hxxps://lms[.]mindworx[.]co[.]za/academy/user/profile[.]php?id=1551

Analysis

user interaction
yes
max time kernel
388s
max time network
368s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://lms.mindworx.co.za/academy/user/profile.php?id=1551
Sample261009-vtzphada87

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
224	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{806B989B-E318-44C9-AEA7-83327A7EF83C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3452	msedge.exe
3452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe
3260	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1120	3260	msedge.exe	88
PID 3260 wrote to memory of 224	3260	msedge.exe	89
PID 3260 wrote to memory of 216	3260	msedge.exe	90
PID 3260 wrote to memory of 216	3260	msedge.exe	90
PID 3260 wrote to memory of 216	3260	msedge.exe	90
PID 3260 wrote to memory of 3972	3260	msedge.exe	91
PID 3260 wrote to memory of 3972	3260	msedge.exe	91
PID 3260 wrote to memory of 4452	3260	msedge.exe	93
PID 3260 wrote to memory of 1232	3260	msedge.exe	94
PID 3260 wrote to memory of 4452	3260	msedge.exe	93
PID 3260 wrote to memory of 4452	3260	msedge.exe	93
PID 3260 wrote to memory of 1232	3260	msedge.exe	94
PID 3260 wrote to memory of 1232	3260	msedge.exe	94
PID 3260 wrote to memory of 3868	3260	msedge.exe	95
PID 3260 wrote to memory of 3544	3260	msedge.exe	96
PID 3260 wrote to memory of 3868	3260	msedge.exe	95
PID 3260 wrote to memory of 3868	3260	msedge.exe	95
PID 3260 wrote to memory of 3544	3260	msedge.exe	96
PID 3260 wrote to memory of 3544	3260	msedge.exe	96
PID 3260 wrote to memory of 4748	3260	msedge.exe	100
PID 3260 wrote to memory of 1304	3260	msedge.exe	101
PID 3260 wrote to memory of 4748	3260	msedge.exe	100
PID 3260 wrote to memory of 1304	3260	msedge.exe	101
PID 3260 wrote to memory of 4700	3260	msedge.exe	103
PID 3260 wrote to memory of 1036	3260	msedge.exe	113
PID 3260 wrote to memory of 3968	3260	msedge.exe	114
PID 3260 wrote to memory of 2896	3260	msedge.exe	115
PID 3260 wrote to memory of 2324	3260	msedge.exe	123
PID 3260 wrote to memory of 2324	3260	msedge.exe	123
PID 3260 wrote to memory of 4168	3260	msedge.exe	126
PID 3260 wrote to memory of 4168	3260	msedge.exe	126
PID 3260 wrote to memory of 3452	3260	msedge.exe	128
PID 3260 wrote to memory of 812	3260	msedge.exe	129
PID 3260 wrote to memory of 812	3260	msedge.exe	129
PID 3260 wrote to memory of 4512	3260	msedge.exe	130
PID 3260 wrote to memory of 4512	3260	msedge.exe	130
PID 3260 wrote to memory of 2164	3260	msedge.exe	131
PID 3260 wrote to memory of 2164	3260	msedge.exe	131
PID 3260 wrote to memory of 2856	3260	msedge.exe	132
PID 3260 wrote to memory of 2856	3260	msedge.exe	132
PID 3260 wrote to memory of 3036	3260	msedge.exe	133
PID 3260 wrote to memory of 3036	3260	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lms.mindworx.co.za/academy/user/profile.php?id=1551
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ff92c9ac188,0x7ff92c9ac194,0x7ff92c9ac1a0
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2269129656775699415,2152882233518148173,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,3049343762773399172,16400255767088797881,262144 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2576,i,11115746156577311952,15820243225033220773,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8905670914681371242,18442659189876384044,2097152 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,12360065165332662835,7566820955880192235,2097152 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,5542313127361060058,11702039282856795241,2097152 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,11316108878643417638,16708959916274762399,2097152 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,15320014377593857786,10579569537267357702,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,552043125601286840,9438767812151522455,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13351635107701701194,18261030946918186249,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,13351635107701701194,18261030946918186249,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,12337371383084875754,4600395299828524273,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,4536276817118577449,12151957560617408623,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,10153548393071514603,6920357036350304622,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,13604355377438159777,16906517871410992729,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5940,i,11635324238050816931,9374867029549316823,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6296,i,12964011182944586101,8270880281945235482,262144 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,6329411311798673914,14135664803087002324,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,13228233287304696135,15362130491261920794,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,7546472912885456523,15656076430206236967,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,353247752273012203,3284969091655865444,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,9038646876878881906,1965690064369654345,524288 --field-trial-handle=2152,i,10235031867611151786,3997820888026569226,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:3036

