hxxps://ndcreatives123[.]github[.]io/N[.]D[.]-Creatives/

Analysis

user interaction
yes
max time kernel
269s
max time network
265s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 18:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ndcreatives123.github.io/N.D.-Creatives/
Sample261023-w2c15sty6p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{3CF73CF2-292E-4F92-BD19-09A0C23AB2E2}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe
3240	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 460	3240	msedge.exe	83
PID 3240 wrote to memory of 2716	3240	msedge.exe	84
PID 3240 wrote to memory of 4316	3240	msedge.exe	85
PID 3240 wrote to memory of 4316	3240	msedge.exe	85
PID 3240 wrote to memory of 4316	3240	msedge.exe	85
PID 3240 wrote to memory of 3248	3240	msedge.exe	86
PID 3240 wrote to memory of 3248	3240	msedge.exe	86
PID 3240 wrote to memory of 3916	3240	msedge.exe	88
PID 3240 wrote to memory of 3916	3240	msedge.exe	88
PID 3240 wrote to memory of 3916	3240	msedge.exe	88
PID 3240 wrote to memory of 3668	3240	msedge.exe	89
PID 3240 wrote to memory of 3668	3240	msedge.exe	89
PID 3240 wrote to memory of 3668	3240	msedge.exe	89
PID 3240 wrote to memory of 3840	3240	msedge.exe	90
PID 3240 wrote to memory of 2104	3240	msedge.exe	91
PID 3240 wrote to memory of 3840	3240	msedge.exe	90
PID 3240 wrote to memory of 3840	3240	msedge.exe	90
PID 3240 wrote to memory of 2104	3240	msedge.exe	91
PID 3240 wrote to memory of 2104	3240	msedge.exe	91
PID 3240 wrote to memory of 3304	3240	msedge.exe	95
PID 3240 wrote to memory of 1840	3240	msedge.exe	96
PID 3240 wrote to memory of 3304	3240	msedge.exe	95
PID 3240 wrote to memory of 1840	3240	msedge.exe	96
PID 3240 wrote to memory of 620	3240	msedge.exe	99
PID 3240 wrote to memory of 4872	3240	msedge.exe	107
PID 3240 wrote to memory of 4872	3240	msedge.exe	107
PID 3240 wrote to memory of 4872	3240	msedge.exe	107
PID 3240 wrote to memory of 1108	3240	msedge.exe	108
PID 3240 wrote to memory of 1108	3240	msedge.exe	108
PID 3240 wrote to memory of 1108	3240	msedge.exe	108
PID 3240 wrote to memory of 1396	3240	msedge.exe	109
PID 3240 wrote to memory of 1396	3240	msedge.exe	109
PID 3240 wrote to memory of 1396	3240	msedge.exe	109
PID 3240 wrote to memory of 4468	3240	msedge.exe	111
PID 3240 wrote to memory of 5092	3240	msedge.exe	112
PID 3240 wrote to memory of 1540	3240	msedge.exe	113
PID 3240 wrote to memory of 4752	3240	msedge.exe	115
PID 3240 wrote to memory of 4752	3240	msedge.exe	115
PID 3240 wrote to memory of 5100	3240	msedge.exe	116
PID 3240 wrote to memory of 5100	3240	msedge.exe	116
PID 3240 wrote to memory of 5100	3240	msedge.exe	116
PID 3240 wrote to memory of 3120	3240	msedge.exe	117
PID 3240 wrote to memory of 3120	3240	msedge.exe	117
PID 3240 wrote to memory of 3120	3240	msedge.exe	117
PID 3240 wrote to memory of 1008	3240	msedge.exe	118
PID 3240 wrote to memory of 1008	3240	msedge.exe	118
PID 3240 wrote to memory of 1008	3240	msedge.exe	118
PID 3240 wrote to memory of 4352	3240	msedge.exe	119
PID 3240 wrote to memory of 4352	3240	msedge.exe	119
PID 3240 wrote to memory of 4460	3240	msedge.exe	120
PID 3240 wrote to memory of 4596	3240	msedge.exe	121
PID 3240 wrote to memory of 4596	3240	msedge.exe	121
PID 3240 wrote to memory of 3156	3240	msedge.exe	122
PID 3240 wrote to memory of 3156	3240	msedge.exe	122
PID 3240 wrote to memory of 1084	3240	msedge.exe	123
PID 3240 wrote to memory of 1084	3240	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ndcreatives123.github.io/N.D.-Creatives/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x268,0x7fff7caec188,0x7fff7caec194,0x7fff7caec1a0
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,17649264986188371276,15648305550808800543,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,5946100597838476609,12275632629722272695,262144 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,17694770250757373474,2048815160399765602,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,16397733397235412730,11240409661467572997,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,10549855420709070919,13841923719104139110,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,17324520896373138349,15970192095392511078,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,10355094058612026366,5957780523691647010,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,11231423664685545610,18132108334648910979,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,15600197841757348033,14841998142237452015,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11691402340042436063,17373987265965207872,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,11691402340042436063,17373987265965207872,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4332,i,1764629336154284767,17451171989209713107,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6460,i,7812501617438078143,11503372146256140881,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6612,i,388005941844293927,760106064954554670,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6528,i,2889286456794299128,16204226002538783311,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,7767315099058201627,15292818956431943096,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6576,i,15506683311105580275,3625991322343725890,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,3408297099234572958,931949665928806311,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6792,i,2551629092320803768,16941512918136441484,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3956,i,2129254347712627065,5087208833953530933,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:1
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6340,i,5814191532407481326,10827913585293373491,2097152 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6948 /prefetch:1
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,5262794249037781030,4757902796405249310,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5176,i,926921386732772986,14407055517735317832,262144 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6524,i,2148705464985631644,15565101443848082647,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,17685272910719048711,9152824658285528234,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:8
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,6946929635850276361,8018548488910617268,524288 --field-trial-handle=2312,i,9301888102835400378,11494455532075385055,262144 --variations-seed-version --mojo-platform-channel-handle=7100 /prefetch:8
  2⤵
  PID:1084

