hxxp://109[.]206[.]96[.]249[:]8080

Analysis

user interaction
yes
max time kernel
900s
max time network
903s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 21:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://109.206.96.249:8080
Sample261012-1gcxvsfw21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{EB6E7D81-59BB-4871-895F-D82F5762E7D7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe
3936	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 384	3936	msedge.exe	84
PID 3936 wrote to memory of 4800	3936	msedge.exe	86
PID 3936 wrote to memory of 3440	3936	msedge.exe	87
PID 3936 wrote to memory of 3440	3936	msedge.exe	87
PID 3936 wrote to memory of 3440	3936	msedge.exe	87
PID 3936 wrote to memory of 3460	3936	msedge.exe	88
PID 3936 wrote to memory of 3460	3936	msedge.exe	88
PID 3936 wrote to memory of 1064	3936	msedge.exe	89
PID 3936 wrote to memory of 1064	3936	msedge.exe	89
PID 3936 wrote to memory of 1064	3936	msedge.exe	89
PID 3936 wrote to memory of 2600	3936	msedge.exe	90
PID 3936 wrote to memory of 2600	3936	msedge.exe	90
PID 3936 wrote to memory of 2600	3936	msedge.exe	90
PID 3936 wrote to memory of 1088	3936	msedge.exe	91
PID 3936 wrote to memory of 2340	3936	msedge.exe	92
PID 3936 wrote to memory of 1088	3936	msedge.exe	91
PID 3936 wrote to memory of 1088	3936	msedge.exe	91
PID 3936 wrote to memory of 2340	3936	msedge.exe	92
PID 3936 wrote to memory of 2340	3936	msedge.exe	92
PID 3936 wrote to memory of 1148	3936	msedge.exe	98
PID 3936 wrote to memory of 3840	3936	msedge.exe	99
PID 3936 wrote to memory of 1148	3936	msedge.exe	98
PID 3936 wrote to memory of 3840	3936	msedge.exe	99
PID 3936 wrote to memory of 3772	3936	msedge.exe	102
PID 3936 wrote to memory of 4040	3936	msedge.exe	111
PID 3936 wrote to memory of 4464	3936	msedge.exe	112
PID 3936 wrote to memory of 880	3936	msedge.exe	113
PID 3936 wrote to memory of 3708	3936	msedge.exe	121
PID 3936 wrote to memory of 3708	3936	msedge.exe	121
PID 3936 wrote to memory of 4296	3936	msedge.exe	125
PID 3936 wrote to memory of 1468	3936	msedge.exe	132
PID 3936 wrote to memory of 1468	3936	msedge.exe	132
PID 3936 wrote to memory of 8	3936	msedge.exe	133
PID 3936 wrote to memory of 8	3936	msedge.exe	133
PID 3936 wrote to memory of 1868	3936	msedge.exe	134
PID 3936 wrote to memory of 1868	3936	msedge.exe	134
PID 3936 wrote to memory of 4488	3936	msedge.exe	135
PID 3936 wrote to memory of 4488	3936	msedge.exe	135
PID 3936 wrote to memory of 1780	3936	msedge.exe	136
PID 3936 wrote to memory of 1780	3936	msedge.exe	136
PID 3936 wrote to memory of 1700	3936	msedge.exe	144
PID 3936 wrote to memory of 1700	3936	msedge.exe	144

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://109.206.96.249:8080
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9527ec188,0x7ff9527ec194,0x7ff9527ec1a0
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,17483351078884887389,17316542940060743954,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1900,i,2271324533752639675,16467150200060530141,262144 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,13383994165067968456,16321257640330142550,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10141306861387585181,10413829369454163552,2097152 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8201900876154458094,7734776311287082017,2097152 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,5754911845744984821,3776553453430816533,2097152 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,5509245639357129438,4084723750814251298,2097152 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,9198037102661840539,11256747523088079673,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,10982069036977895902,11359695869553511584,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7148238458092007218,9748653213342094720,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7148238458092007218,9748653213342094720,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,3686865525372272648,6288463704985041294,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,7489034713225701204,9294408471871804964,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,10736887320521693998,4007878026289935691,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4520 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,14733307002212003585,4571696535612603466,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5144,i,1056783773688280896,3164246816124876284,262144 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,2927166391382372478,15283128181244038875,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,13574495390882549740,16494620136406460894,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,12761176641674893691,2220343827553455188,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,1680910490429325212,4472444329380702556,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,13736522871069981746,9974465973466998087,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,1262427126933839780,16448140705956774978,524288 --field-trial-handle=2288,i,5388495793756469052,4663294344321309755,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

