ab1cd964bfa02a4fb
TLSH
T1B8E07DE515CAC33EE61864CF1178474CCB803A1FD6C1694E5F0AC5887885A94F2C6ABC
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 34KB
SHA256 7ee44fe3229e7b5269d75a8dfe2e16a94822fb2c37f3286c055bf045f96aa77f
MD5 3dbf66e222e3e22ce71521154b54a141
SHA1 b9b5fdf6ba573f1e7978a72d8dcf51f36c97a7dc
SHA512 facda7588ea5415840d80ebeecde47e019a68902ba34fc6a3ddbc96027d653d784a26187c25976e17f49c3c86d575a12be1375f9679172d8b67779007aa06947
SSDEEP 768:X7ucQhVmBCyFKvnYuMb4p3qZr0t0tEgo1bRm3YeoW3cViAj:ruSCyFmnwbcq28Y6N4
TLSH
T1D0F2F1BB242BA3167C03E4C3A2754D4FDCDE3672383DB50E250266A39199E52F75B21B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 24KB
SHA256 307d764ea0006b41b36ca18aeb696d56a1325d99f88ac031370cb018200867d6
MD5 93f480acfc6825074e7c10e0493343ef
SHA1 cdb8c05879917c91e02737b7eacceb6a542482c9
SHA512 fe17caa0923737a1d7a5fdc3115a1b54cf957a2452572ea044126bb8ecb8a0b4e78dd022491870c152ddda9e91c7f7e618446818f7dfa27ebde5c99a6d301de4
SSDEEP 384:29xwNT8oAle7+b6X6njKligaLt7VHzidARZLNTV3U7Gz4FIQR1wdKauFI5F4:YCe9loo6X8KigaJJR/TV3b4rTwcaZF4
TLSH
T1F4B2E16269C4B6AC3AAB2D947ED0248EF1D188966B4CD52D0CC70BE1854FDBEC5ECD70
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f127ffb3b6382841c2a865c00b30dcd1cbe6499e2b2350386c9ce6edbaa4bc47
MD5 b0be293820464a93a3990261e6a5f40e
SHA1 4efca9cd05e0f156d84a3a27ca475c7f26f6bef5
SHA512 e2f35ef1d63ddceec1d5d212566fc510bd6c151fa3dc505445173f8120c81ad533ec859b016fbfe0662718ec60c07df8f16b0038efd1291f06845408659fdcdc
TLSH
T11A71F9818FDF4066F7B8A132C2D8A7773A353983158F2D630191F8787846BC161B7494
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8023fb3f9c4e73f98aafab3583a54d4f4d4b1df567c8d725a1ed8899345dfee4
MD5 1e574d2b5ca7b1702e327e2ddffbc72e
SHA1 1cf8665f6b635271671424eebd53090f9560d9e7
SHA512 8187c6fe99b6ea5ee62b460899b910275d4c80a27ba37aa2fe94d325a9f348b9ba052527fcd25775480203ecd8c1fa558e495d12fe58cdfd9d75e863be113403
TLSH
T1A8512D82CFCF50A9F7B59071C7E813BB763829875A8F3E530190F9B994067C151B7054
MD5 SHA1 SHA512 TLSH

Submit Download

322fdda0-8e74-40d4-96b2-9cc666de1646.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\322fdda0-8e74-40d4-96b2-9cc666de1646.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_wuv.education_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

9f11275a-8d0e-46b7-90fe-30d19698ec57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9f11275a-8d0e-46b7-90fe-30d19698ec57.tmp
Size 2KB
SHA256 ad35628261b691b2c5c7a70d4b3a424690bc1a29befaa1b5354245bd39593fa0
MD5 5c2e031f0487486f673af099387415a2
SHA1 15daa770158a6d6c898141bea9b696ad94c96a35
SHA512 ff894881696c01a648cc420cffc0942f210a2a248d22f5e9b665094acd0ac37f0ea0b446f61e52b31b870aee3e3ad702a7a83e3a6405f86c23f4573106d68b83
TLSH
T1C251ABF3C3D8866DCE1A5FF09A14BD27CE5D0A1842283C6989D9BF5B53E2472D24168E
MD5 SHA1 SHA512 TLSH

