e381e181b2127db3efbf03fbda47aac20fecede6d2c12c5c466cf3bc34ff72ef

Analysis

max time kernel
900s
max time network
861s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
03/10/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample261003-sy5efa1frf
SHA256 e381e181b2127db3efbf03fbda47aac20fecede6d2c12c5c466cf3bc34ff72ef
MD5 2e19cad997309150a0d510dd5b426c71
SHA1 1f89767af340d315d3a5188184e8357814e65685
SHA512 dc6525c425cf453d6ad6aa4555f286e464ccd08df99b9435038715d104f8ce88760f2c9942b3c746c48536e8a9a3c62dc07cb560b1de8d009e90eda0274910fa
TLSH
T19251D8A2F069C11603B11942663A9245143CC807285CE1EEF69E9D45BFCCA4D8BB3EBC
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3718455638-2296795630-1576855121-1000\{A93B8AD4-B42C-4121-B7E0-C77E575DE1D1}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3718455638-2296795630-1576855121-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 4688	5008	msedge.exe	84
PID 5008 wrote to memory of 3692	5008	msedge.exe	85
PID 5008 wrote to memory of 2868	5008	msedge.exe	86
PID 5008 wrote to memory of 3692	5008	msedge.exe	85
PID 5008 wrote to memory of 3692	5008	msedge.exe	85
PID 5008 wrote to memory of 784	5008	msedge.exe	87
PID 5008 wrote to memory of 784	5008	msedge.exe	87
PID 5008 wrote to memory of 4212	5008	msedge.exe	89
PID 5008 wrote to memory of 4212	5008	msedge.exe	89
PID 5008 wrote to memory of 4212	5008	msedge.exe	89
PID 5008 wrote to memory of 3964	5008	msedge.exe	90
PID 5008 wrote to memory of 3964	5008	msedge.exe	90
PID 5008 wrote to memory of 3964	5008	msedge.exe	90
PID 5008 wrote to memory of 3588	5008	msedge.exe	91
PID 5008 wrote to memory of 2128	5008	msedge.exe	92
PID 5008 wrote to memory of 3588	5008	msedge.exe	91
PID 5008 wrote to memory of 3588	5008	msedge.exe	91
PID 5008 wrote to memory of 2128	5008	msedge.exe	92
PID 5008 wrote to memory of 2128	5008	msedge.exe	92
PID 5008 wrote to memory of 3216	5008	msedge.exe	96
PID 5008 wrote to memory of 932	5008	msedge.exe	97
PID 5008 wrote to memory of 3216	5008	msedge.exe	96
PID 5008 wrote to memory of 932	5008	msedge.exe	97
PID 5008 wrote to memory of 780	5008	msedge.exe	99
PID 5008 wrote to memory of 2756	5008	msedge.exe	108
PID 5008 wrote to memory of 1472	5008	msedge.exe	109
PID 5008 wrote to memory of 2780	5008	msedge.exe	110
PID 5008 wrote to memory of 2780	5008	msedge.exe	111
PID 5008 wrote to memory of 2780	5008	msedge.exe	111
PID 5008 wrote to memory of 3808	5008	msedge.exe	112
PID 5008 wrote to memory of 2320	5008	msedge.exe	113
PID 5008 wrote to memory of 2320	5008	msedge.exe	113
PID 5008 wrote to memory of 1444	5008	msedge.exe	114
PID 5008 wrote to memory of 1444	5008	msedge.exe	114
PID 5008 wrote to memory of 4880	5008	msedge.exe	115
PID 5008 wrote to memory of 4880	5008	msedge.exe	115
PID 5008 wrote to memory of 380	5008	msedge.exe	116
PID 5008 wrote to memory of 380	5008	msedge.exe	116
PID 5008 wrote to memory of 320	5008	msedge.exe	121
PID 5008 wrote to memory of 320	5008	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ff9dd4ec188,0x7ff9dd4ec194,0x7ff9dd4ec1a0
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,8969840476719402624,17234094953643493561,262144 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,16006676112419608660,18404625346421578738,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,551947920802835126,5909638334967364004,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=2004 /prefetch:8
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,9221949468163942981,7792401960392320275,2097152 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,17879056425508510243,11662877020268816068,2097152 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,9891719499940418543,13105484808442124343,2097152 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,10391149433405520503,9094459346202348838,2097152 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:2
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3428,i,6209750417700314574,8021540642941851553,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,4276342065340286710,11193552467473362080,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9306261267887585028,10479718258077112243,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9306261267887585028,10479718258077112243,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,15091460773701515806,9020231276484738345,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,17472242283879587998,5411039809499907626,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,5303077556089998162,12335437938641594240,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,8279917892355825000,5516793336045946454,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,9616134611306002185,17859404107242134438,262144 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,17773023180762030320,3262839040919066540,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:8
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,794219319906501665,14252042294509297089,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,7325661648228737982,11474663750860200597,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9000310133789605265,4668737621230627328,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5508,i,8131457030703051234,1048310695053688962,524288 --field-trial-handle=2340,i,6713426066464834102,6823748987231897421,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:320

