hxxp://BONZIFY | Triage™

Analysis

user interaction
yes
max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 09:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://BONZIFY
Sample261023-lkrsvsce99

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4584	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{F7E282A2-A51D-4BD0-8641-AD88CE165399}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
732	msedge.exe
732	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 3376	2200	msedge.exe	83
PID 2200 wrote to memory of 4116	2200	msedge.exe	84
PID 2200 wrote to memory of 4584	2200	msedge.exe	85
PID 2200 wrote to memory of 4116	2200	msedge.exe	84
PID 2200 wrote to memory of 4116	2200	msedge.exe	84
PID 2200 wrote to memory of 3840	2200	msedge.exe	86
PID 2200 wrote to memory of 3840	2200	msedge.exe	86
PID 2200 wrote to memory of 5088	2200	msedge.exe	88
PID 2200 wrote to memory of 5088	2200	msedge.exe	88
PID 2200 wrote to memory of 400	2200	msedge.exe	89
PID 2200 wrote to memory of 5088	2200	msedge.exe	88
PID 2200 wrote to memory of 400	2200	msedge.exe	89
PID 2200 wrote to memory of 400	2200	msedge.exe	89
PID 2200 wrote to memory of 4672	2200	msedge.exe	90
PID 2200 wrote to memory of 4748	2200	msedge.exe	91
PID 2200 wrote to memory of 4672	2200	msedge.exe	90
PID 2200 wrote to memory of 4672	2200	msedge.exe	90
PID 2200 wrote to memory of 4748	2200	msedge.exe	91
PID 2200 wrote to memory of 4748	2200	msedge.exe	91
PID 2200 wrote to memory of 2128	2200	msedge.exe	97
PID 2200 wrote to memory of 2128	2200	msedge.exe	97
PID 2200 wrote to memory of 2128	2200	msedge.exe	97
PID 2200 wrote to memory of 3976	2200	msedge.exe	100
PID 2200 wrote to memory of 4732	2200	msedge.exe	101
PID 2200 wrote to memory of 3976	2200	msedge.exe	100
PID 2200 wrote to memory of 4732	2200	msedge.exe	101
PID 2200 wrote to memory of 748	2200	msedge.exe	103
PID 2200 wrote to memory of 3696	2200	msedge.exe	104
PID 2200 wrote to memory of 3696	2200	msedge.exe	104
PID 2200 wrote to memory of 3696	2200	msedge.exe	104
PID 2200 wrote to memory of 624	2200	msedge.exe	106
PID 2200 wrote to memory of 624	2200	msedge.exe	106
PID 2200 wrote to memory of 2296	2200	msedge.exe	109
PID 2200 wrote to memory of 2296	2200	msedge.exe	109
PID 2200 wrote to memory of 2296	2200	msedge.exe	109
PID 2200 wrote to memory of 1268	2200	msedge.exe	110
PID 2200 wrote to memory of 1268	2200	msedge.exe	110
PID 2200 wrote to memory of 1268	2200	msedge.exe	110
PID 2200 wrote to memory of 3844	2200	msedge.exe	111
PID 2200 wrote to memory of 3844	2200	msedge.exe	111
PID 2200 wrote to memory of 3844	2200	msedge.exe	111
PID 2200 wrote to memory of 2896	2200	msedge.exe	112
PID 2200 wrote to memory of 2896	2200	msedge.exe	112
PID 2200 wrote to memory of 2896	2200	msedge.exe	112
PID 2200 wrote to memory of 1092	2200	msedge.exe	113
PID 2200 wrote to memory of 1092	2200	msedge.exe	113
PID 2200 wrote to memory of 1092	2200	msedge.exe	113
PID 2200 wrote to memory of 3200	2200	msedge.exe	115
PID 2200 wrote to memory of 1952	2200	msedge.exe	116
PID 2200 wrote to memory of 2976	2200	msedge.exe	117
PID 2200 wrote to memory of 2388	2200	msedge.exe	119
PID 2200 wrote to memory of 2388	2200	msedge.exe	119
PID 2200 wrote to memory of 2416	2200	msedge.exe	120
PID 2200 wrote to memory of 2416	2200	msedge.exe	120
PID 2200 wrote to memory of 732	2200	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://BONZIFY
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffd14bac188,0x7ffd14bac194,0x7ffd14bac1a0
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,9223072577953957639,1624096421320157447,262144 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17551408166012820154,10673820530141696679,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,5762929455602841027,11495778685991398709,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,13605702271022812874,15417642953908568197,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2573174418500967041,7009517729478379040,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,6620408785882455983,2661015810521711923,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,16877310304220038283,17261489908369704209,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,10872617713507768345,7573807126522602899,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,8829788294254149629,8430611524247269776,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,4166346063765516633,10281582940949816740,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4946967892029822439,5882940293630915005,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,4946967892029822439,5882940293630915005,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6192,i,2862563874927773002,3145986514084115340,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6340,i,5904206555508716888,5646912555951762358,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5176,i,18120328485711402148,9822111493472448419,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6372,i,17106832595493148983,18292003022169330015,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:1268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4404,i,6801960666881240432,7637134623664846313,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3688,i,11603646875017718925,15312688577028178309,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3428,i,3151630067603084615,9678153588999110731,2097152 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7072,i,9875421426787723083,15525933876182565253,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7068,i,14918914101076161705,2135603170755893604,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=7076 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7140,i,5375214731248825366,15780221664396420232,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,12749785668601006231,11639661124490748349,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,8522906450434482728,7515724260486379625,524288 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5904,i,8093777663543643734,13786402533457299065,262144 --field-trial-handle=2320,i,5701490904260005245,6410505838751007770,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

