hxxps://archive[.]org/details/Project_Cyber_Virus_Swissnex_Danooct1

Analysis

user interaction
yes
max time kernel
898s
max time network
900s
platform
windows10-2004_x64
resource
win10v2004-20260911-de
resource tags

arch:x64arch:x86image:win10v2004-20260911-delocale:de-deos:windows10-2004-x64systemwindows
submitted
15/10/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/Project_Cyber_Virus_Swissnex_Danooct1
Sample261015-sqavvsda33

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{87C30DEB-AD2F-4D51-AC7A-68B265FA64A1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5884	msedge.exe
5884	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
676	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe
3196	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 1820	3196	msedge.exe	87
PID 3196 wrote to memory of 1084	3196	msedge.exe	88
PID 3196 wrote to memory of 4800	3196	msedge.exe	89
PID 3196 wrote to memory of 3588	3196	msedge.exe	90
PID 3196 wrote to memory of 4800	3196	msedge.exe	89
PID 3196 wrote to memory of 3588	3196	msedge.exe	90
PID 3196 wrote to memory of 3588	3196	msedge.exe	90
PID 3196 wrote to memory of 3312	3196	msedge.exe	92
PID 3196 wrote to memory of 4156	3196	msedge.exe	93
PID 3196 wrote to memory of 3312	3196	msedge.exe	92
PID 3196 wrote to memory of 3312	3196	msedge.exe	92
PID 3196 wrote to memory of 4156	3196	msedge.exe	93
PID 3196 wrote to memory of 4156	3196	msedge.exe	93
PID 3196 wrote to memory of 2420	3196	msedge.exe	94
PID 3196 wrote to memory of 2420	3196	msedge.exe	94
PID 3196 wrote to memory of 2420	3196	msedge.exe	94
PID 3196 wrote to memory of 956	3196	msedge.exe	95
PID 3196 wrote to memory of 956	3196	msedge.exe	95
PID 3196 wrote to memory of 956	3196	msedge.exe	95
PID 3196 wrote to memory of 552	3196	msedge.exe	98
PID 3196 wrote to memory of 4428	3196	msedge.exe	99
PID 3196 wrote to memory of 552	3196	msedge.exe	98
PID 3196 wrote to memory of 4428	3196	msedge.exe	99
PID 3196 wrote to memory of 2736	3196	msedge.exe	102
PID 3196 wrote to memory of 4684	3196	msedge.exe	117
PID 3196 wrote to memory of 4348	3196	msedge.exe	118
PID 3196 wrote to memory of 2720	3196	msedge.exe	119
PID 3196 wrote to memory of 4152	3196	msedge.exe	128
PID 3196 wrote to memory of 4152	3196	msedge.exe	128
PID 3196 wrote to memory of 4428	3196	msedge.exe	129
PID 3196 wrote to memory of 4428	3196	msedge.exe	129
PID 3196 wrote to memory of 5884	3196	msedge.exe	131
PID 3196 wrote to memory of 6040	3196	msedge.exe	132
PID 3196 wrote to memory of 6040	3196	msedge.exe	132
PID 3196 wrote to memory of 6044	3196	msedge.exe	133
PID 3196 wrote to memory of 6044	3196	msedge.exe	133
PID 3196 wrote to memory of 1996	3196	msedge.exe	134
PID 3196 wrote to memory of 1996	3196	msedge.exe	134
PID 3196 wrote to memory of 2244	3196	msedge.exe	135
PID 3196 wrote to memory of 2244	3196	msedge.exe	135
PID 3196 wrote to memory of 5592	3196	msedge.exe	138
PID 3196 wrote to memory of 5592	3196	msedge.exe	138
PID 3196 wrote to memory of 1032	3196	msedge.exe	139
PID 3196 wrote to memory of 1032	3196	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/details/Project_Cyber_Virus_Swissnex_Danooct1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fffd5abc188,0x7fffd5abc194,0x7fffd5abc1a0
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,7937245216075817469,12421717474262606761,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,13552170982979083277,5148519593139193414,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,11160454079451241508,16858576311750223950,262144 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=2408 /prefetch:2
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,3087109370328590532,16623914769781383074,2097152 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,16764594964923433130,2142126616816450827,2097152 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4296,i,1149076386078734337,10296354140909421642,2097152 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,16740613471556660200,8505716919652064538,2097152 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:2
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,9020074907064948811,15216919734213720036,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,17465506264700622861,15033053646746575532,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1344008207205558227,10913718128100172352,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,1344008207205558227,10913718128100172352,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3476,i,4058731581656406865,14766578802548732045,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,14021703080845928209,9111319545609301769,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,8741257873440208101,13250960269550157235,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=4528 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,8666512170608098989,15720659209643737701,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=de --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,4628802885319139937,958412864645031007,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,5716080270148319288,2406035868642772524,262144 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,8795006560783594430,17883733257720952555,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,12973196780558287781,69340296214501317,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,17574373732546317912,7936995191193793410,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1520,i,10435593242643474797,7241885102251846156,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=de --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9437582556751114270,5588008183079266,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,11324210168804977466,10085894168398138951,524288 --field-trial-handle=2428,i,5140748682893966943,11262639708301467476,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:1032

