hxxp://h6spk9k2pezhukhxkvpbtr56v7gjdi3k[.]castlemainecaravanpark[.]com[.]au

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/10/2026, 15:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://h6spk9k2pezhukhxkvpbtr56v7gjdi3k.castlemainecaravanpark.com.au
Sample261017-styq4ahs3m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2988	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{2D6195BC-905D-4D08-B540-ABDA3A3594AC}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{20E6DEE6-7510-474E-9162-350E125D139B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe
1944	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 4672	1944	msedge.exe	88
PID 1944 wrote to memory of 2988	1944	msedge.exe	90
PID 1944 wrote to memory of 2296	1944	msedge.exe	91
PID 1944 wrote to memory of 2296	1944	msedge.exe	91
PID 1944 wrote to memory of 2296	1944	msedge.exe	91
PID 1944 wrote to memory of 2404	1944	msedge.exe	92
PID 1944 wrote to memory of 2404	1944	msedge.exe	92
PID 1944 wrote to memory of 3440	1944	msedge.exe	93
PID 1944 wrote to memory of 3440	1944	msedge.exe	93
PID 1944 wrote to memory of 3440	1944	msedge.exe	93
PID 1944 wrote to memory of 1196	1944	msedge.exe	94
PID 1944 wrote to memory of 1196	1944	msedge.exe	94
PID 1944 wrote to memory of 1196	1944	msedge.exe	94
PID 1944 wrote to memory of 3008	1944	msedge.exe	96
PID 1944 wrote to memory of 3008	1944	msedge.exe	96
PID 1944 wrote to memory of 3008	1944	msedge.exe	96
PID 1944 wrote to memory of 1800	1944	msedge.exe	97
PID 1944 wrote to memory of 1800	1944	msedge.exe	97
PID 1944 wrote to memory of 1800	1944	msedge.exe	97
PID 1944 wrote to memory of 5100	1944	msedge.exe	99
PID 1944 wrote to memory of 5100	1944	msedge.exe	99
PID 1944 wrote to memory of 5100	1944	msedge.exe	99
PID 1944 wrote to memory of 372	1944	msedge.exe	100
PID 1944 wrote to memory of 372	1944	msedge.exe	100
PID 1944 wrote to memory of 4348	1944	msedge.exe	101
PID 1944 wrote to memory of 4348	1944	msedge.exe	101
PID 1944 wrote to memory of 3876	1944	msedge.exe	105
PID 1944 wrote to memory of 1444	1944	msedge.exe	108
PID 1944 wrote to memory of 1444	1944	msedge.exe	108
PID 1944 wrote to memory of 1444	1944	msedge.exe	108
PID 1944 wrote to memory of 1752	1944	msedge.exe	113
PID 1944 wrote to memory of 2052	1944	msedge.exe	114
PID 1944 wrote to memory of 2036	1944	msedge.exe	115
PID 1944 wrote to memory of 4876	1944	msedge.exe	117
PID 1944 wrote to memory of 4876	1944	msedge.exe	117
PID 1944 wrote to memory of 1412	1944	msedge.exe	118
PID 1944 wrote to memory of 1412	1944	msedge.exe	118
PID 1944 wrote to memory of 1412	1944	msedge.exe	118
PID 1944 wrote to memory of 2352	1944	msedge.exe	119
PID 1944 wrote to memory of 2352	1944	msedge.exe	119
PID 1944 wrote to memory of 2352	1944	msedge.exe	119
PID 1944 wrote to memory of 2292	1944	msedge.exe	121
PID 1944 wrote to memory of 4048	1944	msedge.exe	120
PID 1944 wrote to memory of 4048	1944	msedge.exe	120
PID 1944 wrote to memory of 3568	1944	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://h6spk9k2pezhukhxkvpbtr56v7gjdi3k.castlemainecaravanpark.com.au
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffbe237c188,0x7ffbe237c194,0x7ffbe237c1a0
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1660,i,4500405762622879424,14834714369377422407,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,10127904359867623926,6527114859719728219,262144 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2596,i,10978929442820524232,17438795286307592648,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,16547686530866961309,2044699383269695446,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,107500526713026133,8036731353047984070,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,1790286128526515586,8552264846313216545,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,6118344914355019694,9803274998247431499,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5128,i,3176047519306800959,2626213598749120657,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,14536483215765696801,12411860561137527712,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,14171185200520476117,5691549327156271505,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:8
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13268562293239062054,7629286679829792143,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13268562293239062054,7629286679829792143,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6236,i,7152799712989241504,9547464349646356169,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,14458874657907895602,18079941231496794652,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,15994807838188979802,4670307448365598638,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4312,i,1114081728974002352,13155874257331725146,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6520,i,16435954030726433756,6573677404874486295,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5468,i,12788789519311029739,6450094849214088261,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6824,i,2266408652283095361,3899883242985649873,2097152 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,11559525793574025815,8272466088171515058,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,8226293879321992462,1570495067849752453,524288 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=6868 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6960,i,15724066911209016762,12757847353640076707,262144 --field-trial-handle=2164,i,15389108109204232828,10043890448497578382,262144 --variations-seed-version --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1280