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0d26b6a5-b4e8-4aee-bfbc-4e08d185cc2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0d26b6a5-b4e8-4aee-bfbc-4e08d185cc2b.tmp
Size 8KB
SHA256 f8d3a82a63d457cd7e7a5fd608f72888982d07b1cd7c4eb4fb89a8cdb5f13f97
MD5 c55e3e114c510cd9c3f581e39ee26315
SHA1 f2cd21fee7f0b2ae889b5545a18747ef96cd479c
SHA512 7820ccf50cae8c2f36a4fb090b7059c66422385283dfd99f7cdba59f4410cc8ca34254eee5bb09e9ee67d356cc3c8304fcce7501c52a8e10febaad2850880564
SSDEEP 192:vONl6ILeXQmiUy8EGsW04Wys/1fLnoFSL3u34NIrqFU6:vONl6yQbhsW04WystreS7upuU6
TLSH
T169121B32AC79BC6B4EE3A591F48336239DA49227E7897F44D5DC661C01EF29C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4748b68b-3ca0-4d08-b3a8-5e6c8c6d9212.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4748b68b-3ca0-4d08-b3a8-5e6c8c6d9212.tmp
Size 8KB
SHA256 a51acc334f2c49ddc9bb3caab1f782e14fbe013b9b2e8d3d406206695c12a947
MD5 1c03d990ff6b788650e87dcd0047f3f6
SHA1 f7adf65affa5da0910c9576c343ff192fb7e22aa
SHA512 a363816d10352c38777b85ec5685fa152cea47b1a1e4dc70a155ed96ae98334d02c79a5b2e6c308a5a470fbbfd3d2a180f6217e327653ab88cb37e3a2f8375e3
SSDEEP 192:vONL6ILecQmiUyMGvW04Wys/1fLnoFV57AC+U6:vONL6yFqvW04WystreDV+U6
TLSH
T1EC02FA35AC7D7CBB8EF3AE45F4873B179E98113BA6852F44D9E85A1C00D768C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c19a781-2701-4eef-8703-960b2a60ffa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7c19a781-2701-4eef-8703-960b2a60ffa2.tmp
Size 18KB
SHA256 a4e6f3adcf21b30bc3d5ba7173179fef73e16279db0a43fd0b5b657cc5bc454e
MD5 58eef045d358b4faf831ad6d52833e23
SHA1 e3047eb990b8210a723054c4a3e00419f3a868a2
SHA512 1cbf3ede46235baafa14c97fd9501f51c40686d6b9b7525793d703776168bda3362a8855600c28dde49804164232e624b738c19ec66d9805c3583289aa43acf8
SSDEEP 384:7ZcIhsNUkpAm3qnWue8P04WystreS7ututgOIwZOyNopot:jhvm6s2WLrN0uXsrpe
TLSH
T18E827C325C786CBA5DF7E085F5873613DEB8D427A7C86F44D8EDA71D00EA2A8030B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f4108d2-df86-49dc-ac34-dbd0b0e35fb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f4108d2-df86-49dc-ac34-dbd0b0e35fb8.tmp
Size 18KB
SHA256 42985644f0c9b595c8e27b53ae86f4b42f2de7f5cd05ae69e377c42ae43f4c8a
MD5 b6e5b287762cad081d3cc34826d543fc
SHA1 e9313284124827a15659a06e514f049f4efbd5bc
SHA512 9eda802e6cef7cae9d62bb2f3aea3f052e19a3caceef18921072b5e714ff52c98c98928462ff172809af0022b8ef0f6258349a35913da2fc020f53f42968183a
SSDEEP 384:uZcIhsNUk+Am3qnWue8P04WystreS7ututgOIwZOyNopot:Mh0m6s2WLrN0uXsrpe
TLSH
T1B9827C325C786CBA5EF7E185E58736138EB8D527A7C4AB44D8DDA71D00EA2A8030BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9692be7d7c6b78a8cd27fd9e180eab5d1f3f22f3430c97460cb81b853a522808
MD5 4522af4692072a79d01f3192c32a6d08
SHA1 265b2ec9455a5be2603ff3c8413ee124af2ce2f3
SHA512 45fe6e7e9c064c9331789088de4c1ac88902cb8cfcc1d61c6b8333b8521ef520d682ffe13777047f7bfc7837ce5b12b79ad9738fe80040896ec4174801c56025
TLSH
T146D022CBF3003000C823303220FF832C0228CC80C80202082CACE000ECC0C0A0C02C80
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 315546ce9f3739235b00f541c159123c6673c446aab663ed151c37804d669922
MD5 6f2b8a31cb0411a6103c6039f56ba673
SHA1 05bd26d3125bbe78717d7bf2b4f6a21ec0051545
SHA512 b0f3dd623911bf11ca8cc72914b727b6ba70fe8fd2c36ee9c91df03fc8fc2859ceaf841b063d69d6756aa7300c21cc65d64fb681bd1d31c5794e5fe0c14fff26
TLSH
T1E9D022CBF3003800CC23303220FF832C0228CC80C802030A2CACE000CCC2C8A0C02C80
MD5 SHA1 SHA512 TLSH

