hxxps://eu1[.]documents[.]adobe[.]com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAADZ_Ashg7VQnyypBLlKv2-HG2kM2t4e7PH3ssZF35kMjqq0wYfykpKP-jEbXnAKEtLq7ME9Oh_85TQRTtpJ0Lg9tAba1bfqphdTnjkmB_tKEpsnEAeqoSJNV0KiReUT2n&

Analysis

max time kernel
900s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 15:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://eu1.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAADZ_Ashg7VQnyypBLlKv2-HG2kM2t4e7PH3ssZF35kMjqq0wYfykpKP-jEbXnAKEtLq7ME9Oh_85TQRTtpJ0Lg9tAba1bfqphdTnjkmB_tKEpsnEAeqoSJNV0KiReUT2n&
Sample261002-sfmfxaselc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{C1C8D15E-91F4-4489-B26D-7258FA8440D1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4812	msedge.exe
4812	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe
1072	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1072 wrote to memory of 4512	1072	msedge.exe	85
PID 1072 wrote to memory of 1052	1072	msedge.exe	86
PID 1072 wrote to memory of 3716	1072	msedge.exe	87
PID 1072 wrote to memory of 3716	1072	msedge.exe	87
PID 1072 wrote to memory of 2940	1072	msedge.exe	88
PID 1072 wrote to memory of 2940	1072	msedge.exe	88
PID 1072 wrote to memory of 2940	1072	msedge.exe	88
PID 1072 wrote to memory of 1684	1072	msedge.exe	89
PID 1072 wrote to memory of 2772	1072	msedge.exe	90
PID 1072 wrote to memory of 1684	1072	msedge.exe	89
PID 1072 wrote to memory of 1684	1072	msedge.exe	89
PID 1072 wrote to memory of 2772	1072	msedge.exe	90
PID 1072 wrote to memory of 2772	1072	msedge.exe	90
PID 1072 wrote to memory of 3076	1072	msedge.exe	92
PID 1072 wrote to memory of 3076	1072	msedge.exe	92
PID 1072 wrote to memory of 3076	1072	msedge.exe	92
PID 1072 wrote to memory of 4352	1072	msedge.exe	93
PID 1072 wrote to memory of 4352	1072	msedge.exe	93
PID 1072 wrote to memory of 4352	1072	msedge.exe	93
PID 1072 wrote to memory of 4340	1072	msedge.exe	97
PID 1072 wrote to memory of 3396	1072	msedge.exe	98
PID 1072 wrote to memory of 4340	1072	msedge.exe	97
PID 1072 wrote to memory of 3396	1072	msedge.exe	98
PID 1072 wrote to memory of 4396	1072	msedge.exe	103
PID 1072 wrote to memory of 2972	1072	msedge.exe	108
PID 1072 wrote to memory of 2972	1072	msedge.exe	108
PID 1072 wrote to memory of 2972	1072	msedge.exe	108
PID 1072 wrote to memory of 5432	1072	msedge.exe	113
PID 1072 wrote to memory of 5440	1072	msedge.exe	114
PID 1072 wrote to memory of 5448	1072	msedge.exe	115
PID 1072 wrote to memory of 2428	1072	msedge.exe	122
PID 1072 wrote to memory of 2428	1072	msedge.exe	122
PID 1072 wrote to memory of 4812	1072	msedge.exe	125
PID 1072 wrote to memory of 5752	1072	msedge.exe	127
PID 1072 wrote to memory of 5752	1072	msedge.exe	127
PID 1072 wrote to memory of 5780	1072	msedge.exe	128
PID 1072 wrote to memory of 5780	1072	msedge.exe	128
PID 1072 wrote to memory of 5816	1072	msedge.exe	129
PID 1072 wrote to memory of 5816	1072	msedge.exe	129
PID 1072 wrote to memory of 6140	1072	msedge.exe	130