109b10cf-999d-4130-84c4-6626229c14c8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\109b10cf-999d-4130-84c4-6626229c14c8.tmp
Size 8KB
SHA256 a09078a991b92afab5f6d7c310b1998a6adcea0771ee04822ed901466a9604d9
MD5 11e19a3d984089cf55510b879055e333
SHA1 7867a6b626492300f7dc50119eaa4826eafeef79
SHA512 a3b26b0b8683a27d3390194c240d70888464e6f4e8683edce9ed81d3995fc50d5fb5020ee45eeab9c412e182b5e30a4790564462750645268cfb81071f23da59
SSDEEP 192:LJONC6DphmqQmiUyxIq8wGYX59ezHC6mEkk7aaU6:lONC619hRwGYX5EG6lU6
TLSH
T12402E935EC787C7B4DE3AE45B48B2B175F98212BAB912F84D6E81A1D01D728C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3626c923-84a6-4674-9f27-47bd141f34db.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3626c923-84a6-4674-9f27-47bd141f34db.tmp
Size 25KB
SHA256 0f740400cb0a3d0062c803dc662fa2b6a6d655836b63d9fb89b758e6f0d61ec0
MD5 26a38926b7be7b3b82c24709ba10b6fe
SHA1 e20ef6345c0c66beea3fb9d4a4f1ff53c250cba3
SHA512 c580a77085cf0f572521da08b1c722298b736ea19d2fb7af85b2dbcd23bac3a23fc2fb7ff2472160f0c2d90d65621fc40d1b90287f3051f438bcbe8a50fafa57
SSDEEP 384:aiFiZcIKzsNe8TUNTUlIlyr59INBvBGYX5EGQUFivi4/uANEbEeU1:RFQC3wg0K5GYuGQJvLJCbET1
TLSH
T1DBC23BF298E7983AD9AE5B43E77D2D034EBCD027B6806A50B3D9551CCC960BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eb8b778-8593-4f47-bcb5-2a61997e7643.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4eb8b778-8593-4f47-bcb5-2a61997e7643.tmp
Size 18KB
SHA256 e04af53f97d1b4593900ec79e81f950bb13d06d86a355c9f0ea261d79d274df9
MD5 625b3cc0838a1633330b61bbbc6aceac
SHA1 90257ce3201323dcb6d61784602cacc082b5b23b
SHA512 a3fffd7e7eae6f6d04ee99bc7a0ddecedc960d4d4189058a7a05ecf1a2a0ff837e33009b20bfda412e18374a023d09b7f5ed3638049f46693ff47012398b2247
SSDEEP 384:ZZcIhsNO7r59INwvBGYX5EGQUFcvi4/uANEbEeU1:xh1/5GYuGQRvLJCbET1
TLSH
T191827D72A8B4AC7B5DE3A641F48A25134FFCA127E7C06F94D5EDA71D01EA19C130B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98b6b01e-0071-4585-bc87-c5676893dd34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98b6b01e-0071-4585-bc87-c5676893dd34.tmp
Size 18KB
SHA256 b3c63616e93dc5224b6906845519b4502b5b32af1e3441a3d6d69f6ff13dc8ac
MD5 3d8f004996ddc6573b5a30f0cbd9f572
SHA1 76b6897761ce0d88e8cda8242a57b5a4e39dea1e
SHA512 379fa9fce23bc5a4b0192d619b36e07f4ba6e22b5bb1b2ebbf7bcbaf9dac3b4802aeb46dbc20c4d1a155f085096b9eb2ae324034d0925fd0cd4566f63ebbee5e
SSDEEP 384:CZcIhsNOyr59INwvBGYX5EGQUFcvi4/uANEbEeU1:whM/5GYuGQRvLJCbET1
TLSH
T1BF827C72A8B4AC7B5DE3A641F48A25134FFCA027E7C06F94D5ED9B1D01EA19C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1cc89f8f1c9f75d127814445edc4d6d9314209d3b11e5a2b4cc826747683f30
MD5 3bc9cc32c2de3150dc7916bb61984962
SHA1 d75ba9bc7ad74cb95dcb4ec6de6e6b18f5813a04
SHA512 fd090e624e91a98337689ed57390fc5813fab21acd3af426c9de6566ea4d92a7875c4f92a1b64d547eaf9ce40cad3d8a85472a30cf521aea6198cf74b69805ac
TLSH
T12ED02232ABF00E82C80B0032082082880F08C03C0800B323A23C20AE2A82CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

