hxxp://xn[.]mckunst[.]com

Analysis

user interaction
yes
max time kernel
1079s
max time network
737s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://xn.mckunst.com
Sample261009-3mve7sf14s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2920	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{37433BC0-D638-4324-B7F5-A5F208FC916D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 1068	2460	msedge.exe	87
PID 2460 wrote to memory of 2920	2460	msedge.exe	89
PID 2460 wrote to memory of 1684	2460	msedge.exe	90
PID 2460 wrote to memory of 1684	2460	msedge.exe	90
PID 2460 wrote to memory of 1684	2460	msedge.exe	90
PID 2460 wrote to memory of 2240	2460	msedge.exe	91
PID 2460 wrote to memory of 2240	2460	msedge.exe	91
PID 2460 wrote to memory of 736	2460	msedge.exe	92
PID 2460 wrote to memory of 736	2460	msedge.exe	92
PID 2460 wrote to memory of 4852	2460	msedge.exe	93
PID 2460 wrote to memory of 736	2460	msedge.exe	92
PID 2460 wrote to memory of 4852	2460	msedge.exe	93
PID 2460 wrote to memory of 4852	2460	msedge.exe	93
PID 2460 wrote to memory of 2948	2460	msedge.exe	95
PID 2460 wrote to memory of 1140	2460	msedge.exe	94
PID 2460 wrote to memory of 2948	2460	msedge.exe	95
PID 2460 wrote to memory of 2948	2460	msedge.exe	95
PID 2460 wrote to memory of 1140	2460	msedge.exe	94
PID 2460 wrote to memory of 1140	2460	msedge.exe	94
PID 2460 wrote to memory of 1604	2460	msedge.exe	98
PID 2460 wrote to memory of 1604	2460	msedge.exe	98
PID 2460 wrote to memory of 1604	2460	msedge.exe	98
PID 2460 wrote to memory of 4268	2460	msedge.exe	101
PID 2460 wrote to memory of 4784	2460	msedge.exe	102
PID 2460 wrote to memory of 4268	2460	msedge.exe	101
PID 2460 wrote to memory of 4784	2460	msedge.exe	102
PID 2460 wrote to memory of 3736	2460	msedge.exe	106
PID 2460 wrote to memory of 3052	2460	msedge.exe	113
PID 2460 wrote to memory of 3052	2460	msedge.exe	113
PID 2460 wrote to memory of 4764	2460	msedge.exe	118
PID 2460 wrote to memory of 4556	2460	msedge.exe	119
PID 2460 wrote to memory of 2272	2460	msedge.exe	120
PID 2460 wrote to memory of 4020	2460	msedge.exe	122
PID 2460 wrote to memory of 4020	2460	msedge.exe	122
PID 2460 wrote to memory of 3308	2460	msedge.exe	124
PID 2460 wrote to memory of 3308	2460	msedge.exe	124
PID 2460 wrote to memory of 3452	2460	msedge.exe	125
PID 2460 wrote to memory of 3452	2460	msedge.exe	125
PID 2460 wrote to memory of 4052	2460	msedge.exe	130
PID 2460 wrote to memory of 4052	2460	msedge.exe	130
PID 2460 wrote to memory of 3292	2460	msedge.exe	132
PID 2460 wrote to memory of 1988	2460	msedge.exe	133
PID 2460 wrote to memory of 1988	2460	msedge.exe	133
PID 2460 wrote to memory of 3288	2460	msedge.exe	134
PID 2460 wrote to memory of 3288	2460	msedge.exe	134
PID 2460 wrote to memory of 1956	2460	msedge.exe	135
PID 2460 wrote to memory of 1956	2460	msedge.exe	135
PID 2460 wrote to memory of 2520	2460	msedge.exe	136
PID 2460 wrote to memory of 2520	2460	msedge.exe	136
PID 2460 wrote to memory of 3976	2460	msedge.exe	145
PID 2460 wrote to memory of 3976	2460	msedge.exe	145