PID 1072 wrote to memory of 6140	1072	msedge.exe	130
PID 1072 wrote to memory of 2632	1072	msedge.exe	131
PID 1072 wrote to memory of 2632	1072	msedge.exe	131
PID 1072 wrote to memory of 4560	1072	msedge.exe	140
PID 1072 wrote to memory of 4560	1072	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eu1.documents.adobe.com/public/esign?tsid=CBFCIBAACBSCTBABDUAAABACAABAADZ_Ashg7VQnyypBLlKv2-HG2kM2t4e7PH3ssZF35kMjqq0wYfykpKP-jEbXnAKEtLq7ME9Oh_85TQRTtpJ0Lg9tAba1bfqphdTnjkmB_tKEpsnEAeqoSJNV0KiReUT2n&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffa6adcc188,0x7ffa6adcc194,0x7ffa6adcc1a0
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,10765871326781118486,7352765523406920279,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,8522457321873661170,16465113784834632062,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9431171184706394937,11320069375992405891,262144 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,3068846171740909447,6413995120165481948,2097152 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,67746313664902565,3084900762753173100,2097152 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,1038772811806861429,6263912900523683883,2097152 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,8312115720486426464,7944240509582504901,2097152 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,3843642506756386005,5422329287397549049,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,7820568822440424661,14206256066471128318,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8508591213810296549,8618040439261519813,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,8508591213810296549,8618040439261519813,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6780,i,11711525739821575742,16959174396019440959,2097152 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,9953042325610712632,11937979622656923949,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:8
  2⤵
  PID:5432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,18260058933246455951,13203390144478883263,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,13428665651487523818,18049948528749422423,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,5384140935409188155,9443388235755761434,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6564,i,13382049849449547814,3453108556269171717,262144 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,15773948976473064003,14733382944479677608,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,4288371759920897135,16534069338372984964,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,8894317400307543766,4808799987022293882,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:5816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,7359815207588548667,10014252003245073989,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,11707948718736436401,15079805149442887800,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1508,i,5654807221514429942,3765766358074899259,524288 --field-trial-handle=2284,i,9542576603069538808,1953434304243011790,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c0cdf42-3199-439d-9d9f-28ad713e1415.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c0cdf42-3199-439d-9d9f-28ad713e1415.tmp