Submit Download

1bede3a7-c3cb-403a-8a59-38f2eef3e575.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1bede3a7-c3cb-403a-8a59-38f2eef3e575.tmp
Size 10KB
SHA256 ceb056ad7ba5109175893adb71ede8bc24380239bdc530d61dc6efa96c1d20b9
MD5 71145a1753118c8837767bde9ae6edee
SHA1 a07be9f64cda4cd7727e2a669f4ccb4db9c786fb
SHA512 531c639fc5b476f44424f8fe2a842582a97f7ad2b07be8579486fdb7668de77c038126e154a8f6e888ffd3a10e1e6f30d803096fb10cea1309bd8f7e6d320ce4
SSDEEP 192:sxZ6RvWp/fusuDNIdpHYHW6+WNGY/I2FIg5dJ:sxZ6Yp/fusuDu4HbGGF
TLSH
T15422D8526E38A97B8CC7E20DFB55BF13D6F5503291901E48AAFD861C09E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

349c3c2c-7934-4185-87ca-d4d2b845d751.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\349c3c2c-7934-4185-87ca-d4d2b845d751.tmp
Size 9KB
SHA256 e4d17c0a2c2a4e18841348d65348eef2377e5bca79a876f8f58da900cf0b1cce
MD5 8b5ff881b4a82c770af31239369acb62
SHA1 8eacb3ee69f5746eae3c1d6a0d7744825555a9dd
SHA512 197090b1769b2a7af77c2b05d8292508e6e6af36144dfe4d3a8d746f2a0306549bb3229716c489bb5cf628a171994e52b9d53f9362c83ed3317206cd6d935d2d
SSDEEP 192:sxZ6RvWp/fusFDNIdpdHHW6+WNGY/32FIg5/J:sxZ6Yp/fusFDu1HbGtT
TLSH
T1CE22D8126E38A57B8CC7E209FB55BF53D6F9503291941E48EAFD861C08E67CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42b57bad-6576-4ada-bc3a-b21a816d1a01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42b57bad-6576-4ada-bc3a-b21a816d1a01.tmp
Size 9KB
SHA256 9b7777efdc16b8864eebf7228e6f05a8a3b51cac77c1eabb65101429c21ea42e
MD5 348af45290085271af59da0bf10aa8fc
SHA1 9f6fb3864eecb2797d53ba4e881c99f45a6922bd
SHA512 6fcad3b38b4dcab8c8ea5b8505a52f8fbfb38af8b910d6aa31b6fe89051c99db33bad43887c574222d1f0f9ae122f387cb92749d2dc2967454c2bae4520d8c00
SSDEEP 192:sxZ6RvWp/fuswDNIdpdDHW6+WNGY/32FIgrJ:sxZ6Yp/fuswDutHbGt9
TLSH
T1D512D9126E38A57B8CC7E20DBB55BF53D6F9503291D51E58EAFD861C08E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

