hxxps://storage[.]westtec[.]co[.]nz/download[.]php/Unboxing_Internal_Damage_Report_Mp4?f=c64c596c5aede4c4968d4de0e0edf67a

Analysis

user interaction
yes
max time kernel
149s
max time network
142s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
20/10/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://storage.westtec.co.nz/download.php/Unboxing_Internal_Damage_Report_Mp4?f=c64c596c5aede4c4968d4de0e0edf67a
Sample261020-2fmlcaay3j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4200	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1826067017-2692080558-3687773357-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1826067017-2692080558-3687773357-1000\{14333D70-836A-4295-9A7B-7A1DE5F63263}	msedge.exe

NTFS ADS 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unboxing_Internal_Damage_Report_Mp4.zip:Zone.Identifier	msedge.exe
File opened for modification	C:\Users\Admin\Downloads\Unboxing_Internal_Damage_Report_Mp4 (1).zip:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
872	msedge.exe
872	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe
2584	msedge.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2584 wrote to memory of 5016	2584	msedge.exe	81
PID 2584 wrote to memory of 5528	2584	msedge.exe	82
PID 2584 wrote to memory of 4200	2584	msedge.exe	83
PID 2584 wrote to memory of 5528	2584	msedge.exe	82
PID 2584 wrote to memory of 5528	2584	msedge.exe	82
PID 2584 wrote to memory of 4436	2584	msedge.exe	85
PID 2584 wrote to memory of 4436	2584	msedge.exe	85
PID 2584 wrote to memory of 4328	2584	msedge.exe	86
PID 2584 wrote to memory of 4328	2584	msedge.exe	86
PID 2584 wrote to memory of 4328	2584	msedge.exe	86
PID 2584 wrote to memory of 3256	2584	msedge.exe	87
PID 2584 wrote to memory of 3256	2584	msedge.exe	87
PID 2584 wrote to memory of 3256	2584	msedge.exe	87
PID 2584 wrote to memory of 5640	2584	msedge.exe	90
PID 2584 wrote to memory of 5096	2584	msedge.exe	91
PID 2584 wrote to memory of 5640	2584	msedge.exe	90
PID 2584 wrote to memory of 5096	2584	msedge.exe	91
PID 2584 wrote to memory of 1084	2584	msedge.exe	92
PID 2584 wrote to memory of 1084	2584	msedge.exe	92
PID 2584 wrote to memory of 5748	2584	msedge.exe	93
PID 2584 wrote to memory of 5748	2584	msedge.exe	93
PID 2584 wrote to memory of 5748	2584	msedge.exe	93
PID 2584 wrote to memory of 5656	2584	msedge.exe	94
PID 2584 wrote to memory of 1756	2584	msedge.exe	96
PID 5656 wrote to memory of 2896	5656	msedge.exe	97
PID 2584 wrote to memory of 3776	2584	msedge.exe	100
PID 2584 wrote to memory of 5772	2584	msedge.exe	101
PID 2584 wrote to memory of 4680	2584	msedge.exe	102
PID 2584 wrote to memory of 4716	2584	msedge.exe	103
PID 2584 wrote to memory of 2432	2584	msedge.exe	104
PID 2584 wrote to memory of 2432	2584	msedge.exe	104
PID 2584 wrote to memory of 2432	2584	msedge.exe	104
PID 2584 wrote to memory of 4076	2584	msedge.exe	105
PID 2584 wrote to memory of 4516	2584	msedge.exe	107
PID 2584 wrote to memory of 4516	2584	msedge.exe	107
PID 2584 wrote to memory of 872	2584	msedge.exe	109

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.westtec.co.nz/download.php/Unboxing_Internal_Damage_Report_Mp4?f=c64c596c5aede4c4968d4de0e0edf67a
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffd3b77c188,0x7ffd3b77c194,0x7ffd3b77c1a0
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,1896931962963888710,9290517903867152780,262144 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,1832570123708657006,3960952194740136842,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,11298433083612858343,9970281122447472901,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3204 /prefetch:13
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,16369260462164913680,1310730982812828667,2097152 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,18308551435529561362,892886281941035395,2097152 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4992,i,16981960435907085894,8237609004724499076,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4996,i,17493318166700496745,8436594998410010050,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:14
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5616,i,17753304743357877571,15288834816346404950,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:14
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5640,i,4803982429439980611,4894141686334296185,2097152 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:5748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,1437179738344000512,7439335121190120107,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5656
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1136
    3⤵
    PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15298159663090682558,9970093559075404356,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15298159663090682558,9970093559075404356,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,14950870459998335436,17366915169294059158,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:14
  2⤵
  - NTFS ADS
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6784,i,10549253652544957776,107424857629929297,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:14
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,15102842693956177220,2841954301322444996,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:14
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,8886416837948428611,14768834180425407957,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:14
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5748,i,9113860065376537797,10743703623078760572,2097152 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1595505582732804034,7503571102649988769,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7820120201972463897,13699439758124526958,524288 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6628,i,10933529625917189267,14098538868690960941,262144 --field-trial-handle=1916,i,12465264938201743132,7486374997152314219,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:872

