hxxps://swarveuncity[.]com/menz98y5quhi/win-11-debloater[.]github[.]io

Resubmissions

12/10/2026, 19:09

261012-xtv3eswt3p3

12/10/2026, 19:09

261012-xtvrnawt3n

12/10/2026, 18:56

261012-xlrd9sy1by9

Analysis

max time kernel
898s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/10/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://swarveuncity.com/menz98y5quhi/win-11-debloater.github.io
Sample261012-xtv3eswt3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{5E4A0E7D-4B79-47A4-BEB4-6AA52292847B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe
4148	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3288	4148	msedge.exe	85
PID 4148 wrote to memory of 4340	4148	msedge.exe	86
PID 4148 wrote to memory of 3816	4148	msedge.exe	87
PID 4148 wrote to memory of 3816	4148	msedge.exe	87
PID 4148 wrote to memory of 3816	4148	msedge.exe	87
PID 4148 wrote to memory of 3720	4148	msedge.exe	88
PID 4148 wrote to memory of 3720	4148	msedge.exe	88
PID 4148 wrote to memory of 3528	4148	msedge.exe	89
PID 4148 wrote to memory of 3528	4148	msedge.exe	89
PID 4148 wrote to memory of 3528	4148	msedge.exe	89
PID 4148 wrote to memory of 4568	4148	msedge.exe	90
PID 4148 wrote to memory of 4568	4148	msedge.exe	90
PID 4148 wrote to memory of 4568	4148	msedge.exe	90
PID 4148 wrote to memory of 4488	4148	msedge.exe	91
PID 4148 wrote to memory of 1628	4148	msedge.exe	92
PID 4148 wrote to memory of 4488	4148	msedge.exe	91
PID 4148 wrote to memory of 4488	4148	msedge.exe	91
PID 4148 wrote to memory of 1628	4148	msedge.exe	92
PID 4148 wrote to memory of 1628	4148	msedge.exe	92
PID 4148 wrote to memory of 1688	4148	msedge.exe	97
PID 4148 wrote to memory of 1688	4148	msedge.exe	97
PID 4148 wrote to memory of 4936	4148	msedge.exe	98
PID 4148 wrote to memory of 4936	4148	msedge.exe	98
PID 4148 wrote to memory of 4228	4148	msedge.exe	100
PID 4148 wrote to memory of 624	4148	msedge.exe	111
PID 4148 wrote to memory of 4548	4148	msedge.exe	112
PID 4148 wrote to memory of 2880	4148	msedge.exe	113
PID 4148 wrote to memory of 4228	4148	msedge.exe	122
PID 4148 wrote to memory of 4228	4148	msedge.exe	122
PID 4148 wrote to memory of 3792	4148	msedge.exe	125
PID 4148 wrote to memory of 3792	4148	msedge.exe	125
PID 4148 wrote to memory of 4288	4148	msedge.exe	127
PID 4148 wrote to memory of 3032	4148	msedge.exe	128
PID 4148 wrote to memory of 3032	4148	msedge.exe	128
PID 4148 wrote to memory of 4936	4148	msedge.exe	129
PID 4148 wrote to memory of 4936	4148	msedge.exe	129
PID 4148 wrote to memory of 1752	4148	msedge.exe	130
PID 4148 wrote to memory of 1752	4148	msedge.exe	130
PID 4148 wrote to memory of 4176	4148	msedge.exe	131
PID 4148 wrote to memory of 4176	4148	msedge.exe	131
PID 4148 wrote to memory of 4304	4148	msedge.exe	132
PID 4148 wrote to memory of 4304	4148	msedge.exe	132
PID 4148 wrote to memory of 1760	4148	msedge.exe	140
PID 4148 wrote to memory of 1760	4148	msedge.exe	140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://swarveuncity.com/menz98y5quhi/win-11-debloater.github.io
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ff9f6afc188,0x7ff9f6afc194,0x7ff9f6afc1a0
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,11984109364797189894,17256336566524782501,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13226320489995383127,2433475905131032214,262144 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,1683605515467094958,5240817667165502517,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,8807029981248033002,17768676430888673939,2097152 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,13002040007999565340,5696519776105917286,2097152 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,12419043156487067493,7430792324034749226,2097152 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,15303300822422358362,3077990988051721045,2097152 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,963989016649482887,17305403248576669865,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,13956929398911319739,17573336471835545267,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8706884281362915355,3249410158950423312,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5884,i,8706884281362915355,3249410158950423312,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,10605196821562058749,1700177014671690129,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,13004705582448162358,10593236476570541969,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,17052465916578956688,10373744403398148418,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,1661373638722604468,4549303105691852486,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4464,i,9808022461093143447,6874382001653413215,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5904,i,5954794765162731158,8868424349096000078,262144 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3060,i,16078706259287070433,17005642403125386525,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,9703408808485269631,12669206320496884345,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,16800494047655292290,11773768947098421105,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,466203986639624104,7394949331266872634,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=3068 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,2882430590019944349,12726075552585174425,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,17727622892507771546,9024255079199864164,524288 --field-trial-handle=2268,i,17240824443787170324,8377050511591417160,262144 --variations-seed-version --mojo-platform-channel-handle=3148 /prefetch:8
  2⤵
  PID:1760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

