hxxps://anime4up[.]bond/

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://anime4up.bond/
Sample261002-syffbaws7m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3908	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{335167A3-017E-4FAB-B8BC-0D4F01F3FC98}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5304	msedge.exe
5304	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe
1288	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1288 wrote to memory of 3372	1288	msedge.exe	87
PID 1288 wrote to memory of 3908	1288	msedge.exe	88
PID 1288 wrote to memory of 4416	1288	msedge.exe	89
PID 1288 wrote to memory of 2816	1288	msedge.exe	90
PID 1288 wrote to memory of 4416	1288	msedge.exe	89
PID 1288 wrote to memory of 4416	1288	msedge.exe	89
PID 1288 wrote to memory of 2816	1288	msedge.exe	90
PID 1288 wrote to memory of 4888	1288	msedge.exe	91
PID 1288 wrote to memory of 4888	1288	msedge.exe	91
PID 1288 wrote to memory of 4412	1288	msedge.exe	92
PID 1288 wrote to memory of 4888	1288	msedge.exe	91
PID 1288 wrote to memory of 4412	1288	msedge.exe	92
PID 1288 wrote to memory of 4412	1288	msedge.exe	92
PID 1288 wrote to memory of 1124	1288	msedge.exe	94
PID 1288 wrote to memory of 4588	1288	msedge.exe	95
PID 1288 wrote to memory of 1124	1288	msedge.exe	94
PID 1288 wrote to memory of 1124	1288	msedge.exe	94
PID 1288 wrote to memory of 4588	1288	msedge.exe	95
PID 1288 wrote to memory of 4588	1288	msedge.exe	95
PID 1288 wrote to memory of 3192	1288	msedge.exe	100
PID 1288 wrote to memory of 400	1288	msedge.exe	101
PID 1288 wrote to memory of 3192	1288	msedge.exe	100
PID 1288 wrote to memory of 400	1288	msedge.exe	101
PID 1288 wrote to memory of 3504	1288	msedge.exe	103
PID 1288 wrote to memory of 3052	1288	msedge.exe	105
PID 1288 wrote to memory of 3052	1288	msedge.exe	105
PID 1288 wrote to memory of 3052	1288	msedge.exe	105
PID 1288 wrote to memory of 4232	1288	msedge.exe	109
PID 1288 wrote to memory of 4232	1288	msedge.exe	109
PID 1288 wrote to memory of 4232	1288	msedge.exe	109
PID 1288 wrote to memory of 2184	1288	msedge.exe	110
PID 1288 wrote to memory of 2184	1288	msedge.exe	110
PID 1288 wrote to memory of 2184	1288	msedge.exe	110
PID 1288 wrote to memory of 2512	1288	msedge.exe	111
PID 1288 wrote to memory of 2512	1288	msedge.exe	111
PID 1288 wrote to memory of 2512	1288	msedge.exe	111
PID 1288 wrote to memory of 5548	1288	msedge.exe	117
PID 1288 wrote to memory of 5548	1288	msedge.exe	117
PID 1288 wrote to memory of 5548	1288	msedge.exe	117
PID 1288 wrote to memory of 5576	1288	msedge.exe	122
PID 1288 wrote to memory of 5584	1288	msedge.exe	123
PID 1288 wrote to memory of 5596	1288	msedge.exe	124
PID 1288 wrote to memory of 4184	1288	msedge.exe	130
PID 1288 wrote to memory of 4184	1288	msedge.exe	130
PID 1288 wrote to memory of 5204	1288	msedge.exe	131
PID 1288 wrote to memory of 5204	1288	msedge.exe	131
PID 1288 wrote to memory of 3488	1288	msedge.exe	135
PID 1288 wrote to memory of 3488	1288	msedge.exe	135
PID 1288 wrote to memory of 5304	1288	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://anime4up.bond/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff501cc188,0x7fff501cc194,0x7fff501cc1a0
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,3758227581971088751,12374705363146125453,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,15657520128520158259,8596009367748848794,262144 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2452,i,16648711010671467532,17502233341435566962,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,14388135805517056882,6901114581659290347,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,6928138790132603981,10640617356953173236,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4832742791954598865,2035218403719275706,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,10334222761462548717,18264832061783250063,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11333808388127955330,3247957112171383714,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,293238508324879078,6387660514094281804,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,782263195068247140,991593217473626209,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,782263195068247140,991593217473626209,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6212,i,17582509400464721909,5566692444547909476,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6376,i,16438343705329218124,16164810948235617844,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4248,i,283178631641954786,13813114017432878967,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6232,i,16109224928032905726,384323135518749879,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=7236,i,8917599767425571014,7867113468861022294,2097152 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,11417580228635460403,10251130349370439386,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:5576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,3214247605864440614,14970338623764959804,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,14834765331752586196,873547878621606868,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:5596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,11401021285822745592,1377455314732869966,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=1032 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,14145139942461018833,9226843561000490043,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,8877457143050100468,9080416940852310893,524288 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5368,i,3454068241667357021,1521457613384076520,262144 --field-trial-handle=2344,i,5286618949077963034,15034733076937641288,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4a125cf5-8fe5-44f7-bac2-3b1488a88084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4a125cf5-8fe5-44f7-bac2-3b1488a88084.tmp
Size 26KB
SHA256 6441562035739a85321d7c715938fb4f2a08124044052c1bd73fce1425005d35
MD5 f375ec1818108fde5dba677c2e160570
SHA1 a3ef12cab59ad02f5cfe4d6eee837d7622cf4bc4
SHA512 e31b40389d02a6d10803fac69b5bbaf50a16cfd8ab895916e9dd49a3509fff20a662ad67933c7c04e9218a169e69387076897b513c2f1b048b63de2d148b7fdd
SSDEEP 384:HiFiZcIDzsNe8TUNTUlIlbVJh5nTPBGYX5E78pxa++2ZitgOIwZOyQLQioK:CFQHPwgTntZGYu7WjlZiXsvbp
TLSH
T112C21AF248E7987AD8EE5743A77E2D034EBCD127B584A654B3D84A1CCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