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://xn.mckunst.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd65d8c188,0x7ffd65d8c194,0x7ffd65d8c1a0
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13787638531595625545,2748633820747301636,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,2966466785823904586,6747406860316838201,262144 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,425961060123905257,1628985631867055026,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,11328013600992444100,10753882705541208340,2097152 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16863043355005857863,1980189511689399928,2097152 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,17737831870716951268,6892173564692788456,2097152 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,17010836860272310612,143076595672150074,2097152 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,16087011194796397698,4266907226087792062,2097152 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,16155626580361217081,9754390759814629786,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,13125776539193592251,10809720597787239248,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18071750079622955048,10418198994145271399,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,18071750079622955048,10418198994145271399,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,7028965449911156435,4347294473257490826,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4884659117696091298,11309630263363709944,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,16107199052717246862,14637542063743845152,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,5034431229144391601,3254188930883058234,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,5055713025407455602,13488597703180686659,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,16731467131978016049,3034016385811525094,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,6001503224742736480,17572832624652574226,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,8708830272988185121,6933561492967051899,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6808,i,342253817645270695,11317407219604069301,262144 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,4202229966231871303,6557498948275100465,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6624,i,7019491318071371121,18270094035167000918,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,17997038951884260077,2546298497982805312,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,8560209836071359667,6438419304298590533,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=3976 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,17375631390654216511,13641773854283848048,524288 --field-trial-handle=2884,i,6451329493608865297,14556189582470108115,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2f9ad1f9-3c82-4c94-bfc7-ce18842ddec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f9ad1f9-3c82-4c94-bfc7-ce18842ddec5.tmp
Size 18KB
SHA256 9080a094004514e776aa814ac627bbacfc4c3b25d788ef6ae48caff19145ba64
MD5 a2c6be29f87612ebdbe15ae7c704c410
SHA1 0fdde9646d7a7613618642ea629167ff8bdcc3b4
SHA512 1edc77abe4372ca76b5038f1f29c13932c1ff1553a5c9dcc2348108b4f10725df9759704c23c9e27f3a9b4aa0395a0d63ee692795c3aa7f9e4add6bbc43f3d58
SSDEEP 192:u+zm+xasuheOwQxMGsNThQIwEpphvHUERQmiU1XCKw4BGYX59ezlCwmIqvzkH1F+:kZcIhsNThWU57vhJ/BGYX5EE6qvgC+Gh
TLSH
T1F9827C716C78AC3B5AE6A041F48B3A038FF8E127E7C97F9495ED571D01DA2D8230691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a07349e-a74c-4dd7-b35f-05156ae2712c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a07349e-a74c-4dd7-b35f-05156ae2712c.tmp
Size 8KB
SHA256 f9e0e6f9a8ac322da21c78a5e82b66aeb399b1799501a0cd3cead9e3d81f863e
MD5 1d33ec961c24ea80f25e86d558b29f6f
SHA1 3626b68163586e1970695ef223bf05d00f3a802d
SHA512 274652688c88158b0f8884aa296a4faa48680c8e8ae96014f1dbbdf63112a393a036e3943aa06a9846e3bbc7ccd99cc1f5f01ad1dd3c1801b29c52ef02beb465
SSDEEP 192:LJONi6DphmqQmiUy1Eq8wGYX59ezlCwm0kk78gU6:lONi619ZRwGYX5EEw9U6
TLSH
T1A102E935AC797CBB4DE3AE45B5872B139FD8112BAA916F84D6E81A1C01C768C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ffbb005-a22a-4297-9ab8-8af39f2883b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6ffbb005-a22a-4297-9ab8-8af39f2883b8.tmp
Size 25KB
SHA256 1a7f0ced76b582ae495bd435421e5e9775d4730aa97ffaca363c2ccbc3842862
MD5 5384e4911c3eac6d93363f70299a5714
SHA1 8c00666ada7ae2dfbefe4913870ed09c9619ec9d
SHA512 fa200c15bd7715c07f5501d930b4c210bd08e48dae4e119c9f389683617cfb0f38f7268bda27d00e332bf9baf523abf2389ec54799246e9081dc0a652ea50a6b
SSDEEP 384:AiFiZcIQzsNt8TUNTUlIlhWU57vhW/BGYX5EE6qvKC+Gh:bFQMQwgpWJGYuE6EKCj
TLSH
T1E6C22AF248E7953AD9AE9743E77E2D024EBCD027B684AA54B3C8050CCC961FFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08613e24-49a1-43db-8636-ffb1da4c1718.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\08613e24-49a1-43db-8636-ffb1da4c1718.tmp
Size 105KB
SHA256 3f461bb307501118465fa355b5c41e2a705f236a6f0a9d6da2f7ec220831c703
MD5 b128b9eab72c965083b92d5147aa016b
SHA1 50e10f3f576f2ffa690298c3261891f992813335
SHA512 c7356be074c8c4dac39c2b53fc3c679e844ec686a16cf50df2caffd578fd4ff9775661084c859882e8c383687ff10fc72b9c4d7784ae1707436f3dee76196979
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T193B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27f6aa5d39c98b4843eaed7972cf93d10e75e08f497afafa54ccf4057f6d52c9
MD5 a91eafa1aeb7b35d5c7abac6d2c83384
SHA1 a76b97105496dbfe28857282f5b661789a032b25
SHA512 4bebba8a121156a8e7e31bb49955c0375f1ca3be7dcd3c9b113d261a4618ecdf6781fce438d8e56020e438286e1619d3844f48e91b2b2c3cbb4a55d4c199972a
TLSH
T17AD02B24C9E41E90D0131434002241453F8CC03858023012D0B812AE15419D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e364ae2365b95ee5142a1a0abe3ee5065b85c554bc5cb9fcb1f31bcd0a1af4e
MD5 75bc6f9debcf49d2312740dfba56733a
SHA1 af0f5dfe4b330cf62c24c0003f6c57159b23e268
SHA512 c0a6cf9272c224460d1e7d25cf8159aa43733ebfb5f2761293ec6a5f2b4d71e061daa60092335856322f566a072c79184d7ad45d2b04b7cf8f3628e3a4bd4d35
TLSH
T176D02B2489E41E90D4131434002141453F8CC03858027113D0B812AE05429D60A21020
MD5 SHA1 SHA512 TLSH