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:916

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

09e1feb7-1b98-40d7-9ce6-db9cc3e7c7ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\09e1feb7-1b98-40d7-9ce6-db9cc3e7c7ed.tmp
Size 26KB
SHA256 838f31d191060bf49250e84d568c13a7b6f944d875e116d4291afc20b1abaa13
MD5 57ef170f5ffda7692e5a8cd0eb8e0db2
SHA1 867f890c3ed77590debd4e3ab77c98c8125ef35d
SHA512 7372cf0335f3fda70edae9adff1d6739e4a1863e8958bb0a3760014d80d209314f944d05e51ce6c8d3e86b90282dab63a31adce1905c22ba87d548e3c6fd6de2
SSDEEP 384:nOiFiZcI638Nz8TUNTUlIxBCC7oEfxzyfoBjohWF1iSvcsa+VYtGgL/7IztoT:lFQ63IwgCCBddBchIiQchg3E
TLSH
T1CBC24B36EC94C9BBECEA8FD6A74A7A03DEF04163958C96D4D5D81D1D00D719E130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2095c93b-726e-42e6-a2db-fde050e3984d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2095c93b-726e-42e6-a2db-fde050e3984d.tmp
Size 26KB
SHA256 2a1304ba3c0457b831076cf1e6651d091b8877e00148c09124aa96a5cfe7e2d6
MD5 978bd41948305d44fc50c638cbc767e5
SHA1 9db0c8f01e9aeb74ffd04c596f7dfeb37b0a1d8d
SHA512 2a86ba02ef22b8f6a00c54f9b8a6ce5e44782cce7a746afb10c4d4339dfdba7283f9a1ba7fb638e6e62718eb909f5cd933268ea5da3375a9c60d700b9bbe8abe
SSDEEP 384:nXiFiZcIJ38Nf8TUNTUlIRKCC7VQuxzyfoBjohWF1idvcMTJgL/7IzioL:SFQJ34wgrCiEdBchIiVcMTwY
TLSH
T1CEC24B36ECA4C9BBECEB8ED9B74A7A03DEE04153998C9AC4E5C85D1D00971DE130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

251ac058-323a-4f05-abe2-8ec2b1c4b067.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\251ac058-323a-4f05-abe2-8ec2b1c4b067.tmp
Size 25KB
SHA256 d415a84445db28783fb59bd71fb7172f4303e563e0cb4ff66584891e08aba2e8
MD5 93424c97d2b3b6d75cf395fe5c895d6f
SHA1 549f406f6b13aa7633578134fc8d05c9c48cd5b7
SHA512 16d43c63f1f8539372570bf7de43aa2ebb30495e659ef485ff842e170c81def7366a27c7da07ae67c24485474818556c397542705e1aa241814572110d839440
SSDEEP 384:nniFiZcI638NQ8TUNTUlIxBCC7JqQcxzyfoBjohWF11QFsa+VYtGgL/7IztoT:iFQ63TwgCC0QWdBchIuFhg3E
TLSH
T196C24B35EC94C9BBECEB8FDAA74A7A03DEF00163949C99D4D9D85D1D009719E1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 00fd53d4e341ca585361bfbe699a2c8a3fdbc255133db935051b0958a30a7abf
MD5 e720824e80db33ac2843bf1ebb30faec
SHA1 f511d38f1de46ab026d3c6963050a3f1f512b92d
SHA512 09eb559f6018245581b30678d5f9952fcadb0adcee197127c7448f39c53ff841dddd8b077678d837d33d8e01126c7d80b7ec77764938cb5368f955ce628ed81c
TLSH
T1E3D02B5CEFD99290D436343A4035428531CFA904D1035200E090010319811410061865
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ef8e0a91cc3656fe639527b7c461215de3584a9b32168d8efc58c800c3fcf45a
MD5 7611be076e62556d26aa1ad65d6c21ee
SHA1 3b62033283275e165c1cdb998b2b174841695892
SHA512 949a38fce52f98059e4356f1465fa0cb57397b5b5a79c468fea50c81a884f46ee37ab38ecf492df88f7280e9e041eedad365f8eab019be95f1d7b37d95794929
TLSH
T110D02B58EFD58290D432343A4075428532CFA504D1035200E0D0011319C11410061865
MD5 SHA1 SHA512 TLSH