Size 26KB
SHA256 fbbbc2d1eca9fa69d1da16484b3fcd45615a112b6d11169a4939d97075c00cec
MD5 606351434d8be14b59dfe8c00d2f0650
SHA1 5fa2bc131ce40ee92e111829cefcc82aafd61bf6
SHA512 d9c6a39ea503237d191a4a65e6bd14ce9ff13ef40fbea1b7cfe938da1f9ae3841913839188f76391ac33b34a999ad6198789f242b6a90ed2da4c3155d2e2f106
SSDEEP 384:7iFiZcIczsNs8TUNTUlIllJdVBDp5u8i0+alZtgOIwZOy0L4oT:WFQg5wgdFrkClZXsTck
TLSH
T14EC21AF248E7987AE9AE4B43B77D3E124E7CC167B1849A40B7D8561DCC961BFC306901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

519ec92f-f081-408e-a9d4-3eb845271915.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\519ec92f-f081-408e-a9d4-3eb845271915.tmp
Size 18KB
SHA256 5101f110948c1dbdc4a7b999cf95dfb7d558d30b3adfb0f8e3beec71a6ca58b0
MD5 32888d1ec7f0ed355be62010b45905b9
SHA1 a8727da2b34532cb3bc1af14a5834de467a227d1
SHA512 60d5a789aca0d747c784127782515befead2e8df7d3882563c364d972003a6afd6113ccd08bd7c757a02dc931fb014087f7bf06098cc8451d4da297aa9a384ec
SSDEEP 384:GZcIhsNklJdVYDp5u8i0+a4ZtgOIwZOy0L4oT:UhrMrkC4ZXsTck
TLSH
T152828D329C78ACBA6DFB9551F64732135FB8816BD3C89F84D8ED671D01EA5D8030B902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ba17bb0-e0a2-4a6a-a2ec-38306ba4774f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5ba17bb0-e0a2-4a6a-a2ec-38306ba4774f.tmp
Size 8KB
SHA256 aae33a044ab3404eccad6a77c2ee49cfcc4bc8e371a0e2ba1eb3aa36c79ee2c4
MD5 cf15bd72f998358abbcfe029db861afe
SHA1 47d26e350fedb694afa2395557ccb28c4304fadd
SHA512 6539cec5ebc32f1eb8f436072d223301424889525de3250cd032500138c4f4f6951b4c5aedc72657be66d9facf83d344f5cd431d4e51e10993db4b9c3516202b
SSDEEP 192:SONd6iDTQmiUyPMRq5u88PA9+a6uZRPqQU6:SONd6IfRq5u8i0+adZU6
TLSH
T1A5123C36B878BC6B6DA39961F54736239EA4026BD7886F84D9EC271C01EF59C1307912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96205a95-e83a-491e-a0ce-4e88b2266da7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96205a95-e83a-491e-a0ce-4e88b2266da7.tmp
Size 8KB
SHA256 8945089c651a036417e6c2907883d7aeacd4a1434d43f3b54cec32b816f043a3
MD5 fc96a81bfa14817aba5420b875625448
SHA1 7c5201cd435aaf8a939d8c43f353217df0a1d303
SHA512 c56fedea530dae4bb1f38242964ebca4be70bac1faec4c2c7e12f3d0c3bc309f9ec0dc9906cd98b55d48e782ee8b5ddb52150b39989baff97e93dda3daa71943
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop5tmD4BfPGxvw45RxmJm78lFIxCYbqO:SONo6iDCQmiUymMHq5u88PAgSqReaqU6
TLSH
T1E302F939AC787CBB9EF3AD15B54737239FA4117BE6945B84DAE8162C00E768C1307822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f1bb27b-8dee-4e0f-97fe-f02466d1a28b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7f1bb27b-8dee-4e0f-97fe-f02466d1a28b.tmp
Size 105KB
SHA256 25559293c954898f2da344ed5fe3faf3c076ca2a1868befb99178bedacb3d026
MD5 7921e958d547711c39f2211be9d582e9
SHA1 d327f17351a129da59733ef73c24b256addb1b88