912a311b-c529-430d-9ea3-1f9cceaa2d99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\912a311b-c529-430d-9ea3-1f9cceaa2d99.tmp
Size 8KB
SHA256 49f72a63dd4dbc1c0bba3ec077d62c356ff7092f0b73078ec16298ab87cc4ba6
MD5 80da4fcf6feebe640d69091d30e44fdc
SHA1 cf41e0321fae7638c0be05c5836147a0eda527d7
SHA512 282b958e16099632edf073f9526ff4f2b65e5b71899a1ae16fce337aa404639169fced8fda0651e438ed504c4dc9b27f8b387cb9bc76dec72d7057648309dd16
SSDEEP 192:LJONAh6DphmqQmiUyj+q8wGYX59eziC8jkk7nwxU6:lONAh619hRwGYX5E78bgU6
TLSH
T14A02E935E8787C7B4DE7AE45B54B2B135FE8212BAA906F84D6E81B1C00D764C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b360d838-1d22-429c-b965-e57ac92e4584.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\b360d838-1d22-429c-b965-e57ac92e4584.tmp
Size 105KB
SHA256 b2d86bb9635e04c694403b46b456ec83da9c370d96a21b15fedba9be06b8e402
MD5 4e53b8aef808dccc6661e3fb447c2054
SHA1 acccfaf681928a627e8dfa4800d80e4660d2ef04
SHA512 13032d466f22156730bff2ac4de38d89c66d27f0adbccfa995aadd43d09216e0aded976b46c0418706370333080baf61ca1adc51bd2e043c578c3b251ad07d2d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T195B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 24c133ed61416156a3d0b4fa00bfca479eb7ecb5184955e998fbedcca605f8b1
MD5 b90ecf74a561822627982f1b8d4c4873
SHA1 3340a2b49ee7948da3345fd34ecb2ab68420b586
SHA512 eb4373bf9ed3d7960d90950f6ae991a5e15a049a12d096bc176bd999a7c117e37d44210634cdfb6f388be8a9ac75d4920be8d0f0c23e0873f2a14b925d350604
TLSH
T1BBD08025C9F46FD5E037103D012241447ECC95665B023116E169156E19955D71E61891
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