Submit Download

42f1c210-4050-4625-a723-07b9b9e6934f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42f1c210-4050-4625-a723-07b9b9e6934f.tmp
Size 12KB
SHA256 c16f3b627ae9f21e21e23c82494766bc5b0fcf35465a990959d355ec192be910
MD5 7c6909e0bba11d1881b7c92fe5af531e
SHA1 53e149590d3a0770c971fc36ad386a48c5f11bc6
SHA512 154d3633cbf990d5dfb40cf98f325f253491141b0a7899581d518663a7c4d31e52d4a6d958e5dd68add8efb2559af2430a43e7ea2d6324fbafdf361946780bd1
SSDEEP 192:sxZfRmoL/fCswI1ZqMqQzodpW/W6+WNGY0ghwpBuRDHIg56YJ:sxZf3L/fCs97qjW/bG5824TM8
TLSH
T14042B5156E24A93F8CC7D219BA657F53E3F95033A4911E48A6FC8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

48214f9e-44b1-420a-ac81-7440e87a3c19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48214f9e-44b1-420a-ac81-7440e87a3c19.tmp
Size 28KB
SHA256 fab72c4fe3c99ab9934eee2cfcc91283a80567fca7823fdade8be2534bb752d6
MD5 6c4e55d79d9c24e573bcbfa1c93df27c
SHA1 4d5967ef799200ed9ffea00654c29a39439ccd29
SHA512 bfcfb3540a21332267332106fb17852b74ca0e61d49f727a7f20d1f446e070d8423dd743951d3689bbf687051d4d0a4dc8c5a5547cff96d7b46235aa0a4197e5
SSDEEP 768:AvmgC8Ba29tWRmpbQPL8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3HgLl/jR0sVYroTN:AvmgC8Ba29tWRmpbQPLu1jaKHgLpj+sH
TLSH
T127D2093B640CCB7E4FC04E9DDD266F966EE802D7AA588D4047FA894C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c1d914a-1427-439a-8e7a-013ea8628e4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c1d914a-1427-439a-8e7a-013ea8628e4a.tmp
Size 12KB
SHA256 33efa3b9d07ce123647f4c130cae4af727baa61d1830f4c68b9b7df67eabe1af
MD5 3da8db8897932937228ff2d4bc2b28e2
SHA1 91ef97612194ce0dbc53bfe8a905ae2ab9044140
SHA512 da273cc30996d4ca7ea30da578d51a5ce2b608d87a20d35d6b4b25468971045fb7f9a75dbc1013d144c20c6a19b266029a05006e08bbf44b9234fd4eb5427926
SSDEEP 192:sxZfRmoL/fCsOI1ZqMqQzodpW/W6+WNGY0ghTpBuRDHIg56YJ:sxZf3L/fCsH7qjW/bG58L4TM8
TLSH
T11842B6156E24A93F8CC7D61DBA65BF53D3F95033A0911E48A6FC8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80e4952f-affa-4e9d-8bed-ee60231602f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\80e4952f-affa-4e9d-8bed-ee60231602f3.tmp
Size 11KB
SHA256 a767f9288419a997893a3aec54f53e1bdb0fa5380bbcb8e785d4e7336a8a4fea
MD5 8770246eddd44ef793aaf255aa4169cf
SHA1 f418390fe3ed333b6d7ccb67eca880ee3d249c1f
SHA512 8976273392215bdbab7db1e3e6d495a338df82c207de76564c5b37bb1bbf590f940ec95497c5d9b76403ab41012c1b0819ec02f9fabc03cee05ac2eb07acc29c
SSDEEP 192:sxZfRmoL/fCstI1ZqMqQzodpW/W6+WNGY0ghwrBuRDHIgjYJ:sxZf3L/fCsy7qjW/bG58U4Tj8
TLSH
T19242B5156E28A93F8CC7E609BB25BF53D3F95033A5911E48A6FC8A2C15E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

972fcd8d-4199-48e3-a2c3-05bd06ff6568.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\972fcd8d-4199-48e3-a2c3-05bd06ff6568.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