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20e89eaf-991c-459b-827b-42c1e46271b3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\20e89eaf-991c-459b-827b-42c1e46271b3.tmp
Size 25KB
SHA256 0efd5136c57b49fc1ca12e92e91ac46694537143233d2007fa525bf34155ab3e
MD5 e9404354ffdd358945de86f3f692e3f7
SHA1 94ec9c8a29bf9c04122a3bee816f5d34695ee043
SHA512 7d93954821c872725025dd71851dd96c9aaffb2277e6877929b50343d2780f87530963faf8fd740f3946337ba695455e7a300f8bc6b06a14b991dc533381bc48
SSDEEP 384:UiFZ3yFaeO8LzsNb8TUNTUlIlQOitORZ+p5u8i3xK8Oga87IOj:vFZ3IzhfGwgdMk3o8OgvN
TLSH
T1C6C219F258E7893AD95E9B53A77E2E138E7CC057B6856A50B3CC560CCC960BFC30A901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4635c0ef-500f-4083-b546-5755cec4f9ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4635c0ef-500f-4083-b546-5755cec4f9ca.tmp
Size 8KB
SHA256 ae834da41406741c5812b9ea628661aa9c50bbabce1ae25726daddcad48f2e99
MD5 b72634f21e07582d9e2cf4b41d4e4927
SHA1 42845b833f7a4dfa7136912f00d0a30470d5ef40
SHA512 8a848a1790ba47c2f35b3f60103b17b1932eed4d8d2736e9cde41f77bc2c76fda25d2fe78e14a5959e3e3b62d3fba860e70794ae5bfb2607c5f9c0e3c924c0d0
SSDEEP 192:SONk6iD8QmiUyZHS6q5u88P3xiHxuZOGqcU6:SONk6NOy6q5u8i3xKoOgU6
TLSH
T15F122A366878BC6B6DD2A961F48736139EA4412BE7897F80D5DC272C05EF6DC130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f551675-2fa6-4291-962f-a18cfcabb204.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f551675-2fa6-4291-962f-a18cfcabb204.tmp
Size 18KB
SHA256 737e668dc3595298f969a4e5bcbe3fd9ab4e056fb24e79c9485f4fd633e1841a
MD5 eb36cb28800ba1fba13b77c4af5c30f9
SHA1 1925545b50e54267c230732944f9f6888c71a570
SHA512 fd96ab72574b44924ebb809c1dc08b0a8d325f9ce55c16cf2df3a6752cfc600f9b32ac2f9dd9b123637102b9c51ee824d5abf66a65262dcdb5f444fdf4336c3d
SSDEEP 384:63yFaeO8WsN55OitOR1+p5u8i3xKLOga87IOj:63IzhWXMk3oLOgvN
TLSH
T15E828C366C34AC2BAC93B560F48B37579FB4456BE7C92F94C5DDAB1D09DA1D8030B902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91b465e9-f5b7-43e1-850f-c0792ed2d34e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\91b465e9-f5b7-43e1-850f-c0792ed2d34e.tmp
Size 392B
SHA256 6123846171688a8e2be978e7128bfddd8c06b0c7878ed6f1dbaafd3ddcf9a262
MD5 45c438d3bd8e61bde8c0f46cf2bb9e21
SHA1 bbd21452fda6622837c78c4485236a3457c9cd2e
SHA512 fdd8967d775ca78fd72d1800bff405ce59cbc67a2b3ba8a89e7402698aaad6e33f5a2e2789cb8011c9990552018eba10848ac842fb4b27179eb65a547a90e050
TLSH
T1E2E00447D30015D3C014033140471F0077F3C130137143450D54017C3D133015D10740
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

