hxxps://modrinth[.]com/mod/nicewurst

Resubmissions

17/10/2026, 15:02

261017-seqf6sss3p3

17/10/2026, 14:59

261017-scsthshv7s3

Analysis

max time kernel
899s
max time network
738s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/10/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://modrinth.com/mod/nicewurst
Sample261017-seqf6sss3p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5604	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{1E541C34-1331-4B7B-B30A-9D968E8353A2}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-53044966-3830981193-2402648431-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3080	msedge.exe
3080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe
3404	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 492	3404	msedge.exe	88
PID 3404 wrote to memory of 5604	3404	msedge.exe	90
PID 3404 wrote to memory of 1944	3404	msedge.exe	91
PID 3404 wrote to memory of 712	3404	msedge.exe	92
PID 3404 wrote to memory of 1944	3404	msedge.exe	91
PID 3404 wrote to memory of 1944	3404	msedge.exe	91
PID 3404 wrote to memory of 712	3404	msedge.exe	92
PID 3404 wrote to memory of 5248	3404	msedge.exe	94
PID 3404 wrote to memory of 2752	3404	msedge.exe	95
PID 3404 wrote to memory of 5248	3404	msedge.exe	94
PID 3404 wrote to memory of 5248	3404	msedge.exe	94
PID 3404 wrote to memory of 2752	3404	msedge.exe	95
PID 3404 wrote to memory of 2752	3404	msedge.exe	95
PID 3404 wrote to memory of 268	3404	msedge.exe	96
PID 3404 wrote to memory of 256	3404	msedge.exe	97
PID 3404 wrote to memory of 268	3404	msedge.exe	96
PID 3404 wrote to memory of 268	3404	msedge.exe	96
PID 3404 wrote to memory of 256	3404	msedge.exe	97
PID 3404 wrote to memory of 256	3404	msedge.exe	97
PID 3404 wrote to memory of 4408	3404	msedge.exe	99
PID 3404 wrote to memory of 4844	3404	msedge.exe	100
PID 3404 wrote to memory of 4408	3404	msedge.exe	99
PID 3404 wrote to memory of 4844	3404	msedge.exe	100
PID 3404 wrote to memory of 2996	3404	msedge.exe	102
PID 3404 wrote to memory of 2996	3404	msedge.exe	102
PID 3404 wrote to memory of 2996	3404	msedge.exe	102
PID 3404 wrote to memory of 4280	3404	msedge.exe	103
PID 3404 wrote to memory of 2280	3404	msedge.exe	107
PID 3404 wrote to memory of 4556	3404	msedge.exe	108
PID 3404 wrote to memory of 952	3404	msedge.exe	109
PID 3404 wrote to memory of 3636	3404	msedge.exe	110
PID 3404 wrote to memory of 3636	3404	msedge.exe	110
PID 3404 wrote to memory of 3080	3404	msedge.exe	112
PID 3404 wrote to memory of 2076	3404	msedge.exe	113
PID 3404 wrote to memory of 2076	3404	msedge.exe	113
PID 3404 wrote to memory of 1104	3404	msedge.exe	114
PID 3404 wrote to memory of 1104	3404	msedge.exe	114
PID 3404 wrote to memory of 5400	3404	msedge.exe	115
PID 3404 wrote to memory of 5400	3404	msedge.exe	115
PID 3404 wrote to memory of 1996	3404	msedge.exe	116
PID 3404 wrote to memory of 1996	3404	msedge.exe	116
PID 3404 wrote to memory of 3420	3404	msedge.exe	117
PID 3404 wrote to memory of 3420	3404	msedge.exe	117
PID 3404 wrote to memory of 1208	3404	msedge.exe	119
PID 3404 wrote to memory of 1208	3404	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://modrinth.com/mod/nicewurst
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x29c,0x7ff91553c188,0x7ff91553c194,0x7ff91553c1a0
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,1310487583440844027,7577165233578363773,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,4848700165279458718,10657315620244446746,262144 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=2512 /prefetch:2
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,12396568568202186539,14866233915478240731,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:13
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3648,i,1634748723323928133,11079159465463179120,2097152 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3676,i,6080666580355742132,1006153355933658680,2097152 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,2339072213234738368,14140143511952871139,2097152 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4408,i,10095352908139358757,13140197136914938302,2097152 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:9
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,6155435563267488818,11567371058620263162,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,2150415466365543179,15548458832861910312,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14642287226871782981,17036694671078815114,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6080,i,12225834378509845241,13181185301872241577,2097152 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,14642287226871782981,17036694671078815114,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:14
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,11563881000941301349,9240808852358917077,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,8758318537872755595,4010019294128483859,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:14
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,12925156873625737353,18205761807040997044,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:14
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,9491074742378856359,4754606710550207798,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5764,i,15510171259489891103,8627915689513031096,262144 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,16784480145111581725,18244464424891389445,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:14
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,650114615058081442,8768745595763906676,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6904,i,18322100539452420809,560995612654369098,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:14
  2⤵
  PID:5400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,11775036790543111953,10059946621062766114,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=6900 /prefetch:14
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,14528006088926595027,7045007036595993926,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,9289426572193088920,18075883949824928253,524288 --field-trial-handle=2516,i,3509616534511777193,5776055284336160780,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:14
  2⤵
  PID:1208