10ac5a4f-bb0a-4d38-b389-610b48fe19db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\10ac5a4f-bb0a-4d38-b389-610b48fe19db.tmp
Size 10KB
SHA256 5be6a8f0c8ea5e2e2245e8df78e749e5e7f65ff49c093c46ab843419c5a92470
MD5 1a2432a832abc9ee728ffe8a807d03f9
SHA1 af768228b8e81ff08d6a0f3dbc6b49f39550e992
SHA512 50dac72231f348a32ad1ea513ac8bd2a0fb64a27d6eb11fe5616f63ac71ddeef5ab9e30f781edfc328b8304e66a088cdfd7ee834335597f34c73a595005e246a
SSDEEP 192:sxZHCRjW2/fbsfPkIdpYnWffYSHW6+WN34EUVa/YgbluIgU7cJ:sxZHCI2/fbsf1YWHTHb3z3/iU8
TLSH
T19122A9526D38697B8CCAD21EBE25BF53E2F9543195911E4CEAFCC61C04E66DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f4086e6-9947-4711-9010-9f29e5d03292.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f4086e6-9947-4711-9010-9f29e5d03292.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66ce2097-e14c-473a-9df3-ced2166f0913.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66ce2097-e14c-473a-9df3-ced2166f0913.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

82dbcf7c-729c-4c01-8227-5c05d44ca4ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\82dbcf7c-729c-4c01-8227-5c05d44ca4ea.tmp
Size 10KB
SHA256 0d24fe5cf59ded818b127d5ea038eba6af90d9904db567aa9fc4aff71d0dec77
MD5 f4300beaee07a0bf8989a4a12de51978
SHA1 34dea77c9859fd900da57732803045f9faa84abf
SHA512 40611635164abfd7fd53de82acbe1022fdd7857b544cce71c8dce70c3a15b8f7171740ecd9e775c7aa71cc6eb6520c481b232d66cfa444a6dcb2fa56a5a3e964
SSDEEP 192:sxZrRjW2/fbsDrfkIdpYnWffYcHW6+WN34EUVa/YgbluIg5R7cJ:sxZrI2/fbsDJYWHRHb3z3/iT8
TLSH
T19322B8526D3869BB8CCAD21EBE55BF53E2F9543191D01E4CAAFC861C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b2de4d723452a1d085a394f54fdf5f95752111d003c65fd0a655622f9dfaf770
MD5 6bad952145d5e25cfd982de06c90a9b0
SHA1 3d05fcd97b30e774fcdcf5bd0bc026e184b82aed
SHA512 3d15cfc83d85bff9e0e33eaca520f3e6d83af47cdde286ed87ce76d8ec96248222d2eaadb162f1f0162d9d54a128ad2dfab1496207573eaf54b1047c248869a9
TLSH
T1ECE026EC06CBC22FA24FACCB01685B8C83C0361B93C0AD1E2F00C6C4B485240E6A66A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b4e2d371e7971e4ba6fb828e9c912f15b7b0ec206828b47871a3bb1debd3fa96
MD5 902aa8b8c8b6723756aaf893b1a3eea1
SHA1 33b1f7db4ac7d3920135578fc0f07699328919de
SHA512 43c7701f0793d02e6c3407a9b41ea273b548024a8c1ae028c664317050c3236f083e5fb140031a112dd008b4ec6ede05a5f29f22775fa05380835d2189684776
TLSH
T19CE026E806CEC23FA208748F11685B0C87D0361FD3C8E90E1B00CAC47C49140F2D27A8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 75f151192d7ef1b30661fd77b3669b983e6c0c7aff6f32cb797f7b5088de59f9
MD5 841b2a455c609e2b5b3cbb7e301bd860
SHA1 0c968696c85dd880c87ffe3237347339ced42ed7
SHA512 72f93ce9a80f19a170ebc98157c05f1154e8772da48515a3b3bcfe1b74f235af5a93fecc91ecac9d4a79469b96f10dd348145ae2072db180d4192e3c8234cb06
TLSH
T14971D68D92AC4176FB68013F73D624EBF33099E05CDFDE428DA4D8396846755AA092CE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 71f475a59e548510d76c0cdc239028fa9689e0a5c6dd3bac71c6835b380e40c6
MD5 305854bec1d0a4764c6aeeb724d39e6b
SHA1 5c9c026a61dfda075813f74ef99b8f1bfca77dbf
SHA512 be7e5b3f3208a1f7c35cf3d92a2ad0772ae7911f6ecedee5182b8d339dcabb11e4379ea28579ab1d1fa0bcff626b4643fad0456556e5412d1cc23943fd77a716
TLSH
T17E61A14DD2AC8574FB68003FB7D610EBF33099E04CCFDE429CA8C83A98467149A082CE
MD5 SHA1 SHA512 TLSH

Submit Download

b36a047d-5f36-428e-bfe8-ed10665583ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b36a047d-5f36-428e-bfe8-ed10665583ad.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3a086def-fea2-40a4-b814-9052fad5db7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3a086def-fea2-40a4-b814-9052fad5db7f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