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

098743dd-a667-49fa-9151-8f1648cff805.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\098743dd-a667-49fa-9151-8f1648cff805.tmp
Size 26KB
SHA256 07f6509cbe778e6a8333f7360538f6b8d5f604c6822fef150977f8faf2770acc
MD5 85ba63ca91d6409f9f2e1b07d148e78e
SHA1 ba6f6dda8949a077d356f5f25df8ab8a7367aa65
SHA512 15946ec574231a00eb227735a389c8a694cb09ef9250e9b861558fd285fa57a18e1ec777ca1b8abebab1c1bc51ebf8831153ac4f225d8105c216a185921106ab
SSDEEP 384:WiFzQkUSv0zsNT8TUNTUlIlPwliRBDQX5+Dtm8/wX88WlCMTL0IIlj:9FdIiwgEUEkDu7WlCMTQLl
TLSH
T1EEC218F258D79937CAAE5B53A77D2D039EBCC023B5845A50B7885A1CCD8A1BFD306C12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

37d7ddd9-5548-4e80-b8f7-3ab15f83fd77.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37d7ddd9-5548-4e80-b8f7-3ab15f83fd77.tmp
Size 18KB
SHA256 254fb70a0334a6d81fe0ea49b0025c0e68bad2dacd91e8d2568279935f52f970
MD5 6275b1f7f33a117bf104ce5124cdf621
SHA1 6ca75e81d111d77104b4862079dd712bfa08419d
SHA512 c17888100d12cdb26464020271e18b74442ae947f9741f75ec5475b531450d24aa51ba0014822d9632875c43ea317738268ddf2465e4b11d2a525fb179fa56fa
SSDEEP 384:VQkUSv0sNOUGwliRwDQX5+Dtm8/wX88UlCMTL0IIlj:v0WTEkDu7UlCMTQLl
TLSH
T1FF827D36A8B4AD674AE26561F49E3513DFB49027EAC82F90D6DC9B1C02CB2DC2307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

497cc623-6db8-4e77-b815-a3ba29e6fdb8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\497cc623-6db8-4e77-b815-a3ba29e6fdb8.tmp
Size 392B
SHA256 375005f6468447908edaa27c8d34c8093fca58d0fbffdeced0cb0c848b958079
MD5 56a63e807f640ec06893e5a793e8d580
SHA1 6acd961e0a518e21078528a9a6dd5c3b4ea334cb
SHA512 197dc87aa1b88c174ca742596abf3213d8a88ebcbd1016d0b09d9ea91c82ddf0fae94828ade233dbfd835ed90d89cd731b4cae71d88ddecf51987d42edbe3a42
TLSH
T157E0020563011657C878533000CB1B243FF1C21403734306052045783D273003D10780
MD5 SHA1 SHA512 TLSH