86fc4e8f-a0f2-450b-80c2-e00e046389e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\86fc4e8f-a0f2-450b-80c2-e00e046389e0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8eeb7a25-fb40-4773-9e85-1d30b4d82fdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8eeb7a25-fb40-4773-9e85-1d30b4d82fdf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

8f8dbb22-ec1e-46f7-823b-31ba16167666.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8f8dbb22-ec1e-46f7-823b-31ba16167666.tmp
Size 1KB
SHA256 28f86894e93cf96e82edfa8c880af1e1a89cf5f0fb9849e5c4be6774de3cb1f5
MD5 c7cb1dd990253bbd25ce8f1de2800f8e
SHA1 c2e40aa976603b4acdc650eb5b7dc7e79b0ef5cd
SHA512 7284c4601da4f5667a319cd020de2f3bf8c3e8a0a9a721ce265002db724b0dee839e96edb0ede1f5a425b2e338922ff6e87569df5c09e02bb669a321e056cb8c
TLSH
T143419CF783E4866E890196F0AA18AE2BCE2D0514432C3D5AC9E4AF6B93E3471D14165F
MD5 SHA1 SHA512 TLSH

Submit Download

c322e9d2-be01-44ec-8415-9d520050a63a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c322e9d2-be01-44ec-8415-9d520050a63a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 1720f28d299b595884d4a701b6dbf8800265c6fedbf067ffc24c9dbae8b1f192
MD5 99f2ec503e9b860a27894dbda2fad40c
SHA1 afd1173ef67739b48925f967adaf5a8be94a62bb
SHA512 f85f292d4dc3eba78c1d857ad7786d6c58e9a9a72c316a1540207403ea777e4f1661bfef7360ca5fd1a83d7a41a3b9d5c38e062fb7d1e95572dcb0a49751a822
SSDEEP 192:ohdNdBzXXFPXgRbKvtp0JlzniD/qmP6Wz:oXNXznFfgFKVpIljiLx
TLSH
T130B2571131BA12593CBE390891B59B2F52813573711CEA2B7FFD10A68E6BE481DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

fb2637e3-9705-490c-9ec1-6d49cbd610c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fb2637e3-9705-490c-9ec1-6d49cbd610c0.tmp
Size 414B
SHA256 330aa935233a4bc7f3519d285644114c58e359333e43a0c60ef15fdcb117e33d
MD5 7ab8f86e8db243725d4a0d4bd1be8447
SHA1 9d9847ff06054fcf4c881fd63b5c05227e714b1b
SHA512 8e3a53cbc339ced02799a3970bce90573ff392169a349a2a2f577d41f4e3f41a79e6eb79a9f08c61b4dddf226340bfd63356b5b7f926b884affa8260834b9d3d
TLSH
T1F5E022B9C822AC3F08FD1B2E20A45B8AFB5023572F50854F3A3D81098FB063A8185D6C
MD5 SHA1 SHA512 TLSH