Submit Download

43edf81c-6de9-4031-881c-1a36b0cc6665.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43edf81c-6de9-4031-881c-1a36b0cc6665.tmp
Size 27KB
SHA256 6e238234843e931ae4398a4defabc4dca9f7fdcd0d66bfcb2c48cee292e80bd5
MD5 211dd45186a6f52a3da6db9cbaea6ee4
SHA1 57a6f92edfd49d931237b64056e9065d23694d7e
SHA512 1e446bd00d1f6a44d5ba383934c66257d4e687da02762d0fc4c4e3c9cc94a177765f874382ee9210b9881a3a95a304993cb440702828eee568b8e3c2c94cf965
SSDEEP 768:wxichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzTro5nq:wxichfPWvPZplu1jan+LKgzgtq
TLSH
T100C2E93B640CCB7E4FC01E9DDD5A6F9A7E9802C7A6588D4047FA984C02C77EE61264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53196d6b-49c6-4681-9a2e-ccd29a7d26f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53196d6b-49c6-4681-9a2e-ccd29a7d26f6.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53a66541-e170-457b-8afc-2ce6bb15cc38.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\53a66541-e170-457b-8afc-2ce6bb15cc38.tmp
Size 10KB
SHA256 f06f1fd4d4cdcf927134c7973a80ceee2a014974f4350608711ccfb8a1a916c0
MD5 7ab6c0a5961273a6d94b14727ed1c07b
SHA1 4160eb1b104df15256af6da94c70116022e12b3c
SHA512 2a30ae9bf219947586cca637b3d11bd30f86e0f151211a55f12ddd4a0ed0c99801a52c6995578d20deda5b0344fd0a6c9bfb580a59930ed86df04ae88a605860
SSDEEP 192:sxZwRYnO/fTsRMTIdpbxHW6+WNyrwXYgJWdIg5MJ:sxZwYO/fTsRMMVHbFXmW
TLSH
T1CF32B6566D346A7B8CC7D20DBB56BF53E6F95032A1901E48AAFC871C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57c7d1c9-d2aa-4de2-9f13-1fecb8cc993b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\57c7d1c9-d2aa-4de2-9f13-1fecb8cc993b.tmp
Size 10KB
SHA256 fb9ca0842a3ae330ff0f38224ec898c6d84050db9f8affb08a61ba4468bc9e10
MD5 bfb6b92ba5558f918d56472f96a2c432
SHA1 ac46ecaa26ba11712fa7aece09d6b1eccf898ff1
SHA512 59fd68b15624a6b5c8c01aa09bf911fe0f3c01b2db3f5766dcb6324e6ab238c75b5e7285b0100e3ab30f8f9b948d42e3bc3dcb43d882b26a8a94c18887c65d46
SSDEEP 192:sxZwRYnO/fTsRMQIdpbuHW6+WNyUtdYg8WdIg5MJ:sxZwYO/fTsRMxaHbfdbW
TLSH
T1CE32B7566D34AA7B9CC7D20DBA56BF53E2F9503261911E48AAFC871C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d1e71e7-9f67-4737-a760-d5754f400259.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d1e71e7-9f67-4737-a760-d5754f400259.tmp
Size 10KB
SHA256 24917c1517744141641bacbd26a1e13648ac09dcc062efa5cc2c47679527c633
MD5 7567a1c42721247e4d2de98ead015b77
SHA1 dc10080e76bfcefc3d4fda4a3db242a8d0417723
SHA512 400e14841d63ddaafee33a7ce480202f73d96b02327c278028190f49a0e797959e67095943a94a259f9d75402f552535294ae85927e807e46408208b80891318
SSDEEP 192:sxZwRYnO/fTsRMcIdpb5HW6+WNyEdHYg4WdIg5MJ:sxZwYO/fTsRMFlHbvHbW
TLSH
T17F32C7566D34AA7B8CC7D20DBA56BF53E2F9503261911E48AAFC871C04E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 fd30378ccd2a8b7fdf19d08aaeab60eaf9446cb519e1c4bc7284c9494e505cea