176e68d9-a76b-4443-916a-880bc504c7cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\176e68d9-a76b-4443-916a-880bc504c7cf.tmp
Size 26KB
SHA256 228c6ca16aaaa91ec2a1f3f4cca103ec3253cc314ceb7b9de5ed65d78849fd79
MD5 59e298298e936dcd82382c8de14accff
SHA1 ea2a6e088ca79fc8593ae717ce0892936fe29cc9
SHA512 230b5a4ca009038e272a30e5f2dc0e75124b20c4b78468f9c56fe2d3119ecc0c1367b49536110cccb79abf622f55c0f8c6fa327280509388fc6f372edba6cdca
SSDEEP 384:qiFzQkUSvTzsNC8TUNTUlIl6wz1Yxc2p5u8iGlswO2IMIIlv:hFd3fwgcckkGlFO5ML5
TLSH
T188C218F248D7583AD9AE9B53A73E3D038E7CC167F6945A90B788151CCD861BFD306902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

219be0f8-1475-447d-9519-5cc6d409bf70.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\219be0f8-1475-447d-9519-5cc6d409bf70.tmp
Size 18KB
SHA256 77e8f4a982bb98c0e0d7c954ce8e12a52958aebf968590ebb1f9bc192fb077ee
MD5 e8179f6122f9b80c194620b000837abe
SHA1 ca33740517753ae8f493ed409f81d2551a494742
SHA512 04f4432bc80b73a30c4a1177afba055a78cd882c90123c34b6692ced52e84278adaf8a770306a1f83103e7c1996b06e3e96718cf7f62239fa920592c112e4566
SSDEEP 384:UQkUSv0sN6jwz1W3bp5u8iGls1O2IMIIlv:E0fDkGliO5ML5
TLSH
T10F827C3258A97C279DE3E551F54B36438EB48167E7D86F94D9DD2B2C02CA1DC230BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

614170ab-6812-41f4-85aa-40a2923a8af2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\614170ab-6812-41f4-85aa-40a2923a8af2.tmp
Size 18KB
SHA256 4980ce26292256c5034ade211eefe0342313f68065415d413cc13ae40389599d
MD5 b69046a4ff1b2fe1064afaa21ba84282
SHA1 21a9de939063b060853856932520cb16dac6a280
SHA512 4ea172c8e9c2382d8442cb828afdc3e4c022a68461e01db843ef6ad35961d3bf392012ebdcaedd3b20f6fda3702c17d672fea019cbed2b68d3a43fca79561c35
SSDEEP 384:YQkUSv0sN66wz1YVc2p5u8iGls1O2IMIIlv:Q0GckkGliO5ML5
TLSH
T14C827C3258A57C279DE3E551F54B36438EB4812BE7D86F94D9DD2B2C02DA1DC230BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8ac4ba62-53c9-41b8-8414-f54458aac6a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8ac4ba62-53c9-41b8-8414-f54458aac6a4.tmp
Size 8KB
SHA256 c14bc91d926dd72ab377ab9f43947788fe84be74be73cef8f7b59e879622b9d8
MD5 57b6e62badd69bd7d426e1331f2e447f
SHA1 d71da35553dde2797cdf452b50904088d16b0b7b
SHA512 b07775747e02c59a39e6044ea3bdddc75b3778b04eb0e16fdab27157401b71c447ff012f84babaa611e9205a5e247d8f53b6ccf314fe56c8539eced7217c21c1
SSDEEP 192:pONL6iDjQmiUyJS35q5u88PGquh63IuZTq9U6:pONL6Ij5q5u8iGls/OU6
TLSH
T1D912093168687C7B6DD2E951F44736239EA4417BEB886F80D9DC262C01EB69C570B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