438ab4de-43f6-4423-b487-725ae900a0d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\438ab4de-43f6-4423-b487-725ae900a0d4.tmp
Size 8KB
SHA256 ccc3a50b8c7eb2c58e6993e976b1ae61a1bab60a752c32889a6141c53712ad0e
MD5 5c2fc81284ef9379502d2414b3d35e51
SHA1 ec729394aa6d4e2257dcb4774a2e7597ce72f0cb
SHA512 14a76e12aef5b0751d812637a5703d0895859bee21955483bfa336a52e79aaad441544de59fda275825816da7ea1af157d65c2469138cd8b8e3f19575b4f4120
SSDEEP 192:PONS6DphYqQmiUycUGdwGYX59ez6CyORM6QxkII3oq5VU6:PONS61bfZdwGYX5EzyOi6QC3FU6
TLSH
T12D120932AC78EC7B1DE26951F4873513AFA45127EA88AF54D2DC3A1C01DF69C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6eb8410a-469f-4266-ac39-6a125dcc8ff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6eb8410a-469f-4266-ac39-6a125dcc8ff9.tmp
Size 18KB
SHA256 684c6ab9f95282a776b2b206d8573b800de44ac381472018ec17b14b3173a3b2
MD5 e53f11207de8c45c2cea19a4276c6934
SHA1 a6196f16f7d033f5c9549ae2e697a06481a1686f
SHA512 d0e8bbdb510c743adfa42f12dbd8619ccb560aa15103df8d32a78b984a47854c6a03f74187077b2e53c0de15aaedd13414d78906dc8203157da95f3261effd74
SSDEEP 384:UZcIhsNvoD5MJCS/BGYX5EzyOi6Q13FTJQsQh:ShHQJGYuzyO3Q1VTJ1S
TLSH
T125826C725C74AD374DE7A945F18A35139FF59037F7C86BA892DC7B2C019A6D8030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7367192a-b1fd-4898-807b-d101b9a8d1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7367192a-b1fd-4898-807b-d101b9a8d1c9.tmp
Size 25KB
SHA256 68e3b0321cdc110f5d0e5e1f1d4943878ff5a79000016d1cef4787c1b1ed25f1
MD5 7245d779e7e7ec45c8861f9f61def631
SHA1 e353b01c618587fcae8e784bca23418eb377ee2e
SHA512 54de418aaa7877ab63e5bfd2527d1a7ab80776579f0921d0f79db9b16d6bd5182ef794856c5b3380d413da0024986488339daf6a82767dd4abebbb1dd3052325
SSDEEP 384:tiFiZcI/zsNR8TUNTUlIloD5MJCZ/BGYX5EzyOi6Qp3FTJQsQh:kFQ7AwgmDJGYuzyO3QpVTJ1S
TLSH
T195C219F248E7993AD9AE5B47E77D2D038EBDD023F5846A54B3886A1CCC561BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