Submit Download

59ad690b-f95c-426c-bcc7-ff156ebf08ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\59ad690b-f95c-426c-bcc7-ff156ebf08ed.tmp
Size 8KB
SHA256 4f306d1da20528dfdbcb970b5186c206e2e0e675f15066ba2d0d963ac101060d
MD5 2b68ff4a266a0339745bf0a9f419b41a
SHA1 66f2012f3096827de6c8746f11e497110538a61d
SHA512 e66c60f91d7ff6438f5ad14bfbd7fd0b61c16fcb45cf0c6c112f96d71535ae7e056c5302094a9164ed15fe911dd42bd617fb7839eaaec88e4889a1b13de98790
SSDEEP 192:EON56nnHGQmiUyzlQYcX5hQDP16jzor/eMcpYU6:EON56nCmQNX5+Dtm8/OmU6
TLSH
T1CA02EB35FCB87C7B8AF36D55B48636139FA5213BE6946B80DAE85A1C00DB69C1306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8eabb57f-59bb-4122-89eb-d2cea64a8ac1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8eabb57f-59bb-4122-89eb-d2cea64a8ac1.tmp
Size 8KB
SHA256 28b077fa81e840717ee2c0d966cb829be9bc6b7f3726a8269e1dc96c97107c8c
MD5 b20a656b08b5214d7820b9b72458a2a4
SHA1 2e93684b48741b4ab410550a0848d981f042140c
SHA512 0e21cef83e0078777b974a7a0bdfa2aac1ebb19ea982c6b0381b28aca4b36c8d94177e76432214ef2eb86e0ae1808e62ce692d0b22e70898ae7bd56ebc57aa09
SSDEEP 192:WONU6nnHhQmiUyvlRYcX5hQDP16jzor/wX4FfEYg3uq5CU6:WONU6nfwRNX5+Dtm8/wX88DlCU6
TLSH
T162120C36E8A8BC675EE26595B08631139FA51127EB887FC0D6FC1B1C01DF6AC534AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a2286b8-02db-44af-8c6f-113e729326e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a2286b8-02db-44af-8c6f-113e729326e4.tmp
Size 392B
SHA256 e5a4e2319a94e9576fab0acfdcfd8152b36513bc82b60a0b06d8a3d4d39c6ab0
MD5 6fe3e7bbf106b848859afcd1f9fb26c6
SHA1 9e23f0c52ec9c35dbda6adcbc2adf95fe64c4ccf
SHA512 23390c1b3bdffbfc657c57835a2395960a9f0b79d60e40288431273236609aac66be83a01def9295845966d727d682102dea74597d9da48fe1d1428461cf86ef
TLSH
T1E6E0040573011157CC74533000C715343FF1C11003734305041005743C173003D107C0
MD5 SHA1 SHA512 TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

02a3b547-89a8-4dd1-8ca1-1067f115b51b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02a3b547-89a8-4dd1-8ca1-1067f115b51b.tmp
Size 10KB
SHA256 1d50fcd659c151872c7fa2fc9575989099e268e606ba90a957319179469d7504
MD5 571c1cd8d59fb01bc5ed0f9bd8c2323c
SHA1 eb20e3167e5ddb0efad3fd08ef23f380260f705d
SHA512 274ac8bf527817ffa8a92d1334f9c6735013c191478affc4378489e5ae9220d415b9b7d724d5e9a016d27558109fdca80703d72c97e96df94be5ff2659f855e0
SSDEEP 192:sxZ4RVW5/fysLyNIdpqqNqmHW6+WNIIDilp/YYBegg+mIgrJ:sxZ4u5/fysLyujHbo/fM/9
TLSH
T1E822B752AE34A97B8CC7D21DBA55BF13D6FA503261D41E48EAFC861C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

106d7f00-90b3-4aa5-b1ec-ca407d6e72b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\106d7f00-90b3-4aa5-b1ec-ca407d6e72b1.tmp
Size 10KB
SHA256 2eaf7ea571016e7c53fbdc23ddca146185e04188df594421a1142415102ba6df
MD5 6fe8e4665bc2ec80c5a5110117bdb9cc
SHA1 f631b1f4867e5b6dc82219ef7271b0a0338b333f
SHA512 8d99bfacf22129e968b7897687f802faee4eeaee3293234de16a095410241d45b2fe4246231a7b43c77984cb1a6e764408e6d8b80f641e4a48e0b3f6bc6075fa
SSDEEP 192:sxZ4RVW5/fys2yNIdpqqNqmHW6+WNIIDilp+gO/YYBg6gg+mIg5DJ:sxZ4u5/fys2yujHbos/fg4/7
TLSH
T1C432B752AD34A67B8CC7D21DFA54BF13D6FA503261D41E48AAFC861C09E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