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4828

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1808

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:800

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0f03f992-8815-4370-9239-05b7617cc69b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f03f992-8815-4370-9239-05b7617cc69b.tmp
Size 38KB
SHA256 a59601bffa327780ece916b9c03bee4d86f6c617fa56a22fc60edf339ffe957b
MD5 03427331911ff094230c0f710b546ec4
SHA1 1b198f279d853c20008262331b1d4b48a31a43db
SHA512 a57aeb6e7ef104f924620b88bd717bdab69ffc18b942cd840815d5d4fa2078b63497458bc88d0eda4cc82a33ff985907c4e71a31de9a65e68b96510e3aa7c173
SSDEEP 768:g/UxvxjgC+i3du9TOf9fffff7znyJYe1ELsAvC8/YNtISHrkw:NZj3+i3Tf9f3fDzgYe1EQujYUS4w
TLSH
T15803BF36ECB4CD375EF2A388728A5753EEF4811399C45AA486DD2B0D06C72AD530F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

283be066-7fc2-4de1-815d-bba52c64ec66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\283be066-7fc2-4de1-815d-bba52c64ec66.tmp
Size 41KB
SHA256 d3add7038088657385f11c5dbc524df4be62c71a3e63be3af5bb80c1287dc217
MD5 316f27fbe9b4ba2d8807b6d9aa3a32d8
SHA1 cf4bd52ad10832d841ce7bf6b7f0b38f8bc8a0c4
SHA512 7bf2fe08aaf67c540bf282303e49025d21b88d61d566b508616f6750f4e7e46a2707a5870be79f94707222df91c51ff4f3fbcf4cfa44f2a64078d5d6665b5179
SSDEEP 768:XFdG3qwgmN2A9TOf9fffff7zIGJYe1ELsAvC8/YEtIxT7LG:nG39N6f9f3fDzBYe1EQujYnZ6
TLSH
T1A4134AF298E78977DDAD5787A37D2E12AEBCC113B8844654B7C91A0CCD831BFD20A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2f3a6233-d018-487b-b877-151b675b34f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2f3a6233-d018-487b-b877-151b675b34f4.tmp
Size 37KB
SHA256 531925cb8710def02efd3f88ef2173d4ce0397a76fbb16ec28cfd07cedb0adb1
MD5 d16827d0d26d9ef3e7d41e4400007559
SHA1 e2b2b9997ea185d29e622a005d351784a38ace9a
SHA512 5f420b2cb9118eb8a7d76ec07bee28dc0b10fb1f8999cf032fbe9935f4d560f7b54ba3427688b11c6e5f36105118c22791aedbed6dbc40603c38a6f4a1aa6ea3
SSDEEP 768:h/UxvxjgC+i3HD9TOf9ffcKJYe1ELsAvC8/YMStSHrkw:0Zj3+i3Uf9fBYe1EQujYlS4w
TLSH
T1B703CF36EC648D375DF2A388774A5753EFF4812394C45AA886DD2B0D06C72AC530F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8b5d712c-015a-478e-9a6b-872344500648.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8b5d712c-015a-478e-9a6b-872344500648.tmp
Size 38KB
SHA256 d8485b79f4864d76ec59e51e7c0e39947cf7d8d38d08f250d59fab817cc3c865
MD5 414f156f8468d60ca9ba7356d70d802e
SHA1 1b634c571c92ebc0fa25ac77322a8d6096b9b7e2
SHA512 46526bd36cffb4999f88eacac953ca2a1fc33c70851b57949ba756880e40b1b43004bb5be1a7357dd8accdc8513133ede6a51dccd36fe69e40a0795fd3610f73
SSDEEP 768:C/UxvxjgC+R3mN6A9TOf9fffff7zCyJYe1ELsAvC8/YEtIoJJ:HZj3+R3mNmf9f3fDzzYe1EQujYnoJJ
TLSH
T17A03BE36ECB89D371DF1A28473491753EFF4412395C85AA88ADE1B0D0AC72AD534F85E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