0015924c-0acb-47e3-83fa-96ceebee730a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0015924c-0acb-47e3-83fa-96ceebee730a.tmp
Size 13KB
SHA256 e554d894911504b6fe1f51b21a0214acbb60f72564117f00ce9689f5ab312754
MD5 00cf5f28288e6753f96ff7eab1eeaf01
SHA1 a7f57cc7fb3c8d72f20b9d8566d1ff7456af8c57
SHA512 c581964d21227237a944395f7412e02bb0c96c4b1500e4e58c469296748f8598fa562df17e717254d2f779ff1ecef501298c5828b8c4a51163dac6fc94952208
SSDEEP 192:sxZzR/ucBzo/fFseBEDdpTyVQlYHW6+WNwJTg/YaSU6hIg5ugMvB4Qq:sxZzcmzo/fFseBEvWHbL/CfMvi
TLSH
T12152B8526A24D8778CC7D609BE35BF12D6F9007299A51D9CAEFCC91C04EA6FD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23dd2fff-a81e-41de-a45b-53fb0aabd786.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\23dd2fff-a81e-41de-a45b-53fb0aabd786.tmp
Size 13KB
SHA256 e36f1a91822a7b42444024899187b5889beba58b308dfab8a5d3cb44d2e0fab4
MD5 941869af463c3172a2100ef30a905d19
SHA1 e95e24c808629de8859f0626683f150ad858eb36
SHA512 4dcafb53c524131548b06cf8694e37964c9bb9670f974d3c53449f7c12aef52ed40dea8ef94ec2b52aa1ce4081553007d7abd7461c02a54e5e0ca607fc7922bf
SSDEEP 192:sxZzR/ucBzo/fFsjBEDdpTyVQlYHW6+WNwJTg/YaXc6hIg5EgMvB4Qq:sxZzcmzo/fFsjBEvWHbL//BMvi
TLSH
T11652C8526924D8778CC7D509BE35BF12E6F9007299A61E8CAEFCC91C04EB6FD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33b127fb-c836-4330-9952-acb2e1f142c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33b127fb-c836-4330-9952-acb2e1f142c7.tmp
Size 27KB
SHA256 5ed568f522623429eb50125de388495a1d882ee55f1768adbeb199326151c001
MD5 38a2104a6a5a6223b13cc7116eac8fe9
SHA1 498f8e097253e8bf71a485033d14f2aad8e0ec3a
SHA512 c50ae5215aae0e73c612a42f6c0fceb842e2c53ecee2420aff0d7d070fd1e5dc33efbfa8a8062914083f6292eeb2c2c527f770d0a97f7e5bc5425320b880ee41
SSDEEP 768:rMyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3ororZgzo:rMyQRbrWvvlpZu1jaXKLf33TrZgzo
TLSH
T17DC2E93B640CCB7E4FC01E9DDC666F976EA802C766688D4047FA994C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