SHA512 29c83b34cc319b93140a7156f0e4fd32fca94b626b32f9aa46eb5471603b5bab4338ee0313db91199b04ee0ff93fc3dd5d552299e129f6c1cd750f4211244525
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7E:fwUQC5VwBIiElEd2K57P7E
TLSH
T117B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c5d2e3a54f03904bbe55eebd2e15796e5b26d6e7120a6693c971408f22102794
MD5 4656163abf32e5ab1a0774c2d3ffd3c0
SHA1 7bb2730f110962fe6a55dcf63196da9d74635fdd
SHA512 2096bbc1475260d24baaa9e51217bd19dd5edfd500aa9c96f8c9ec0510a31f436be7ca6a34af3ec2478245bbace0f09d84f152f56ad9a37ae2441e8f22301bc7
TLSH
T1C9D08094D4B47AF8F035313D5136450177CCDF96F603235A91454956C8501C309F1DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

0e364d92-cfa1-477e-a660-bff7ccc960e9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0e364d92-cfa1-477e-a660-bff7ccc960e9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2e0c12f7-0810-4c0f-adb9-7a6bf9afec78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2e0c12f7-0810-4c0f-adb9-7a6bf9afec78.tmp
Size 27KB
SHA256 1e3eeeb6dddb613d02e3cd423d00141f9dde758935f49ee9e7afb646f7a8190b
MD5 e88df0f1327ea4ed95c44146e9fe1245
SHA1 e612cf9cdc847e61c72883c776ad65d95d2a8532
SHA512 f456976743284718207e1d7a3103c60f15e657dead788d2f98efc7fcfd441d2d614ce001f70b571cc994b3fd2098019538df663eb9ed5eb9797a2f89c4eb0dc9
SSDEEP 768:0FyQRbrWvvlRZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3MroFZw4m:0FyQRbrWvvlRZu1jaXKLf33XFZbm
TLSH
T1B1C2EA2B640CCB7E4FC01E9DDC6A6F976EA802C766588D4447FA984C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eee23a6-a6cf-43ce-aee5-c69b987ac495.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6eee23a6-a6cf-43ce-aee5-c69b987ac495.tmp
Size 10KB
SHA256 cf20b814faef1ffad27ae0e41357eeac830c59174afc5bcf728ec13bbff03057
MD5 dd8941e0d72837943485b02fbc0766a7
SHA1 990f57c9107c245e5f432c4e347b1982d1cc0541
SHA512 b2de67a8090655df2021e31234235b4672dcd92a00766c3fd7a24d78e3900e1f277ab9e7d6cb64552d76846f93c47830ca7525dcf6f8315ec2c349cc19056ee9
SSDEEP 192:sxZkReVWcb/fVs57Bo9IdphVHW6+WNbwh/YajwXIg5aJ:sxZkNcb/fVs5do+7HbY/KQ
TLSH
T17E22D9526E28797B8CCBD21DBB15BF53E6F9503151911E48EAFC8A1C04EABCD220744F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b8fe25-c7e7-4be4-9086-1a38f9932bfd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73b8fe25-c7e7-4be4-9086-1a38f9932bfd.tmp
Size 9KB
SHA256 2a2eeecac0afdde75533fdcf827074c6f4c6023d61b577c0319d51e8f660aa5b
MD5 1573d2f154f0de7517d94cb67bf7dbf6
SHA1 f7c9cfaab28c4fa5e8b9a5d24a32f8284fe6e189
SHA512 8648308bff6a0f21584235e35bb75bf28e72d82a4a207690660b9cc717fd6db78933dfbfc9273c600da9651f98e928e92d249ccddc779f8912e4463b080ec9b8
SSDEEP 192:sxZkReVWcb/fVsE7uo9IdpvVHW6+WNbwh/YaIwXIgrJ:sxZkNcb/fVsE6o+NHbY/j9
TLSH
T1D522B8526E28B57B8CCBD21DBB25BF53E6F9503191951E48EAFC861C04EAADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ed5bc7958ff03cab51fac5d8d698ca6f9684b525c62793cecaf628006a78e1a6
MD5 9aba2a4cebd7499844474fd9bfc0ca05
SHA1 1cf0dd071e4aa135ecccb383130bdc52354ce8ea