27f1ebb2-8bcc-4006-83c9-3fc31a47bac9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\27f1ebb2-8bcc-4006-83c9-3fc31a47bac9.tmp
Size 24KB
SHA256 a0a33ae3a5c2dfe8ea234d99cc1eab0a08150cbdb258b58651c23a463d14105b
MD5 4d26105f416f8f04542255b2b3b11408
SHA1 e49c7fd4ec6142366202346d434fb7e96b2ef38c
SHA512 5a0b2290a217b7adb2ad70552d3c7c5d41d3b321a80adae993a01cc2b5ecfd495b355ffec838a4be4afccee551a3229fbf5944b692c7a36d93ece0b6e3d0fdaa
SSDEEP 384:sxZ4H1/fHsm66s8qMpRiYnazAW8pZS15posJWeT+Gs34HbfUEZYrV:swH1/fj4Mnc7WeT+G1HbfU8Yp
TLSH
T1CDB20905A924D87B8EC36D18693D7E33D9EC505222C5CEDE1AECCA1C029D1FDAB47867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38c818c1-8dcb-458d-8b3b-ec4543d90983.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38c818c1-8dcb-458d-8b3b-ec4543d90983.tmp
Size 10KB
SHA256 db15b65d7ae550cb305b403761b88d4b9c1463518e2ba52681bf2ecb1fb5738e
MD5 3358c34a717fb8db5ea1ecda2dfcc905
SHA1 04de85d38de49c31f8e3c4ec9f3237007a1d2d16
SHA512 3d4b4d15e688f61ca2401ffa4239da8ba17b4ca73f12ae393674b1f02c4bc09a1f59bb65444a2655a3f74f8885d6ec6c313425a5c637aad755b0453892c4caa6
SSDEEP 192:sxZ4R6W1/fHsU4zIdpBolHW6+WN+2o/YgIyF0Ig5yrSJ:sxZ4H1/fHsJsB4Hb8/WV
TLSH
T1E122C9116D24AE7B8CC7E30DBB55BF13E6F96072A5901E58AAFCC61C05E66CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5079b65c-4695-4177-b9d1-e346f752b9de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5079b65c-4695-4177-b9d1-e346f752b9de.tmp
Size 27KB
SHA256 39aca78ec51ad23a28f0b25f8d322bdad0e3264aa09989eca94f4c8ce9519771
MD5 3b7d614f42b63d4ea649f3ecee973f09
SHA1 a0df753f3ef6f1844b9fcda0ef2f899130f7b9f4
SHA512 f9911472f297956f707fa34a32debe67513067c3b5e539a5364526aa70dc11746d76ae1c9adc8a31c62c5cd7d3812e7263e4d16fbf53d44c488587790c15ac0b
SSDEEP 768:NjaichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzjCroWiI:NjaichfPWvPZplu1jan+LKgzjZVI
TLSH
T132C2FA3B640CCB7E4FC01A9DDD5A6F977E9802C7A6688D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d959974-f4a1-4fec-9003-bde11df45524.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6d959974-f4a1-4fec-9003-bde11df45524.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 293B
SHA256 8c3e2e7499d6da9060e70b399102e58a362dc38b07ffbd01e87866475dd98de6
MD5 eecab1aaf85c97284b789c757a8e3904
SHA1 a4a91cd6551295e1ce285fd860ddb59e635420f2
SHA512 4ea5b9a7fac2530ac1996f5247125b245f5bc650e9ac1a67a6ba5ebecca8e509f486f2d4bdfe34a98e15b25c8573a4676b0b8018b4377528e58d64e189623f19
TLSH
T11BE02BD94AC4C77E9344A6CB4628874DCB84632FF7C0BA0F4F18D948714B988A69F6E1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4e3da53b2a51d2da48e4005bdaf99644adf52f9e6550b05ba105717823657d77
MD5 57bcb814b0a0be0c14b9d9bf4fb7b82f
SHA1 c4d56cd17896682920051cd2bc899eaef8769185
SHA512 cbf4adc23188e9b1214ba26169bba14f4ac8585f251a6cd9ac2c292f16be69741c2a636482226d12e496ce33b804b2fc14b53ca3e41df6b0701ee159d0d88dc6
TLSH
T1F5E026C444D8C32FA70C65971278874CCB81761BA3C0AE9F3B05C985F185B98A786BB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 37a8585f0969b0a3969c3a81108208b83c371b906ebeb30265501698a4663b20
MD5 1dd35261631815134ddf65fd4b6b5bd7
SHA1 c4576cea23898cb2734cb2ff5ab621bcf2d91fcb
SHA512 11fefbb24dbfd09e73e89441bce4874cd630763def1a6ea1f4eececfafceb51e53a1153115d4943a663cb2daf717088c07c211a443d5fdd625b39c42f8095d8d
TLSH
T1F7E026E414C8C76FA30864870168534CCBD0365BA3C4698E1B00CD857096E48E7C67B8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

