hxxp://marketwatch[.]harbor-dev[.]xyz

Analysis

user interaction
yes
max time kernel
148s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://marketwatch.harbor-dev.xyz
Sample261002-mk5kdsxapf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3676	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{97FD6CA1-AD01-4BA2-93A0-C3C648303F08}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{B4C671E0-901F-4362-BF4F-7E6CBA50CDD5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6116	msedge.exe
6116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe
1676	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2568	1676	msedge.exe	85
PID 1676 wrote to memory of 3676	1676	msedge.exe	86
PID 1676 wrote to memory of 3712	1676	msedge.exe	87
PID 1676 wrote to memory of 3712	1676	msedge.exe	87
PID 1676 wrote to memory of 3712	1676	msedge.exe	87
PID 1676 wrote to memory of 4756	1676	msedge.exe	88
PID 1676 wrote to memory of 4756	1676	msedge.exe	88
PID 1676 wrote to memory of 4292	1676	msedge.exe	90
PID 1676 wrote to memory of 4292	1676	msedge.exe	90
PID 1676 wrote to memory of 2500	1676	msedge.exe	91
PID 1676 wrote to memory of 4292	1676	msedge.exe	90
PID 1676 wrote to memory of 2500	1676	msedge.exe	91
PID 1676 wrote to memory of 2500	1676	msedge.exe	91
PID 1676 wrote to memory of 4884	1676	msedge.exe	92
PID 1676 wrote to memory of 4884	1676	msedge.exe	92
PID 1676 wrote to memory of 4884	1676	msedge.exe	92
PID 1676 wrote to memory of 4684	1676	msedge.exe	93
PID 1676 wrote to memory of 4684	1676	msedge.exe	93
PID 1676 wrote to memory of 4684	1676	msedge.exe	93
PID 1676 wrote to memory of 4264	1676	msedge.exe	97
PID 1676 wrote to memory of 4264	1676	msedge.exe	97
PID 1676 wrote to memory of 4264	1676	msedge.exe	97
PID 1676 wrote to memory of 2080	1676	msedge.exe	99
PID 1676 wrote to memory of 2080	1676	msedge.exe	99
PID 1676 wrote to memory of 1768	1676	msedge.exe	100
PID 1676 wrote to memory of 1768	1676	msedge.exe	100
PID 1676 wrote to memory of 1056	1676	msedge.exe	101
PID 1676 wrote to memory of 1056	1676	msedge.exe	101
PID 1676 wrote to memory of 1056	1676	msedge.exe	101
PID 1676 wrote to memory of 3176	1676	msedge.exe	102
PID 1676 wrote to memory of 1124	1676	msedge.exe	103
PID 1676 wrote to memory of 3176	1676	msedge.exe	102
PID 1676 wrote to memory of 2040	1676	msedge.exe	109
PID 1676 wrote to memory of 5680	1676	msedge.exe	117
PID 1676 wrote to memory of 5688	1676	msedge.exe	118
PID 1676 wrote to memory of 5696	1676	msedge.exe	119
PID 1676 wrote to memory of 2140	1676	msedge.exe	128
PID 1676 wrote to memory of 2140	1676	msedge.exe	128
PID 1676 wrote to memory of 6116	1676	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://marketwatch.harbor-dev.xyz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff84e96c188,0x7ff84e96c194,0x7ff84e96c1a0