32d83989-3be8-469f-849f-721db215396e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\32d83989-3be8-469f-849f-721db215396e.tmp
Size 105KB
SHA256 3f461bb307501118465fa355b5c41e2a705f236a6f0a9d6da2f7ec220831c703
MD5 b128b9eab72c965083b92d5147aa016b
SHA1 50e10f3f576f2ffa690298c3261891f992813335
SHA512 c7356be074c8c4dac39c2b53fc3c679e844ec686a16cf50df2caffd578fd4ff9775661084c859882e8c383687ff10fc72b9c4d7784ae1707436f3dee76196979
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7r:fwUQC5VwBIiElEd2K57P7r
TLSH
T193B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

0101a04c-fbfe-4639-9fed-ef5b9809dcf8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0101a04c-fbfe-4639-9fed-ef5b9809dcf8.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3990d07a-d726-4015-8a44-e7616dac4185.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3990d07a-d726-4015-8a44-e7616dac4185.tmp
Size 11KB
SHA256 d7cd9cc399d8235c83d40e81785277b0a1bece0bf97c798a563062a3f85fe29e
MD5 cb3d8dd801c95123499e52483d1ee9ed
SHA1 8ab0d733271419f8b0dee24c21dd75145689c27e
SHA512 7fd3a14df0ac2755ae0ee7bed4b6f3f2e2b3155f9ed515e1eb28df0d0edca919bacd4a407fe7da321118e4e466997b64dbac76bb322ed377ae5c28dabb87b848
SSDEEP 192:sxRpRKbP/fe3slGqrViqzoA8pich/g6+WNYlr/YxFOtjUpGiIgIJ:sxRp6P/fis0einl/5q/JlUJs
TLSH
T10E42A515AE38AD3B8CD7D219BB55BF23D6F91032A1952E44E6FD8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

520e0efe-7fa3-40fc-aa0d-51d302da6d89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\520e0efe-7fa3-40fc-aa0d-51d302da6d89.tmp
Size 23KB
SHA256 1445d8fd1dff07a2cecfbd8a3028e16c54bad6abbb82da6b1d311cf0487f0d13
MD5 210928a6fbd1c578689e85e97d2cdb97
SHA1 01d84181292d07f4def74c5fbe2482ac6ae28a5f
SHA512 4b5b8f915c8ccee488dcc0d7b81b89c87c2801f703d1bf89773ccf757efb8da17c109079ccf95098568ba9e464df4e0ac73c036cc2ce497c84327efe54e4877b
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RM/rowzL:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0VV
TLSH
T184B2CA2B644DC77E8FC00AAD9C196F9B7D9802C79A548D4047FE994C03C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