f_00079f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00079f
Size 80KB
SHA256 f2749e00371bfe1e12236a365e181624bca12719853f0b09c97115c404d11697
MD5 553baa4378e706a3db26dbb123abf105
SHA1 c717fd300e164072d82508b9496dbd4cd1fb75f5
SHA512 a490232a2d9e17b12d067fa26a565e8c26f8faa9cd27c2736998e3318de471895e37c90f32a686b3a9914909fcbe79ebdba68089421e4cc8a4b40b4f363d27cc
SSDEEP 1536:mp+fYi9ZkuUCzDPg1HPHi0M95d/Bp+8IqbS94oK//8kL+1:kuZxUeDP8HaPxBU8IqNna
TLSH
T15C8302918E3764D637E359D4ABAF76621A06CA5E3624C6C7CDA52E08F908E7D363700C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_001759

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_001759
Size 79KB
SHA256 b1cc8c9a00aa77e0d201aac8c41ba604f4133ff7893aaaa14efdd3d11902d6dd
MD5 926856ea5c491fec0c58fa5dd2642eb9
SHA1 6c0d04d8c7e60595af4b723b285cb900cd6388c0
SHA512 70e2941f82386c8aa7acbb6f56ce603420e134d3c8b1a1c99f617a98a658b67145cf393fb1d8c2c21009f6b309f4495edbb09ea3c6c267e51a0de0e0d2640fb4
SSDEEP 1536:mJdmyO30euTWLdF9KNKUWBzsbST/3hwIMmxAOd9RP3hgf:2d00eecgMBzsebhrMmxAOdT3hgf
TLSH
T1308302BF09F16DB40A0E88C5029E876AF44C1E59D0542ED23134BA6BCE55B6CEFDC4E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0019f5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0019f5
Size 80KB
SHA256 51c3bb3bc9b3a917d93aad55ec9f9c5d9676ff98a99c4d4681a36cf8b509b6fc
MD5 c6d687f936263f7a7698cc5457d7ae18
SHA1 546665778208658c5f4c8eef70606916b2060f7c
SHA512 9e2c3fa2e2d695559bd004bfd97845263da3717cfb95d34e2e604c184889bfe6344b67579ee03eb8aa32afc4f1eaba911a866dec71dd34aed7c390b5b565de33
SSDEEP 1536:meKQl8mt4WYHBqmsd2FJXtvLVNy2/5E6/LPjeTGQoa4oVxLxVM0JDHhf:rJ6m1YH4mJXtvtm6zjea1DofxppBf
TLSH
T11E8312B77093964C571A41292EC27A4FC69134BFEE1DCF4ED90C898A9932952FE009DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_001c35