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,5059991512792738451,2417992600172999329,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,4745785192454182757,3520575321821079447,262144 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,11854582461621575971,10098914785624525023,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,3108823463939158656,4176038463959853887,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,5338103682870434026,4431021210601470813,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,5763797205562825349,17498102733895358480,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10599471603681879435,18022488258884470937,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4988,i,15874372779535261942,11261758721457007784,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11954681599832360283,17823383858665062509,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10678196502187958624,17574683016883874237,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5924,i,9465337463476241449,9042242017802613858,2097152 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6132,i,1291722321237303005,14850748685135295240,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6136,i,11350775286231008514,16504026859918816979,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  - Modifies registry class
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2636113512923943723,2913244347184942278,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2636113512923943723,2913244347184942278,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,9218131919936749977,8318832953005727044,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,9961149972675929253,15100276183791341284,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,3748971141757457830,11669276150060236435,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,14060081903614460677,12193373283650475986,524288 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6644,i,8681159111373613941,2823831245508715421,262144 --field-trial-handle=2276,i,13657393997738758830,17609608877216699779,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16982075-ba59-4d29-a2a8-c397b7310fa1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\16982075-ba59-4d29-a2a8-c397b7310fa1.tmp
Size 18KB
SHA256 f30b946591f7ee7bc7a0da6ff27e90b60485a123aa3480e9b9ebba4a2a44c272
MD5 5a3c81cf92bb1e538a38d81ae49e45fb
SHA1 53a40086145d2cb510e3df3c15731bc0a7b2c024
SHA512 7d8af6f41a0348bf6243c5a44285eb76058f59d631e8a12775079c87b798f07b0838ff8304b67a07445590aea685c01895d5d22ef3db8ec627959abffdc4c4b4
SSDEEP 384:HZcIhsNWoOdbVr1h//S35TtgOIwZOy/eo/:vhljr/STXsDg
TLSH
T17C829E32A8B8AC776DFBA141B48737039FB48067E7C56F8495EE9B1D01DA19C130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c8069de-eb2b-4a5a-8859-350c9c31ec11.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5c8069de-eb2b-4a5a-8859-350c9c31ec11.tmp
Size 18KB
SHA256 69cf4259e01a3be543284b2efbf7c8e729e3c4073ab8aba05e1c2763f5c49787
MD5 17f0b53cef79d555d175b04c621d082f
SHA1 19b0e33348446487a778e968270b2344939a7a62
SHA512 a1a4ad645cabcf1de437a93793f16fe680358cb4dcd7ae8c954851a48fd9840b3be500a45276d9353cfd84c8d81658c658d5b0ed4d73f52970c659bc3cdf97f6
SSDEEP 384:GZcIhsNWhOdbVr1h//S35TtgOIwZOy/eo/:UhGjr/STXsDg
TLSH
T14E828E32A8B8AC776DFBA141B48737039FB48067E7C56F8495EE5B1D01DA1A8130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

