hxxps://transfer[.]it/t/CqeeBrhRRRSa

Analysis

user interaction
yes
max time kernel
1049s
max time network
1027s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://transfer.it/t/CqeeBrhRRRSa
Sample261011-c8lr3scg28

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{2236D765-225E-4FDD-A5F3-0F7C358A3562}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5872	msedge.exe
5872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 540 wrote to memory of 3084	540	msedge.exe	86
PID 540 wrote to memory of 4044	540	msedge.exe	88
PID 540 wrote to memory of 1116	540	msedge.exe	89
PID 540 wrote to memory of 1116	540	msedge.exe	89
PID 540 wrote to memory of 1116	540	msedge.exe	89
PID 540 wrote to memory of 4700	540	msedge.exe	90
PID 540 wrote to memory of 4700	540	msedge.exe	90
PID 540 wrote to memory of 4144	540	msedge.exe	91
PID 540 wrote to memory of 2080	540	msedge.exe	92
PID 540 wrote to memory of 4144	540	msedge.exe	91
PID 540 wrote to memory of 4144	540	msedge.exe	91
PID 540 wrote to memory of 2080	540	msedge.exe	92
PID 540 wrote to memory of 2080	540	msedge.exe	92
PID 540 wrote to memory of 4316	540	msedge.exe	94
PID 540 wrote to memory of 1040	540	msedge.exe	95
PID 540 wrote to memory of 4316	540	msedge.exe	94
PID 540 wrote to memory of 4316	540	msedge.exe	94
PID 540 wrote to memory of 1040	540	msedge.exe	95
PID 540 wrote to memory of 1040	540	msedge.exe	95
PID 540 wrote to memory of 2848	540	msedge.exe	99
PID 540 wrote to memory of 2848	540	msedge.exe	99
PID 540 wrote to memory of 2796	540	msedge.exe	100
PID 540 wrote to memory of 2796	540	msedge.exe	100
PID 540 wrote to memory of 2840	540	msedge.exe	103
PID 540 wrote to memory of 1428	540	msedge.exe	110
PID 540 wrote to memory of 1428	540	msedge.exe	110
PID 540 wrote to memory of 1752	540	msedge.exe	111
PID 540 wrote to memory of 1752	540	msedge.exe	111
PID 540 wrote to memory of 1752	540	msedge.exe	111
PID 540 wrote to memory of 5396	540	msedge.exe	115
PID 540 wrote to memory of 5404	540	msedge.exe	116
PID 540 wrote to memory of 5412	540	msedge.exe	117
PID 540 wrote to memory of 5588	540	msedge.exe	119
PID 540 wrote to memory of 5588	540	msedge.exe	119
PID 540 wrote to memory of 3452	540	msedge.exe	126
PID 540 wrote to memory of 3452	540	msedge.exe	126
PID 540 wrote to memory of 5852	540	msedge.exe	128
PID 540 wrote to memory of 5852	540	msedge.exe	128
PID 540 wrote to memory of 4148	540	msedge.exe	129
PID 540 wrote to memory of 4148	540	msedge.exe	129
PID 540 wrote to memory of 4148	540	msedge.exe	129
PID 540 wrote to memory of 5872	540	msedge.exe	130
PID 540 wrote to memory of 4924	540	msedge.exe	131
PID 540 wrote to memory of 4924	540	msedge.exe	131
PID 540 wrote to memory of 5216	540	msedge.exe	132
PID 540 wrote to memory of 5216	540	msedge.exe	132
PID 540 wrote to memory of 2840	540	msedge.exe	133
PID 540 wrote to memory of 2840	540	msedge.exe	133
PID 540 wrote to memory of 5492	540	msedge.exe	136
PID 540 wrote to memory of 5492	540	msedge.exe	136
PID 540 wrote to memory of 452	540	msedge.exe	137
PID 540 wrote to memory of 452	540	msedge.exe	137
PID 540 wrote to memory of 2376	540	msedge.exe	139
PID 540 wrote to memory of 2376	540	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://transfer.it/t/CqeeBrhRRRSa
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ff9e5fbc188,0x7ff9e5fbc194,0x7ff9e5fbc1a0
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,6517638536765605435,14703229076562596183,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,2322059529606581612,7513202998152998593,262144 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2512,i,7954341211984899832,17863453833048200361,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3404,i,4746702458087900798,15473844752167190206,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3408,i,16395980272127582019,631961275955328115,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,6163905288203911530,17741651974974419848,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,5846513105385269391,18398311408383107232,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,3782077215049245478,17981314142460727811,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,2498226255278901101,9059786781960461558,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2804727251284899061,15755621398929821055,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,2804727251284899061,15755621398929821055,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,4399344996499892822,9658929000607539883,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6416,i,2100594973228887297,4767262957504974257,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,6053188701627496787,12899298364285493338,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:5396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,15387585622997546212,593343544714291947,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,17067383176672928994,3323479513172260973,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:5412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2136,i,1125671938461951289,12784853395298855971,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1204,i,4922338030825432902,16499952274790087174,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,16170661939464153393,10154401895987650833,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:8
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4176,i,6085548062046711766,10978925395538116993,2097152 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6892,i,13522474409015859818,18312636405029462475,262144 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6956 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,13335131810175256040,1030420201645032640,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,1235762187056733869,6405359668882947643,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=1516 /prefetch:8
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4004,i,6054831222004308080,13861645751690195167,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,10292570732406968746,6299907133508153311,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,6056290571014873531,10680339663858334751,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,10852105271931273749,4746549473557836818,524288 --field-trial-handle=2356,i,2594287744964741384,559591329261355322,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:2376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7d9eded2-841c-4d99-953f-fb74e8ad1272.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7d9eded2-841c-4d99-953f-fb74e8ad1272.tmp
Size 18KB
SHA256 d1781387b3e0704ac57b85c33a1d300d616e6b4b0841898969c50261761efdf9
MD5 044b1ebe52344ff4c8c0fec209bca4b7
SHA1 514fc0a3f3f2a01bd49f286e6bd1c9571b321482
SHA512 0952c5bc0685690d7b2f055a293e88aef2fa5bf5bedb0ac408a32d5f0f6850ea8dd7e3a95578df53b827434aa689ce23fd814a2205ca71c580a456d32de308d6
SSDEEP 192:uHm+xasuheOwQxMGsNG/QCL5UbWMWQmiU1xFQ0On4h//YhcaoPqzlatljja6ZfRF:VZcIhsNG/tubpyrlO4h//Yh2oIfRF
TLSH
T172827C746C34ED3BADE7E141F18632138EB49077A7C95E98D5DCAB1D01EA1E8630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