766453c0-bb71-4b9c-9397-385b1be3b55b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\766453c0-bb71-4b9c-9397-385b1be3b55b.tmp
Size 11KB
SHA256 70e95f1fc26bd5070930973df4f16ff0890e10b7d2d240eae506ff21c4700eb6
MD5 f602067c9e46f064785b5dec5b7dd8b1
SHA1 5a62b87f19aaa04433b60d7cf2e9bf11900528cd
SHA512 9003e1756c0f6ee61de0840357eaa7a2078786036b5e884a60e3f5b2440def448f72c58700c5308acb579a20f62bbf4724cb5beb589d48a627c78bdc5395e7b8
SSDEEP 192:sxZ4RVW5/fys2uNIdpokNqzHW6+WNIIDilp+1SfYYBQZg+mIg5RJ:sxZ4u5/fys2uuKHboPfft/9
TLSH
T12F32E9526D34AA7B8CC7D21DFA55BF13D6F6507251D41E48A6FCCA1C09E76CD220380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9048acfa-4609-4c9a-b04c-1ad5db7839a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9048acfa-4609-4c9a-b04c-1ad5db7839a1.tmp
Size 11KB
SHA256 2c0540d5c81b6972db1794b757bf4b77a9650bbaba1692fc649a1572291b2e59
MD5 3cf2b94b5bd68c0ddf4425041e1755b3
SHA1 c2740e981473c6500681f4637fb0ab86936ba671
SHA512 70eae03418dfd8b83a4d0011161f2828053a24d4516b4c127f783369a4fc2a43977e76db318a611f0cd61144fa48794affabb22f033252698d90c7945cc98875
SSDEEP 192:sxZ4RVW5/fys2u9IdpoQNqRHW6+WNIIDilp+1SfYYBQZg+mIg5RJ:sxZ4u5/fys2u+MHboPfft/9
TLSH
T13D32D9526D346A7B8CC7E21DFA55BF13E6F6507251D41E48AAFCCA1C09E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 349KB
SHA256 fc8003b938951589e786a16ddc902d25e23ec0355ccf50683c5e712449b9ef4c
MD5 76c9318e814644622ae9932bd9faa66c
SHA1 0e1f067a378b0a37f261113dda07805aa15d6372
SHA512 7304fba7e23959de16e4e4df33d46c92e7d8e303e896c2d3a0e8a85d850519707603cb237342f4b4914b24ba14a90bad86f7d6db100dc5ebe51700c16a257316
SSDEEP 6144:SPyALtIV5QVdaXjjHvTw97JPguuMTiN3dZhrrJFHT7rrcMZlQabBMXN3cqqp8i:SqA6yVdu7w9Rgu5TyXxrJFz7cAlbFGCv
TLSH
T120742339394DA237399BB64018AF4651E584916017E4DEA3A8F560884ECD9F9C3FF2E3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 91KB
SHA256 8a34db3dd801e719ab5db4f74644c5023418d428fdcd06fb32f9639cb9edb863
MD5 0e86bfe60747f0253ba5d1be1c66a306
SHA1 e031901e8ba78340eb48cded82028ccc5e591d09
SHA512 0b4412c28cb2f2eb2328df70ffa9e272ea1d79f81859eb66593640f496f4191ee5dfe66619ad4ed90293d3d81caa4013c7214c5e9d20a4ad7c30e2461c660d11
SSDEEP 1536:GWfTd7U+0Q0+a9ykEK7B8W9b/JPK8p0h0J2dXIwoJyOj/3kc0WD7:haPxyshC3dXSJ5j/3YWv
TLSH
T1079312E3916B3EF9C0F11E3CE85B4272EED3A24F77DEA4158900A501FE57D61A2D2A44
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3fedab261f7dc47cbdd9f863ede5d2909f815ef0b477cc2e1df9fe88e9c624c8
MD5 8778a0b72c6efc4856d957986fadafd9
SHA1 d7342864b01ed759266681cfde0e817be59a1461
SHA512 76e05540eeb835b5ef0f8b5d181316d76cf01e0b31e237afc6a31300350239f9fddd92a6ba78e2fc2dc740266343f8b2101cb7602d1c122fbdf950e02f4f4157
TLSH
T1D271C8B126934090FBAADA7780D014A73677A3BD48E36F062BD9E7BB87077F06054108
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6fa7d6bfaf5a6e28d8ff0577d72cc5d78905088c415ecbdef223509b46039802
MD5 b82e375db7ce0bc2de5ac50e86dbc580
SHA1 659d6cf41291531b73a544b4cadec35207956520
SHA512 aab45b8211689c86ae0ded52e94f55d67ecd0c3fc27c5f4f8a2df9d330b63f91257f6c52ee5efede1afc10fdc8d902f3b40f25b5449281154481cc3f1ca2b2f0
SSDEEP 96:GFU4ADKZgWnKDqZyvijh3lvBIVTuf7DuAAlUOmg2X:GngbDkyvmvSTo7oUOeX
TLSH
T10AA1F97622934058FBAA96B299E045923937D3B945D32F0A3FD8F7B7C717BF06250208
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a29989cd503e35f10868db1194199de859ef40599feef960cf88328eeee611e2
MD5 e6f878769c1e4fd37d73b5fe1bda11c2
SHA1 c2dad26c5270325390a5a28489b020dba387ae55
SHA512 311220fc9c205c32812482f6e5fd7df64d50bdd5f6ab91c0abb0cfefab1b5b0f13414a96a23473246f5cbb17a552109a48b72717ee366358eb8da7a7bda5d24f
TLSH
T14B61A4B126930490FBABDA7794D401A73673A3BD44E36F460BD8D3BB874B7F4A054008
MD5 SHA1 SHA512 TLSH