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2c531312-d99d-4dfd-82d6-7e706685525e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2c531312-d99d-4dfd-82d6-7e706685525e.tmp
Size 392B
SHA256 3cfa099d54485cfbf2016cc1411c0f300c23c8668828726bb6cf5dd8bda84c03
MD5 afa64ee3a4470636cb59a2ef7476129c
SHA1 a4ca10c2d2470873d71496b496bd401340a58e22
SHA512 3b8c3b3f01fc846eaeb8cbc5475d1a271d784ec90b24e303c9de06387b8b985d8eea4666957e11bc1fc9377ee6ded8656efcd87937fee4bb83f2605113da0d80
TLSH
T141E0020663010E9BD475123400AB5F243EF28430436201060734017D1C713197F24684
MD5 SHA1 SHA512 TLSH

Submit Download

49749fd1-73a7-4459-83f7-1999551745e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\49749fd1-73a7-4459-83f7-1999551745e2.tmp
Size 8KB
SHA256 7de75e1811c873fa3ad2a591bc5f701f36c61fb13cb2b4df2ede35e397857870
MD5 4642ed3bd2860c79dcdc21383e13f7c4
SHA1 4bae05b4bb8e6b469a784bd8aa9bc9f30a25079e
SHA512 a9b29ef05d9641d5025856b0e8e6f0bb5ceaa876017554a8b6ed7185413a1c97f7f8bcc3592f596601ab65b7ce2f57ffb52ac8e382421a3a9ecd702c8c46d7e0
SSDEEP 192:1ONT6wlDgQmiUykiW4X58gZYjzorxJiDl95U6:1ONT6kgWW4X58EA8xJirU6
TLSH
T154020A38F9787C7B8EF2AE09F58626139FE5116BE6552F40C6E81B1D00D765C2306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4de79c8c-b33b-4ebb-9b41-dae3bdb008bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4de79c8c-b33b-4ebb-9b41-dae3bdb008bd.tmp
Size 392B
SHA256 086fd87238762489a2df8bbf644a69149005b6d70e834146bf836acf21ddb020
MD5 d2d6652d498dc733a49f01f7c4a2efc3
SHA1 73220a90ac429c5fb947c4b7dcacc150601cb311
SHA512 9ebfd7f287f562483907b4fd76b6c613b864fd2d0ca4a32f1ab499a97914a0c7a5017ddb79cfc81698854d802025c6bb1409d07f260cf2bba1816e3372d15016
TLSH
T1D1E0020523000A56D465113000575F102EE1C010435102060734017C1C713183A24681
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

056e4118-3065-4b46-a4b3-b37cdfa87e73.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\056e4118-3065-4b46-a4b3-b37cdfa87e73.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

116a7134-87ad-466f-ac28-b11e6ce90dba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\116a7134-87ad-466f-ac28-b11e6ce90dba.tmp
Size 10KB
SHA256 2280e474cc3b5ae1db743d9a8f75087a0706acb3e15b34b802c7a6cd0ac1fecf
MD5 338c4940dad908f0fe95a7ab87ffbbaf
SHA1 b02812f5f79276a236f70b7ac79793f5d5021890
SHA512 a1872ae122dd706dc3c74721203034903769c88b57ccbcb7cd2327cd7dd11b79811d57d18c26c5af635469cf35910b7056ae3cf2bb1c9d76a6166b0cef0d81d0
SSDEEP 192:sxZHRTWR/f5sRbIdpalfHW6+WNdtJXYrYpNCIg53OJJ:sxZH8R/f5sREMHb9X0Uz
TLSH
T12522D8126E38A93B4CC7D20DBF65BF13D5F95072A5951F48AAFC861C05E6BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