558c47bb-f773-4da5-8e9c-b65d0bc36951.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\558c47bb-f773-4da5-8e9c-b65d0bc36951.tmp
Size 12KB
SHA256 a48c1eff4c8725da294c4cdd4cdfccfaffcb7d146ba4f0640d54b5e760c92786
MD5 fc6be6ec24b234cf36ca6e3d44ce7c02
SHA1 1fcfd087de1b488df11dc6f193f898edcb2d7842
SHA512 c00a96946a3511ac00289e8b87147467cce16e634b958c44ccf83318b7f4847c7d2a8dda65ef3602324ab18be988253c9d16069a68a3d0393ff40e2f57feff9c
SSDEEP 192:sxR+RKbP/fe3sg9qrViqzoA8pich/g6+WNYlr/Yx+OJjUpGiIgDQJ:sxR+6P/fisKeinl/5q/GRUJo
TLSH
T18142A515AD28AD3B8CD7E219BB95BF23D6F91032A1951E48F6FD8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75b5f4f8-2e16-48dc-9c1c-86a5e5a81926.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75b5f4f8-2e16-48dc-9c1c-86a5e5a81926.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 cbeb2968c375b791002dc297f77648116100058eb71e2774f5d95b17a77cdb19
MD5 a689bb1b636e6f7920881d5847d2bf1a
SHA1 16387c7125cc89c287219cbc35d57268b78d28ea
SHA512 0f991e36720bc2fa6e684b6908b5e54f33247c090a7672e6a08f3c10fae1df5217c715f2596d25775a3c41d5071dd880a2bfd4bb51222bfe6dba625c4d13edac
TLSH
T114E020A409C9C23FF30578C70158574C8785365F92C16E4D2748C544F34B740EBE5664
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 5d19733544d50c4e2cb92049f6c684ab44f121f51dd83deb6f108c047c825521
MD5 ef59c7e1929fe779642631646769bab0
SHA1 c32ca597f5cec1e25b712bd2d369f82c674e1997
SHA512 3d23114115040e9a2772561c8bdb198303eb05ce35db6fc2b6ee6b4e854c1d0ade27054ea7cd4ea48322f0b00d7e0174bf3657b670a5921c05e73d4d0fdee2b3
TLSH
T14DE0208809D9C21F630C74C70374534D8393261B96C16A8D3700C544F24BF446783BD5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 87cc8b3caed501f4467176be1c89d5266da87e2b6bfbe812d05d562ba7a0a79e
MD5 44afd17ced96cb6283ea481c9d0384ad
SHA1 8bce5d534935a121ed37a83d8188fb056a56d3cc
SHA512 c6bc82e5c602a46e9a7d5f0b4c89011ad74b5d23c996556a7d563bd280de5317712cb2b85f038d4591eae173b0173185682a1f38ff195a05b73d02db4742567a
TLSH
T146E0869807CEC22FB31876C7026C634C8792365B97C56A4E1704CA84F64FF44A796790
MD5 SHA1 SHA512 TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 37KB
SHA256 328101577b93b753153a90b9d211e0b2495776c2def25832bff00b41e58a5732
MD5 c8f2ad1212214a3be613c79b01bd7ee0
SHA1 5595628c9f331249e2cf45f7a2129b32ce402929
SHA512 8683647d6c0413a0738a52156f016c8e0d58cb281248a845fa0d765880f33e32518ce4dbc547c175e3df0948fc4557d513f5d90a004f4c72fc49640a1ed50557
SSDEEP 768:GYjJCyprdgng5rQfOkSReZvo6dt2hk5LCJopYmlEaXXSgqwm/SphC:GMJLDrQ2kSQZvowc0LqQPEAXScmSS
TLSH
T10103F2D174D2C39E29F18C6F22D6BDCC596B8E9BF4B2FD761D6C869003034C26B89906
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a3