Submit Download

4cff2f1c-2a9b-4332-9312-06904a29a3df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4cff2f1c-2a9b-4332-9312-06904a29a3df.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

13315440-95ea-4239-9019-ae88150af205.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\13315440-95ea-4239-9019-ae88150af205.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

a0a0fa92-8f9d-47d6-a617-80452866ef7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a0a0fa92-8f9d-47d6-a617-80452866ef7c.tmp
Size 8KB
SHA256 0cc3f8efd98ac2d2f0005dd0a256bca4666323856255acae6440c19ca949534f
MD5 328326718032ca20c5a899969eb2547c
SHA1 e52d19eff28cb23d34bb86f30d447c6185641003
SHA512 b7aed600f86e77b2a6563df4d2b8683d6139274b7c7ef446fd7057dd316e7ab5e8702cd955690b541ab5c89f7f6bb20b3fdf7ee528c466683b42a87330252684
SSDEEP 192:DU9Xy1Qj7uJUJVJ536j23c4aIvViIsIgIWaPVvifPnNPDdrfBuqlfzJvR:DU9Xy1Qj7WUJVJ536Qc4aIvViIsIgIWv
TLSH
T10302AEF7C7D8C22DC91126F49B15BF2ECE191928431C3D2A88D9AE1BA3E2471E21565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1b213d7-760a-4ad1-97ea-01b9197afaf7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1b213d7-760a-4ad1-97ea-01b9197afaf7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f6460c9e-079d-429d-b52f-1635b03ed300.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6460c9e-079d-429d-b52f-1635b03ed300.tmp
Size 4KB
SHA256 513108da2be46d2496c7ab32662663c2c3250ef77822f2752effe5e042928a28
MD5 df7387af1e4c96b592400ce295a85844
SHA1 c0bf76cf7d99576b2e23057e7f43b97f6ed16daa
SHA512 c6794ba68cb412cc876d09a7adfe0c8eba5d27834a59165c18f300d63b0c52aa8ee4399dc022b55ecde90362db1d2b1a50d3c771f4a1293fa54576a4a4b80d18
SSDEEP 48:YALlNPOhdNhRhwhvhah1hcsszEs/6j2es4CKsABsepFsF/PsWI/wEsd40EsRtsf/:DhOXNXy1Qjuzj6j2OjtpevI/wR409MaE
TLSH
T11F918CF7C7D9852DC91126F49B25AF2ECE1D0A18431C3C2AC4D8AF5BA3E2871E21565F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71e05f61cfcc0fe9_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\71e05f61cfcc0fe9_0
Size 196KB
SHA256 d8999a708f7b32f4c9232952b9a9427df534693bcb3582ad3775b193bc174fc7
MD5 fe3371088206586c57d8097a3473d82d
SHA1 3551a634942683bf22a2993488f49d5901ace6e1
SHA512 324fe110384285714263976600c3b45ae5c8ded21dcf9166c6b694d0c05c4e3713a6f87fe89c042d28b74cb10053680538ba46a92605bc4f318b01e6298493b1
SSDEEP 3072:R2XU0LBARbIRdaYcob5ISvXFjvyomKJZu:EXxLBKIRdaYxdImNNJZ
TLSH
T108146B356300F43FB923DE6162BE7F4E3C25A167DD0686FCA5A4E9309AD6DF20522748
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 72B
SHA256 43836ad29c3415976872d509e94a1277bfa9ec35e7ecb3b89ed8b179d7bbe094
MD5 a93405438efeb19f771d305d8bc96bf7
SHA1 9e0a39c6aea67d298cf57a78fec8e48bca7190e6
SHA512 7c6af1f2a2af90af81dae9928e09c287be5222e2b23552c0c3e3da344067d2dc70a48099c8a60095758c8ebe641c7f41b532dd2fb1190e52d09c6a491d089c80
TLSH
T1F7A0029001D03906C89077B0228251C137A068120701CB13C8EF00B4CC73244620D9C2
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\temp-index
Size 96B
SHA256 12c0babe879cfb374b40a1fa9647a8f7d583467d92fa49d38a4430cce9d60ce7
MD5 d5e1cf9724c06fc1db92f474fbdca853
SHA1 1175726b6357524a93500853fecfe31be0633cf6
SHA512 705008ad88b37385937355b56e41d1793d485bd063db989d828fc55581ba1b19ebc1ea056e449d1c6a3858af081f22ce7545dc344ebe41c2fc161fa0e396bd3c
TLSH
T172B002DC414876D7CDA9A77062D1C05537714D116B43C97B899F45B48C2374EB1066C7
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ce9832ca5918e36310bd48e84536f581026d9a7fc54cb28e326bc4e3a305a589
MD5 3bf26aefc05f4757ad7b94d48d4174c1
SHA1 39d585742539e182d6d7bd6dab3280e47d0ceae0