0eb1d48e-07ea-4a17-a2c3-02f7556a077d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0eb1d48e-07ea-4a17-a2c3-02f7556a077d.tmp
Size 10KB
SHA256 dfafc8cbd248e1229109fc6c1c394b772d538014a971f131e2f7901dc1190977
MD5 8ce63a7dad4f62d3080bac8444b6e58e
SHA1 3e463e4d75451a3f4e759779de85191a918125eb
SHA512 058033af4d3591e3bbc0d3425b4f9ca90ccee666f91623ec4880419ed4ae4b1beda61c01d1c2d1ce7f78e55c506f579aa8e4e10f783c39c41e7373afe6e0a666
SSDEEP 192:sxZkRoWs/f5sP2BIdpYzHW6+WNnoG/YgRm0z0Ig58lJ:sxZk9s/f5suqWHbl/kQ
TLSH
T16322C8516E24AA7B4CCBD20DBB65BF13D6FA5032A1951E48A6FC961C09E77CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

231a609c-b034-4ad5-a641-d311d03ce284.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\231a609c-b034-4ad5-a641-d311d03ce284.tmp
Size 10KB
SHA256 87483c363d62d5b0fbf40711689ede59bdaa9cf2484f0681c05a520dc44d5b0b
MD5 284f4a212d039076521b0bb71a6f6f13
SHA1 b5501b047eaf6998dab45879f7bd3d2cb61c0d5e
SHA512 15fb933072b86d42e9e481dc301ed3c8469658aa74e72191194432635cd2686161106f99cde5f9d7cd1cc60c9a4ac95f81aae9c78cd8fb64ea40d2f8958f9dc2
SSDEEP 192:sxZkRoWs/f5sPBIdpYzHW6+WNnoG/YgRm0z0IgrJ:sxZk9s/f5sPqWHbl/k9
TLSH
T19E22C9516E24AA7B4CCBD20DBB65BF13D6FA5032A1D51D48AAFC961C08E76DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