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a3
Size 39KB
SHA256 395a326ec481ac99a0edfc56de612a98e1abd956ca3b3541ddfdce0209721815
MD5 9e6364897ef0aa943122b9ce583195ef
SHA1 d9381564fdac043274c1a3356feb5a03563c600a
SHA512 13060ca92ee2e1b61007a94f19d09569a163a6d7eabb4dbb5a7215147447997902c3be6fe4d7e4e1f7a711a23d082bce5663a64e7633ff84e797e39c89c56fed
SSDEEP 768:XqzP4+FxUGnhOSP3JQrsmhnrkXge4nn1IwBuQsxRFOGq0/4+4tzuZ:X6g+o45QlkXm1TBuXxiGdrEKZ
TLSH
T1CA030146F3378F0291C22578168DBF32CD6A01468CDC9B9A6594D8CF21CAE7C4AC717D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000c4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c4
Size 77KB
SHA256 c55544fb40d6a22b27922380bdc3786ea32a56c5b7bc7a12e8918a8edeba71af
MD5 305a1bed47ccd01e2978a73cf9999618
SHA1 09677e6c8906c31cd5cc4aa8965f1ca4fd42bc1a
SHA512 46800c84951d686a6025c71f33933b478f2987d13081a53fc55d70fb6d15e2e45dcaebe331ee7608a7ce2f08319e8fc4c2414af3c54639ccf1ba3b646d9cd5d3
SSDEEP 1536:qYqMF60h4Anp8Dk24Kon4gD+jAN2xk1b23uuTs1ujMTW+7gl1/QT:qTmDh4wkk24tn4Y+jAn23JTsIj2bw/QT
TLSH
T1337312CB46A346785043647A5E4BA3146A362374AB9CC706339D4BDF8F660F0E226CE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 c780e70478aed695d5557bb209331a7050fb33c5c09fa39609657e19ec05b1b1
MD5 4b18e601f7951f59f02891cc9a460e8c
SHA1 cb3089ebbbcf4653cf6e3bb7ed4fae75822d3021
SHA512 0b7cca8b1d8fec46b787c97105025d3d46a6e4120f381db90185e4eed59c17c9896b45476c1f0be06c600e4093702bf8e1e5c21e61ddc46e09cc8e1a95cb2feb
SSDEEP 96:e571mgy0rKZ2CGAX+ICfAGQnYqX4diV8EOpVGjajBsAFujjeYPacE67GUlbF5b1y:2jOloBPnxY/hQqf2
TLSH
T11AC140B162A02D40F7906B7061DE8F8235F8046BD6BBCFD1A9C8F5749DE6B5A407E321
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8550b3e86b6e67e21caad5dec3be01203722797bfc64fc1b0f723518ce3f7d4a
MD5 39a3aaeff33a9004ec45f8e53cb0a3a3
SHA1 c12d568b5610b1cc8f9217339eef0668a5744b85
SHA512 b49f2a7628785663fd0e35d3f564f3d50a1b9f55aaf744f52704599e704078628546738557f45cffda09965837cbfe5d0515cf4d93c892bb432ce00e7019c2a8
TLSH
T1FD6140C673B40054F7544175B2E2CC8736B8054E978F9F921998EAB8DE75F2B418F162
MD5 SHA1 SHA512 TLSH

Submit Download

cd0b3c69-0cbd-4bab-bcfa-b33bcf6b790c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\cd0b3c69-0cbd-4bab-bcfa-b33bcf6b790c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0309189d-03ee-4844-a6b1-06b5dc315397.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0309189d-03ee-4844-a6b1-06b5dc315397.tmp
Size 6KB
SHA256 e0f06a9b50fdfaf6862f2dd62d90e580b8fd73ff1c264791b1f114cc3e51b9f6
MD5 0a4485906f7bf148aba0a9a3c2640629
SHA1 aeabbae4e6b4721994566d281eff880d3da328c6
SHA512 db278ab7ca23a4a5891ff1a82e29e35f985b3b83760d8df00e2f0d746e8bd7e89cce7d34bbbb8ffad30ab40dbaed0b8850236e8767f7ca4db1d64a089afa68f9
SSDEEP 192:Dn4aI+hzAS2VaaiKs1IJWFKXeWCIyIryFsBQoMvIuZfitRRT:Dn4aI+hzAS2VaaiKs1IJWFKXeWCIyIrB
TLSH
T107E16CF387F4962D8D2192F1AE162E1FCE2E0964562C7D2BC5D49F2793D2471E102A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4548c7af-208f-414a-8495-685a0faa3f7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4548c7af-208f-414a-8495-685a0faa3f7c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

7f76f63c-94fb-4338-a401-3648ead900aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7f76f63c-94fb-4338-a401-3648ead900aa.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