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4306981c-6477-4de6-ac49-a1fde2046703.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4306981c-6477-4de6-ac49-a1fde2046703.tmp
Size 26KB
SHA256 a56282a6e402f02b706886009b01d7a438f503a7ef45128efc3614c7a9ef4c86
MD5 fa85cb8a06a5255287776cb44d30f31e
SHA1 8611704eef38bff8ffe4f335c1dfb2ebcc526e5f
SHA512 54a8bd01f577bce31821ac4a141a86a25793cb3f7f2c034737e3604171682a1a820ae2db3f5a737b6a3bf4096b5d3c95d99cd59cd424f54dcd97278c6675f9e4
SSDEEP 384:SNF3QkUSv63sNE8TUNTUlIlpWD1GNqzIGm2G8Lhp5XhBHiIJg/IJtn:IFJmRwgOD6sxDxhBHiIbHn
TLSH
T146C207F258EB983BDAAE5B03A77D2E028E7CC157F5946A50B3D8590CCC861BFD306901
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5cae1268-2fb4-488c-98dd-052fac03e9ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5cae1268-2fb4-488c-98dd-052fac03e9ec.tmp
Size 18KB
SHA256 3fe9366aeba1ca0fe10e55066f13bd4d5fefe971518fafa2faf3eecaa101388e
MD5 053b6ec8c98cb6e41fd5070de602c972
SHA1 6a2bfe854f2e85d6bfa8703969bc1c9fd2d88534
SHA512 def736af62f6ed7d1f88e4715dd544865b004d5f4347f4e502c661db0efca583c1e846effa1882eaf84db8bdf65f3c4e9a40cf54bf8f9e6411642857bd3945a1
SSDEEP 384:1QkUSv0sNMUWD1GWqzIGm2G8Lhp5XhyiIJg/IJtn:P0jDBsxDxhyiIbHn
TLSH
T1CA826C36AC786C275AF36544F54A3A13DE74C127D6D92F60D6ECAB1D00CA298230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