1c263d0f-044f-45c9-84ff-e69be917b260.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1c263d0f-044f-45c9-84ff-e69be917b260.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a68b26c-477c-41d2-9607-0910a4207ed2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4a68b26c-477c-41d2-9607-0910a4207ed2.tmp
Size 10KB
SHA256 1b081455af76acd208939f0cae34491f6468f05db1e2168667d681e96fe4abc9
MD5 e8643e5385a191cd908003c29713df6e
SHA1 cd7d480d7db768e6b267dde5bfd251e92f77046f
SHA512 fe4a407baf4eba483f8190ff7be59a470feec2e174966efae053bbdf62af0c66be18f6e22fc00c52f039cc9f31135448b1ee1d4d3612d6d3db17dba278502086
SSDEEP 192:sxZzRDWR/f2szwIdpBnHW6+WNm43/Y36iHQIg58J:sxZz8R/f2szRpHbZ/XPa
TLSH
T1D522C7566D386A7B8CC7E20DBB55BF13E2F9503262D11E48A6FC961C05E76CD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b5f99c0-1913-4122-8fde-cad9286c7c25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b5f99c0-1913-4122-8fde-cad9286c7c25.tmp
Size 10KB
SHA256 dcfb7f75802673863e15e7ef76d48ab0b6c234775122b839579a341162d0dda6
MD5 5551dc476efed48bd325baa215da7dd0
SHA1 8360f471f9234a73800e2de6a9aa92dabc34087b
SHA512 486da3ec7f50ab229f1df395b5dedebebcbb292a11c7dd8a28f9a8162fb56e55f294ce0b93ebb4e5de53fe346e6672dc5a82026c7a2976b54bf6badcc6cf4ca0
SSDEEP 192:sxZzRDWR/f2szwIdpXnHW6+WNm43/Y365HQIg58J:sxZz8R/f2szR3HbZ/XWa
TLSH
T1F822B7566D386A7B8CC7E20DBB65BF13E2F9503262D11E48A6FC961C05E76CD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e83d5fb-f919-4715-860b-dcde6192d723.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e83d5fb-f919-4715-860b-dcde6192d723.tmp
Size 10KB
SHA256 ef92a517e2f3dcd417b29e5885adca4817180c13b6ea88f382ca141c1b894af9
MD5 988dad8f78d3fe614dcc4be1aef0a677
SHA1 16f078869628656456cfab8e859d5fb0c7239a26
SHA512 d0d9cc3a00e89fcb9a9ff7ab7c395db204bd2799553331aa21c485d0b5f31eab4ad41e3c8190e5cf8523f38ca5eec007201adb508ab718b954bbf3cdc2fbf6e6
SSDEEP 192:sxZzRDnR/f2szwIdpXnHW6+WNm43/Y365HQIg58J:sxZzFR/f2szR3HbZ/XWa
TLSH
T12E22C7566D386A7B8CC7E20DBB65BF13E2F9503262D11E48A6FC961C05E76CD630740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 c489c27e3b816ccecb15f2e37169dbc0db6b2e745da08116b31dc033e616f827
MD5 4e711df3ef90ff9aabefe2f06adb12aa
SHA1 799035058cd62657543191d8093c54ca00a148c8
SHA512 d7a5bf126c9e5c06a83faacd36eb7a7ce8290b77a30e3c09189a98db3160323d301606033670d4aa8861a6ecada9f8854cb4ff5a38918047fe3df7a256c7053d
TLSH
T178E0208905C4C31D5304E987517C431C8390366A93C4BE1F27C4C94A7105394A6F7650
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 589268cfb5c2e478349e48ae2aec5b7f458da19a092b22bf3fa209477dbf2993
MD5 5b171376af6db0ccb79e6b953976f7a2
SHA1 3b40bddb87e03f4a23ac8c2395e2bb5ec9f67611
SHA512 6884ae1e8c0ad9d764ecf1d6ed47fc60af413f032e9bb90b2f2bc0ae2b7e33c998e1a5d51cc3dbbc8f55b1d79acde8a53fe5ad3a55ccd5492f61dd876761b044
TLSH
T193E026850AD8C23FA348B5C74168830CC384366FD7D8690E2760CAC9718BA50A2CE690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d37933d6e7282bb7a6c0ac72a5b9c7ee0371d279dfdb45518f6d593423e858ae
MD5 9716bca8ac86d1314c8876d8ddc13fd6
SHA1 e38ff9cca67dd56dbd83dd76851f65b875ca106c
SHA512 be65ac36024afde8e9c8b6c8593e6de47e2832ebdaaab934262bfa289d5a2982afe97806f3194b2314690d36119e846fd80545256437baf4d5a888c2b33e527f
TLSH
T180E0268407C9C2AFA308A5D74178835C8390366F93C9A90E2744C9C97087644ABAE6A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 80e3e5c8f46932ab3d3bc0e00e287dd4ac3b98b07a70e9444ab8bb512c0284a2
MD5 310e842bf2de43460443eb34fe6ea694
SHA1 6713b5173131e2c6d20806368e63970614b2ae06
SHA512 2e87411e8a5b53d33d641428cf091bbafaee76458fcd6fb5a834127d4d53f2efb480d7742cded37b6fccc26bf1d91c72469ce9dd447dc5f3bf79b41631b0672c
TLSH
T13BE026C604DAC23EA30AFA8742B8630CC780B65F93C96E0E2788C9CDB046340A2D6690
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 556f9d806aa3ba5dc63eb4a3739be4765f76d045ab9677a3d56120875b86fd6b
MD5 41e84f911064737f77764d1814319c85
SHA1 d41db21e419d84b37913502ddb2e6ac1fbed14d7
SHA512 e5625455210d99c37ea313ec893537cf77e32dc72773f05b258e798fdcf61cf576ea98f7e190adf67337c71d6830efe22b02a2e972518020abb18ebee72b41f5
TLSH
T1F06197808C80C1D9F3E16373A1C72CABB5BA50811EAB0EA1597EEDFD8846F165684E34
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 60e6789465fb92631140741b8f62f3e98e936edf14816fc2be237a1e4c73e13b
MD5 2b28b7ac248c5dbd43e69597e345027b
SHA1 2ddc95be6c09bb3cd737d360655fbc7a440fb05e
SHA512 12130b9fd28db28e69a14ab4c311f798b87118387507d001f70f4a201a390d0e3f211e8db41311e58efc0cab832f871f5c72517ede62d4733a9b87adc818662a
TLSH
T18C6198808C80C1D9F3E16373A1D72CABB5BA50C11DAB0DA1597EEDFD884AF1656C4E34
MD5 SHA1 SHA512 TLSH