Submit Download

d4299e1b-1c84-4289-aaeb-7c59f473790f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4299e1b-1c84-4289-aaeb-7c59f473790f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fef14dd1-9011-4014-bafe-17d742eaa35e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fef14dd1-9011-4014-bafe-17d742eaa35e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 dd3b84e0b852dcfd96f2704d18c6da1ecfce4e3de18ea5ecc03e7429121ce93a
MD5 c31dceb29405c0ccf439c7830a8f7fcf
SHA1 a5c32d5beda3d4717b41aac0624717b0eeba4281
SHA512 1dcf6e49fa5a392503e187c789e0fded57a093701637f326fbafd1266840c10de6b4e4ec3d30a427d7a58af40a0c9d07e84390165716ee6ae2747a98603db686
SSDEEP 48:K0mImLuvL1ttOb9wVISrOK9715OxjeY4JbPyLcLq2EGqTba5iISuTK9K1oTxMDYY:K0mZ84KRiy+byKIwau1yKOAW
TLSH
T104A1DE1571BB062478BD394C80B49B5E968231B33518F62BBFBC04A58E6BE484DFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1e2dbf4-b14f-47fc-8ee1-ad29571ded65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1e2dbf4-b14f-47fc-8ee1-ad29571ded65.tmp
Size 10KB
SHA256 bd26607927b063b5d9e9a4f6769ffaf9df9084fb261bb7bbafc6e87c32f39a9d
MD5 a203ce6fc8b3f41a72bd5fda610a5ead
SHA1 3006dc5dc417fc987b9605c7fc9923063b1beacf
SHA512 c6e9f042ff34a6a85e67238a662c34dd31c3766033495e481c098ba351030b0a5a7ffe3ee98600a121302a5e44243b8726bd37ed7b189dcdb07930ca3f40dba7
SSDEEP 192:sxZ+R9WZ/faso5IdppjHW6+WN+bAdYRP8cYIg5KJ:sxZ+KZ/fasoSxHbxdmIo
TLSH
T1E622C8526E38A97B8CC7E20DBA25BF53E6F9503251951E88EAFC961C05E76CD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a623015c-7313-41d1-b382-6c9f4ec30a5d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a623015c-7313-41d1-b382-6c9f4ec30a5d.tmp
Size 27KB
SHA256 94c61c38296608e55155c8803b5ddfeae3790a0dc9728b81311f28fb1a2f5f70
MD5 8ea5bda6f9b7e981e48ed36c1e39f175
SHA1 6fbb98e78389d0f704397571fe55b3193632d012
SHA512 90c7cd659ddda6b521af86343fc1684ff2604dedcddc2b3cf3cf3868c0c431b8a0569cb2e453a97daeb13b00fb206e63852870bfb3cd3e385d4406ab1db92ea5
SSDEEP 768:8yK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3ProQ+nx:8yK9uzYWvcQWsu1ja0HL7Q3cQ+nx
TLSH
T1CEC20A3F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adee239f-f403-4ba1-8ac4-85948311d3f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\adee239f-f403-4ba1-8ac4-85948311d3f5.tmp
Size 10KB
SHA256 9f3ff6efc655075f45a6382e74d65c4326f85b8fd2de51cd2fb22c299610168b
MD5 280e612618deac0762e7123a7501a824
SHA1 e3e27c893c7223cd66e4b0a35aa1bc89c272262d
SHA512 645191dde4e27e619e602db6bcd3d8fc71476bced22dedf728411db9b57970fbb293c729ee3555acc8f41adfed36102daceba0058dfa3edbd9a20aaf4860cde6
SSDEEP 192:sxZ+R9WZ/faso9IdpvGHW6+WN+qpNYRPdcYIg5KJ:sxZ+KZ/faso+uHbNNmlo
TLSH
T15D22B9526E38A97B8CC7E20DBA25BF53E6F9503251951F48AAFC861C05E76DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fcc3f9a2-8d39-470e-89d8-d5113ca9445a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fcc3f9a2-8d39-470e-89d8-d5113ca9445a.tmp
Size 10KB
SHA256 084aa4aac1f1078285f988eadd786f2624f9ce8f1fbf8ec236355a5e628c8124
MD5 38a75d66a411052dcd59149b6a49a548
SHA1 1c2b234c109f390a07b8bcc8ff536be981bcff9d
SHA512 3a7f99d0bc3f52e31c934cd8fbd6e523878108d9c71c2f4994c58ee5c1e8aa0a71e4ac3c064862c98d1ec285627a9fdd8335a4a274ccdf97028e432b3fed1311
SSDEEP 192:sxZ+R9WZ/fasolwIdpvMSHW6+WN+N5lYRPCcYIg5KJ:sxZ+KZ/fasoHkSHbulmao
TLSH
T1DA22B8526E38A97B8CC7E20DBA25BF53E6F9503251951F88AAFC861C05E77DD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