3b27925e-9fba-410f-ab4b-ae031e908b37.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3b27925e-9fba-410f-ab4b-ae031e908b37.tmp
Size 24KB
SHA256 698a7943cc3edbee7dc61ec89252031229ad2b6cdeb65cb7d1f6831fb6e8a8bd
MD5 32895b5f2345a0d7ba2ceea37dd60edf
SHA1 e74d982a665d7b057fe84c529032256c892e9915
SHA512 3748d21c18bf5ffb14d6455bf820405a5cc02d0c14a08fb4a26cafe39fdc923d4b89be5854f966a7a8a3409f777c13aaa494c62d81126bf1f55d97e94e1ca931
SSDEEP 384:sxZ7qN/fysC66s8qMpRiYnazAW8pZS15posJWeT+JxCHbNXUk:sTqN/f84Mnc7WeT+JYHbJB
TLSH
T15EB2E605A924C83B9EC35D18697C7E33E9EC506222C5CEDE5AECCA1C019D1FDAB47857
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42332e25-3314-4d73-9147-68f11858c319.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42332e25-3314-4d73-9147-68f11858c319.tmp
Size 9KB
SHA256 8c4c3f4b2d5b20ab71fb4ccb886d5a12dc844468da9c688798e80b2087d093ab
MD5 944971dac127c9f3c9ba9662eaa81f21
SHA1 f0951acba4c182f83ac941c5a8e03a8a185764f9
SHA512 fba39d238fd0bfe84be55eb3bb23d31fbecd3fd9f83294840d98aa5467113d04b5f87ef758901d7dbc70948f9162eb77baf55cda8df011efbfd46cc2e7dae18d
SSDEEP 192:sxZeLWN/fysFSCFIup1aHW6+WNabB/Yap+1BZEIg5UJ:sxZeqN/fysk2wHbM/Zm
TLSH
T10F22B8526E28A97B8CD7D30DBA59BB53E6F95031A1D40E48EAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d3c79db-7f70-4f24-9ef3-cf77cc7feba9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4d3c79db-7f70-4f24-9ef3-cf77cc7feba9.tmp
Size 10KB
SHA256 4a0e79abe7cd10c5eafc89e202111f3b047f7f754d23ec10dc6c6e8615041c58
MD5 dc6a5f0f0fdba7f75de4f91dada2b4fa
SHA1 344a22edad219006c28dd3f90b64bfedd169743e
SHA512 c80936e8aded6ecc314926862801ac37c1fa02072c5cf923aca5359f9b00ea76c8dff63b8d0ad9544d82407bd516324a89bb48ea083eeb937873d66c92d86a0c
SSDEEP 192:sxZeLWN/fysdSCFIup1aHW6+WNabB/Yap5zBZEIg52J:sxZeqN/fyss2wHbM/gk
TLSH
T1A722DA516E28A97B8CD7D20DBA55BF13E6F95032A0D40E48EBFC961C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4eeeb8f6-6832-415a-8827-cd4bb3580458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4eeeb8f6-6832-415a-8827-cd4bb3580458.tmp
Size 9KB
SHA256 256a7af625acd10c345b31b9d30fd3455df4f74fc981e9ee9a07c585c9cd6232
MD5 75926728d43a7cb8237e414551956f7c
SHA1 72af89bc113306005f70f787b7c36f2c669d428f
SHA512 dd57d4baddfb9600bb8ab288f0965c69fbc969ad7550238ae1d0870b83106c21e2de7df12d81240f7772c9f473ce4df1ade2b3e00bb555edcafe93146125a6eb
SSDEEP 192:sxZeLWN/fyslSCFIup1aHW6+WNabB/Yap+GBZEIgrJ:sxZeqN/fysE2wHbM/o9
TLSH
T13B12A8126E28A97B4CC7D30DBA59BF53E6F95031A1D51E48EAFC961C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

509db4b0-27b5-4274-8383-406806167399.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\509db4b0-27b5-4274-8383-406806167399.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