Submit Download

54060ec9-b472-4560-b151-fe24158e760b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\54060ec9-b472-4560-b151-fe24158e760b.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

03be5a41-4cc2-4481-a44f-77cf594a5f67.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\03be5a41-4cc2-4481-a44f-77cf594a5f67.tmp
Size 1KB
SHA256 223f9795680618ea5a07fed4a3b0feb71b4996c5784606825b4d0215cabfab99
MD5 80efa33a3a1992bc989bfce7bc8086fa
SHA1 85d68915f74cd3880124743238be249258494560
SHA512 0e8db8516afc6abf0c7929c436b6ea25fb51b9698ebff36467e5edace162a1e58b142279521690abdf5a1811dcc97b8a7c9d9fed4a7204d6292f4fc7b808c07c
TLSH
T1EC31CCF783B185AEDE1152F09A14AE2FCE6C0106431C7C6986D0AF27A7E3471E001B5B
MD5 SHA1 SHA512 TLSH

Submit Download

94772477-d3dc-4f2f-9a6b-2e2090829144.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\94772477-d3dc-4f2f-9a6b-2e2090829144.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b379105c-a65a-4ea0-a01a-039d02d6f6ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b379105c-a65a-4ea0-a01a-039d02d6f6ab.tmp
Size 1KB
SHA256 834a0183dcd7fa415a1b24968836c82a3cad8cca719999f723b28888f65273fe
MD5 cf1f834cb461dadac9caca7ca1e702e9
SHA1 01b94ddf6dd4526aa917ffb46d6d52e5608a1bf1
SHA512 23eef10a208800e837ea56cd249b413dd5840d4c95f43be2a11cb0917e8644ed25204f81d29127d5c1247090396e629ddf88fb1e1a7c740d095efa342a5fa462
TLSH
T1FF219CF383E1956E8E1156F05A14AE1FCE2C0502431C7C2989D4AF2797F38B1E101A5B
MD5 SHA1 SHA512 TLSH