MD5 07c083b4420bb6fdbbbb25b3c01a4a3e
SHA1 8d01472b0080b252af9c7c2e5c3a7bac8c394f78
SHA512 62a95bf8e8ba3a6527c43bdc253bbc50520829d71fe18a6a61cdbe7bfff4be0b27c0309955f70f688d57afa65cb49bab6f8588713d433ab7766ac806ebfead90
TLSH
T193E026A426CAC33EF30864D741F8630C9B80275B92C0690E6B84C9C875C7A40F7E6EA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3f72cdc9d32b72871ff323fae0817ad0bd4e68467e91959e211794a4460172b2
MD5 ad4006230eb225fccb01756e791f8f65
SHA1 649f4bc6c7aa017fa2b84c267c4e8408aed05cee
SHA512 614776e9f01510ce90e59f815a949748788161e9120257f67a57478bd0f520d0e564a4531e8106cf1d13976e40ab958bfd95c95b512fb08c783bd97cb8ebd261
TLSH
T129E026A466EAC22EE318A457036C470DEF81269AD6C06D5E1750C5CCF845B44E282A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 64ed53833467cfe246c9ade5604f7f956b34fb3ac53131fb89311646b93f2d27
MD5 3f26af362ddb2b102b552e81d9563c3b
SHA1 809f6d017eb112a713946892565875008707cd31
SHA512 085efdc84fc4a2ade4b41fa37a4f672189e163128b7ee32d52a1f0247bcec7681b7b44312775c750b07185fa1bdb6b10abfcf761b6acd9d5b07cbb4f5aa9c509
TLSH
T1ADE026A529DAC22EE308A64B026C830CDB91376ADBC4F90E5750CDE8744AA44E383A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4f8e591cad612c66ea7a5f14edcc77f232945580603dd9324e1af7f98c4d9c5b
MD5 d7dcade036df3def817ef9440a2f7cc6
SHA1 d435f76ad734cfaff2f0d45e67296fcc6de5e30f
SHA512 bdaece2c796f79d9d94be134a2366a9f72a2e542a4f278bf75320c5350798c7c64eef04c67f99d28e343b75527e4d077f00aa47e45fa9c044ffdfc49607147c5
TLSH
T1CAE026A417E8C22EF3086747116D430C9B90275AD2C8AE8E1B64EEC87485E54E2C6ED0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4139968050a30573646d5fd6c439869384718a00ae06949d3b231c02294c41b1
MD5 08dc7ba03b897db67c8879e2f95c101a
SHA1 addee0534dfcae78b808659b34b6ff0316a36437
SHA512 81180fe49cccf079a9506d0ad54483352da77bed1d7b40a1815c013804dbced1a8a8826ea0dc5162a7fcf8b8487472d5b637370712161afe58465a9050d3b6c9
TLSH
T12CE026A817E8C23EE30AF84B5168430CDF88365F97D0690E2740CDCB7486A44F792E90
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 954a5f0d11d8de059ce4af28a92d676dfb275c910c9f8e32c654bc2451c3cba5
MD5 e50ac4978fa84e51181e941c8f8b97a7
SHA1 564f9671b960bd5f791175cbedf4f305c03538f9
SHA512 9fb9aad4ed2f584a5fcd50a6433da69a231216cc924bee73df2ed3bfe4024eb2fd5448e0a27f39007af757e50f2eed4534e6b5f98e826abc008608dd2400d220
TLSH
T1DE612C851A9150D4EBA44D30E5FA119F3F3988B255C3BD3211FBD1396B4B364DEF4050
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6932ad2d83180bd89e39a1c7dc8691a3f4c9a6d4925474afaef5dbcf7ee0f36c
MD5 69f8c43ec47c5d1e4f0ef470f88a252a
SHA1 3a2d2e7845e34308810a2f8d5923deaa2663fa8d
SHA512 7ddaeb28f932958c5ee2f05b1ee3e4f9e11909e242f8e62cba498d13cf793a500416dc54eb30e4e9ac56ac9e9ca38fb2c8cfc6da9b95a8ee7a9a84f8fe9892f6
TLSH
T12A611B811A9190D4EBA44D30D5FA129F3F3988B255C3BD3211FBD2396B4B364DEF4050
MD5 SHA1 SHA512 TLSH