543ac3a5-97c9-431c-bf34-b4b414db1072.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\543ac3a5-97c9-431c-bf34-b4b414db1072.tmp
Size 27KB
SHA256 f5ffbd6ff53943cc8d21bd96487f390107d22d7e7ec4b29004be0b4e30ca2c06
MD5 41dad308c331af31a0227b288437455c
SHA1 081ea171a484d1db878b47610467bae13c675a29
SHA512 552dfa6111a7b25a1b982b386b3054179cb4ed1777b5960579a5d0aeb19a58702e64b0930eba85ff1e606adb5c3ad6ac0f0f18e646a9694ceb96aa1b5b17c9b6
SSDEEP 768:UKWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7jro4pfe0cmRM:UKWPcLKWvKeEeu1jaClLiF7Q4pW0cmRM
TLSH
T124C2EA3B640CCB7E5FC01A9DDC5A6FA77E9802C79A644D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5df3b2c3-c996-444b-95ba-c688f11ebe1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5df3b2c3-c996-444b-95ba-c688f11ebe1b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 6fe56f7b3b1e84707577fdb84854300ab3e854142f9e296e09119e4db2a9ea63
MD5 4b3a817597e36118084d0b6627a84819
SHA1 086b5f2699d8bbe1ce4d6d6726f20c9e8bb9551e
SHA512 74afbc3fa9d3edc234fad65428c8a931a31e43da47a56ce6dc322271577388f8bf3ead889f85b10f2a961b34c8980726be1d07dcacdeff25e8fdfaef5b9edfba
TLSH
T1BCE020D445D5C21DD32C64C741B4534DC3952B5B96C0E99D6700C9CC754A75067C5590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 78aada0e88021585d06961f0d98a51a7b10091db466dd6d435872b4f3d8e552f
MD5 cb7919409a92e222dd7d871535538a4e
SHA1 b30808483abbd0006bd8609a28778669d2a651ee
SHA512 e728da7bbe69eab01c45c12554ebf485e59ed1ae6dab1dc2814af8e157855b3b00c3c2adc1786288c8d6197b57cbfc97a8ae987c04914e3b941a4595068f919f
TLSH
T100E026C454CAC62EE34E6AC701AC630C83903B5BD2C4AD9E7704C9887686B60FA82794
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4eb866f3226953a9db4f7e47af2ebcd54ce187bc543289d13276ac2992794c40
MD5 86af0dcc50f567ace1f9f3239722e537
SHA1 aa7262132b73dd0fba29d12e947ce950c7f54ec6
SHA512 91eadca3323262a58b1947d799a7530fdbe2d9664ca69ec3f9f91ed9efa8768cd4c237184f9f6c8d4974c80180323769627645e28467061cb7e02f490dce7a6a
TLSH
T177E0208408CBC21DF34465C702AE930C93902F9B92C0B90E1B04D7CC780739477D2752
MD5 SHA1 SHA512 TLSH

Submit Download

f_000056

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000056
Size 479KB
SHA256 d5c2e63e6b2d2018ab60c4b22be0813e0e39fa048f5db9c28229b2c49ac3e698
MD5 80f209028d08d15dc8d27e5ad968662f
SHA1 d1527f6a3a476781055f2622aa3714c19f7f3a9e
SHA512 eee7bf47872b9d834b7d3e071a6de5aaeb38c7823c6db3a07f9f154b927d80adf9a395d56460c9ec8819cc1af88c192fe415f2f9ca35cae9b183cd80a4052a29
SSDEEP 6144:Ic6NHwpiQjSns2HO1g7I0r86Bw9YciU5G/jG2FiOUkade77B6jSOD8FACaxm0dwE:I1wpiQ2nEVP6t+G/YdS7TY8rKT
TLSH
T18BA48D431B749778C229D0F5CEEAD7C9B23016C6AD861B9B9B46F4A01A471E331CA5FC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 f2d33ebd52f70250c284dd581fac2e5957fa534ba91bbceb18738a56556b8a26
MD5 752f453cbd172989666900a75c37117c
SHA1 d52429a5404d1f518e759ab6d422b6c6eebb6e4f
SHA512 e06f294cb2796debfaf478787176acc9601b9d810db7af73fa83b2c616434ae778880b5fdf317616310b27a8370fce26614474848c683f96020093eea764624e
TLSH
T1F9512D57A6BD40A6DB9B177180FD21873634B97255D31E8A00A4C7BD5B26F9FC34C870
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 6ec369887536f3731e81053cadc5ea0f753567e832265c8dcd2eb61bfab159e9
MD5 54b2873b6b457ba9eed9d20502767fbd
SHA1 76184d0324a98b3a3eee205e08becd8f88ef40d9
SHA512 a6b6836d5c479ea3f62be45409a0c33e2c531339833e49c42e079adc4d34c72ae865502291709bfc8af921b29c4b6836886b3347348e5d1ad3c1218fd54acc99
TLSH
T169512A4762BD40A6DB9B167180FD25873A30B97255D31E8A00A5DBBD5B26F9FC34C870
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 891719ad1dcf5982f943a23077ddec6146eda2e184e5b77e4db7888d12b7b47c
MD5 fec870e12ab33976f88323eb391ee1c1
SHA1 1ba8b924043fc9d4d1f9181ea8637137e5e1a154
SHA512 2b49261d6c28ced66bb122c9bdef292a3ea1b4b4786dfc9884abe61f65f5f5f6c4407df9bf2a87f263c649a8b3ea46d85747dca94d001e085bc7b4423214766d
TLSH
T12B512A47A6BD40A6DB9B167180FD21873634B9B255D31E8A00A4CBBD5B2AF8FC34C870
MD5 SHA1 SHA512 TLSH