416f75c8-c32e-4b20-9b8d-ae2506163c32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\416f75c8-c32e-4b20-9b8d-ae2506163c32.tmp
Size 27KB
SHA256 aa9f3324ad2688af6bcbf26a6f15d148c8b35877548428855a57b02526d4d862
MD5 7f4fdf36e82172c3e51a9f1434368392
SHA1 0f03b88d2b5b9679efb14415a0965be9458a1e98
SHA512 b29ceda624c7ceb994af159700a99ed43cb302fb2c08ce68da4154a65d73d7c616bf9b8e9c02e8ad150eb83baece62f208af9a91c6308eaa38d893e777439c55
SSDEEP 768:E9ichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXz/ro6aOc:E9ichfPWvPZplu1jan+LKgzsxr
TLSH
T1A9C2E93B640CCB7E4FC01E9DDD5A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62e3aaca-ad55-43c4-a757-27b4f77aa7be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62e3aaca-ad55-43c4-a757-27b4f77aa7be.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69928d3a-27e3-490f-86a2-430fe2586867.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69928d3a-27e3-490f-86a2-430fe2586867.tmp
Size 10KB
SHA256 91f89481e929f0439eb5439dea299d21b931d6417858040cd67116d04a3486a7
MD5 d7343c446b836b7b1c2c7d4cc25fb502
SHA1 c83be830df7101742c55d8d5388ad3363e87bcc8
SHA512 92760880c7728f409b7b1ce0d7eee08ebcb6338b88fefd8aa4c68b1102dfa7f17b39e9af4ed38498052ba89b1de67ac8c10447b7fa3fa3a4304ed8ee92e553b2
SSDEEP 192:sxZkRoWs/f5sPJBIdpYzHW6+WNnoG/Yg6m0z0Ig58PJ:sxZk9s/f5sBqWHbl/Lq
TLSH
T1D122B8516E246A7B8CCBD20DBB65BF13E6FA5032A1951E48A6FCD61C05E76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a1d294b-c711-48d6-96da-d7541da42ed4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a1d294b-c711-48d6-96da-d7541da42ed4.tmp
Size 10KB
SHA256 64a0a6cf151a0cc1573c62177bf4049817a62b98de66cebacd2dde0a3e401e8f
MD5 00e6cc9f9c3aa25912efd359941cf507
SHA1 d44805719dd10eae5dc60d55fa516bf15e026014
SHA512 093154a2baca17396926fab4d6cf6668c7dc84094fe9e7a6b2375562f1841388c6ee4b94ca352a44493b21f66b5d101475131e4c9254c2c4dc654eeff6d34bc1
SSDEEP 192:sxZkRoWs/f5sPJBIdpGzHW6+WNnoG/YgEF7z0Ig58PJ:sxZk9s/f5sBqgHbl/bq
TLSH
T11C32D9516D246A7B8CCBD20DBA65BF13D6FA5032A1951E48AAFCD61C05E77CD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a28db94-7817-49f9-9030-892fd4e28644.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a28db94-7817-49f9-9030-892fd4e28644.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 adfb9a45ae5683828791b092b5b8fa3ab883c1f963732dbb0b4cb89aef2dc528
MD5 a9808447fd0c26e3cf54dcfd7179ac73
SHA1 27672eefce9446866c6ecf3f581317053c8fae92
SHA512 5a7f19a9e13c4fa07cf06662aa1539111f6e3c8aa60378cbb35519586442dda0fb8cf76e84134ee47b0d95138669b98ce8ed9816d00e22db83c3400415c7a4a7
TLSH
T1DBE026C904D8C32FB718669702EC530C93A0271BA2C0AD8F1F00E5C4F585E48AB86EB1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 6c27503ea806a0bacfd7d068241e3ad2afa3c0e95873fe41d02835db14f64941
MD5 d003aed2d6d2eb03f8ee13593f5838f5
SHA1 7a2b7d9200eae745d96c184b6dab32de781b2deb
SHA512 2a38c1a8af98bb00c85dbba1ecbb0a659bddb398a11541914b02a78526c56b0d25a48bd76350169daff11e9096f1064925a186bd598bc536876ee13f51a4be00
TLSH
T1C0E026C906CCC33FAB587457016C438C93A1271FB2CA7AAE1B00C5C4B00DA40B3A6AB5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 fc1de8d2c4b72c37605959e6b12dfac269612de9fcf2613ba54150d9209ab7ef
MD5 ee50afa04cdc546538924ec272674fe2
SHA1 1a7de40db319b9e5d0587460079a5d80456783a6
SHA512 def4fef05da36b7a7a13620cc3a9f0cd1ca5f3df46b3b720b164afc79a498f73763a35b2069fd859c9f11c0fe64bf52e65ebb9b77f2c9a2d74d8abfeece54e40
TLSH
T147E026C424C8C33FA748B5570368531DD3A1A71FA2C46D9E3704C5C9F646A80A3EAEB1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 70363ce6ce2902a6237ab914a06cc77c853473517f07503895531e6e30c962b9
MD5 7fdb7cb35994d3bf4ff36def4e741488
SHA1 33a470c55925340ed12df732ea9fc8ffb496b969
SHA512 4044c7d01ec911b6aab3d2e50438a10aec69f412e6b26ed47da8f4fd6fde9b63372838159d881cea5e7846bbf4932a8ac85cb3b40a0e73ef83eb6e8b89ed2539
TLSH
T162E020C415D4C31DA704A5574274838CC390A71BA6C0E98F2704CDD5B185F406387D75
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b37157d59decbc3bd5d846829c9f0d33fad2f5b54330c589b9c548c369e553b9
MD5 63d16bf664fe08c185460f5b0f784dcc
SHA1 d332d5985ff74971cfb47674dcbe113f4ba391b3
SHA512 cc2213233b81dae9ef73e7af66128f62dc96635436c291a242e4de70a6c48f9a099e18213efbec860b286f989122a487f4f587d2f34ac102fccdf0ec90a5e325
TLSH
T12C615D811BB088B3FBA451F8C6F498DBBA32838D54839D110AE4F56D5C5332741F724B
MD5 SHA1 SHA512 TLSH