Submit Download

f8758195-f70a-44bc-b201-c2fe7564aff0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f8758195-f70a-44bc-b201-c2fe7564aff0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

05cb61c5-e923-4f02-bac9-b56d6203adbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\05cb61c5-e923-4f02-bac9-b56d6203adbc.tmp
Size 1KB
SHA256 be04ef28b75fb5d05df066ddd7c3830f2349328ad96315790af3a315dc4c1c51
MD5 0de03da176380833167f13bb38efac84
SHA1 cfb64e51b7f800e32aaa827dc35b3517b3278951
SHA512 751134dfb26d17bb7efc0c0199ac522a45fed0a0805b0c874d869c196a2e238d80bffc9c65d4a76907e6e7ff220f4fac8922c0e572e09b52ed679007a680f010
TLSH
T17531BEF3C7D5866EC81216F05A24BE2BCF2D091582283C2DC5D5EF5B93E2075E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

07afa31a-db22-46c8-aa3a-04423ea5b5cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\07afa31a-db22-46c8-aa3a-04423ea5b5cb.tmp
Size 1KB
SHA256 d1b4dba4eb0d45e9d02d11fc521e2658e9fd41ac1e43177f4272297577822771
MD5 5945e811fa191fb810837cc523b12974
SHA1 ee5b371e0f0ab7afa86313dcaa13296303c9d866
SHA512 1e69547be125b35b779532df74575de0e1910dae2c18e1ba96fb5c5102d521e31d637065e7856816fcae39f810122ec082d5b5cc60df75d744ba351796848ce2
TLSH
T1D941ADF2C7D4825ED81216F05A54BE2BCE2D091883283C2DC9D5EF5BA7E2075E242A5F
MD5 SHA1 SHA512 TLSH