Submit Download

59a863f8-e5b5-436d-a839-060470b8b0b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\59a863f8-e5b5-436d-a839-060470b8b0b1.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

40f7cfa2-df31-4343-a883-2a4b171f9e72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\40f7cfa2-df31-4343-a883-2a4b171f9e72.tmp
Size 1KB
SHA256 b511aa9155c6b2f3e3e0e2359e75d4dc9073b646c72fc60dab85702e254a391b
MD5 231181a6ebd99d5b02139c90c60acf1b
SHA1 2a69722b8910030e34e9d6ede4d4ca34b9d7d308
SHA512 e768a2dae68ba75c686039aa5d95334efeb1c6bfa99c6fbb5b2a8b97c2dcd387549add488de5d2bf118c742b3bdc972e1215abb01caaf85e2faa4ba15f4a8f9b
TLSH
T1FA1138F397B4856EEB01A2F4DA099E1F8E581422471C7C75C6E06E1BA3E68B5E100A5B
MD5 SHA1 SHA512 TLSH

Submit Download

4d5799aa-4956-4228-af05-d5cd83c2f6a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4d5799aa-4956-4228-af05-d5cd83c2f6a1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

57958fa7-9dd9-4602-94e6-0cd0085857c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\57958fa7-9dd9-4602-94e6-0cd0085857c5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f42b351c-e804-40a6-a7fd-9367f65df7bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f42b351c-e804-40a6-a7fd-9367f65df7bd.tmp
Size 1KB
SHA256 8b03c16e484a05996339e852bd5d44ab6bba9372b789461bd0809b3643f068c8
MD5 32532d7ff048e1fa8edcd9cc0fb587ac
SHA1 81034d1f6224029f5fe785411fc5848d8eae735f
SHA512 c19ca63c4fa9ab1a64614bdc9700d7cbf765bbcdd5ae1bc8a9207c5ce17c16974d431bb8028c2f61db0eea16d40ec7f2337ec769f9c6641338a64d64af52e704
TLSH
T1E231BCF397B4856DEA1262F4DA09AF1F8E5C0422476C7C75C6E06E1BA3E64B0E100A5B
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce246bcf-8b0f-44b6-9465-2240449f2c78\index-dir\temp-index
Size 768B
SHA256 529a6f376d28b996b9e0e81fa33fbf58da18580e20ecabf806c2daf892f4e9a0
MD5 d77ae907ad6211df46165b75402cb4d8
SHA1 acd3e9b06a6b40ec651190723388aea8bb577ea1
SHA512 60759f818ad63fc7fab29a25a590fa0deaf3a86043524e34123b0250e6c782a7bc1b125b0bab5c344341beb6f6d3a6b8ccf700d9d87760c066524dcb3b8b197a
TLSH
T1D00141C90D130A2EEC050630203DF808507903EC1350BA4FF2EEC1269CA6344BD82AE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ce246bcf-8b0f-44b6-9465-2240449f2c78\index-dir\the-real-index
Size 768B
SHA256 d198463566f89a568b06269114996f4c68e45a3d49bf0e638f1c99a13c02241c
MD5 21811404fe1767976e06752e8aa30a5e
SHA1 91f9bd88f5d3118205d7218681476dacd617b7c2
SHA512 776d37a83aa55facffb7db8239e5399b3159fd9fe6e195adf8670d814ac51bd6f038a0f3e16e11389614a59fa293478afc9d258c21fa35b69032b5e35d6d6aaf