000981c7-fc69-4619-9061-518cae2ec566.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\000981c7-fc69-4619-9061-518cae2ec566.tmp
Size 25KB
SHA256 b14232a901dfe43f5339d3220a1601e66da4277e2fab1b6ee677ec452fe53145
MD5 9c47bb059d1689f0ebebe12a400bda07
SHA1 36f369a2e13123d92ab2c80c8aa21e91f6f5c330
SHA512 5a177fb66d350ac2029ce810fc0c8825da5540798716bdbb784f9d880fbf9ca4b8f2da358c9c25101fb67b3fca1ab08aec1f3e4edeef0f969c8e9c250b3fc540
SSDEEP 384:sxZ7Vc/fws+66s8qMpRiYnazAW8pZS15posJWeT+Jh6DHbmPXJ:szVc/fi4Mnc7WeT+Jh2Hb8Z
TLSH
T119B20805A924C83B8EC39E1C653D7E33DAEC506222C5DEDA5AECCA1C019E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07c26500-63a5-431f-8c18-2185fc67c56e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07c26500-63a5-431f-8c18-2185fc67c56e.tmp
Size 10KB
SHA256 633d18c15b1cc403578383711454cad26971f574d261c89a9b191fd92e841ed6
MD5 0c59a0578b5c7390fec40ca6b5734576
SHA1 0f8fc6624a6b1a67ae1f72bed04fc38c80013838
SHA512 872c95de6b1835afc4ca11cd101e2cdef9525267a3b91506b890361711d31f848c2bb71eddefff6868fb22443efbb1c7c89b6453e3546ebaafedd35397afede9
SSDEEP 192:sxZ7RAWc/fwsnPxIdpSAHW6+WNlKBTYamBSIg5ZJ:sxZ7Vc/fwsnP67HbWTrJ
TLSH
T13F32C7516E28AA7B8CC7D31DBA55BF53E2F9143262911E48EAFC861C05F7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1b643dd5-3f9a-4d17-b0af-bf67fbb2c86a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b643dd5-3f9a-4d17-b0af-bf67fbb2c86a.tmp
Size 10KB
SHA256 3cd62cb0c717512d21271ce0d6df6b93e4f91489255cc02cb046ffd8232edfdd
MD5 399c5e0f8d93f640ba3606ecd9c9770a
SHA1 1c5c6583126812e61dcd0c6f894f29aed54d0115
SHA512 4611bc87ad76240da9629c6c7ddeaea7da5759c27385f143f151a60448b633ec31798bdd1435c905ba2f049ed1d3915f5d0f8606fe552aab50c6e40c952f092d
SSDEEP 192:sxZfRAWc/fwsnqxIdpSDHW6+WNlQvxYaUBSIg5ZJ:sxZfVc/fwsnq6QHb6xNJ
TLSH
T19022C8516E28AA7B8CC7D71DBA55BF53E2F9143262911E48AAFC861C05F7ACD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1ffeadcc-dfbb-4037-9c3f-af368dcf152e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1ffeadcc-dfbb-4037-9c3f-af368dcf152e.tmp
Size 10KB
SHA256 981075eb0675b20dc8cdaf18250d1086a62dd360a459a4e2ff238276baf14112
MD5 60032e7ed20f216b4655443cc59c309e
SHA1 b8baa4b3d252907d3f824327c05d49b870dc8243
SHA512 0b1095a2cc7df12258f92f7f9105bcc7e432f65c65e495dc2057ae6f97595a2d523b27c21977ab80fa47a82df2d4c8c5c2091ba8d708062b359083c92a923628
SSDEEP 192:sxZ7RAWc/fwsnhxIdpSEHW6+WNlypPYauBSIg5ZJ:sxZ7Vc/fwsnh6DHbmPjJ
TLSH
T1DD32C8516E28AA7B8CC7D31DBB55BF53E2F9143162911E48BAFC8A1C05E7BCD120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6671cbc5-157e-49f3-9ae2-5025727a4039.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6671cbc5-157e-49f3-9ae2-5025727a4039.tmp
Size 10KB
SHA256 7be0587e5fee32793ada328489be3795512ea2817f105f1912f47c15284965fd
MD5 6dd283dc11409d3283b7414381ab0f7d
SHA1 0c939161c0a2f586c2a1ef1cb33d97befdedc295
SHA512 c1af970f88ef49b7b1e85e52284471389fa4dec77cc444e7543a939fb65ce0ebfdf8407cd4e152bfee8ea0fbcab2f6358a8fb18ccc460b1c099a76ef02d556d8
SSDEEP 192:sxZfRpWc/fwstqxIdpMDHW6+WNlEU/YacBSIg57J:sxZfKc/fwstq6OHbp/lX
TLSH
T14922C9516E38A67B8CCBD31DBA55BF53D6F9143162911E48AAFC861C04F7BDD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9de2fe1f-9139-4e69-a70f-003c6eeb259f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9de2fe1f-9139-4e69-a70f-003c6eeb259f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 328B
SHA256 e5ca08cc98c5a239b76335b9bab304cd019dabcfe41f0428df69b55130efda4c
MD5 2426f777b264316d8ac17757bd319727
SHA1 a205381e576bafa0a801defe6d75dd064c5f1d11
SHA512 e86b57958fcde2cc3b89855ad9eb8e35e46fe6aea68847ce07faf74e3157c61ee61c194c7f3c71adc0dbc47e9913cf87b69845adb1cd4a9e291cf274ce82d9f2
TLSH
T196E020DB14D5C31DA205684F1278AB4C97B0365A92C4AECE2B08C5C47545080E3C1571
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 135346d758225f161c7eb51889a47edb23f508dcd70695da707510acf9dc7fd4
MD5 c62eee3531d79bf6883fc2963d6fce96
SHA1 8c8029ba5b26e384f2915a1225bce3167b66a340
SHA512 ee8b058e2ddb6c6ffcc14b614d144f29866e13be3993b7a67fe3fa284231c260f5b3928f43ba688b86aec2c7b0839c51ec580fc338f577daa6ebe686a45a4c05
TLSH
T151E026ED04C9CA2FB248644B237CE78C83E037AA92C0F90E1708C5887405440A3C27E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8b6b4b5deaaebdc08ca3f99da53a10726bfa4c55defe8e077e6ead263bb4808b
MD5 ef93101b4094a751ef286f1c1526ee66
SHA1 f2fc18f4c0cda84c8628b4f3d2cc37f3337d115b
SHA512 754e19fda4adea934f9c43a5f5273bd567e06908e7fc1ffcb5948910e125014cd920e2f7d61a70f186f45103ebc01742660e029e0dfb3e35214393ee0bd2c5ec
TLSH
T136E07DE804C9C22EA298748B2378FF0C8380369BE2D4A95E3B40CECC7445944F3C66F0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000060