219cc81a-2800-4d49-92c3-e9f06fe9abb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\219cc81a-2800-4d49-92c3-e9f06fe9abb6.tmp
Size 27KB
SHA256 d94b46f36ba63c4b5b406748eaec1595dcd6dca10c104b679e03d91b7f6903bd
MD5 962fcaa96d8ba16c79f38c77d94235cd
SHA1 ae4758032aad216153ae37125c6c713a438c418d
SHA512 bdf76f782971e7d2ed05ed9a16c464ffdb05da630a0bfeac486c23cd5e36645d4c3d2531a2851462979f8dacc115300e003a78d2c37f0a33a17d4b9ea9509f25
SSDEEP 768:CEKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/7ro9VP:CEKlm7QWvUYe0u1ja8/L/E/I9VP
TLSH
T11DC2FA2B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EE51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2ed45f59-05cc-4e8b-accf-40bdad3e549d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ed45f59-05cc-4e8b-accf-40bdad3e549d.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

44b6b018-1a55-451e-866f-30111fdf7566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\44b6b018-1a55-451e-866f-30111fdf7566.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56a638fe-e8e1-435d-91d1-78b514901e60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\56a638fe-e8e1-435d-91d1-78b514901e60.tmp
Size 10KB
SHA256 0868f0d23be17b4d7035ed3c9849a3a1c393a79742ee75873fe30f90462aef59
MD5 cf4b57215738a3ea1e4ec459b4c2e47e
SHA1 aaa6db5a57372af7e9461d5539a92c731f4d69a2
SHA512 2203983733e70fa651fca6875aff67fd0347b680c733b6ea228a97ce174a3de84b084d7548e60e9bb866c9443b6462bd85953235c725d673a3e30351ee57eca8
SSDEEP 192:sxZfR0Wf/fMsUSIdprOVHW6+WNugY/Y362xtkIg50J:sxZf1f/fMsUbmHbG/XbC
TLSH
T1CB22C9526E38697B8CCBE21ABA15BF13E6F9503251D11E48E6FDDA1C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7bc93065-2e00-4ed9-ac94-08bed720d643.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7bc93065-2e00-4ed9-ac94-08bed720d643.tmp
Size 10KB
SHA256 bf775bd96b32e306631737b7bad9803d60404bbe18b18eed43be1705411b9093
MD5 397321d67dc6399b84723be508f57e17
SHA1 9043f05149aad750118a7a1ccf1097ddd45ef23a
SHA512 36b3d208ad3f4996bce1a0bb1066c859d640a376c1377043e95f42f150db53794bb7eff6413a43e473b3bd921510117d2780e34f8ed2442a4e985a12e9367033
SSDEEP 192:sxZfR0Wf/fMsUSIdpJOVHW6+WNugY/Y364xtkIg50J:sxZf1f/fMsUb0HbG/X1C
TLSH
T1CC22D9526E38697B8CCBE20ABA15BF13E6F9513251D11E48E6FDDA1C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8977c441-d15a-4520-b855-beac997d0f91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8977c441-d15a-4520-b855-beac997d0f91.tmp
Size 10KB
SHA256 0862f67aba267e35bac6105e8269558634c03e1371b1857bf87f4a154209bba4
MD5 b1990693b8ac3f956a0514f5a94229d6
SHA1 137e194306b138e684290859f1697d94e99372b2
SHA512 9d5d7027a8a8cf228a455f66316230176162bd848a2096672181b8477ef11c83e19abd4b12add8e46cac09f9cfdeccc5d936ee711c3e8e83e2179b79bc7f6724
SSDEEP 192:sxZfR0Wf/fMsNSIdpJOVHW6+WNugY/Y360xtkIg5eJ:sxZf1f/fMsNb0HbG/XhY
TLSH
T17522D8526E38697B4CCBE20ABA19BF13D6F9503251D01E48E6FDD61C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c6ce592-cf1f-4a13-b7e1-79ce240562d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c6ce592-cf1f-4a13-b7e1-79ce240562d7.tmp
Size 10KB
SHA256 34fb223a8dfe9a2d95f69ef2e753c7352b372105677cfaabc6b50dbf0e3db3fa
MD5 3afd28c4a561e38854dc78a7b6fb7679
SHA1 aa938805defef0296f0313cf04c83570ebfa44ca
SHA512 55bffa33587c737b6e37559ac16f17a7e4054c5c0b938da317c24c492c458631f6f2f487246a2841d3ecad7513198d7e4ac7490457a1bcf277d1c140e64ca382
SSDEEP 192:sxZfR0Wf/fMsHSIdpJOVHW6+WNugY/Y360xtkIgrJ:sxZf1f/fMsHb0HbG/Xh9
TLSH
T10022C9526E38697B4CCBE20ABA15BF13D6F9503251D41D48E6FDD61C05E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 eeb0c6574f7c57247bfbf96e0045b3b32f7e70c1780022e5e2500b9d740a7cfb
MD5 ea6c1213f7568cc127e31752514594ad
SHA1 0be2e807f11aec26b6f3ebb164d1f81d47e95e0f
SHA512 3e2c583f7a28d322172b94cedd6a40545e3827e557c2bbbcb840073979e17b262d5fabf1581204cd42b84fca893eeaec225fd0ad05b1e04bda88402ea9d512ce
TLSH
T11F51A5C0169407E0FBE890F48DD51587363D6DA216836E3239E7DEB6FB867A9712C484
MD5 SHA1 SHA512 TLSH

Submit Download

b1d89cb6-3c1a-4b54-bf99-84d8d3abaede.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b1d89cb6-3c1a-4b54-bf99-84d8d3abaede.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