TLSH
T1C80120DA01034B47EC000371DA3CA806216641446390775FE3EAA02BDC52780BD83EB0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 9fd2ff13a1e67a2e553a1588d96fd8856316f6a9f532aabe33b28c1b0b206bc3
MD5 5e167419e12d19f3869e46b38cc0fdb1
SHA1 486ffebe490de5fcf57b814bcb6a67e1cad4e131
SHA512 afcf035c7f20c83fabf655f5772ecb8a1d76f28b7db19ee07b35c7aa1e2c197918b4e424ef81f8b140bd63e75a2ed8aade852b61fc72705ce477d5e19d9205fc
TLSH
T122E06FBA6EF30C60ACAFCBE838B298B00109B858C541AC4E00A693C3A0F2715380AC61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 48522b0a051ff1495e1e1d24087a74c3255b1c4cfcce1efa3b372ffe5174e05c
MD5 c000d3a48af9d1ace9ade452e7fb29f2
SHA1 32ea1007b47391f3511aad072d9d1ab842f298d0
SHA512 06af6459509abc6e76d282868d24da595bb38b3c80c79434db2628ec55fafc2dd1d37498aef8ea87e09d14ed5e72f7585bd3cb7a1851d624d41edc52d55c6c26
SSDEEP 48:K0z2Xz9Vlmb1YNISzmK9j1Rmx72YAhT3yLdcRtfLPwbD2jISlwK9l1Hwx1gYmnLh:Ks4YKpS+KeQKPKscwKZ2aQ
TLSH
T10B916D11706B16403CFE694850A58A6A035235B3311CFA6F7FAC86A29E6FF091DFDDC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee437e85-692f-4e3a-a6b9-d8f03a117fa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ee437e85-692f-4e3a-a6b9-d8f03a117fa6.tmp
Size 10KB
SHA256 9d5e3a7283b92d2c927ababed84cfd0231216b7469a291fd0cf3389538ee42d9
MD5 3bf57aefee49f80a1869241e36b64974
SHA1 96b0509521f4b86c27932bff9fb5ddd7c6bfa572
SHA512 9d2c26bc0a102d860a193bea12582f7e21e3616e2dd03c9743f7af36e0c741a851f0d5f6cff9ce44b215a61aff5c044cfefcefcc47b0430be7b779ca3427be35
SSDEEP 192:sxZ7LWN/fysdSfFIupPaHW6+WNa/sXYapX0BZEIg52J:sxZ7qN/fyssxCHbNXLk
TLSH
T1AC22D8526E28A97B8CD7D20DBA59BF13E6F55032A1911E48EBFC961C04E77DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26bade8c-33bd-4b74-b0c0-5a2f9cedc308.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\26bade8c-33bd-4b74-b0c0-5a2f9cedc308.tmp
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc9eec2b-7428-4c10-945d-692b92942871.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc9eec2b-7428-4c10-945d-692b92942871.tmp
Size 18KB
SHA256 192654c7813b94260e5627f11e1a441b248c9063cb50f788e0fe9e8f4d5b816d
MD5 8648fbaefb7bcf289b4613267f9e0fa8
SHA1 520b7da551c68c65b4702fe622096839c9141953
SHA512 631001136526e63c95deca08872a1e75e4ad623b8cf44d06dd5947a6f39e3e9f3dcacfdbe5b24cc0f077d45a5504dc5d5c787a95fdcfd527b553400fe4a6a8b7
SSDEEP 384:1QkUSvssNMIWD1GWqzIGm2G8Lhp5XhyiIJg/IJtn:PsHDBsxDxhyiIbHn
TLSH