Submit Download

d1c029dd-ae83-47ed-810d-90074fd73ddb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1c029dd-ae83-47ed-810d-90074fd73ddb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca0228ce-979d-4f91-8831-cd3ef9814842\index-dir\the-real-index
Size 768B
SHA256 3f42d039f0ec5f1719e7a167d1f5d605a4224f92c21431de5be1e146d5e7a76e
MD5 a624a1f14e7f7fffa30fe344af355628
SHA1 e8f58d8f21d257d3918cb68eb3f8a305709991f6
SHA512 e7a5ceb63c08f930edf47ccd81c99bf7e42da8c22cd00c245e3ddb23d19e48a30ad1e2d62fb4f61671d2f8689285653732e5666ffc8c2d17f57e57a32d37d697
TLSH
T19E0120D641138A43FC400370DA3CA8162166804463A1770FE3BAA026CC92B807D83EA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ca0228ce-979d-4f91-8831-cd3ef9814842\index-dir\the-real-index
Size 744B
SHA256 79644738e9c7de9579ad8595c498eef07ac0cad77254e49e4673ea2f3b8f3dd7
MD5 2b62655dd25a96efc3443df1c22c1f1d
SHA1 06c886de606522db2354a6fadce16e6f60234f47
SHA512 591873dc6b85639a0d30ea8a48a42b05c06067b870c0c54c66c0ebd991ad73a2ba408b895142c5a6a0ccdacbe3d368fafa6a16e4737ad06c42d458110529069d
TLSH
T1D70120574E130E17ED140935A83CB885B27403EC83113A5F61FEC02EDCA77C0EE81294
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 4ee51af965b0a91cb993f29ddf52fc4c081deec3f20fcd9bf0039c6142215e5f
MD5 78da3202085990de3dc31d08eccf6465
SHA1 34b26d9f367a45d9f36403ffb9e8c306640a1173
SHA512 c52bb9b15915211be1ecd202c51d50052367fb88cd1648d3e85678a5026431b58e83a253a6234909455a8bbe0f01f954b7904328e62a2d396d352d59bdb1b1eb
TLSH
T1ACE068763DF75810EC6FE7D6143168B00018B944D415FC4F613D85D724A27146059C21
MD5 SHA1 SHA512 TLSH