Submit Download

feb15217-0ef4-4e03-b2cd-d504dceb52a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\feb15217-0ef4-4e03-b2cd-d504dceb52a6.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2156a5d1-0431-4dee-9cae-d5b0f09404ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2156a5d1-0431-4dee-9cae-d5b0f09404ba.tmp
Size 1KB
SHA256 8495aa18349c3de78ec2c3b71736bce7fdf03f3a005213e04b9f08e9ab1419a7
MD5 b05c12100db4ad3ec4dbf2be07315673
SHA1 6739f0ca00e8db3e51a4ca9fbe60e5f57e44f844
SHA512 02150623dced79df9c30e01ac382bf978977fa3656c0c721394f3bd3ee316e64bc16810582fe4182fd5b84587226cc99c2195af81fa9656f5127f901552fb22e
TLSH
T1B1218CF3C7D586AEC9015AF06A24AD17CE1D0A1543283C19C9D4EF5F93E34B5E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

24712386-acac-4c18-a1a2-1c2dc2374fe1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\24712386-acac-4c18-a1a2-1c2dc2374fe1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

59f72b32-dd91-48ca-9fe5-c2e569b50a73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\59f72b32-dd91-48ca-9fe5-c2e569b50a73.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b99b1cff-deb3-4a89-adf5-9e725410d2f1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b99b1cff-deb3-4a89-adf5-9e725410d2f1.tmp
Size 1KB
SHA256 88b2ba5b64e68e36750a20b8581f16cc954b80436400b9b2c6db37faf627c240
MD5 0c6c645ac7c6ffcc76577ef64a9c3996
SHA1 f30e09c179a0355889a5efdb5fbc9ae11caafbbc
SHA512 8d3da1b6e59250d95b97e8a6c67f2e08d1ce236266ccebb245263ceb4d7eec4c89fe86149d562ca298187a51c1eee38143cf71f25dcb1339511d608243f21c12
TLSH
T191218BF783E186AED91156F0AA24AE2BCE5C0515432C3D6989D4FF5B93E3071E102B6B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\temp-index
Size 528B
SHA256 cffe8b5f027abfc442ffb0aec64172fe3f3ce524012114150293c02322514533
MD5 72e1f6b12c00bd4372d4ae4bbda136dd
SHA1 e58474185af9c87cd7f38d3ca0d529a09f733847
SHA512 0c187d5ea659d0ddcd124f20404eb2babcc79ecf18d0592d0719417a90208d2eedb04b29ae60b1f95bb1b2692fafc2b7268ba2122d1cfcf456eca0d914682016
TLSH
T18BF0F1995F23425EFC184230203D359562F006CC93506E0B61EC801AAC463855E81654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e224deac-434e-4633-bdfb-da3a59c15d46\index-dir\the-real-index
Size 528B
SHA256 b80810c5987b2b5e7ab56dd1a998d7e3d800f6b82cc0a82e317928fd42d1de22
MD5 7f765594daa0e6bb719fbfeb9b72d6d4
SHA1 16b02e8167fa833294881e6e73b67393ef8ebdd9
SHA512 befff93aa618089724519e3fd5e4e1840a0b9693427c01e754f59c0957ca683ff362092787f8dd4760dbf61f71a432fd177afd5c4f624900b5d052ee046070fe
TLSH
T10EF068D846538796FC040272A56E755A62A51408A3642E4FA2FB5455CC46B806A82BB5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 c688adeed1c7652969b459e98d39856da514e0b3bfaf9c982897a0feb8709a6d
MD5 9ffdeb16e2a119fe4d855db33c28d207
SHA1 6d42f7ceae960bfdd0cbb11233ac125d082eb91d
SHA512 b94471172fb57f98d77fc7f4aea774dc93213cc4b42bd83724b78743ed0a42b304f560f47183a6d264d92392cd556474b7a7911f3e00645da0b104766cfe3a2b
TLSH
T1F8E020B72FD72854ECDF87D6103188D54105B968C544EE4F607E91C791B1755385AC27
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e099236d42e70bf0d875a78cb0bb4784de9feea967713d4a3b6dcc443cf82724
MD5 18da0bfd7b4a5b73ee750e668e6ffc7d
SHA1 7a5be0ee67e18ac05d4c0d55385b8ceb9a9d75e8
SHA512 7ccad77f7a48c57d1a77a471291f29aa908d52d1cdcc876c5d1cc128bdff7686d3885f781eeaf827c419a1c34c59ffefcaa35ddb5f152b40d01f54f3220c24f6
SSDEEP 96:KAdOKOY6VAr8QuC+giapzIIgKQ1IWgsYIZ23/CKY0OvbU5dDRm:URVAr8QuC+1ap8IU1IWdYIZ2mpvbU5ds
TLSH
T1D3914741356F068639FE694851B4C62B015131FB3368F97BBFAC40A28D6EE042EFD9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f04ec089-badb-4a9c-9e56-072ec97a93a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f04ec089-badb-4a9c-9e56-072ec97a93a5.tmp
Size 25KB
SHA256 5864e55f4ce8bf4c095d862ce3dcd6a1c2becdd0c3bb33118f4ec8c87a1bda40
MD5 58df316f577abfba45a763cc3eb5f785
SHA1 1349cb747c64a9a54268581d7ac53159794b44e1
SHA512 d2addbabe6d902c7f2a29c016a57b324e0434d56cd1ebb6570bdf81aabd3be84e6e2bad0b86b2a7ab1a23ac66232b76851df6c84fb369882666ab36a92906ddb
SSDEEP 384:sxZk9s/f5s966s8qMpRiYnazAW8pZS15posJWeT+oqgHbl/Zq:sM9s/fq4Mnc7WeT+o1HbZE
TLSH
T173B2F705A924D93B8EC35D18653D7E33D9EC506222C9DEDE1AECCA1C019D1FDAB47817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