T1A7825C36AC786C779AF3A544F54A3A13DE74C127D6D92F60D6ECAB1D00CA298230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed2acb41-e487-4550-9615-534ce5900d7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed2acb41-e487-4550-9615-534ce5900d7b.tmp
Size 18KB
SHA256 5ec2de60f99f56b9f86291fbad1fd0a36820f4d63c08cc6dcb47d3196f984b57
MD5 3ae2b86107f7a83f6a9b0e8bdd229adc
SHA1 33925535e14b9439d5f34dad61f5116fe47874eb
SHA512 2cb5c8fbe2dfe55a775f22c1bf2a3fbd0d4e6f569b6b7739f6922735c906c5fc48b8029c38ae5ecefa3b52fe83d28fabc30f428c215f40038c7435efd1518427
SSDEEP 384:zQkUSvssNMpWD1GWqzIGm2G8Lhp5XhyiIJg/IJtn:dskDBsxDxhyiIbHn
TLSH
T152825C36AC786C379AF3A544F54A3A13DE74C127D6D92F60D6ECAB1D00CA298230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eed08bb5-6d25-4407-a878-653e69c916ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eed08bb5-6d25-4407-a878-653e69c916ad.tmp
Size 8KB
SHA256 8ff31dfde66bf4914df3cdf33c108bcb94dc74a146fef5befcf7cca2ee079479
MD5 60c47774aaa8e04618a7777010937c24
SHA1 c73e6f3da510d085f521694ff2a56884f2126590
SHA512 93dea669be5bf9e2b38a0b6367b663b4d335e7d7493c2c5aac9dae3cc31c91a1fc2cc3f01a5b9ed8b8291fe020a50369fa9a4998b93f6b742b51822a3842d401
SSDEEP 192:aONj6IE7QmiUyIlTPuIGm2ajzorLhiC7sMC9uU6:aONj6DtDPuIGm2G8LhHszuU6
TLSH
T1A6020A35AC787CA78FF36D09B4872B239EB5112BE5956F94D9E81B1D00D725C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53b0143e-9293-499f-b205-3e7d87891cfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\53b0143e-9293-499f-b205-3e7d87891cfa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fa484697-8610-45d4-94ec-68ff93c9ffa2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fa484697-8610-45d4-94ec-68ff93c9ffa2.tmp
Size 8KB
SHA256 52137d2f74c2fc627e170e1293c57c41712a1ba5e351b90d73944ff9281f889c
MD5 be8b8fba859a30c800437d75e19abf0c
SHA1 3e5459f79c2dc12cd4893130e5049652ab58fa03
SHA512 0528f8c21de28365b0744d2dbe43b63f6c358632e4637978b9910e5f1d4ad31cade5af0680f8377a2da74307ed6a7c5d9a39be39efb85d29fad6a9972b779eb2
SSDEEP 192:XON16IERQmiUyilT2uIGm2ajzorLhp5Xh127HeqEU6:XON16DvT2uIGm2G8Lhp5XhyHIU6
TLSH
T16E121A36AC78AC6B5EE37948F4873923DDB58127E6856F50D6EC2B1C00DF25C530AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ff418a11493b561a8433a669ebac62377868420f409a16d3917c556aed25bd15
MD5 03f7000431636fea74c9bd10cd553821
SHA1 d1506322e4e33abf36feb0a3772bf78c771ab6bd
SHA512 9ddc949cdf993672ca4b8b0e0314eeb094507e9a9e8e5753e81cd069e73d299d51a7c33829c6926cb76a85999e8dacdde47277e1e2997c9ee4c964bef7d0581b
TLSH
T18741F45CBAF91008B3B3BE1A9BF2B82E487A7D632E06949D10110E4E0A27A41D871737
MD5 SHA1 SHA512 TLSH

Submit Download