46baa94b-60a1-4d8c-bd78-a833bc08fd36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\46baa94b-60a1-4d8c-bd78-a833bc08fd36.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b0bf0f57-a75e-40a3-8dbb-c9bcbecc7f79.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0bf0f57-a75e-40a3-8dbb-c9bcbecc7f79.tmp
Size 6KB
SHA256 d8f75af9c7ae7fe7c13840c801ab2359932f6d1bc149db203d81c424d125d494
MD5 6581723df7f8c0faf90a7f62e8f44516
SHA1 3ee9376e144d4d35dc6f5765de599e741734d7f3
SHA512 dae4fdb93f5cc287a1026ae8e64ed8595af959f9b5913d1fb98366eba608ff22fc9278c1611e971d52c9d71d6b8b03f0eebe9debc8020df9b22f7206fa1bc28a
SSDEEP 192:D9WSOgH9M1KpzpIX58R9c9Q9i9+Zgm9i+vxyMSpkHi8isT:D9WSOgH9aeNIX58R9c9Q9i9+Zgm9i+vn
TLSH
T136D19CB3C7E4C69EC81726F05715AE2ACE5D151842283C2ACDD9DF4FA3E2472E54478E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0f3ce82e53dddd07572ec9ea95b08caf7e5cc6bc991dcb3d64b2fcac88d10aa8
MD5 427f7e0a79abac48a6ce448c27f4e9cb
SHA1 45ae1587e9fbf2753d216023c102135c944e53e5
SHA512 4bdfecbc4968242d1c61c3bdaeffa02a70830ba3faa7634b041bb19c00eac8735a07b120d9d7367f16ab3c31ee3de96d697f28b2cdbdac6847c4599a06e1e652
SSDEEP 48:K0Q/26gK+/b2NWISS/K9u10/xIvY1mOUyLL5LILVLpLzL3LLLkbL3LSLPISLBLkH:KgHyKoUW6KgKPK88AKN6+h
TLSH
T11291241275BB036178BD6A4C506A9B1F825131B3321CE92B7FBD41B18E6EE145CFD8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

aacc207c-4911-4f7f-8204-07d30c36a8f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aacc207c-4911-4f7f-8204-07d30c36a8f9.tmp
Size 10KB
SHA256 f701c9bd42f3a88def3e881791f9087ffcd0e0b073ac78e3fd507c4431300232
MD5 f4088209a05a4697e6dbefaff0069564
SHA1 814686592cf6920536b2a5eee3c144262551445e
SHA512 8a2ed863a13ec84f4da15e243acdedc0162674c71b1a09b86a01a0de630ca71082556f7b3194c0b716e65d76e2bc0dbea9f5c2f8160da24f7c73d8255ab3abf1
SSDEEP 192:sxZrRjW2/fbsprfkIdpCnWffYcHW6+WN34EUVa/YgNluIg5X7cJ:sxZrI2/fbspJCWHRHb3z3/UV8
TLSH
T15932A7526D3869BB8CCAD21EBE55BF53E2F9643195901E4CAAFCC61C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8782ae9-2a51-4bf3-addf-a62d389468a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8782ae9-2a51-4bf3-addf-a62d389468a9.tmp
Size 10KB
SHA256 e0bd7506cda4cf6114541dec667659b367bc6b5063e5f217346d04cc523d9c0d
MD5 e10c3c5e271ce5e03a07560bf028981a
SHA1 8447612ced2070916d889a5e1dd9931931a43b0d
SHA512 e6d16927d5fc722205f878051766231aa38eb5cbc589bfc07b9717d0c8e32adb42d440b8f27e0f32459d555c31c333ef2110b037bf593f4d67060a6c53467f30
SSDEEP 192:sxZrRjW2/fbsprfkIdpYnWffYcHW6+WN34EUVa/YgHluIg5X7cJ:sxZrI2/fbspJYWHRHb3z3/CV8
TLSH
T1C732B7526D3869BB8CCAD20EBE55BF53E2F9613195911E4CAAFCC61C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