9017e8e7-6812-49ba-bf25-451035013daa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9017e8e7-6812-49ba-bf25-451035013daa.tmp
Size 6KB
SHA256 19dddf045da33291a4f3266b98ea487ca64f2837688b8a38f4322695c8b23cbb
MD5 ef68b16deddb6a81c4ae9317233212f5
SHA1 feb06404c25535b42048cddf3a4aee0a75b4c4a9
SHA512 99a6d82e13b3b33946d63fa09498c0ef95ed7eed778e3ee5ab38dc1007a111c75777534f3fdfacc3951d2c9873b013fb41baa91da831ed26631f32d6883e66cf
SSDEEP 192:DWD2ovvhybem7VaaiZ1IJ/FKXeWCIyIEsNcQoMHIuZ7+tRRlGj4v:DWD2ovvhybem7VaaiZ1IJ/FKXeWCIyIo
TLSH
T167C148F787B49A2D9D2192F0BA166F1FCE2D0424972C797A85D09E2793E2061E102B5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9cefbb62-df55-4056-bd94-e482569d1243.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9cefbb62-df55-4056-bd94-e482569d1243.tmp
Size 1KB
SHA256 77365023c2a2339afe17a50209d893d4fb3b1473018f84ed1cd326a3b6ba0d97
MD5 1b1eff0a5bc5b40bf72bc680b3f84c08
SHA1 b72f7f9fec440f09745d0c717790b0c0e498e3e9
SHA512 90050cad6b510b0b8becefdc2b0f42c75386eb3a33bb7d9a83e6fedf2a875f63243b891bdd4699fa660ffba05a1e6b911533346d57e09ce3e25a471a0d34dee0
TLSH
T1F921AFF7C3F85A7D894196F86B182E1BCE2D0854531C3E5BC8D4AF5B93E18B1E28095E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ebbd165-52a1-4145-b022-179cc6acb872\index-dir\temp-index
Size 1KB
SHA256 c1603e91f12a5491bcd47469f8717c36bcc29f1f1260953a446f8bd71ce89a9b
MD5 89ebd09783c8ab0645c0c5208187f7db
SHA1 fe271c008e29ff8e9466a0da3178b9fd68515467
SHA512 6cc1cb075d07c3d72611b79f9909b4a52aa222856c18994287892fa884cc5b35d493cadb693efbaa46c6c5ed1acc9d37ebb968ed5af70e67006fc6f09ce0c4be
TLSH
T16B11208F0D621B0BEE981239283D6999637913CC4305660F70FDD12A9CE5B58FD82588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4ebbd165-52a1-4145-b022-179cc6acb872\index-dir\the-real-index
Size 1KB
SHA256 971f057034d3eac36d90576b169ab68131822113c27cdd70198df0f41ff4a6c4
MD5 d1bf1357574423afc5c9e0320b17d3b0
SHA1 ec61e6705fab73e1486e6e61771d9c4312bef752
SHA512 4d5c62817c6dcebfabd51ab734bffd75fc7dfa89591af019e1050fc7ed9839a1aa4018ae3206593df0875304769debdcd0eec73a53f539170a1cee5dba898b7b
TLSH
T1FE11155601735B56ED4412B5156D7982633A92441348AB1FB3D2A06ACC80788AC83A94
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 47d737cc38c4f0277c079fe2d2eafc8d0d678281405d50fae55e590ff53be012
MD5 96501325e33208d6c26ca08b5b1dfa46
SHA1 f40c8921c75d6e6bd7129082c07539ccc891b085
SHA512 7dc9c997fe36c6609267f556ba517333ddfce986023391f49182f08cf6b1157bc431764642aef99ee111c9a562874693ba8d5a04050cb77641d96eca4497441e
TLSH
T112E0207E3FE72810ACEFD7D9287144A10501FD648914AE4F543FD1E355A13652846C66
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 fade18b08965c9083cf630d76ca35a8db4b63f3449288e6d8ba1c99601d9d40f
MD5 a8edf895913648a8fb14ef4366f3bc39
SHA1 467d8f143213efd317f432bf58c2dfac33bdfbcc
SHA512 89057d400b01a3e83dad3b839a48186ed0df52dc189c21660b6a93cf23a7b106fb21a7f35884f4073aa151346b8946da3382cac7a5574d1134883fdb8934d8d3
TLSH
T10AA002196F844403C4119B715AC903513762CC1021124393409E2155DD916D04D51001
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3701e729cb9a89aa861da911e9307acf6f100695d5c683d18a26d4764e504bcb
MD5 c423ad2c932503c6d37ac582c4ad7b7d
SHA1 ff0d4f7528c074aaf41f83f067b6bb6bf1c57541