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_001c35
Size 80KB
SHA256 713b6d71e5b003923e4bc9272b3f0561c84fa9a38869aaedf8a5b1e7cbcda1d9
MD5 48a38292a9d8a3342f0140dd29dfd49d
SHA1 443018673159383503645d2cc5735518cda196b9
SHA512 3942777f8c0d7d03c74b11ff1c822e43ca8de28428edc6893bfd14bd6d45dfa60e81a1a5f056fdec2327f1521f0e4b9f9b6eb560a97a8fd56487a181dc1b8d95
SSDEEP 1536:mzaYtsOHHX8Mmjpl7/XqaPwv6MorfEzSWrSt+5WqADmrValo4z0kA7cK:gJRH3wHr4hwfEzSxpqtIu4zq7l
TLSH
T1FF8313C546033644ECAD8F97560BE2FEA564D602EFD3AFB3901994F56C9A08C874C1AF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_002075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_002075
Size 81KB
SHA256 16c8e2f0e59ede178fe95495ab901b07f70dd9d62d42473b79da2024fd67817a
MD5 2f0ed6f84af11c447b88fd0f3fd44418
SHA1 a8d8a04cdc3d619e844bfb5288f9e6c6447147c4
SHA512 7d8d60af05d16f8e212b556d23fe814a0a6d2a2d401f4844b6462a1628572c894985f5948203c075903c52c678cea2d05da93dbffb025451bc66a81687da392c
SSDEEP 1536:mUDrJ3uxzoYfLz+abL5vERq+XDNypbdxSj4CQklPtoXoId20btNVWV8:bfJ3uxzoJaX5FgyzxSj4sPInhPr
TLSH
T1EF83126047C4E7EF58F879CE28A80B98861E76BE3D14D327913DAA90911F087FF08758
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 fcb00b1edcd82378f22e85f3c8573406f55b4908d6bb055ab351268ec38d4a2a
MD5 0fddbcf0c7e2fda1358aa0f2d98118d7
SHA1 e0d85d226f9e1a55b0a6a95dc2f224aa6718e4a1
SHA512 3caf89eb86bd14acd0096d9905be6bc7e05d1f44c6712764b1e89788b3fee13f5751a558b18f56b7bdb4a96f2281c46766050850ece1271b73a267de65fca1fa
TLSH
T18761D8812287837EF777647581CE11CF3E3429C9198B2F22C0E5E578B88F755A31810B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 52009384bf209d56f3b5c9bb06589daf9a9941f3b53620507494744fc3d76dc5
MD5 48e3f9ed27750e38afc0146afcdf1420
SHA1 76d503679e5c26fd9a4a0ca59a9243ef370d7a5d
SHA512 16ad0fbbbd190d7a40030f0d619a041e1049689d002b4f582ccc52fbdee16dc8b8498290f69e1c38a2c8be7bd1efd350eb29e4375c5a1b748727ccd2bad60e10
TLSH
T18861A5812287837EF7B7647481DE12CF3E3558C9188B2F22C4E5D578B88F765A35911B
MD5 SHA1 SHA512 TLSH

Submit Download

5c684542-0358-4a02-aefa-01a5377bafd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5c684542-0358-4a02-aefa-01a5377bafd3.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

29acff65-30f3-4940-b84b-53ba7949e6fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\29acff65-30f3-4940-b84b-53ba7949e6fb.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

49d6fa08-a983-4e81-b03f-17664e863cc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\49d6fa08-a983-4e81-b03f-17664e863cc3.tmp
Size 1KB
SHA256 ee45eeeac4a63b79ed78fe79c05f57077af2b8e9d332a9c7b95e173047b4cdb5
MD5 6bb3e01177bec43e9fd8978cbd8c830d
SHA1 59ade4c2195f286113118e9e0aa7c1c4779933bc
SHA512 bf3a2534bfeafb970fa4d965e6069a089dc1b7dc9ab5afcb03a814fcce87a0484330f306bea1309448a53ef69f23f8ece0b78a99b4e0fece1c35ee91b05da5dd
TLSH
T16E21BEF783E186AED91156F09A14EE2BCE1C0505821C7D6A86D4FF67D3E3071E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

a961c830-5a86-4059-810a-d24af0aa9953.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a961c830-5a86-4059-810a-d24af0aa9953.tmp
Size 949B
SHA256 558d4e8ab04494ea2acabddd07f2b6a0d3c19930dd7457779d2582938ed452d6
MD5 dad9bdb7af5d03ebc116d2627ac19ff6
SHA1 8ab12aec571ccd6c7e2fce342f543a9553109ed2
SHA512 0c4d9c107bd81cb766b1f617d56f3853d97751ae97db52115f244219382a0148b6160cc3591058a2d5510cdda999a21ad422270cc8cacd1e38167c0e6988fe01
TLSH
T1801197B3C3D596AE890156F05A24AE2BCE2D060642183C19DAD4EF2B83E3066E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