SHA512 875039461a5f3c93f27b558de905ed68aeb552220b8db014e8c71e23e535cd4bfe3520a563f5fc88164c663e6ad2272de25fb9f5e7d1bb8fa9a92a9532acb00a
TLSH
T182E020DE04C5C61D724464C7157C670C83D07A9BD7C4A90EE704C648B54D04463D5AA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1dc4185b9993b78ed9c33fb97cc440e4425e57d27036dfb3d4dc6ecf30b4eb94
MD5 3d13e82b73181153f6ff67a828f0425f
SHA1 1be681881b7e8fa7f2156d851e210b8f1ef11cb5
SHA512 0d3e8b51142e22a2699b7f15fbaf4d3a18fcb3d80051a80bf840b010130d408301dd870f70e5e87565472c92acf1e7310f4f2061e1826441a801606ef49e7701
TLSH
T1C9E026E944CACA2FA28978CF026C6B4C83D1376BD3C16D4E6B00CA8C7406040ABC26AC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 00a98f863e4257077f9f2240dcb98837b3bee903945635f4dd13e42fb420b940
MD5 5f6c4498a675313f28e473fb419170c2
SHA1 31b9185b2bae112ffbf675ff71652568935ed1ae
SHA512 69fa85b929ad0a90f87750a358c8fb5e9be5d46e9cc972b2d9df1b8d3606f0ecfe1ef19a0a9a00d1472dfcb9e930bc6393ff05e99d94f12c87dc68697c2f042e
TLSH
T152E020D804C5C36D554564C711B4578C83C07A5BD3C4AE0E6704CA49B4054806786D60
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000091

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000091
Size 58KB
SHA256 c3cb2bc19f6584146a044ab3294c63cc0896479734e42ac7ff5bf1bc7fd0145d
MD5 66b4d1f8694c3a24a8fdace36663bd26
SHA1 c952e56ed4ab91b1257f597864d26955a1ca5182
SHA512 e8bc9d33d6b5fcba981beea1ee170911db21ecfe71ab12009f90713e262294523e1256f0340bb1190541c0309339e4217016c825a40dcaa745869c9ec225910d
SSDEEP 1536:2kvL8oKDNQkmPkeYE7bq0nyUw1Z8SMw3d4E7ExL22AiLV/egBMqp:2kvQ5QxYEXs1Z8qoa2AiLV/eLqp
TLSH
T10143F19CBF2DE303E17A96D144B7EF5A8BE6B4B6AE84D08106C799400198D1F0387B59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000092

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000092
Size 28KB
SHA256 5b3358672e454c6896ed55ebd53c8f7022b9c56798ac9dfe002c056d1f6720a5
MD5 4d6b4788f06e33eb2257178fc707c8c3
SHA1 bc4738991b8ea34ee86feb38ff0530849f6273c7
SHA512 0ce9d58073deb1d25951616874863c496abfb85152fc9f498d6f06693dcdb0add0a7599d805bfddb8fe3349337af59eddde720d288764e2e1f8edf7ed109dc13
SSDEEP 384:eiA3kW4zob5DMFcKMxoAYpFbptxqwnJ04J2exJFAeh2T09OSiF9iSZY2Bl4cQzVD:I3k9znoxvY3NjqkpJbw62zNoDCklfn
TLSH
T1A1D2F19367E528325C385E0D9BCFD7267D9A2F8CFE882004B94676C5D892A85524F48E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 2.8MB
SHA256 87b0b511c3e5226f3831f98dd5e9e19370bf7ccbec9cfa32e2dcdd48ad768aa4
MD5 495e6fa0836c0a578b95421b53396366
SHA1 3d990631d65b69f1eaf889c2bf278f22ac779402
SHA512 61e54e65e2ebf1e55e5c8404123b17bb7d0a9b1d61eff866ac13fcecaf232a3de43bf7b052fd01e4b7c98a972d63273fc86a564f7161206ba8e6b8f1098fbd1c
SSDEEP 49152:YjXKikj/oEjWia7WaH2wqwlOnk9hMpP9PC2dQ1mr0lZv4bAlSCad7TASmVUi0FHJ:6XK3jmia7WY2Bk3MRUdtZVlSrp7ti0Qm
TLSH
T1EBD533CF8DB3DECBDC503A3422A55067FB079EE53A515F54A261A2F652B120028BBDF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000096

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000096
Size 636KB
SHA256 ec4ce34335c6018e776f00a1672bcdd278afb454be91032b1db3f223c9e15064