SHA512 1f80922b8a4676a5ddc410c21956686e4c9f94cdc40ed8db33d9758bed22c2b4ea947903983d3103ccc8fd8697196cc95d38c9448236b87d3f5d41ac7859145d
SSDEEP 48:KDdI1K2gA/y9zIlK0k43viVRfhtn+lQ+IxpnKomgbn0X3f4V9syuV8VPVAVsVr:KDd6K2gyWzCK0kr4YKxCem
TLSH
T1ED91EB32333A430039BD3A5C81D4AB5B465231A73025E56E3BED45A28E7AF540EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a465ee99-6617-48b7-94b5-74fcd58d588a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a465ee99-6617-48b7-94b5-74fcd58d588a.tmp
Size 11KB
SHA256 2103aed50773c5a2477fb89e3dc0d5ff1dc16ac9a28ff68628e3c81783e1b8b0
MD5 4fce2c82a472ec56b94658561067f62f
SHA1 91af8976d1b399a33f8613c4b82cf1b4ed1aa617
SHA512 60b7fb3d371b80ff2517908ea820305c8dab571bf67f616d1b3c9a60d4efd5e1d6f110a960bc420453e3ad18f1e082256633a998d70e3ed5090a8d443fc5f773
SSDEEP 192:sxR+RKbP/fe3sgGqrViqzoA8pich/g6+WNYlr/YxFOtjUpGiIgDqJ:sxR+6P/fis5einl/5q/JlUJq
TLSH
T15D42A515AE38AD3B4CD7D219BB95BF23D6F91032A1951E44E6FD8A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c66306cc-ad2e-40bd-a5aa-1f5522305af5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c66306cc-ad2e-40bd-a5aa-1f5522305af5.tmp
Size 26KB
SHA256 4413570118e9f83d67d0e436e92928ac374135eebb47fc5d69fd4f150e61bbd1
MD5 79664e1f7bbd2900861129c7d699918d
SHA1 cb879acccc920001f675994709a0d4baabc940a1
SHA512 35a71b029aed2cc55fa175eb3874be1915a35bec8dd1e598b6582846d4a078cdd50515b2580cee9641970b60a458080570cb40fab3a968cfb95a905b30dfd61f
SSDEEP 384:sxR+6P/fisK66s8qMpRiYnazAW8pZS15posJWeT+ueinb/5q/GJUJo:sC6P/f44Mnc7WeT+uek/5QGJUe
TLSH
T1D3C21905A924D83B9EC35D18697D7E33DAEC406222C9DEDA56ECCA1C01DE1FDAB0741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e9fd4be-2a8d-4d31-b768-48a9df75d828.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9e9fd4be-2a8d-4d31-b768-48a9df75d828.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 f9efaea87fa355e1e6f5784b13d56056771e12a586f2c7f9a46ae8249be0857f
MD5 d8a1cf9ac409eb850a40757b26af6787
SHA1 f719239719e13620013c040041377028c5839bd0
SHA512 0f296f40c682f9d5b3999913277040fb2bfce210b4dd480740d3044c3d97f51ed550b9c57408b815aa33a2d854645099b7c01b5d1ba39cd5760c8534beaac712
SSDEEP 768:fN3mNPA9TOf9fffff7zCyJYe1ELsAvC8/YEtIxT7LG:fN3mNHf9f3fDzzYe1EQujYnZ6
TLSH
T121F28D72E8B4DD775EA29695B2892713FFB48113D9C80B54D6CE2B0C05C72EE634B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b5772321-a0ac-4bf2-8a7f-ef0b0b993758.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b5772321-a0ac-4bf2-8a7f-ef0b0b993758.tmp
Size 33KB
SHA256 2d7f73f84b9c8ebe9b1a323e6abe027404e7faf554a289bdbb4b3e9e1bbdf7a3
MD5 08f3c19c7d17670e8b468bb6178eed7c
SHA1 03b344b3b4942ba0a018bf824866675d82edba36
SHA512 0efeab492bd31a03777f9454fd541608656c1a9efe8c7aaead7eae4a5d9b9bc243e008f9297f75287db9b77a44b4049fdf35f40936bd8c64192842b72f800b74
SSDEEP 768:wN3fNPA9TOf9fffff7zCyJYe1ELsAvC8/YEtIxT7LG:wN3fNHf9f3fDzzYe1EQujYnZ6
TLSH
T1D6F29D32E8B4DD775EA29695B2892713FFF48113D9C80A54D6CE2B0C05C72EE630B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bf8ffeb-343b-4056-b7f9-46f26a5189b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5bf8ffeb-343b-4056-b7f9-46f26a5189b7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download