SHA512 013ed2c81de79b2ce991b48f491e34fc76cc7d0ae150e5e0e39fc357dc63271aa0098b0efce204f8fa26ac69641be361875078add948e3e780b6574918163e8f
SSDEEP 48:KgMb6G02aDbqpyIS+DK9a14Dx8TYRi6AyLvSbvRxRqbpkZIS/qK9f1VqxP6YcdBk:KEbKKcMuqMAK9Ku16KuIqn
TLSH
T199914202307B425138FE3A4841B4866A42437677359AE9BBBFAD40974E6FF041DFE8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a1f3ed85-9200-4e34-8393-d7e048394259.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1f3ed85-9200-4e34-8393-d7e048394259.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdfca7fe-636d-4664-82eb-0796fa31c4da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdfca7fe-636d-4664-82eb-0796fa31c4da.tmp
Size 11KB
SHA256 68212444af028f07485faed5761ee4278faea37af3e16af42caa4bbdb09bba27
MD5 0e3ab396431708f2054b4fd13a601860
SHA1 eb8d65b0cb0b4af4066c2d3118cf684ab3da29b5
SHA512 5cd49593ccc7fb59ebdb0ff20a894f28ff97b7f7d15b21bc59251454ad671727d3b707ec568b176a176a544620ec959176f0bde6d860592380cc5b7513428868
SSDEEP 192:sxZ4RVW5/fys2uPIdprTQNqgHW6+WNIIbOilp+2LdYYBVZg+mIg5RJ:sxZ4u5/fys2ugQHbpzdfA/9
TLSH
T16832C85269346A7B8CD7D61DFA54BF13E6F9503251D41E44AAFCCA1C09E7BCE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be898c8d-0a56-4b07-a21c-5836dffae39c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\be898c8d-0a56-4b07-a21c-5836dffae39c.tmp
Size 11KB
SHA256 8ad13bbcc54afe6b1ee76ddd9a047b9552a5cc74b476886c020ca3f1b5e342e6
MD5 e1a2b6e073565d7c40b29460a856f717
SHA1 51abdbec8c10a66d5080ec7d61a57f7b1f041587
SHA512 4ea8c2d7ec6872af232fdb46003d156896dcec32e6c6104e3aab7cc84a42ca0f9346c0a2baf3ab67839a859b3efe2216a83fb1ec8ecbc2edad4b5c25f9ebecf3
SSDEEP 192:sxZ4RVW5/fys2uNIdpqkNqzHW6+WNIIDilp++M/YYBJKg+mIg5RJ:sxZ4u5/fys2uuYHbo4/ff/9
TLSH
T1D432C8526D34AA7B8CC7E21DFA54BF13E6FA507261D41E44A6FCC61C09E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e0bb4284-b0e9-4fb0-8dda-b05d18d63058.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e0bb4284-b0e9-4fb0-8dda-b05d18d63058.tmp
Size 11KB
SHA256 6e2bd6f2740f1495aff83894ca31376815c9e92d87fb69730e040cfa55efbbfd
MD5 137f30b3ac09d228bc6b5a67ce0d2114
SHA1 971dbbbc168c5f2acec150609a1dea734c6fb72c
SHA512 5be146734d64263ffcffbc3735c732448728218dcd89138dc56f2d132c95d14fc9f10f3d01338caf5ce739c898ca7fd80d29479ee2586ee291c7c372dc4c7bdb
SSDEEP 192:sxZ4RVW5/fys2u+IdpoQNq8HW6+WNIIDilp+1SfYYBQZg+mIg5RJ:sxZ4u5/fys2uvZHboPfft/9
TLSH
T13232D9526D346A7B8CC7E21DFA55BF13E6F6507251D41E48AAFCCA1C09E76CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8b5a55e-bd92-41d2-ac18-9b02fe60800a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8b5a55e-bd92-41d2-ac18-9b02fe60800a.tmp
Size 27KB
SHA256 f5c7910084b1c47f3119921e779cb3988e3a1ff842f5800212e97cc96de5b6d0
MD5 4eae7073cecdfa95be1f0b306dc2e3c2
SHA1 ee9e019e37a460ba999c90ca7e91a833da50ef98
SHA512 566e973977a2575cf89d213877803a22ecc2a13a06e77dfecff06b7c9cd9c96213d752a91cb0399bcbac52fe4e45bafc1d59b268ae3b7cc8911494a6561b3f7f
SSDEEP 768:DUyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXIrop7Xk:DUyYR7jWv3NpBu1ja/CL8OXzu
TLSH
T112C2F92F640DCB7E4FC01E9DDC5A6F9B2E9802C7A6948D4047FA954C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8314f63f-2f4f-47af-9c6a-6fbf1ff7c7d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8314f63f-2f4f-47af-9c6a-6fbf1ff7c7d0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 98e7b50f16b830571c8b704063393d38e36607267c9af311c4701c0658d528f7
MD5 51fac5491f238baf293ef21d8eeb3c8b
SHA1 04021e338116aaca9b21132aedf7df368c146bbb
SHA512 5bb08a775bf974404502588c1da5c9ad6439e53e02e87387c47de2b9947f387386098ec8cbd959e8691a7a9f7cf823cdcc8d7f4d9af597e47a011737673c766f
MD5 SHA1 SHA512