667cb9b4-fa5d-4475-8c2b-324f29d2dff9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\667cb9b4-fa5d-4475-8c2b-324f29d2dff9.tmp
Size 9KB
SHA256 ee35e766926fe6d473469859ecb21474b8da3187689d2777c45bfcaf7e731392
MD5 a6da97924a3c8a8fbabb457d0a7c98af
SHA1 ff3aedcda3ac03e5176a1d534552c2b888565772
SHA512 a88348bd3bd471d7ea2946fd4c28de32df02b762e024192b0d280c6e678e38cf6ae9d268df8899296f770dcd71d1460f3f7bec130800ff22eb6f1de3bd5ee051
SSDEEP 192:sxZzR/Wo/fFsRipIdpDuHW6+WNGYaJU6hIgrJ:sxZz8o/fFsRiiiHbGp9
TLSH
T16A22C8516E68A57B8CCBD20DBA65BF53E6F9103191D51E88EAFC861C04E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67db1d2e-3b15-48c0-83fc-907051c57419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67db1d2e-3b15-48c0-83fc-907051c57419.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 061829d59b70de29cff897b8af98d4ad5939342c26386ef9c551b0bb9d569a27
MD5 732d94e60fa72d250480746e1b940a77
SHA1 10fc30711947cbee4c68decbbf214964df2d5fba
SHA512 ea1eece1079fe34c18039ab679285b89741c12d069348bc3ae7c9e9be163588b356a269a5c30df7f79dee047c99b7e5096c7eeecb6b7dde1bf56e51724386553
TLSH
T168E0268458E8C32EF358774B116EA30C8F802A1AD3C0AD8E2738C7C4B006048A3C6A90
MD5 SHA1 SHA512 TLSH

Submit Download

f_000084

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000084
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 45KB
SHA256 940e937d624dff1d92f851eb934d25d8f553b21ece4ea0cd28ce09a9c26d42a3
MD5 44e017eb03ad119606b480cec663fa30
SHA1 9241911887c38c5465f7c2e52241aa36cef8fe71
SHA512 fa9327022c36d67b6a43370f035d1e7817e65e0a8260a14084dff52665372fafa909c2b1e41e7590aca67086c84f975093ceeb0c2169afad18f7dd066ea3bbe8
SSDEEP 768:n5tNF8slLi+NBxYf86HMA0PF8/3SDtPoHMzqQqZKq1r/sFD5f0tjlLILDkF1OYh0:5tNHxNBx286HaGfSDtPo0q5rwDetRwDH
TLSH
T17523F10BD1C595933AE03B3E3ECE143C80846699A757B2E2F12A350AC6E4F59C50F5E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008c
Size 37KB
SHA256 3c0d5d9f9e8915acba88888fec151bd7ded7079a623f6a9734aece4521c01ec4
MD5 b4ea307d18cfb705f057321275c2cc21
SHA1 dfb3b26593308dd618e484e3ffec7ed3d39443b2
SHA512 f440861116831c6174a16fe9d08375102776ef31982e9e6c7c8fdc668cc0c613975c8fac7fc229ef25520305e7b23384cde7d18f75aff7510ebc2955dfb8cff5
SSDEEP 768:xUkZQao9bYgNbATHwt+iV3EqrYcy3VL69nl5ZUkeco:xhqd9MvQt9VUDcnzo
TLSH
T1CF0302EA00B95AECA19E18F47219274DD0B2D905F9152CFC946490A26D47DBEFCC3726
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008d
Size 43KB
SHA256 08b668ab17c2dde5424fbfacddfcca4e37e2471be0e1cfff477831d4122157b3
MD5 a524ec6f978e298c04ff7e6e618245df
SHA1 15e6b5ac570c11bd38953ed2c8d9c2306f062a2c
SHA512 416e1be619b0d64f694a2aa7bf945d89d0d812e7cd12e387efac6574d1c66596d3b075b786a2a399d3c03de326666bb7a196851d85c4b85aa609c85c920ddb42
SSDEEP 768:aD2YhIpzPQAP6aqZjY5tBJtKLNtyn1EnHHDpDm4cuK12p5ZNS/DeWTzR:aDTapzIAP6BuzJtIdptcuG0zNADb
TLSH
T1E5130219B14CB841D529773F326A76F1F61DD50AF9E6FE403A7103400BDADB260A68CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008e
Size 22KB
SHA256 5def91175a00d54a78774f3e3c3805cbe2fe066b34a98c2e80fa99089fe845e7
MD5 0ed5b2773796a85baf201811d97bb74f
SHA1 0a62a87041c87c14b9d8473a0e47395d1d6934bb
SHA512 26c7aee10ce2bbede4c95ab0bca30bb0dd0929f40b00b42d1cc013b15b796f9e9930daabb6890611749175a6b0831f12616a4e1e79e4dbb36e9d1e38c8401bce
SSDEEP 384:seNGHWOxsHsoEJ+7aOCxF8WtKPTPNDDMtXlmtc2VbzJXz4IbwC4/ES0RnzLmoxbP:cT7oEQ7Dsre7N6lCcib5/4/Pvoxbn2q3
TLSH
T15BA2C0F1AF654D9D462164FF45D8EA811DD2FE5C4BA69BFD0EA70C481F888E8491402F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00008f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008f
Size 164KB
SHA256 26a7870eca9de307b323dea401268e8baabf74c187f6840030d3cfa762eb3cda
MD5 1def3841c69494e0fcd0e84b4885d365
SHA1 37ad4d5df44371d288963037c7954339aee31783
SHA512 03f44a480e999d4b711ab54e3df4a372efeb644455127d197b02e3ab62e66cadb9deddcd1e17b625556eb165c5b7a51116afcfd897d934b1d223bf57917b5525
SSDEEP 3072:5YG4jNxGRJ3KF+1R1yJc3FFq3CXt1GM3pwx9OuyzXslI4Wkaa:5YGoihVyiFk38tM1x8uyzXsljWDa
TLSH
T134F312DD3603A7EAF255CE71A71988715CA09833A696B1FE03B1CD5CDB6E09C706D02B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000090