effd2fb3-76f3-43c3-b6c5-3bcd864e91fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\effd2fb3-76f3-43c3-b6c5-3bcd864e91fc.tmp
Size 27KB
SHA256 eb0d1ff0a96b2a864603a34c42021828c92f5245bf70e95613813a30f22225e7
MD5 00a6e3bd8e53e7630389542500222f7f
SHA1 b10c446e515ca29a4b7a65bd7c6031df407acc9c
SHA512 1b9bc93455b0be8f193796d3c433b21583d5b94473620cb814c71cc4b005b77ab8b8b86cae7e17bded3639b39d31f19fd834e0479a0ab4a728ead685c5c33624
SSDEEP 768:yXichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzpro+qG:yXichfPWvPZhlu1jan+LKgzCVG
TLSH
T13DC2FA7B640CCB7E4FC01A5DDD166FDA7E9802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e47dab4d-e35e-4f4e-bb0d-3543fc7ee0e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e47dab4d-e35e-4f4e-bb0d-3543fc7ee0e3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a05fdfcd-f0ef-48e3-9701-c0801d1802e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a05fdfcd-f0ef-48e3-9701-c0801d1802e1.tmp
Size 8KB
SHA256 2d9882d06d7a61ea5641283fb8439798d4d93849eeb9cd55ac192f932c5c0241
MD5 1a454e969ae62c3074171a886e744687
SHA1 f7cc5bb3bd12282f1223dc888add6eefacadb4a1
SHA512 8f21c91a7ec98b80f9059c41253ba9cd97c7b0c1f77d89549030fbec7c6b9f9d775cc869898061e4b494fe28e560c7789b5aac460cc295a24a13132b7f42ae3e
SSDEEP 192:LJON/6DphzqQmiUyW+NwGYX59eziC8px2F++2ekIIxq5NU6:lON/61weNwGYX5E78pxa++23iU6
TLSH
T1DE12F936E878BC3B4DE3A591F48736139EA55227EB84BF94D5DC1B1C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8fc361d-419c-4368-b8cf-dc5b0887d347.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c8fc361d-419c-4368-b8cf-dc5b0887d347.tmp
Size 18KB
SHA256 db162dc4a7dfa9dd6858fea309dfc9cfd17fa1a86bb677e9d0b2e1523cffaf01
MD5 cdcb197b3c065d877ef1f09d8ad585eb
SHA1 97a4f101b77d2dc6e2271f5e9c0eefe1e03e4243
SHA512 c362c9c91af65c5286ee19ca0c676be5c4e63080ca98aa9a9a58370974915cf08c0ce632fb4f4920eafc29e4d78ec525511c6266c4f12e99aa59fc55a186c15b
SSDEEP 384:mZcIhsNOGVJh5nwPBGYX5E78pxa++2bitgOIwZOyQLQioK:0hYnCZGYu7WjlbiXsvbp
TLSH
T17F827E329CB8AC7B1CEBA181F48736034FB89527E7C8AF9495ED5B1D01DA698130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e1937ff-0555-4401-9151-bf43ddf584f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7e1937ff-0555-4401-9151-bf43ddf584f3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f8dda20a-73bf-49ce-83fd-177cb88a3c3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f8dda20a-73bf-49ce-83fd-177cb88a3c3a.tmp
Size 18KB
SHA256 f132082a01d6fe8d2f7fdcda8e357a1c64c2fc8f49ecb02addd7b79af1502d04
MD5 832f87abb1071611fed7c6161d138736
SHA1 948d089067f56748ab9bb2c3f128d3507a6d94d0
SHA512 5090e3273032f523547c8f5f6df747816dc87db9c0b20325d8ee607af9be13f9b1b43ba7b736ba12be7ef6e042cd3bea20d8b9fe4c597cd05f8cf8d66feecbf9
SSDEEP 384:pZcIhsNObVJh5nwPBGYX5E78pxa++2bitgOIwZOyQLQioK:hhDnCZGYu7WjlbiXsvbp
TLSH
T1C3828E329CB8AC771CEBA181F48736034FF89527E7C8AF9495ED5B1D01DA698130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 28f336bc96d12a959d8e091fd78d95a14f8276678eaa590439f15bf6386636d5
MD5 f272de96e840c5e198a22b91a09a8c28
SHA1 7a8c525934fabde8816107039740539cb0eaeff6
SHA512 bd004a60ff6ead76956bf19997eaeb2ef459a889ce468eb1edfdee9f9aad4c0da22667ca5f332d872a9ed3f7cb14c4143175ffa7989637fa84e7e6fceba4b0e5
TLSH
T16441D45CAAF91148B3B36E5AABF6A86E487F78372F06D59D00110E4F0A22A44C861733
MD5 SHA1 SHA512 TLSH

Submit Download