cc751d0b-272c-41c2-aca0-96ff1cab85f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\cc751d0b-272c-41c2-aca0-96ff1cab85f5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b4f4b583014fe1812a77705bc925220047a6e84f4f4fbbd3bc9ab382722123f6
MD5 2ec9fe399502db261037e88e95529bbf
SHA1 44bf634c321d3ac97fc34b50bc90287caea68a62
SHA512 360ccf2b58331584bb35ce038a40f32116fce3b2d00eac71800ee4632c654369fadcc24f1c108abeca9fe0a4617b26489443c2ea4ada05c0ea0ca3a79132347e
MD5 SHA1 SHA512

Submit Download

b3d413c0-11da-413b-824c-f98b626cfafb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b3d413c0-11da-413b-824c-f98b626cfafb.tmp
Size 8KB
SHA256 4086bc6d6e83a672166d0c507c288df01c127ec78bfccbc10cafe45300072796
MD5 e466ccffba0adea2acc9204929bf1fc5
SHA1 bc34439328952afa98c8fa4123c0e0239874ee4c
SHA512 0907201aff9abe54bc6d870c9073baafa6266ca81d80c4ca36c3d5daf3b82311b99c7767cf09a4f152ccf9631f243994c462fbdf54325b2e59291543173124e0
SSDEEP 192:SONK6ygpQmiUyK9tOCTVght+FdVaotzPcvGU6:SONK6lHFtOCTVSSdThKGU6
TLSH
T14C02D734AC683CBB8EB36E46F48726179F98117BDA962B94D6E80A1C01D775C2302836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db43268f-8c6f-4f1e-a1fe-06e9c82e8be3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db43268f-8c6f-4f1e-a1fe-06e9c82e8be3.tmp
Size 21KB
SHA256 72a3aadbb7e87a0f8cfad33a3c3b02f7b8aef37b4aab281d34c9b2b172565baf
MD5 0b4e13d8f4fda1d488d520fcf9ee3e5b
SHA1 b95c20649831f9a5615a121ecfed03b91859c3c6
SHA512 03653973a783b520d80bb5ba1006a2f745ffcb62da269e90dc8f97e75662e4ab6131522e4ede06e1be4af1d101b0c448b3425ef9e86c81c3dddf6a9be0e16103
SSDEEP 384:qXiFiZcIjzsNk8TUNTUlIl6wDSFddOjTVSSdTHVLeVZh6DKhHYwo5:FFQnpwggQnHN1efYGHYw+
TLSH
T192A26D339C689D7FADE7A645F4463603CFB881A3C5866BD4E2DC9B0D01AB2AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e7a50b64-8503-4c8a-9668-eef02658b42f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e7a50b64-8503-4c8a-9668-eef02658b42f.tmp
Size 8KB
SHA256 9d2cfed1f93b671bde83607b62afe8de47e16c8d17309a5a27d17e94cca53610
MD5 dad4ba6629429f98bb9fd94f2ecdf3f6
SHA1 2fe48bcef8ad19e8864b10eac327c17558229c9f
SHA512 de380911a9ed73c356e3fd7e80e03dfac7c526d7e2f453a395f587a3ede1b6351486c3e1f50eaf0f96b7e0764800c3ec148685348cc3bfcc4d8c49bf01b5f4f8
SSDEEP 192:SONd6y6QmiUyv9/OCTVght+FdVaoHhpNF3U3qlU6:SONd6lm/OCTVSSdTHVGeU6
TLSH
T11A120835A8687C7B5E93A545F48735039F988277DA8A3B94E1EC5E0C01EB7AC2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3ceccf1-a513-4ffa-8239-d5273b4860d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c3ceccf1-a513-4ffa-8239-d5273b4860d0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cd80a058dfd01ba65ebce78aa2e35eb6e9b872a5f9baff0742090e0d892a5b6c
MD5 decc462e144820c2c0c674bca8311cbb
SHA1 bcd49345e680eb4fa24e3ca977d39f8c7a76a6e4
SHA512 d1330fe6b6a421d3b3cf873a3fb8e65d169a17d07c0a5ae73c096dc3a37e0ef3fee562d904d1e76325515b017aa8bfc8080cbaa2810c3b638996629f21d738cc
TLSH
T1D441285CBAEA1148B3B76E1AABF768AD447BB8772F06D45D10110D4E0A63A40D8B1B33
MD5 SHA1 SHA512 TLSH

Submit Download