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000090
Size 22KB
SHA256 d17c9cff19e331c1cb11bcae1366bc72bf17bb454e6066b8df74ac707f5283cf
MD5 b79907b72b6c604b8e8ef6347e4c850a
SHA1 c3dfe3efd0a23da19b6ba3d2aae48451dec8b388
SHA512 09c1b87d416709e10a9420e5be784904495324e5602535a52b8745a2e820158661935ca196ec8a65b751725e24055cceb0120c0f358ae83e50e0597525279860
SSDEEP 384:SSts2GYhpVc88yOmTbLQMgaeCaa3WqlpR+EaJI8ly18UF/yW8oi2Y6V4+Z5YIY1R:SgpK8fT/ZgaeC8qlpYVfYZy8i2j4+nYN
TLSH
T197A2E1C10ED93C1897E84927429BD36D5734B7642265A3831573B317E4BB4AB22EFD4C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 dfa350dec9ebe598d8f0e542317d8f43dd2902bccb556c0823920a37c4b419af
MD5 3e1a30508784ed202079a0ec7da14b62
SHA1 fb3404ec4811810ce6ec475e92a543d4007937b1
SHA512 b692fc50002a9fe230c927bbf4546a045151dd506c8a26077c93ce6748ee6fb38b2395ff1a818e5c1502f28b82fd59b46b14325078dbd2626618f0ed88a5f468
SSDEEP 96:jsqib7ozZbjmtIGGZBYKlcxjaaBkbDSxF7hG:Aqib7KZbjmt9mBithBGe/7o
TLSH
T1A4B109629753339FFBAA607040E458DA3B3710CA844BDF2ECB9CD577649B740A61C02A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 859e0a8e9d376725b722488a0f3e0ec1022059dd2e44606e978b7d86c292cf28
MD5 4ab06ae2038f8fd54983e3e99c3a7811
SHA1 d1c2fe56f01df0aed57beb18e6f4cce7d73cf1b2
SHA512 1bd4b6399d5ee961f25f17e40b6207ebc54cdd9e37ea306bae613d1397525bcec6f4478f144945d1381e686829b676018f54358e97da55c9acf2e2970d9b7ceb
TLSH
T12D619282A74343ADFB6B607181D528CF3E31554A419B2F2AC5E4D235B8CF354BB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

34c6c037-cd3a-4930-aadb-d6cf24872904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\34c6c037-cd3a-4930-aadb-d6cf24872904.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

00c8ec09-2119-4091-aeda-0f0fa1e15b90.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\00c8ec09-2119-4091-aeda-0f0fa1e15b90.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