Submit Download

c52e0cf8-6e87-4680-bfb7-5d634259535e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c52e0cf8-6e87-4680-bfb7-5d634259535e.tmp
Size 18KB
SHA256 bd667074788ef0ca5c027d6a3ad61cfe49c3cf098269e6c8ee1db74862ab8233
MD5 68524d3d6e74294503564d164474e33f
SHA1 9c15a597aa048ad2450dffc138e5cf0583869d7b
SHA512 4b9ba0787480c508c2efd70d1c2c23ef8c7e947952151bee68f63a15b878b4d347fcd224e16e0b600fabbe4ac79b62a4dbacce683807fbfd71b47ea0eb4c46af
SSDEEP 384:CQkUSv0sNOUPwliRwDQX5+Dtm8/wX88UlCMTL0IIlj:609TEkDu7UlCMTQLl
TLSH
T187827D36A8B4AD674AE26561F59A3513DFB45027EAC82F90D6DC9B1C02CB2DC2307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c738b35c-74dd-4ab0-a48f-4fb87cd097c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c738b35c-74dd-4ab0-a48f-4fb87cd097c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 669ea225b05b9f14eeba5560662b4b5f0c40d80d0edc6a286e9f2b81f508c278
MD5 dfa0ce01fd319ba29d8a96523cb48567
SHA1 bc89dd57dc36dcc6f76f9aceb4dcd8a669dc1066
SHA512 1a4f6692a87d5d8495f155d1a081fb3ebcfc8f557b3e44b95758f6334c4b5c343c84fc0886b88b9e31bdf027508b9987f1ba916b2f92a5fc8a673b5365c09133
TLSH
T18741F658A6F91108B3B7AE46ABF6686D487BBD772F0AD45E00110D4F0A73B41C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download