f93c32c6-a2f9-4380-af2e-d9d5df8ac64a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f93c32c6-a2f9-4380-af2e-d9d5df8ac64a.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\temp-index
Size 480B
SHA256 7db7cfdef5461b40dc3bf8ab8be8606ad872410a36521cc0f1b061c36cbfde1d
MD5 454e80d544f025fef7cf69c790f8667c
SHA1 36b119ac4b4bda67e6254307e5a937dddfd82356
SHA512 e918d029af345e3df3149016b41bc60aee9359a8482e242262d32288007d038e228bd7f864e398d537ca761e50a949bfe5946159bc9370e957030e04d3339998
TLSH
T10BF0209E8F635259FC544235307E75A66BB11ADCA2A1BA1F21FC801F5C4A7889E82714
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 480B
SHA256 98943f3b2400e43cf14e2054a7ba8929eb5b8b5f0c6c15152d8f1ae20ead670d
MD5 db87037c01b204507a4b2c19e7ac89bd
SHA1 dcca82aca9541d8ff3b5f688d92c6b29bd7921ae
SHA512 d7718a5e03616a3d23482baaf24ed73c127847a20ec1df784294014a0c28f1f1dc3c1b96218b5ca1ebf75eaa2661dd8dd3e292f1e3e7bbbdf83d780c89dd434f
TLSH
T1F0F07DC946339389FC444132B57EF16661A17688E2643A0F61FE9056CC06B84AE87BB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 4ca25c3f7f418c4a799dd2e89f52ab98773a655e32c8ce66d4c4cfb9fad2111a
MD5 e81fb97b49ecf1f7524778b9fba14d71
SHA1 e597b919c4f3ff8d3bbcb6affc03bad3cf4aaf76
SHA512 92094cdb545b6bf54f5fd21b93bfbf4c7e13319b815db296e41a1631f2906377ffdda36f0d42a738c4c48f762e654996ee9c3bbab3846d2bedab18017a405752
TLSH
T119E0C0B72FD72954ECDF83D21031C8D40101B868C540ED4F202EA0C391B0345385AC23
MD5 SHA1 SHA512 TLSH

Submit Download

f19ac10b-f26e-4191-ae7b-902bb877be4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f19ac10b-f26e-4191-ae7b-902bb877be4c.tmp
Size 9KB
SHA256 ae103659a8e1f4b689af1ec22af021440d7251cf6f092a52ee66289b1aa56495
MD5 9342c5ad0b6523773fc295eab066b25a
SHA1 cc505f5f0c2e848096782a0f109870a2cc98db74
SHA512 006bd86011633e723ca11c12cbc0ed6e02a69685747f2ef3bf39183fe56f5220a208b7aed93362970e1442e2b18618c8cf64e50ca729e5e734f9b81f5f93f2bc
SSDEEP 192:sxZ4R6W1/fHsPFzIdpBolHW6+WN+2o/YgbaF0IgrJ:sxZ4H1/fHsdsB4Hb8/f9
TLSH
T14122B8116E24AA7B8CC7E30DBB55BF53D6F92072A5D01E58AAFC861C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6488df5-303a-4348-bbe5-ca1c6ff5538b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6488df5-303a-4348-bbe5-ca1c6ff5538b.tmp
Size 10KB
SHA256 4122c2bf7c6821ae7fcfa2e7e1e99a5a6be9bf047cd39e823494c67ca0cd4901
MD5 d2974b2b00cbc158247aa1096b221542
SHA1 a1cdc98ef9e5d5a93c466ec8ea0981cac90677fe
SHA512 11d9307ddaa7032ab4f596f642c40bbcccd3759b2d1b082554ea63fdb92fe72a43f6bb5a4ce595ac1f8f457997ba913ce3cf1622366d9d29ba1bc82004fa646c
SSDEEP 192:sxZ4R6W1/fHsU4zIdp3olHW6+WN+2o/Yg5RF0Ig5yrSJ:sxZ4H1/fHsJs34Hb8/QV
TLSH
T18422DA126D24AE7B8CC7E30DBB55BF13D6F96072A5901E48AAFCC61C05E66CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 9a7a415b833078bf7d71981a43feaeffe5ca13c3e1aa2a2894f3fa44e8144a65
MD5 33aa3e55ef614db879f9dbd25e1bd340
SHA1 84d53545427e8627e591198fb167aa0eba756f7d
SHA512 cf1f249736bc746bdf3afcfdd208a2d8224fe9d68a557fc959e12126d8c574ca1e29956b024228f9a0506ea7eea93e39572b2e6bc848c8dad7b2975f733364ef
TLSH
T1F421A4C8B3AC91BA9EC9F651910D804351B22E37331D98B1235EC2F10F8C8141B2FEB0
MD5 SHA1 SHA512 TLSH