069c859a-5f3a-43db-b980-6d1ebee11718.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\069c859a-5f3a-43db-b980-6d1ebee11718.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ba754644-82d3-4e40-bd46-e8fc3140e49c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba754644-82d3-4e40-bd46-e8fc3140e49c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f398e023-bdcb-479c-9bc6-7722ef67ad36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f398e023-bdcb-479c-9bc6-7722ef67ad36.tmp
Size 18KB
SHA256 fc81b511a6ee8a4dd16cebe684b30fa68dd09ce4d2e4a433594e41b2d7cf995c
MD5 311d841c8f7f042bf0536bc10d68b0a9
SHA1 2e4b055e3aa0f87b7068b48bd4649251d639fdee
SHA512 7503e4c0f7d3466dfea64376e2b5b2540da2e34bc487aa2852a472af23b3c611fb9201ca3d0de22ed294fdbe8cc0a0069571a00af499e3307573c30142fca096
SSDEEP 384:WZcIhsNvPD5MJCS/BGYX5EzyOi6Q13FTJQsQh:EhmQJGYuzyO3Q1VTJ1S
TLSH
T153826B725C74AD375DE7A945F18A36139FF59037F7C86BA892DC7B2C019A2D8030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f91bb1a4-88fc-49ce-afd7-011a1767bf14.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f91bb1a4-88fc-49ce-afd7-011a1767bf14.tmp
Size 8KB
SHA256 46cd5f781c6bae4913d555de978243c45d3fd83bc124db54549fa078edf72d41
MD5 f8662f8d1a6489898c46fc0bee152426
SHA1 46c97c2b7be7514285cabc0ecc78db4ead2c4b68
SHA512 af96fcddde09fceb105eceb11f4bd198fc27ccac8f5b56dbc6e323ccd5eef2b90bee7790e8294499b8734365bf613e7ef40b3a2fc191cf92da77e3a2be8f28bd
SSDEEP 192:LJONf6DphmqQmiUy4Gq8wGYX59ez6CyORMWkk7syU6:lONf619qRwGYX5EzyOiwbU6
TLSH
T19A02E835AD78BCBB8DE36E45F58737136FE4112BAA942F54D6E82A1C01D768C2306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c517d1e94ac7bbe3c85079925ab867233daf647468749b98b02d9c9fbc972a21
MD5 252b242202a3bc1f1dc17f513f9ab3ce
SHA1 ed2d8537bbb1bf8162be9beffe4020eadd352bd2
SHA512 2122a9c9690ec18460afa2eaf9d73668c908589329ee3c2bb41cb18a231a5772f0573bfe694d5b7c2b1ae5ce43c19da3355413bd12cacac977888bfbe3e56c34
TLSH
T1E641F688BAF91118B3B67E56AFF6A86D447FB9772F06C49D00110E4E0A62B00D961733
MD5 SHA1 SHA512 TLSH

Submit Download