MD5 fea73ef087f37d5778053e136454185b
SHA1 eb55f9e870336994dec5f9c4e90a3cb5f216f4b2
SHA512 75af6d75641f006d58187c2c538c3ad761e4c8dd373320dccc0b0e982b7b8d529e53267c47711978b950bed4ae24da52600e4d4e82f8460531b3ba1ea22fab5b
SSDEEP 12288:T5yHolw2BtzNa1cU4CxxXALI5ZNAhOmjL8Qg0P9nSKM6G1VAAssPx646BSuY8p:TUHoljtz+Rnf5ZcfAQgYnSfj1VA0Pxd+
TLSH
T103D423F7BB23955F253E0E3219F49934DC2C72B4645FFA59C55E0DA688F20AD3A29203
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 33KB
SHA256 8c1dfcbdf3ee0b6a9b6c0c6cc9d7a05695cd92c316d3f882268e236fba4b8d68
MD5 8f367c0013adb94bc8ebfeb802fd3ea6
SHA1 3cb5cd8d5076eed5ef461c6a439a87cfed614b63
SHA512 ba16b2fa1499d1e5e4ee373d12529a7569c0a314c29fd545a46eee3e071f99347c581ed39c51b5b8b4205d9ecf8083aa02e928d2e401f9bdcaa408f59637e34c
SSDEEP 768:Cd6RQA1xSUHDyozS4Bv3wdjMuc+u3oaF8Y4uM8p737fGMCCW:skL1dHuiv5+1ae8pj7hC5
TLSH
T144F2F15CA64963815B9C0BE8D5CEC2880360233F5DFB3FA51BA96489240E75ED4D8AEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 bd455740b3f8cf87675dad2badbf4addb15e870bec9ad641b9cb3bb45b28b3ab
MD5 ea52acf2942264c833702df5ea95257e
SHA1 8752a77a532f71322ab80ba13ccf67dd431d1218
SHA512 8722ae46e2b01b427be8fe2630f3e15f77ec64e6b6e830dbb850f160e0f1f5f3dc4a21a2734a093b875a7741237ace91383fd203f5c60bd522393b1fc78ab478
SSDEEP 48:4AC6bnvZ4yFjmIC5HSdzV+iEE/G/heHU8ucFsfz8wYoT+G6xVu/vrkD:1aCjvC5yqP6GJCNybgoCGI4/jkD
TLSH
T11A91A6F4FAE9C1C5F7D87038CAE2394636BDEA858CC34EA215A0D7757D8BF600251466
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1f4983dc765ee0d4f9aa105b2d3b3ca9f342be23fa0312e0e66f4b5eb118c586
MD5 c1c088ca20646d6a8772c21fc79503aa
SHA1 7d087741a515a359d611ebdd62407e7f63803b22
SHA512 fccacf218e53e686be42a2e24c9c219bf56a1bf9e42ea7280b3886b42bd0231c2936ac57309b8e5f898e680338616f993a27cd88fc3be086dfb5b4f6af327cc8
TLSH
T187615F78B8FCC4D5F7D8447CCBD52A8A36BCEA869C979EF201A0DB786D8AF101154046
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\temp-index
Size 120B
SHA256 63c0e045e985e9b413aec8dfe2c1ef7c11b5b7d045e3b6fa2f0317c7365cdff0
MD5 77455b85f4ccd945509396b22c1de51e
SHA1 53a354aae467df2b43da0929a3c0914ddea8e620
SHA512 3bd78ab2551c4f09a1e04300a61d25f78f012dd34b50f61310ba6a7dd83ddbc1e3f6f306e0c4cc9ebdcda2f1729ca9f57cc5595926c961f851358251613d0e61
TLSH
T1CFB092E29BA82504DF5077B9A422B5C696083AA80ECD4A2600B49430B841199A246439
MD5 SHA1 SHA512 TLSH

Submit Download

d86b5a76-324c-46a2-98d6-c99aa4836d32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d86b5a76-324c-46a2-98d6-c99aa4836d32.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

572be9fa-8395-41d3-9f30-84573f24a3c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\572be9fa-8395-41d3-9f30-84573f24a3c4.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a61a75e1-a71e-46af-8d96-0e07d119fe6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a61a75e1-a71e-46af-8d96-0e07d119fe6e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

abfb5d72-04f3-4511-a989-bb9b4483e59b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abfb5d72-04f3-4511-a989-bb9b4483e59b.tmp