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000060
Size 27KB
SHA256 9433f0b21e28cac8a58e00174901b24ed90f227202041f971cae7b9ee992a080
MD5 109fa14cdf4654b4fe3433dd14cee9bf
SHA1 f0e12ffb886981b6388cd0182ee740160bdb860b
SHA512 18d01d26f2566c2b434c7720a58515ade1dada2b96ee67b76ba36bbba856194ea0a472c6e4d2035fdb78387539f561be4cef47393d8e97439232dfcbd54e2347
SSDEEP 768:oMr2KO8H6oYgXM48ogjuYWVaQ/FC85BwG1q:oWBbHpXM4MSYW1p5n1q
TLSH
T1D9D2BEB89C90F6570C5B44AD914340EC8F5D70E5FF03910D8C275A765CAA43DAE6AECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000062

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000062
Size 491KB
SHA256 b5000421c0327e929ec61f1f6336c9455daf71df1f647fa90ed1295d913e3b37
MD5 3901b8ec704415a40de39a185b3d5cc0
SHA1 98e29356c69ab0ffe06e0b54570da71626775ebf
SHA512 9f4ca8851695087218c358a8137ede8d7b8a700be67e5de4cf970421d5ad41992108b9828a97c2be38ee31376f8df0a1d6ef43f817052aa364a6896def9731c9
SSDEEP 12288:BwdNJzZ6krct0B9P4kCFkjblbk53CF0XTKyA+A3nNGstV/E:adNN8jDkGkjQ049A+qE2/E
TLSH
T15DB423A2F23C81ABAF128F0752FF546DC24870CDAA85F725FE815E8381656C569341F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 1.8MB
SHA256 b479155f2200ebedda1e3bbb84495d18f343a5ceea005f853f2474b47b42e617
MD5 ba8ca7280fd79fb521a5cf966b14a427
SHA1 5ba63b01207039650cb885bd659cdf513728d947
SHA512 3066ff837383bc5168d9ebebce3b475053bc9c02a7469ab014273fed59a38764d0299814e7ce089decf3114e97787e03bb555e611289957a21b3e74684bf3785
SSDEEP 49152:YyGM+q18DZxCI3WkHrLuQmnHME9XOylblyoBaC1:9Xo3WkLiQEsCXOylbgoBaC1
TLSH
T1158533EB82F1A41E7840D99C87BFD4902D2C20FECC492C395EF5E56B93C7966592C2E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 37KB
SHA256 1786c82f3b1cac596fb2c43b4d2f6de6532661572b32e8c1dc5d97f67e1cfcdb
MD5 d6e05e6accfb87c16da656624894f0b2
SHA1 9c3fcada7c596873176c0fa8b7df51ffd5fd9c29
SHA512 52af81d513d801948cbf4724d45031f19a88416be3899cbc4475b7a0c5200297e7339646d2033e9de72684b0b51a5680d4604ce46dcfb539a6088e731100d054
SSDEEP 384:qU5RAWWdr/Sfyl9lxNJ5N32wL52IHNT+I0phqmMt5:qLsf4PL52ItTWphqmMt5
TLSH
T15B03A832718CC8EAD0EFEEC60FBB3951A9DA1E2BD583404C9DBBDD9442DB6314117269
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c8476cc503a9142a382a6a0079365f36064a019700d36c23440e9ebbe558f641
MD5 71838372445bcc1816abf9e65db7e561
SHA1 291d7e5010d399fa9edb5e14b69849cc385d13dc
SHA512 37bc669b1f853f81a8bfed2fe9f54b257c3edb7cf0b12ad621ac76f3e180c8ae40b5934bb5798d9c4e5c370b5adcd5bcae23ce9b24b7483ea3807b7a7355829f
TLSH
T12571A7E1548C4034FB7C64FB53DD8587363495867FE3FE1226D9E93D882636A3398A84
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 196140ecbac2f6a3f074f2f02411d60c81947752fe146d8fa048129a086f92aa
MD5 08fed26be45add34e1205910e9577362
SHA1 18d54feaa9077546fa289f00be3e95e0b2908aea
SHA512 fbefafce23ec068957f972e0d6a406fba53da607098516b3e915945288161189378a2b1d03ebaba2d776de1d93a04809b69ec59fb0b1770ca932ed3d21660d38
TLSH
T1D37194E1548C4034F77C64FB57DD814736389586BEE3FE1226E4E93C982636A7398A84
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0dbbdb757bfac24a2e1c1e4292c31aa35ea5015b58444d6cdf7aaa2952df6fa3
MD5 9fd487a9de22102fb368b474b2f576fb
SHA1 8632cbc79b05312b3724b7c369ff0aeb8afbe5a5
SHA512 3731a6ab071b61044f4b21172fded636470770e51cfae719d391ba202acb1d2755ce8ab50645eab6dbeae6814fada75f2921e8e3da7e6b8bc8a2a943e5872adc
TLSH
T1A37196E1548C4034FB7C64FB53DD8587363895867FE3FE1226D5E93D882636A3398A84
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 edc0758e2357bba7620d13c9f89cf890ffb33918c7475d813bf737d6cd68eb26
MD5 1ea45baaf328ac1a1015957c62e719f5
SHA1 540dd4deb3d55b3456b8aae5fcd2448174a7f3b2
SHA512 7a841809ef164542c701496bd15e9d7f02d0bf18bdb0dce7ec696f6ff55792c5a86a558d986e481294efd44077b013a254bc8cd41d92b0d25303770c16f21939
TLSH
T1D56194E1548C8034F7BC64F757DD814B3538D9867FE3FE1225E8E838882636A3398A44
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 88b455aa2a36ebd74d9019b92e9413b567fdebe5191f9b0977d6386a1cd4829b
MD5 5915dde48370dd1315aba8c2d889758b
SHA1 b48eecfca3153a8ea72ddffb3d6b81879058c24e
SHA512 6826e576e0248bcbd68e695b0554bc3bd5c7c09a9bfd892eaa99f1051b282077c870e9e21d0d95ebe5b3977b2e3bcb06c16ca0764801d890c8be6905f41c1ce9
TLSH
T1AF71A7E1548C4034FB7C64FB53DD8587363495867FE3FE1226D5E93C882636A7398A84
MD5 SHA1 SHA512 TLSH