913fa3d0-136a-48f5-aa76-b79dc0e9bdd9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\913fa3d0-136a-48f5-aa76-b79dc0e9bdd9.tmp
Size 10KB
SHA256 5de79b7ea177415008d13d650494dc40f3035c0b26a92b85e3e2205ae1c3432f
MD5 388b8a0dbac98f2633d7c18083f1ce77
SHA1 6a68ac9e21fe3e8183fbbde2d5aa90e9a19e675a
SHA512 9c31632ed497a8b1d59aa9f7d688d6a6658fb488d7df6488121e118c973d6b1e012bccd4ee196e27553c46ccec666155e71f64412c707a879b92b4928a44e8e0
SSDEEP 192:sxZ6RvWp/fusuDNIdpdlHW6+WNGY/c2FIg5dJ:sxZ6Yp/fusuDubHbGSF
TLSH
T1EA22C9526E38A97B8CC7E209BB55BF53D6F9503291911E48A6FD861C09E77CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 40b80eda34570b57ebfe05f9f2a152ac7dfd7078ea816f5b6a12fb9b6863ef52
MD5 7761a6b3cd9585a977cfea5bc68ad0e6
SHA1 e39264212667795491ce01b50ffdd42633419e51
SHA512 27783262f1f375c967b30490275ad36e861d7c005974337e3f063030b9767f0bb4f98f0315a8243a2380a300ee17316dd3dd1a8b6512d615abcfc431b393785d
TLSH
T1FDE026E52ACAC62EA308A68703EC670C93C0361AE3C0AD0E1B40CD867405084E6A27A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 6b9fb4629ca1583f2f7af4cc35ff7755044a3fa5a9a1ac1e77baa26d052e689f
MD5 6e3115f630f3ce0ebcaa10a4fc1d37fd
SHA1 d4fd191a918a1b29d04e7a5ffc5d609b7f2340d8
SHA512 96186d8a17b90b25302b1858e66737686afe8c651637127020cd00dcfcaa9e44dd5b9559823c0be391d1170f12cc8ebf3bb3e351e10581ba59a94fe275811336
TLSH
T112E026E826CAC22EB2187787026C678CD3C0365A92C0AD0E2B64C584744D065E2A3AB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 2d6f340fda8a803a942c982219b0f1ad1a550f5fbc41d42bee7c0f54b6f2608c
MD5 2af720b4b579bd1ef344f2e5a233f4f2
SHA1 3afcd00c27c1dc7ef311a18c8e62d6666376e00e
SHA512 b8c0cd37ddabefe111668dc1578c85bc7973893b08cc4afc429257b6ae0441c706ff588b90a2a5cdc3943023bd3e8e33f35952cab1f17644d341aa4710c57dec
TLSH
T128E026F42FDAC22EF60864CB036C6B0C87C0361BA2C0BD8F1788C58876C6154F3A36A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 8c141d544462647f0f1cc639ce76b3da6adac5db61e6fca1d199da987bbbc893
MD5 486a29ab37bdf27c619e3934ef839cbc
SHA1 c4443cde74e25f85f3178065571e2cadaea6210d
SHA512 6cd2238f5c89c74eccc097eba9a5b2f3986b40563ac83776b8bdbeac3ceaea8f6f65b0e3cd8ce77a91f8e4ace637e7c0f7e53a034caf17a73e5bf1d2b1f83e36
TLSH
T16561628057486FB0D76C9374A1C6528B3634BDC614A30F9DAFADD538DF3AF984096188
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 70862f9f1a6a131d850432fdb7dea75bb2c4fcbe6eca0deb3468114092aee632
MD5 3f4892cb169c3eba12b9c01592c017ac
SHA1 89197e348e9ce6c0bc8197593bed2190a8661f95
SHA512 be44cee98391e2e796298b91e7da8c7c7ad85d4abe63a3cd2f38e2e0ed0c96d4ead85b1174e83cb2649f3d5d08a96eccb8806b39c9752bf4706dbb07939f0750
TLSH
T15261828007486FB0D76C9374A1C2428B3634BDC614A30F9DAFACC538DF3AF984096188
MD5 SHA1 SHA512 TLSH