Submit Download

b43f74fc-ee27-4314-a0d2-49f91c013972.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b43f74fc-ee27-4314-a0d2-49f91c013972.tmp
Size 27KB
SHA256 abdae4b1787f6631665aa47315f74e990eef6ddf8f568ebaaac744fbb87c8145
MD5 ae2f728fd532648c1371dc9d8568ddc0
SHA1 7911bd4e77d91ddb4a4653cf068f0f2c919ec32e
SHA512 0d9d36f8dcdacabb8c924f63db90efdd7b4387834ef121e813b4834da84b205607e87563ba4bad8cf684cdd483fac3d11774c945bf947ed5faa52d44704ce463
SSDEEP 768:2QKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/1roRu:2QKlm7QWvUYe0u1ja8/L/E/ORu
TLSH
T121C20B3B740CCB7E4FC04A9DDC5A6F976EA802C7A6588D4047FA994C02C77EA91264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2109c44-d9d8-4ee5-8ee6-4a003308a13a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2109c44-d9d8-4ee5-8ee6-4a003308a13a.tmp
Size 24KB
SHA256 f12ea8144e9f9fb318a02d3b487098256a7a53cb7a9c98da93d160ba5a338798
MD5 1000f61aed0efa648a89a05b0da8b6d6
SHA1 596dc96ae6b9c1fa2611dae7cb56435e00c60d95
SHA512 b0b44434c6d9bf06bd912569a24227b85c880605279c85e4cdbf997125c9a3d7d903618dbba9f9a348da20a0757f5d8c6fefd7bda7b462adb9b6916a63a3ebe6
SSDEEP 384:sxZzFR/f2sp66s8qMpRiYnazAW8pZS15posJWeT+0R3HbZ/XLa:srFR/fX4Mnc7WeT+0xHbdm
TLSH
T181B2F805A924D83B9EC39D18693DBE33D9EC506222C5CEDA16ECCA1C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca6ae7bb-72b2-4a11-8b1e-76e8c005f1f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca6ae7bb-72b2-4a11-8b1e-76e8c005f1f0.tmp
Size 10KB
SHA256 3ab06e4178ca247e9beb41aa5030337276e82a6a215150835c04c5024dc83819
MD5 7a0c8a6403838338f74eade693356848
SHA1 fc12fcd56f2639be3bf5f9aeb76292b1e6aac430
SHA512 a61096f5ab2ed156bd3927aa2b287b0d3be9a65ba74d45ba15b7f0b44fa9c1051e5e4ff2566bc93b7b06cb9d91d4ccd78869d983891077fbcf5ef53f42b427ca
SSDEEP 192:sxZzRDWR/f2sBwIdpBnHW6+WNm43/Y36IHQIg5WJ:sxZz8R/f2sBRpHbZ/XtA
TLSH
T1CF22B6566E386A3B8CC6D20DBB65FF13D6F95031A2D11E48A6FC961C05E76CD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0d8da89-05b0-45fd-9839-7e631c95b835.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0d8da89-05b0-45fd-9839-7e631c95b835.tmp
Size 9KB
SHA256 ac2836ab0ab96527c96bd11f6caed2bd12c6ab1a6d32aea9d78768234b124555
MD5 63aecd8ff687683ab351a258fe6f10bf
SHA1 061af136919c06f9c9c8d146e36140a2475acb05
SHA512 6592806a408a6b49b2310256f8239767047ae295ec492b826f248d2b57a1c9a18f8d0e11d6c631a73c707b559ca4a15adebbb6994dcdb6d561955e48b1dea31b
SSDEEP 192:sxZzRDWR/f2snwIdpBnHW6+WNm43/Y36IHQIgrJ:sxZz8R/f2snRpHbZ/Xt9