9624e64a-869c-4a5d-9045-474ef3d745fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9624e64a-869c-4a5d-9045-474ef3d745fd.tmp
Size 3KB
SHA256 2edc7bd8eb39a1caf0175193c1a50f8f73d3995ae0242b4542f9ba29438968e2
MD5 62272fdc47fcac7aacf0db8f4fe2a4e9
SHA1 a6d0109725d9e888712a25f0970c35fd153461aa
SHA512 8ae3e90b65ecd37fd0ffca02d55de230324a0af24bd2b10901a9c069bb84ddac4e832741f9f76e0c1a2b8bd1bd2ce32f67303ba5087514015999a09bbaba2801
TLSH
T11571CFF7C7E5866DD91166F09A142F1BDE2D0946836C3C09C5D4EF1BD3E24B0E285A8E
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

ab257cf7-da87-45c9-8bd0-d47af6b4fc57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab257cf7-da87-45c9-8bd0-d47af6b4fc57.tmp
Size 210B
SHA256 3864c808389e06e7f8ed7015d4a4d9761d64cd4b6440c7447f05fee887a243bc
MD5 d42585306e85f1d99a5d43e3d724ed29
SHA1 dfa74e9bf8993261d87402608bbeca8c6da33415
SHA512 3fc69419a07044a83e801a354a0788a10ddf3d07f0823f8c283f267ff1bc369b12651f2a7fdecfd36323c32d21e411148412a4a3b3ae792ea6514de44b66011b
TLSH
T1C8D022237244B1B1862D3E981029ACCED3F200349827E1D820E9E65C7EB6C2F160B0CA
MD5 SHA1 SHA512 TLSH

Submit Download

e0d9598b-7c48-454c-a20e-c10a0ae4bd8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0d9598b-7c48-454c-a20e-c10a0ae4bd8b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 68bd53a62a20ec1e8cd8c784164a4f9ed4b5d1b09995f4a7a4854156563bc2c0
MD5 808872b57a080305fa79ee31becae010
SHA1 d6488bd4df9e2948bb36fcd316d2859e38261f94
SHA512 c9082aff174a3ca5097905e865c308ed4a727a9b40d0ab01292b21f0716e284ade462a78f9ea3a3f06add44654341153a96666772af1744c495afd014ed1b578
SSDEEP 48:K0b7b+b/bbblbdbdb+bbNbgblISb7b+K9bL1bJb+xbTbuYbIbZbrbfyLNsh9P7/d:KsAAK9aCK+wKva8MAKZ6a+
TLSH
T10A912C1132BA0760387D3A5C41758A6B52823373340DEF6A7BAD40B69E6FE044DFD9CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca6a86a1-dc27-42ed-9d6e-f807c10a57b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca6a86a1-dc27-42ed-9d6e-f807c10a57b2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef5aad8b-9fb3-4de4-830a-9cae24b931ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef5aad8b-9fb3-4de4-830a-9cae24b931ac.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbc3a66c-619c-479e-b6ee-62139108849c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cbc3a66c-619c-479e-b6ee-62139108849c.tmp
Size 8KB
SHA256 e3af9eb151ce22b5d3a6cee2c843f641a736864a12c4468ed2ef88e4bb43aeac
MD5 facbeeb3c21ca9af02db15f4bb1ca66c
SHA1 a8a4f22e001652dd9030646568a3ecaac4654383
SHA512 32c954257b553fc55be97f11916dd095d942bde844fa7f74e6933e8fbdb4f24bad598a8e7381ebe86406d7b7bfbcb694814432d8ef94fe2c4726a1a12419fab2
SSDEEP 192:SONs6iDCQmiUyJj3Hq5u88PGquhMSqFVmU6:SONs6/8Hq5u8iGlCaU6
TLSH
T1810208386C787C7B9DE3AE15B54777239FA4013BE6941B84DAE8162C01E769C1307932
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3eea9708-7e02-4ac3-9b75-9f83d36ce667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3eea9708-7e02-4ac3-9b75-9f83d36ce667.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0eaaa1ee10d9aa88eda95d04e7801698e8b1895da73379e3a6a884ed308c4c70
MD5 d9d767274d0311065b81c1ddef148307
SHA1 0feb3c73fd3d4070f71297858eaf20341966c1ba
SHA512 f5fe1502593eade14dbfc889dd9e9ae4dfa65f051831b8e31c6b29e46ea59da1e041ce4045e49eefdc36c53f3f0a9c613d9aacd3965ac7923e3a363c26789407
TLSH
T1A941D598BAEE1048B3B76F569BF6A96D447EBC332E06D45D00010D8F0666A40C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download