Submit Download

25ec2c66-2808-47f7-ba06-f96a5b417ffb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\25ec2c66-2808-47f7-ba06-f96a5b417ffb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0eb33706-f4b3-460b-b7b3-4bd84a5f710e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0eb33706-f4b3-460b-b7b3-4bd84a5f710e.tmp
Size 1KB
SHA256 8d216b8b57bc03fd8f57b46c1905c7a8d04675ccc5e6d9b7e4a50a18bb1baf70
MD5 ae0191ba5e6444bde875120bae4feab9
SHA1 f6ca086d6f12889bbf9ee50151308d33bad9a687
SHA512 904b3027c5be33bcefafa49df66baa48f8fe9a5a37ca17b3ebf19c80fbdd934d8932b966104aacfadf31d861b53ace35a34962914e3173ac7abb85524bff3cd8
TLSH
T13D31BDF783B185AEDE1156F09A14AE2BCE5C0506836C7C6986D4EF2793E3071E042B9B
MD5 SHA1 SHA512 TLSH

Submit Download

5a1fa824-06ed-447d-b9a0-bf133f4d4780.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5a1fa824-06ed-447d-b9a0-bf133f4d4780.tmp
Size 1KB
SHA256 7a7de1d9d5d14a2bfdf53504131ad3d12a0b6c962817eb7456cd409ef2db692a
MD5 f3d2ca9fa9892a9100443625bc6584c7
SHA1 834510328b08c37419c5b18b0373d03896041377
SHA512 f8669cb83a27137f035716ac35229d658a3a845f5bc075324c7ef54f9cca4b61907384fc07d67f54a5b6ea33463e65335a697aac3915934474405e460b234e8b
TLSH
T1EB219CF387A1866ECE0156F09A14AE2BCE1D0506436C7C2986D4EF27D3E3475E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

88b45219-ea3c-41aa-b1c9-937b39b02f7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\88b45219-ea3c-41aa-b1c9-937b39b02f7b.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

8e1b6eab-ce23-4217-9763-1e29da60b8ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8e1b6eab-ce23-4217-9763-1e29da60b8ba.tmp
Size 1KB
SHA256 4e2f2f7d218a49d5fdf2e328f9d98bc5dc4bb5a35f4e8a5abf108ffcc95870eb
MD5 a8a5f4c2f128fd3fd920fa8616a69274
SHA1 8f1adeb1df145d63db56b2cde6ac836bc69873d5
SHA512 b8167c5e732e99c0ebcc12799285f5f1bb53b08cff20b98706f34eaeae482071c69c71ade113a961cdc175cc3db6fbf2b159b840aef70de030c318a19543e080
TLSH
T1C5219CF387A1866ECE0156F09A14AE2BCE1D0506436C7C2986D4EF27D3E34B5E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b2ed1ce9-8068-4e91-8767-dfb6e15c20c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b2ed1ce9-8068-4e91-8767-dfb6e15c20c5.tmp
Size 1KB
SHA256 22a06646543a4280308cc2e6bf043a46321f41de272141026d03949610b772d7
MD5 619c77ea21d101f1b02ffecf8ff33f53
SHA1 6b0e1d5239cae35efac5110486de7eafe4c982cc
SHA512 2b2490a35c0b03bc433f8341e6e4c456ef3c79a011ade78dbdd65f44be0d414b9636a00037dd9d53ae35be8406bde823d92ea1b8124f07822b45ea8ea373468d
TLSH
T1D0217CF387E585AECE0156F05A14AE2BCE1D0606435C7C1A86D4EF27D7E34B5E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