64f111b9-7703-4ab8-96d6-7dcc05e61781.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\64f111b9-7703-4ab8-96d6-7dcc05e61781.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a57899b4-04de-40f1-bd8f-b7be53b10d34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a57899b4-04de-40f1-bd8f-b7be53b10d34.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d7db6164-7af8-4f5b-bc15-5135d76a8a19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d7db6164-7af8-4f5b-bc15-5135d76a8a19.tmp
Size 3KB
SHA256 88ba338454d691d4afa18afafc3ea0231a29f6cada31d33e80dd5082c1a357f2
MD5 2b5c89ff866819347c693d74cf1c70c9
SHA1 b163efff399c4310bf783e9c6c7f12fb20cd202a
SHA512 83fde2c4a0ba419fd23ceb69d4c6c1baec08bbb0ec19b219a943676b77fbf780841d593207685386257d1440dc87a7cb0ed403ad872b6ed1301714524df520db
TLSH
T1287149F7C3D9812DC95156F49B29AF1ECE2D0618432C3C2A88D8EE6793E2471E11575E
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e10ed46af938fdd43bc582885fe1b3cc2de60e686377bf3ea8a139998e689826
MD5 e54619b2a623fe7f9a9f2dfbe0c01660
SHA1 15500d0bf68e9767c0e9ab4c68dfab638c9c22d6
SHA512 843bdf721347c89b94f4c3b64d5f50c30e8e3f365438f22313aa4859cd0fb03e4a6f642030bc820f854bc3fa50c6bdd6534e39971fb4351e858a93dc31ef75f8
SSDEEP 48:K0BQ9xbfj8bP6nISJ8K9p1D8xhsYarhhyL6lI064I5bkjUISs5K9Q1K5xipYb8EU:KUuQKTS2OJWKK0plmKeMa9
TLSH
T18391621275BB5261387F6A4C4164AA1B465131B33154E92BBBFC40F2CEAFE085CFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4902f955-242b-4d89-94a1-d504f3148b60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4902f955-242b-4d89-94a1-d504f3148b60.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf5a7cd2-4966-4d31-9c2b-f365deeb8454.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cf5a7cd2-4966-4d31-9c2b-f365deeb8454.tmp
Size 8KB
SHA256 4023e2d8a53ac4ef7bc2e0566a0423d1b01d92ece7f0c2769a374e79d910ac11
MD5 353d07c82a5832493682ac008b3ea7cf
SHA1 177396c9c8288ab52f12d9d649221aae5297c609
SHA512 6a7be7070824ce4ce8fbdd9f47fd4305f5c3702eb0c7e2e970a7bc36f327e7c02c7f6b13633472d7b57ec0c86a3cdfbd5eac9a96e97850e6822d85b9bfa8c36f
SSDEEP 96:KqONkCQsjpfbUmjH5ih/cIPURHl8h4otop58aDyBKP4v+Y1xf//ojdDxv3ywlBC7:BONy6JUm0QmiUydSso//2ywlBCbbNU6
TLSH
T1FE02F939BC687C7B9EF3AE45B48777139FA4106BAA901F84DAD81E1D01D715C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df4f27e3-5f76-4380-a169-21e8abc36b94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df4f27e3-5f76-4380-a169-21e8abc36b94.tmp
Size 26KB
SHA256 c3c51a3f2f18c8bd4aa4dadb1365b6b39e7c5c94d66a5896f7b511897274369b
MD5 1dc8e6fba6d559b6f2258ccd8d3bb847
SHA1 d40c0c7527c8b8ac7d7d8e4e8cd21575e650a94b
SHA512 9fe4a5953d4388cdc00bf0a8fbb76ae0f97debaab5619d2be08aa90abe57d6bec3f46d27755ed9a61113ae6174866b7c44568cb1ad0edb23dd64035bf988f52e
SSDEEP 384:3iFiZcIozsNW8TUNTUlIloOdbVS1h//S3PTtgOIwZOy/eo/:yFQUfwglKr/STXsDg
TLSH
T161C218F258D7987AD9AE9743A77E3E038EBCC063B5809A54B799591CCC960BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8d1177e-dba6-4347-a972-b8252c39c11f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c8d1177e-dba6-4347-a972-b8252c39c11f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f2b06b3d-23b1-4b6b-b4d6-daa0dbeac322.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f2b06b3d-23b1-4b6b-b4d6-daa0dbeac322.tmp
Size 8KB
SHA256 914987cd8303b1290354d4fa5852f44a7f95fe1adfefbb6417261d7635035347
MD5 07b6f4350a0af990d0c84c5720739927
SHA1 fbe3e90d527df35b15cfc06f6d0d6530e7f0eade
SHA512 c8f5f1863d6c81e00d601cdee4eb1201337f3937df1ebe87002309431df1f2f7f3c1be7a293bd7434c930d7762bff6e9bacaa08742f0fcdc8485adcb90fdb3de
SSDEEP 96:KqONkXQsjpfbUcH5ih/cIPURHl8h4otop589DyB2psP4v+Y1xf//ojdDxv3ywxxX:BONv6JUzQmiUy0SHo//2yw3RNxbYqVU6
TLSH
T1E6123A35B868BC7B5DE3A481B48736139EA44127EB856F84D6DD1E1C02DF16C630BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 222ed2cb1e778a80bbb094828cc69af7d1c280b4042cb714e69c4d4433bcc81f
MD5 299d6851c36485be57c5fab1b89bea6a
SHA1 0a0542373b5c552d42c3223d52f1d09b0f3307a5
SHA512 1d7b76a5ddd40cd5c21c28218e9af6d9e9db88a635844c3b70260b28c8160254a8a3edc65ae46425352ba9c7cacb3d8ccdbf2137445c82061dc8e89ceb228f83
TLSH
T1C1410B58EAFA1108B3B77F4A9BF6A47E487B79371E06846E10110D4F0B63B41C961B37
MD5 SHA1 SHA512 TLSH

Submit Download