TLSH
T13222A6526E38693B4CC6D20DBB65BF13D6F95032A2D11E58AAFC961C05E76CD630780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08f89b0f-436c-427d-b296-b202ed58fff3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\08f89b0f-436c-427d-b296-b202ed58fff3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a478c8d7-dbd3-4d3a-a153-c60393900e9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a478c8d7-dbd3-4d3a-a153-c60393900e9d.tmp
Size 21KB
SHA256 21c1c48dfdddfc11ad29be3da0faa70458ea83da85e6b04bb00d5130b16eb1ab
MD5 fdda72b972a589289f5377284b3a2cbc
SHA1 2361b3e6f86ee9871814421046814cccc57d1c76
SHA512 fdef4fa5ba629998fc4041a42217a168b0b0afcc8ae8a353629c073797e4bfdd9da08003c3820a94c3120a5b929ca812199b5857f3d914dc0508459c73ee98de
SSDEEP 384:WiFiZcI+zsNG8TUNTUlIl/tubpyrlO4h//YhkoIfRF:9FQevwgNOE/QGoIfRF
TLSH
T131A26D725C74D93BAEEBDA41F58A32138EB440B7D7D59E94E6CC6A1D01D70E8130BD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a4e1184d-3856-4791-819c-34b7e8f989e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a4e1184d-3856-4791-819c-34b7e8f989e1.tmp
Size 8KB
SHA256 f348894586d08d786980ba3554774ec063a477c416cfa89afe7b752529f6b2e5
MD5 9fd95306ea391190f07115f094292224
SHA1 7dc4b56a4b9f6bac92320e025076c0540757e9e5
SHA512 9d76b549f495dac753cea24088c7ffc7ddfe255849f6549d5c80be38b26560e57e3f9e3dd4fc708547aa9117b0b4f7d8a2c74401c1fd1450bd9251e058199157
SSDEEP 96:KqONkrQsjpfbUmjH5ih/cIPURHl8h4otop5taD7BKP4v+Y1xf//ojdoxTeYzqsoW:BON/6JUm0QmiUyuFso//YpBCD1EYU6
TLSH
T1F902F839BC74ACBB9EE3AE45F48777239FA4106BA6915F44DAD82A1C01D725C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eef73ca3-dca7-41c2-89de-7bb6b1773d59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eef73ca3-dca7-41c2-89de-7bb6b1773d59.tmp
Size 8KB
SHA256 cab365dfd2401b1ee02bb2ffc5aa02e842bcc1bf65ebb7fe01350a84b896707b
MD5 9392fbe6172bed409a904cb5fc5f1431
SHA1 a7645cefec7b3d180a6ad7d45061031aeaf78f2b
SHA512 8b5a4254eb1eab0d35a796f5ed1bfcf65c7e7060e3ea3cc3d56c075b9c9ce41d67f6ee934f36f1b141c096b993db55fc416f4d1b0c2fa33f5df473a92d34e4b1
SSDEEP 96:KqONkPQsjpfbULH5ih/cIPURHl8h4otop5t5UD7BIsP4v+Y1xf//ojdoxTeYzqs/:BON36JU8QmiUyDiFlo//YhPNxPqzU6
TLSH
T14E120935B878EC779D93A584F08776138E60416BEB856F94D6DD3B2C02DB1AC930B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3665e9ef-a39b-4af5-a459-bb79f059025d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3665e9ef-a39b-4af5-a459-bb79f059025d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