ec3bf02a-ccb3-4d43-8852-9ce43b6f7d04.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ec3bf02a-ccb3-4d43-8852-9ce43b6f7d04.tmp
Size 1KB
SHA256 298fc079e31b9a03c4ca1434a46229150a79fae6a521d44e26dcdcbdab17abcd
MD5 32f81bee669e7dc874001dfba89d2acf
SHA1 70142aa7d0d19574bcccaef604c5c69e368f84ba
SHA512 0405f2aa58fadb999f20caa96cae5958ee43d81662e3b014d0a17823241e3e2a6a613fa88e0f5e04be76ea761b5105f5babb76c933e265b3da11af659b5a2d46
TLSH
T102216AF387E585AECE0156F05A14AE2BCE1D0606435C7C1A86D4EF2797E34B5E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 576B
SHA256 eda4962e9569bd59165e6e708ea8aa7674c41c2454bcc2240bf70f36c98e8d32
MD5 ef7398b0d7388fa224565bda217b34c0
SHA1 b1a5868ff6dfca1262694786d7d4de28efb3b515
SHA512 446aece518da7d00950076fb2752f060daab3678ea6d5f25a7471f4cfd22057e882de1d7a2994958ec88b8502659d86625e1698454a34cd39cbbea95fd78fcac
TLSH
T1A0F02BC83E23499AFD304131603EA0A92BB802EC2310684770FCA0269C07B80BE42AB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 576B
SHA256 016e1498b537b00646710368f9130a08fceeccfa42576f1acea443ccf9b51850
MD5 eb6492814cd0bb99680209229142caf2
SHA1 db6ed258367cffd69680fc49cfd7767f2facae0b
SHA512 04307c37620a924bb0bcef12324263297e8f0479e90ce26fabbd627716243811c0e60a040231c819b6268f449586773532cf4d25f172acb4f1b11903e95e72df
TLSH
T1F6F0F1C856138F82FC080131E57DA19A62A56008A328790FB3F69025CC13BC09D42FB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 63474d2102cbd044a404ff40121aeac62ec01d64dd55d21421e912881d267471
MD5 00e8e9c79921f6aba73e91b6682b58ed
SHA1 154e6e617d2bb121348d14abc58500b29711cfe2
SHA512 972672c6ae3f2c9e6ec674cc10abbc3cadbc25514c03c1243c928d17ebff04e428141f6066d8ff81dc742cb3c29ad2a502aa97d276fefaa4045fbb0377fd6775
TLSH
T155E06FBB3EE72810ACBF83E2083140A90001B8008999EC4F102AD2C740A13823832CB2
MD5 SHA1 SHA512 TLSH

Submit Download

aab0a56a-2e1f-4a4b-97db-d0cc80bf0917.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aab0a56a-2e1f-4a4b-97db-d0cc80bf0917.tmp
Size 9KB
SHA256 1b363018135b9d74cc1e23654663d04f1a9a1e02b8fe04f044525a87037507c1
MD5 b80e5cde61ca1691a7cbfd91441ce20f
SHA1 abff23b11234bc7540ccb8c59adbb859eecb07eb
SHA512 260d18d5de4e5e75b826ac56f5f94a48e3d56ca76f6ae7097124cd61fb212a5e5ce2fff14e2bba21329d7256912fdbda5f9501d65011fdffffdbb24564a3f8e2
SSDEEP 192:sxZfRpWc/fwskqxIdpMDHW6+WNlEU/YacBSIgrJ:sxZfKc/fwskq6OHbp/l9
TLSH