Submit Download

fd0d5f2c-3a79-47e5-9875-14f5ed6714a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd0d5f2c-3a79-47e5-9875-14f5ed6714a7.tmp
Size 10KB
SHA256 59892f9fa76344075dcee7f754ab5640825bec131ad64ff3a0b8161390d6bf8a
MD5 eabbc5925ac398c952dce2c638437f4f
SHA1 cfe33fba1b0569143c045d0279e2fa243d058727
SHA512 d8cea99a561c09e73b577cf3342eab84654c13eade21c33450bb2b174619419162fa6ff6caa1bd1bb9d8847cfccad4d93c896988aeb953d9d2340629218d76a5
SSDEEP 192:sxZ4R6W1/fHsUFzIdpBolHW6+WN+2o/YgbaF0Ig5yrgJ:sxZ4H1/fHscsB4Hb8/fj
TLSH
T16022C8116E34AA7B8CC7E30DBB55BF53D6F92072A5D01E58AAFC861C05E66CD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66b45762-eb20-4f07-b98a-0c7ce585620b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\66b45762-eb20-4f07-b98a-0c7ce585620b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a5346512-2aef-4d6a-883c-8ca435d6c7d8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5346512-2aef-4d6a-883c-8ca435d6c7d8.tmp
Size 26KB
SHA256 0a26cbc098e0d5594d1e319abe3fd849fe45f6123800777a21bfce5a92250d1b
MD5 0525ab95474f371a74fc432ff84aaee1
SHA1 b4a502391a08e1f1ca5a1a800b476b840c434384
SHA512 0555562e84d9a3ebbc6124d0317fd017db7efdecba414e8cef1079f4182b839f30b84a5977a5e4523a08efff83c7e3245620b10dbe54076c501ce2d3a03005fd
SSDEEP 384:aiFkZcIK3qsN98TUNTUlIlmr59INBvBGYX5EGQUFevi4/uANEbEeU1:RFCiqWwgEK5GYuGQTvLJCbET1
TLSH
T12FC23BF298E7983AD9AE5743E77D2D034EBCD027B6806A50B3D9550CCC961BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b90bcab9-f9c5-4e4b-9346-71b6d64927f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b90bcab9-f9c5-4e4b-9346-71b6d64927f0.tmp
Size 8KB
SHA256 86957696257c723b7ca54f9a94d3a98e4c3e08c49b5fd11f699a7f2603113530
MD5 bde09308bbacadaec93f2c7ed327acc1
SHA1 4450ae60daf8447e5f698b2609535850a426ec2c
SHA512 64443f45e8c9aa647430289c9812c67ac30756c2519f3cce20e4e1902300cbffd3f7344a7ad90a87725b4ae72474a0a60110dc86ffd541333ed6a49bb93113a2
SSDEEP 192:0ONP6DphrqQmiUyNDItwGYX59ezHC6m4Une+0kII0q5DU6:0ONP610SktwGYX5EGQUFVvU6
TLSH
T1B212F835A8B8BC7B4DD3A555B48B36035EA85227EB857F80D6ED2A1C01DF1DC230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

840e142a-fe63-4789-8a0b-62c5d07f5ea9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\840e142a-fe63-4789-8a0b-62c5d07f5ea9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bd8ea596dc2394fc59f0834a7ad0a8e8adb5d04c23fa23b16a1172731ebb803e
MD5 110ff2d4169836874ecc10a506d56093
SHA1 e6796c2b271f5e9f784953b8efd8ddfbff38409f
SHA512 1447f83087bccdcb90453496af52524e41f0836012b0cab05c8b7c3c9520bd4857f2d69ed1bba802ca22ec0484c4b1af7a1a46fc5c56f8f018ef200d51ae3ba1
TLSH
T1EC41FA5CB6E90108B3B76E56EBF6A46D887BB8371F06D49E10110D4F0677A40D972B37
MD5 SHA1 SHA512 TLSH

Submit Download