Size 2KB
SHA256 8e87d946dfbb2a60ee985f0d4cbbb5aae44bb668c2de75bdfef0066a301d9b94
MD5 86bc83401e9039caa39937e926f5e65f
SHA1 387520f508f08d542b27acb1ad5c34dac35ef6b6
SHA512 3d0ec9d509574cc29aa1bd437dbf10c5819f65a051710531995a203dee16fcd2b147601d8f0da757d2244e1cfa783f1573f57aee76958ca0f566a100f451f31f
TLSH
T10D516BF783F9852D891291F09B18EE1FCE590911872CBD39C9D09E6793E34B2E101B5B
MD5 SHA1 SHA512 TLSH

Submit Download

e946e2a8-6ddc-4752-8657-5bf2e411bc31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e946e2a8-6ddc-4752-8657-5bf2e411bc31.tmp
Size 2KB
SHA256 3f9ef9c11dfdd688e8fd218363ac0f513ae05f9e499b723a48263d981bd08d6c
MD5 f64bdbfebdcd78db37abf54ad930a33d
SHA1 cf95a3dc6e9a24dc60955812d4818c271e0771ef
SHA512 5f166d28e8d32b3439b9787f98af74df775ae6ce69ed818f25f96f2fd220c8607c46e116615b32a4a47ff70dcbca31afee8ca66fa116b5c1a04e3d44bfed3457
TLSH
T132513BF743B5456D9A2292F0DB08EE1FCE591811872CB979C9D06E53D3A3472E101F5B
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 06aee9922cb77bcc21ee2ca84f123399b41afe91b3ddd1f5afd9bf7931134649
MD5 71bafd97cae275680464b93e2f231444
SHA1 62c1bb2ca9ecf4127a442ae38c446cf3c21b9c0b
SHA512 9f3f8c978e9ce3971b490eb7dd3120ae2bc0998b66be07a15287b5b9c23deefcaed2c0ebbdbb7f4f5813b8174892a76c5aa35ba4f601603734f7b765769c7131
SSDEEP 192:sxZkReVWcb/fVs57uo9IdpvVHW6+WNbwh/YaIwXIg54J:sxZkNcb/fVs56o+NHbY/jS
TLSH
T14122C7126E38B57B8CCBD21EBB15BF53E6F9503191951E48EAFC861C04EAADD220744F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 1KB
SHA256 c3cbe1c4d7de21ae8f38210b7a1db8dabb5536d61471d508421ef368dcab820a
MD5 48de9c58f1c8bce9a7144981c7eabfb8
SHA1 268eba1895b70724a02f5f02608107fcf01f3909
SHA512 fb340c6e9baf76b4bc97aa0453297bcaf95a0e5f18f35347731811ab69af10ededf52cc7ff35f06a9623d593d452110998a9bb5196af5f08c6957ad8e297d927
TLSH
T1822165825E925AEBFE907279143D24967330D2CC13107A1F12BDE0359C57B04BD459A4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 1KB
SHA256 bc8d3d0994ef9c999ee0f0c66a9ce30d300a6da71f68a16de6086574d6bd6a46
MD5 460e214786eaae0dcee152a88b89d557
SHA1 cc7eb8f17bc3a1a5f1f9b3e029102380dcdf9d22
SHA512 432dd95f85a9a09f8aea6563e54d64ecf44b3a156dd29e6ab70b0474cb4a79b8b6c93a5caedc8d37a6306c8f036fb9573394179ea719991ea86e36e6079dc1c9
TLSH
T1DC21846241630B67FC44337649AD68937330D54843543B0F63E7F03AEC82B80AD86EE0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 20c03c3c8b6b8775b6a4d22ade639feaf163d4c7618644bc25f024b9cf0c6bf3
MD5 159b7116cab58d14b53964d04b2e07ac
SHA1 9da0dfcfe5187fdd913d3c2faa769f0511444d4f
SHA512 c56de732a4af2199bdbd283f6e4bf1dabe5796e053f0c1156cdbe6fa31494b01c5191a331132cba14b302491abb48552520331dbabce49b645a9b248e4c5ce43
TLSH
T132E06FBB3EE72800ACBF83E2083140A90101B8008A99EC4E202AC2C750A13822836CB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4d2773cc296cb8e7e0c500c95985fd68f45b77edc2780f6f5ee78a0d4e943a1c
MD5 6d1b2e0a1ac74acc0db77104a234bc3b
SHA1 a3d4f75f877d261d5958e0370569866bdd15b6f4