T16922C8516E28A67B8CC7D30DBA55BF53D6F91432A2D51E48EAFC861C04F7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b291cb40-da79-42ef-9bbd-ce03573e67c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b291cb40-da79-42ef-9bbd-ce03573e67c2.tmp
Size 10KB
SHA256 6d9bc553da01ed8c8931ffb5e7b32a4b80645e95d3408835139c91f55c65652c
MD5 e38526c6fd0025d3c27b2004ae720fb7
SHA1 f6632b732833f154f77ebf4bb0b6f23869106fc4
SHA512 8e024ed90eea053b14736a8cf0d32239300281e782d4fd93fd4690f20371a2b6954a5d437700677ffd72f476f9f50275fe0437bc823109c20ed05544f46ba07d
SSDEEP 192:sxZfRpWc/fwsnqxIdpMDHW6+WNlQpXYa4BSIg5ZJ:sxZfKc/fwsnq6OHbWXRJ
TLSH
T1F822EA116E28AA7B8CC7D30DBA55BF53E6F9543261911E44AAFC861C05F7BCD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb72fdef-b2eb-495d-a51e-af89abb98363.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\eb72fdef-b2eb-495d-a51e-af89abb98363.tmp
Size 27KB
SHA256 1ca3cc255113eb13029e6ec131d66df8fdbc52b31e3057517cb6bb7a9900fbc7
MD5 f5fa8e4bd418ef7834125ec279301ce0
SHA1 1cc5c82a4e6ea1bc7f892ecfdcc8c6e99d5598f3
SHA512 fce5bdf6c1e3d2bf0463e944a897e8d294a1f03a18a43710f045ed50082b797b1b20873a02eef3690d40e77015e2a9488195b624f5874c077f134afa3dcba906
SSDEEP 768:eTyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3tro2ZgC:eTyQRbrWvvlpZu1jaXKLf33G2ZgC
TLSH
T131C2E93B640CCB7E4FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff221649-394e-4a59-aba6-686eb7c66791.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff221649-394e-4a59-aba6-686eb7c66791.tmp
Size 10KB
SHA256 2e3d9fdb746bb4d7c17a26c2b0e27a6abba2c8630eb0aa52a2d309676a1bbd3e
MD5 ec28080f2cf71784a708e0208c108622
SHA1 f339329174227a658437bca25b707e4d3a071f5d
SHA512 294d363f9a7f3f31c0e5aa0cb8911d3ac87871f34a54146a0424a948c5033bec37a631fe7125dd656c58123b300aac4b0e3ee712ce5e03274602fb37432a89f8
SSDEEP 192:sxZfRpWc/fwsnqxIdpSDHW6+WNl6gdYa2BSIg5ZJ:sxZfKc/fwsnq6QHbHdbJ
TLSH
T16F22E9516E38AA7B8CC7D70DBA55BF53E2F9143262911E48AAFC861C05F7BCD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e66774e-5a4e-4249-ba80-8a3be9fb9183.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1e66774e-5a4e-4249-ba80-8a3be9fb9183.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7f45dc13cd36ad057adf5468249244002b75afb0ce787aaa771ee3ef8f36ea52
MD5 4f1fccd2a34bf202ef301aa0a05049f5
SHA1 9aaa80f448bfd225fd033a52d219b1e587259c5c
SHA512 f4ac210a5c03bdca94b2b130f39b74b57b6c527c4fd325c67c177270c4d449db47815def3118a8a10b452e59a91afb2513e86ebbfe29acb114cfb0f53c7f6074
MD5 SHA1 SHA512