ff68ce5d-4955-4ade-9f00-a0f3afd96c77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff68ce5d-4955-4ade-9f00-a0f3afd96c77.tmp
Size 18KB
SHA256 58f200fb66261670ec48574c473f2ab6507aaa0db5c7341784b83c7059a4d2b2
MD5 70aa04d8923d0b4b16bea78b0bff6958
SHA1 6d0833a20bd4de930a027caa36dc5ee25f97f265
SHA512 4e603e5e62668426e87c01cd60d583a870a281fbad9711068fcd1e9e311d68c057296144b1aae6034126fe902c1a110ba4d81c7abc4cb2e7ade3f3d577863c3d
SSDEEP 192:urm+xasuheOwQxMGsNGSQCL5UbWMWQmiU1xFQ0On4h//YhcaoPqzlatljja6ZfRF:1ZcIhsNGStubpyrlO4h//Yh2oIfRF
TLSH
T17E827C356C34EC3BADA7D141F18632138EB49077A7C95F98D5DCAB1D01EA1E8630BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d64a18fa1420b5ef86b96bf6f4db3cf15383d515125667404dea986ae9c18312
MD5 1dad892fff767a3180d7f4a339e955c3
SHA1 383466976f7e46e8bb00d5160e34b3fed2195f37
SHA512 6edfec3dc5a003e585ba6aa9b826dc6ab52dd9a4920f3b91c9c8454a1d85c3ee896c144925de9af4dc8b4a550020a1a23a3d13e272289a3972ea08d4bbdfdebe
TLSH
T10C410758A6E91148B3B77F569BF6A8AE487A79732F06946D10110E4F4A32F00C972B37
MD5 SHA1 SHA512 TLSH

Submit Download

59c4cdc3-ffe8-4098-a6d0-64c84ae358b2.tmp

Path C:\Users\Admin\Downloads\59c4cdc3-ffe8-4098-a6d0-64c84ae358b2.tmp
Size 15KB
SHA256 08d6b62543fd7a4c39c971d17dddafba6483d025bdf1dd19833e8cbdf9c07dbc
MD5 ddff988ee8d1ed2559ec8bc60a8101be
SHA1 5d627411cf61152e82b9f5b6b2ac1a7da9bf878b
SHA512 13d1efe554525563e9ce242516bc8aca42643c8f9d58c35bf58857ac70f55fafa3255d712b42b41c0c00fd4d716b191dfc5f3cb3d50bd75b5b9b0c98413d9b88
SSDEEP 384:rjHxaJtMd65gojDK4H2zZ5uMfgmmvqP5GToWw:ngRqojfH2zZ5uEgmmirWw
TLSH
T10C72CFE44585A260E4E5B4711B93E27D933A73E887F3A247DA340B80B6D2E4F077466F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download