SHA512 e02ff29ce35ff4261309ece2fa9fe239e382116ca6fb94485cac2b8083dae5c931492ab623e9ef4699074fefec88a13a3c52bf8286fe5f68b2bfd0068e8bd5b0
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWXPw:K8S4K7S6aaoKnK4X2Ks8qZ
TLSH
T16C913D41756B560038BD295984B58A2B534235F3312CA63BBBBC54F28F6EE044EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e012b725-641e-4ff6-b7f8-ed6672d2b1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e012b725-641e-4ff6-b7f8-ed6672d2b1a5.tmp
Size 10KB
SHA256 79d488a75640fb1cc780c58c7d61ddee912b2c4442aabc83a1cd7041e2f2acb2
MD5 37f8f6481b0a183649da36829f0f24ed
SHA1 c9c755f6c4ae2d42a3438e9d5117cf899a4f2580
SHA512 8d45e231a7d119be848bbb689945de0f80217bd7676584528cd8d16b86af6eb68f6e2ead754b753ae2ff22ac483997e8cc9f4d9a86a8856566c4825326b7cc2d
SSDEEP 192:sxZkReVWcb/fVs57Bo9IdpvVHW6+WNbwh/Ya0wXIg5aJ:sxZkNcb/fVs5do+NHbY/PQ
TLSH
T1C522D9526E28797B8CCBD21DBB15BF53E6F9503151911E48EAFC8A1C05EABCD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e23ed2cf-1cdb-4062-b23e-6aa9494d445f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e23ed2cf-1cdb-4062-b23e-6aa9494d445f.tmp
Size 24KB
SHA256 3709ed8fde110480d5ba376b9e7096b3fdf6423ee841119afcc56b98bb0afb16
MD5 5fcaa2e43ed9273dfd4e1cd1b4b9c703
SHA1 687c0c8b974df454a62257914b4b64db1db4264b
SHA512 3634807968e54e3b95d3e48b79b72c27398d958a625a67d089bf79e9e956dc31e47b110795fcad2ae4bb0b1833e5a8af8a1536bec09bb391cc3627d4957b5c0e
SSDEEP 384:sxZkNcb/fVs5R66s8qMpRiYnazAW8pZS15posJWeT+to+7HbY/VQ:ssN4/fwR4Mnc7WeT+towHbKm
TLSH
T131B20705A924D87B8EC35D19693C7E33EAEC406222C5CEDE5AECCA1C019D1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

661a45e1-5d9e-4223-bc33-a2ac43cde9f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\661a45e1-5d9e-4223-bc33-a2ac43cde9f2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a00799fe-0c1e-40f6-8ccd-c8a870875e31.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a00799fe-0c1e-40f6-8ccd-c8a870875e31.tmp
Size 18KB
SHA256 0c8adc769d4155814721d6c294e2374118ffcfee3abbc963197c63f152eec093
MD5 7374fa895e9a8f39b0ca08084be6b393
SHA1 89bc90c95adbee03a1ab1b1925d9df5d59562229
SHA512 6e9afd1feb6eb476ffff24b5679512b8415bf685a8dc54711317b0229338e08725935cae1f0ff54d6fde263fec45c54569afabf439802c6f7258f424afec5127
SSDEEP 384:RZcIhsNkIJdVYDp5u8i0+a4ZtgOIwZOy0L4oT:5hkMrkC4ZXsTck
TLSH
T1DE828D329CB8ACBA6DFB9551F54732135FB8816BE3C89F80D8ED671D01EA5D8030B906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f091f59-b7bb-48c2-8dbc-b2d8df973972.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\8f091f59-b7bb-48c2-8dbc-b2d8df973972.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3162be6ead02ad4d6661c429da97bf616bed24fa58bce389b6c9e7ca54ca608e
MD5 3abb975a234b8b6aaebe7573df41e3fc
SHA1 5bf5f6c673b73540d8f11dcc1082584ae7322ed0
SHA512 09f93e6a74e647e0afeff24d6b67d04fed6cf81a8a99275976c2cc4bc9b13cf87809ea574afa8e595b09f3a0dc32c329762bc26b747365797687b6ca447c7749
TLSH
T17C414C6DAAED110CB3B76E5A9FF6B86D487EB9772E46C05D00110E0F4562E00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download