Submit Download

1714e884-37f5-4f39-96a8-ed317498607e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1714e884-37f5-4f39-96a8-ed317498607e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b8158d65-ea5b-48fe-8ac9-0472faca0d98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b8158d65-ea5b-48fe-8ac9-0472faca0d98.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\temp-index
Size 864B
SHA256 0f56915422e749b2bd0617e2de1133f89e65c2512d61b128c6df3a5221073638
MD5 92dea4e88415b6da38b5e732ccf9af81
SHA1 4f43b6a60620fe87419b40b251f008d60397d61a
SHA512 52b45c1c0b6755a17b6667daf46462a7caceff59157922cf08285518a08cf223c883bfb7f218f6fc333264533b145df55f7a5b13f720fe7a3bbe175ad9a37842
TLSH
T15011629A8E126A1FFC540330243CB88A72B002CC0341A71F52BEC11A9C97704AE81250
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 864B
SHA256 eabe415e27bf92435bf0ac946236bf83bb6ede7a2e43a4488faba45517a6edd3
MD5 3440eb99280445948c5dd41be2d594b3
SHA1 fba4280dca3196b3a46f9c59f3f9b92ef57be16a
SHA512 e797bc3d42358ad356dccc2cc4d69039e88e09ee68dda104b801c6ec80d6e53f03ea5a448a0710c53f67853815b095f79999446c737d9a1846f9800a4282d92c
TLSH
T1D61141E501539B16EC4803709A2CA946717542845398675FA3EBE16ACC83B84AD82FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 62cb5b84a443bba03b4b10e0520e878e420d05f3154e38562205915a4eeb387b
MD5 56d00c13bdc50114f2448d0ac6d02436
SHA1 b8a15282965f529c634a1d243b55be8d9c820141
SHA512 b0ebec2ced387eb36863e83613d37a936fc684dd3a096a2331ea4b0be332fb3a4d91cfd9df794ce91923b0acc408918df558038525584e390ffb3980ba87dc30
TLSH
T184E0D8B72ED72864ECAF83D6103188954105B968C544ED4F607A91C791A1755785AC26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 18424345399721a04b95af8acafd30c45ff9bdd774617e31cb18aa84998610be
MD5 16e6b9b6ae1ac31884fcf86e9a4e5d41
SHA1 dab45308c1822433d7ce819dff0f8b3d09d7994e
SHA512 d2079b4212b6a6182e4d54e563993279c64bc7b917f7d5bcd255369f03fe05ed1e6c2491bdcfc400f3a488c9636ea3454a8254b2edfe0f953a92b5bf1aa4b6cd
SSDEEP 48:K0hwdR7/DcbvaS9AsSwQhbM78ISEhK9I1ShxqxYzEwiyLjGnDtFVWbFIdISDWK9f:KUSFeKeYyicIKh6ahaK6Y5
TLSH
T13E91D24130FB020438BE75AD45A48B1A965231B73116E56FBFBC41624E6FE488EFEDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b98d4c24-d1a7-4161-8cb7-5054e088dd2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b98d4c24-d1a7-4161-8cb7-5054e088dd2f.tmp
Size 10KB
SHA256 492671ee8c61025fae2d90283bdc6e302cb5c1bcf02c7628264db81a59c66baf
MD5 d303f43cc6c2735a92f17b1c4fe41c01
SHA1 ebcc27de551eb2409888085ea13553bce14fedf0
SHA512 7bdedae1e194ccb6b21f18d73b16aadbfc2211021c369c8d44e646e64c30683b4a0b9fc11c7771674deb93d3c5effb8235c4de225e17153abaebffcc04f08127
SSDEEP 192:sxZwRYnO/fTsRMGpIdpbjHW6+WNyYZ9YgsWdIg5MJ:sxZwYO/fTsRMGiPHbr9fW
TLSH
T15D32C8516D34AA7B9CC7D20DBA55BF53E2F95032A1911E48AAFC8B1C05E7BDD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd6c0b26-4cb2-4cfd-9bf4-47313d2cc6b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd6c0b26-4cb2-4cfd-9bf4-47313d2cc6b2.tmp
Size 10KB
SHA256 9bbdae065f408e227950a0c8af2eedf1f4a5d357bf597a27a961363064744daf
MD5 cb17f2d15968261f7a9cca16fa38fd0a
SHA1 e36860a3933047a1633f697612afecc9f8c6a94a
SHA512 dd0847922102ca365465653d36dc24264bdff5c791fbaeb85f33f7ac0a7411c10f032c492ebf8ddd693bc056e42a83e6efa72b546f3cc56fb734f7a3d9b6c5e8
SSDEEP 192:sxZwRYnO/fTsaZTIdp5xHW6+WNyMS/YgrModIgrJ:sxZwYO/fTsaZMvHbo/tz9
TLSH
T12022A7516E34AA7B8CC7D20DBA56BF53D6FA5032A1D11E58AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cfbf42ee-7d0d-41c4-a357-4ec1d444e0c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfbf42ee-7d0d-41c4-a357-4ec1d444e0c8.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