Submit Download

d0295e54-c97b-42f6-879f-3c745ed5b395.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d0295e54-c97b-42f6-879f-3c745ed5b395.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ea78d0c-de9c-49ec-b4d1-fd8e711c4c08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1ea78d0c-de9c-49ec-b4d1-fd8e711c4c08.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

6971204a-9950-486a-8293-3913baaa4227.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6971204a-9950-486a-8293-3913baaa4227.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c1940157-83c7-4457-a79d-db1db3ff7e0c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c1940157-83c7-4457-a79d-db1db3ff7e0c.tmp
Size 966B
SHA256 b51233c6c80913221d4a587a48f7760455ff946800163fad6826063714ca7f1d
MD5 e0afd993b5893cc6988091726f389b82
SHA1 7a969e18b15728f82fc3b9b5092f92b2904337f0
SHA512 81d62ad8b2e96cdf628f86d365451db5ea54def78557eaa71f9133d4cdf8d6417b472d8a209ba9740f7cb5783ccc4d27342525efc2c2bc2919689e960cfb74e4
TLSH
T1CA11BDF387E195AEC91116F09A28EE2BCE2D0506421C7C2985D4FF27D3F3035E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

c2419594-c160-46fd-b069-e12eb1e125e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c2419594-c160-46fd-b069-e12eb1e125e0.tmp
Size 949B
SHA256 3606cfee959d515727db9e45a23a7c85a59bbf6f8e9f68d738d725fb0a7466d3
MD5 b0e9524b4f02cf74fdb61e945d221a1f
SHA1 1949f58da8e4e15d81211f7f6f1ecb20f9558c41
SHA512 f502a7a3676f6f58b022ed8ab78032f12b6f7a8778426d8590dec7778250c6e9781e2512a533b279c53c34dc5772789a989a936cfdb4f512e6f7a0bfddad927d
TLSH
T1F711BDB3C3E5C5AE890156F05A24AE2BCE1C0506421C7D19C9D4EF67D3F3479E10159B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e4d1be98-2d51-4ef0-a4c8-b976750dffbd\index-dir\temp-index
Size 528B
SHA256 56cf8424867f411e27859f63512a402ade907e2aa81869e66ff0bdbc29e457bb
MD5 00cac92e3180bc9bf6c70f40e3860894
SHA1 619c5b9044336cc0406c2285e3792b29a46ae892
SHA512 2d0eb30e8a5968eeded74ff8a51b8801654c4582189e6e997590ae6f7a2e69db11f52cded88c9e4dd39d3e1605a6a317464d6ca83ad9b04ed39412f2d79f770c
TLSH
T141F0F14B0E131A0BEC20117238397191523410DCE3445A1BA0FC905ACCC27C4DD8014C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e4d1be98-2d51-4ef0-a4c8-b976750dffbd\index-dir\the-real-index
Size 528B
SHA256 5fc87e54dd173a20aee3bfba84817a927a39c5091297af2ea63280b980db71d7
MD5 550d7d2dcac8e3305691434d39d9f686
SHA1 beec51842a1565006299612a5a619e4abdddf268
SHA512 1f88fcfad94819ccf6d581a9b83960580f283cf19dd6bfa9ecd7c982741bb630b1de830e21c991b43a789d83c60217d993b0be7219635e98e10d57c1084b044f
TLSH
T1E3F0C09C02239785FC0412B2783977A562752404A358AB4FE1E6945ACCC0BD4EE826ED
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 b96e1ec3041e63ecbbcead828c7f9516ff07d070bf8ceba43a50f125107ab637
MD5 20e49a886a38857a1c8d5b09be8e3045
SHA1 acfba561369abcab403bae7a2b9eb626f4fa97b6