Submit Download

a2676092-2f52-4274-b4a4-e4b8ab1b7500.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2676092-2f52-4274-b4a4-e4b8ab1b7500.tmp
Size 27KB
SHA256 e1b21ec95d6ea61eeeee2061343e6a8beb88dc377bd822a2027e9967597c19a5
MD5 f3ac37b18c0d41973e436c6cbcd26394
SHA1 540b55a6acdbf67788ba8beee812c89cf9355302
SHA512 9cb8705694dba70c174d7f6f94baaea0ee9865e2c2381d056b977e356f7f4076dffce6b62a38d6dab5b19f5c7913522a4a8b8baf2b26f9d97431087bef5abda9
SSDEEP 384:n9iFaQkUSvt8Nf8TUNTUlIROCC71yuxzyfoBjohWF1iCdcMTJgL/7IzeIIly:0FCt4wgrCoEdBchIiqcMTQL0
TLSH
T19DC23936ACA4CABBADE74E95B35E3A43EEE04153D98C4AD8E5C85D1C00971DE230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8c87f82-75ec-4c8f-860b-32a6d293b3d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b8c87f82-75ec-4c8f-860b-32a6d293b3d7.tmp
Size 27KB
SHA256 bef53da831467ba6c7fb430abdce0b11794b68fa6344eb120951b6e26e02c0cb
MD5 1ac1a875ccc53046f9101be691529125
SHA1 2d3e01ed4f319a1514c1fab7d752b58322e87ffc
SHA512 c8d671053b3560f3d6f898228044821efef30fb49e2f43c2ab4cc99565890ff1128dffa62464a6caee31b0e6b51c3471b68aa6088cfe63b3044836b5a459520f
SSDEEP 384:nUiFgQkUSvb8Nf8TUNTUlIROCC71yuxzyfoBjohWF1iAvcMTJgL/7IzeIIly:vFIb4wgrCAEdBchIiucMTQL0
TLSH
T1D6C23A36ACA4CEBBADE74E95B35E3A43DEE05153D98C4AD8E5C85D1C00971DE230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb718fd6-0b02-4c5a-b3a8-e7594db39119.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb718fd6-0b02-4c5a-b3a8-e7594db39119.tmp
Size 27KB
SHA256 0a4d0ee7e5c78df5d243973aef20ba085eca9ad11a36d1cfc29fba33dbe86087
MD5 e1d1477af566e155391353f5f539730e
SHA1 1efbb7c3772be164a633e4a08a0f88f630055002
SHA512 668ae79d7140c12352e20f9449c45c1adcd433a8571145578d6f8073347cb9a3aca7e021a8842e425ba44b94a0cf88e32fee4f2bda903595dbddf0d9fbf69720
SSDEEP 384:nXiFzQkUSvb8Nf8TUNTUlIRKCC72QuxzyfoBjohWF1idvcMTJgL/7IzeIIly:SFdb4wgrCnEdBchIiVcMTQL0
TLSH
T1E8C23A36ACA4CDBBEDE74E95A35E3A43DEE04153D98C4AD8E5C85D1C00971DE230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc5339e4-6df0-47bf-8668-8b098646c86a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc5339e4-6df0-47bf-8668-8b098646c86a.tmp
Size 27KB
SHA256 1fb47b028917a288dba16591a815487ba927a482fe08b503e0700056495b08bc
MD5 f3a9c699880952454e2cb7d9c2fa5f21
SHA1 b6ea98f133f7766183389d9944b9abc198f81a3d
SHA512 0aa3eb6af16d67a0e706ae0bcc2c63358cf428ecc3171a77168bc333194a77f9bb91dc675c8a63244ca30360c1f7de5b7b4ac39f2d02436f4c25fef16a2f7464
SSDEEP 384:nXiFRQkUSvb8Nf8TUNTUlIROCC72QuxzyfoBjohWF1idvcMTJgL/7IzeIIly:SFDb4wgrCnEdBchIiVcMTQL0
TLSH
T154C23A36ACA4CEBBEDE74E95A35E3A43DEE04153D98C4AD8E5C85D1C00971DE230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24da9491-481c-487b-ad97-3b8bcb47255e.tmp

Path C:\Users\Admin\Downloads\24da9491-481c-487b-ad97-3b8bcb47255e.tmp
Size 12KB
SHA256 ad09b0d641ad7d954ace4b3bd5200699d8ef2946df7b01102e0abdef8188ffe0
MD5 764aefa4f98683783b0e7d493a65e712
SHA1 e96b72d0cd7367ee1171b1c23b411bcb01b87e95
SHA512 8a6fe9addb0d1b23f801705fd9e8b88a94ac38f59b5828be0afa69cfbb3103f1abe5bcf8b4b1e15f665da689e319f1aeb41c660c45383b196856f477d01465c8
SSDEEP 384:H6s99dg02QLCSnQZawID0vY3PYgPP8MPF:ac32QLCODiYg68MPF
TLSH
T1E042AF92A7998D25B6E4B5FE734C627B9C137FCE1B142493553A34C8C90902CF2BDD89
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unboxing_Internal_Damage_Report_Mp4.zip:Zone.Identifier

Path C:\Users\Admin\Downloads\Unboxing_Internal_Damage_Report_Mp4.zip:Zone.Identifier
Size 149B
SHA256 40b0119e196a01ba6e430f9d7e20ba079d066df53e8fb6f9c845255bf49ed35d
MD5 fae51ea119cac1c8409bd9931d65d227
SHA1 9e4160413f86b8e2c9e82f30d5f9f063b88c452d
SHA512 b1ab9114bbe2b9419f72cdaad6b7da53e935a579130f8454e0d9f98af7c804ca8c6da6405cf82087b1440571ee046b00895c4699bb965229e96a8ff8470e20fd
TLSH
T1DAC08CAF002C8024C62472A4158A126824699980188AC341A4A188C85CCE07823B225B
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1756-197-0x0000013D50D90000-0x0000013D51D90000-memory.dmp

Download