d91a389c-ee92-479f-9b25-817e4c1f405a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d91a389c-ee92-479f-9b25-817e4c1f405a.tmp
Size 10KB
SHA256 f3d50608dff617e34a03f6898a723ac8ab2dd8682308689e5255cf4176d6dcc4
MD5 f025828b5f48c2b68b83ea29bfdcbdad
SHA1 edf69a035db2f6f2c91049ccd84dd904ed18cdd0
SHA512 4ffcf6e6253838989e645a1a7c13d0614b85298344c3abf3f55f77913044ab74e3d8b2fcc079f8a820c82dd654df554c0ed602984af794fb12b05fc79a866669
SSDEEP 192:sxZwRYnO/fTsRZTIdp5xHW6+WNyrwXYgtodIg5mJ:sxZwYO/fTsRZMvHbFXsc
TLSH
T15D22B7556E34AA7B8CC7D20DBB56BF53E6F95032A1D01E48AAFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df0c4837-44c2-453b-8f32-e1be145de20f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df0c4837-44c2-453b-8f32-e1be145de20f.tmp
Size 10KB
SHA256 718db3d1c80823ff5836c18580b50f7b38ae5debf7d5060878a30e3c94aefdb4
MD5 051f9c9bf015f1d55a79f7893763ec3e
SHA1 ef9c6b24f92b103eced860a8925229f158ea7805
SHA512 133e015feb99c4563558daf8e669aafa53ea95afc62d6968cda92e925ddb75751d2ba20309455dd5715e79e3b34d21f62deb50a73aff7036f704dee3f9699753
SSDEEP 192:sxZwRYnO/fTsRMTIdp5xHW6+WNyrwXYgfodIg5MJ:sxZwYO/fTsRMMvHbFX2W
TLSH
T11522A6556D24AA7B8CC7D20DBB56BF53E6F95032A1911E48AAFC871C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8f59db07-03d9-4ae6-9c16-b11394b28198.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8f59db07-03d9-4ae6-9c16-b11394b28198.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c3b53b20-6ee4-4d1c-8802-3890c6a889f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c3b53b20-6ee4-4d1c-8802-3890c6a889f2.tmp
Size 18KB
SHA256 e3bfb6d01813fdf4f0f0285e979720f3fb0008071f7769f7d9593a8514d14aab
MD5 4ca798d462e72b8ff968170a1e8dbf09
SHA1 ad0a6db24e21d7937064e7eddcd68da6e122159b
SHA512 4ed9a976429dd379de2576f3143f3bd245dc6d2537a49d4d5fb6f03001537cf3f280427fd124c2dcefd355543c17c7e9ea5052294b4725d6f5c05a170ac7dea8
SSDEEP 192:uJzm+xasuheOwQxMGsNTeQIwEpphvHUERQmiU1XCKw4BGYX59ezlCwmIqvzkH1F+:LZcIhsNTeWU57vhJ/BGYX5EE6qvgC+Gh
TLSH
T1FC827B716C78AC3B5AE6A041F48B3A038FF8E127E7C5BF94D5ED171C01DA2D8230691A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3edf8504-8e5e-497b-9105-00976945fadd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3edf8504-8e5e-497b-9105-00976945fadd.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fea64178-e8b8-4a3a-a0c0-6e5a13d40143.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fea64178-e8b8-4a3a-a0c0-6e5a13d40143.tmp
Size 8KB
SHA256 0246334385fe23f46f2b3a25d435bff79332c9155dc80b46c119adfad40d76c0
MD5 edc2ba83cd5dd0efd27fd8f6fba28018
SHA1 1a5fc452829ff3cec9a8d8cc0add4218a0b51aac
SHA512 9f9429b9753ca80e7fa072dbaf4a737606901ffa5119c8e6891239409da2fbcdf4e400aa11d6a8a51c1e9bb3ab53678b8513509f1f0213e0a64e3db58a063978
SSDEEP 192:LJONW6DphCqQmiUyRLEdwGYX59ezlCwmIqvakIIFq5RU6:lONW615iAdwGYX5EE6qvrCU6
TLSH
T1A7121A35A8B8BC6B5DD3A491F4873A039FA8522BEB847F94D5DC1A1C01DF29C2307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f12c619d2a1a53b1a7a1e749d61cd5da44c4488c00cd9375fd6ac933dc4f0dd8
MD5 a33937172b958ff95b1b04b2cd2fb05e
SHA1 c0694ac6c22fe7a987ae31b6b57dd78aea9a45f9
SHA512 78f4faa130955908bc61a7b72c5cfc8c326f564d99af06c758d61d2210497f00cb8a47681fabc907ca205ec0e670ab7b8a0bb4c9be6bd9c98694857b15353db7
TLSH
T129412958AAED1108B3B76F4AABF6A86D447F7D372E06959D00110E4F0623A41C861B37
MD5 SHA1 SHA512 TLSH

Submit Download