SHA512 ad46cb7bda4b456db7c96c37d7bb05c9fb4095974b8e645e1269363953fb1091a0b98acb73e312fc1fc453cc23f1ab9adeb79da59bd85739d3802f4bfd3ce76a
TLSH
T1D9E068B71CAB0810EEEFCBC42031109800983D508586ACCF101AC7D711B1351784EC73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2052dedad69ef857314fa05fcbd1c648915b0f218dac8d567b570817591b5e9e
MD5 fdddf4b022a64d4836a2d33450e8be69
SHA1 05b0053f8b809434a74253e0d09eee60d38ff652
SHA512 1d9ae169d2582f9ac81bec3ae4a53449d5b43b5cb03189112d1df16d18bc6984d92209d3342af6f16c07d53330f75f3e123d6e02c772d492bedf27e41d210323
SSDEEP 48:K+zivjZtRkhtYPIY7kKXBPxkrD0y4ZD5y1FI1K+Qo/yBkIXKR+c7yfG/IlKY0oQT:KUsYKxy6mFSK+QKCkYKR+q9/CKY0rT
TLSH
T192C1201171FA0341387E290881BA8B5F865232E33178EA6F7FBD4452CD66E485EFC9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd2cef23-b4b4-4bfc-ab17-ddf49f263676.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd2cef23-b4b4-4bfc-ab17-ddf49f263676.tmp
Size 27KB
SHA256 0afc7c83cbc641afd214df2493d07226610e79cf1cdad9c965a49ad2255fca3d
MD5 c05102645aeb5254041ea0c90e0f9f1b
SHA1 46621e25f23b103d2f3a17597c075a29f8b85d07
SHA512 6c9e3423b74ef35cb87249de7396f9e483d4bc2da74c4daf7c16f31da87441bbb03285bc2050354f9941bfc7ada4e376362247f44dea21346ba87e3816b7dcaf
SSDEEP 768:cqmtKXIWvEgCc8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3Llztc7jromS5:cqmtKXIWvEgCcu1jas3L9O7Qt
TLSH
T1FCC2EA3B640CCB7E4FC01A9DDD5A6F9B6EA802C776588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65ed82f9-f10e-4eac-bd0e-a07da30b5a9b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65ed82f9-f10e-4eac-bd0e-a07da30b5a9b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b289d958-580a-4205-98a8-61011e81f3e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b289d958-580a-4205-98a8-61011e81f3e5.tmp
Size 21KB
SHA256 f29a69c36176c03b46be82e9308777d6afbbdb97f642e2006c1a52796fc93815
MD5 d30fb5f0afba5288d507a420fa442a61
SHA1 855294f8bd5b996d54e64c309a46412293f30206
SHA512 a8974f975cf5f197421a60710453dce3d302fe172ae0cd77341e04122e76a4c6b815cab6e16fce3e2a89dc7998129d3476e3254a9f802fc1568c97982a36f2c2
SSDEEP 384:LiFiZcIczsNc8TUNTUlIlkpAm3qnWue8P04WystreS7uLutgOIwZOyNopot:mFQgxwgZm6s2WLrNYuXsrpe
TLSH
T186A26C334CB8987F9EFBAA85F58B3213CEB48067D6C5AA54E6DD961D00AB1DC130BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2110634-2bb0-497a-b43c-132d1614dde9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b2110634-2bb0-497a-b43c-132d1614dde9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 092abe454287e012f2c4fe5b2f74eea8216d32cd3ddc8d2ebf05d1a7694898b3
MD5 5e1ee76d86676521850eeef9415c07b0
SHA1 3b0c92f6ac1e2452098bc7ec9148161e8b0baab2
SHA512 aa6ccd1dd44a53a261b89584952361655ad941f97b974335884ee523f2714a6afdf526bd40ab10f519a46206a16583e69b5f3b21991a06ef0c490213ced99781
TLSH
T11E410758B6E91148B7B76F5A9BF2986E487B7D372E06D45E10010E4F0623F40CCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download