Submit Download

d8d355b8-3c12-4ce9-9f30-103fc5d72f91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d8d355b8-3c12-4ce9-9f30-103fc5d72f91.tmp
Size 8KB
SHA256 6fb755190317160b9266f280aa448c7d2a9c4402a08d71c3c91a787c1a145490
MD5 5656eb98142588b96348f8464fd404b9
SHA1 147a4785a8674668036829c673982b7f131475af
SHA512 bb7e69474729b8f1b8059c4a8415d0cf6b42c30ff96928f3ce107f1896d0221d05e5faf7dc42a4cd9eb65bd4d9d2678091385ef727c865b1a85fd9176c494b3d
SSDEEP 192:SONGh6iDCQmiUygSHq5u88P3ESqOdnsU6:SONa6/AHq5u8i30OqU6
TLSH
T17D020B396C787C7B9DE3AD15B5873B179FA4112FE6942F84D9E8161C00E729C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d6a751e-e0e7-4b2e-afa9-946a9ab38df4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d6a751e-e0e7-4b2e-afa9-946a9ab38df4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff62335d-5c32-4472-a368-772874f3a0fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff62335d-5c32-4472-a368-772874f3a0fa.tmp
Size 18KB
SHA256 d5dfbc3aa64a2ef75cd078f54a9d6be8a2e6e5601a764ffbcc6bfdc6b8dcb972
MD5 e60883d421b7955554433dfbd3a223b6
SHA1 3377b676bc39683393366489ff0df98ccdb4af8e
SHA512 5758a0510ef6063d56fe3e2999a46460ddfaea051cbcc80f6bfd139e6dd0996d82285bc40202631547ac6c2bc293003f1add0b084f95a1f9aaa4f7b09517e63c
SSDEEP 384:x3yFaeO8WsN5QOitOR1+p5u8i3xKLOga87IOj:x3IzhWEMk3oLOgvN
TLSH
T198828C726C34AC2BAC93B560F48737579FB0446BE7CA2F94C5DDAB1D09DA1D8030BA02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c18a06efde84f874b3335b190d6e6d8c4326aa886473dcb2cddcdcd886cb0772
MD5 279ab4534dbc6e0fe5028d8e1f3d9d9a
SHA1 dd256e7f8217740ad899bcda9a7a638b1763dcb7
SHA512 ec24b0bdde19842b100b02456444334bef5414c1d6c87cfa325a9edb505d9e791426cf21287933ad4756613b1575a84f6026d718f6d9a24137655de9703cf690
TLSH
T13541E95CA6FA1148B3B7AE5A9BF7A87D447BB9372E06D46E00010D4F0A66B40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download