33ebf8f9-04b0-4842-8d52-f01385e4201f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\33ebf8f9-04b0-4842-8d52-f01385e4201f.tmp
Size 10KB
SHA256 bc2835099f1225bfe667845b426086a88578b364b46ccf01cefde14cba03cbd1
MD5 8059ea2cdbd60c32df073a2901ecc0c6
SHA1 34a03aa5407ca0f4326b5885054a02f77c7003d7
SHA512 fa061823b44f9e3d607821c03d4a9215232eb7cf2d052e192bd3be052fcda47b9f8d815b1f44ddfa233da507c3c38d085fbc712f296a5811c10953f9e39ba93d
SSDEEP 192:sxZHRTWR/f5sMzIdpaluIHW6+WNdzwZYrEjNCIg5tOJJ:sxZH8R/f5sMsEHbaZGGz
TLSH
T1F332D8526A38A97B4CC7E20DBB25FF13E5F9507264951F48AAFC861C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35d2fee5-e166-432b-8b0a-644d716b3912.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\35d2fee5-e166-432b-8b0a-644d716b3912.tmp
Size 27KB
SHA256 28185fd610554287f2e89a1eed92011d637aad9c2790fe7b466600aa39c5646a
MD5 fd606a3a59056ad6b943dc66fd874deb
SHA1 5c0ae979cf591e1ad41500c7413fcb88daca496d
SHA512 a8ded50d215167ff42588619625c300773ea11821170fbb8dc4eee6bf5090f07dd4198976d4287eeef64179e1cfbe63acb9d59639523a32ab2f1cff6700a7516
SSDEEP 768:63y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbBroR05Y:63y4J/DWvbtBhu1jajiLm0b6W5Y
TLSH
T11EC20B3B684CCA7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c26bbc5a9d6667b144e18dcb1396c4ee45ca8580346584e2e04d9fd7be3f33fe
MD5 bac1cd951f4a71b0a04d8abc23c4c234
SHA1 5e69fcc5c4a3f0476bd2a8f86b999c61a7eb97e7
SHA512 035c9e24d7ab6a833c52d3f3ba292caff4c64c20178e4b5a096c1c625899021c0aa57b73cb9682dcddd69103cc937010a23d1547d2e2065ab4bd1f86fc6672b7
TLSH
T1FBE026C416CAC32FB35AA44B066D670CA7B0265AA3C6ED8E2718C586740D140E6B3BD0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c410ff96c2ed0e9f1542f39fd928fa5f4f2e17b710f54778ceb9d3cc69602a27
MD5 2f95caa9aaacd5d94b695140e4c77e2e
SHA1 21260239cdb3b3903ae329abda67770c3148c7f0
SHA512 1753a701d71cf443990712ab3e6dc9ea4dda04e1942dee3d3990b27d474292c688543cfdcd3c8d4e457df994ebbb074f9e4660d6a457ffaff990fd7bbd6b771e
TLSH
T1EDE026C525DCC22FE26C644B01BC930C8380261E92C96D8E7B08C98C7686080B6C2FD8
MD5 SHA1 SHA512 TLSH

Submit Download

f_000079

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000079
Size 100KB
SHA256 eb740320db2931589f73beefe11307c2aac0479e113ec69b1f8616bd9ce1ea44
MD5 127c5d11de89933a62dcd992c9392d9d
SHA1 1d222486e5788fde5e633f7993c41bd352478162
SHA512 2f97e3a7c4bcb5f5fce9b23188bdf4d4aa19869b148d3e2e03f096043fc60d87fb44277589f2e2f7611945ac899b81250c13eff95984d048c123717787d7ab9b
SSDEEP 1536:Nul53QfUkRkiaI87mWK7pqqV6I4waiSUE3BBZp0UHac1xW4CkV8qlVHxmt:Nu7gNkimYb9TERvNfWxA8qlFxmt
TLSH
T168A3128FCC62277E0159F016BD5BC50BBA07DC2679401AE2B80799717EEFC8729641BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007a
Size 73KB
SHA256 c204ad30d9422e9cb943d934990a1d2f9d2a604a3966648b3d6511e2ed6bee52
MD5 4ef8479a714603e95f17d2dceebd21b8
SHA1 86da8c8cd8b6eca761e57bbb45d4d447865bff16
SHA512 74f4caa1a78b90abff2c018c06df9d5539a7a236516731a3d7c22781e1dde827509d2d54e3eb032d9a8bdce47977c997a4301944f2aae272293fbe1c87bd5f15
SSDEEP 1536:GWmSkTHOPy6OxcPOMpDla7cyEWGEwUfvtcNFWcUO8dvYbFyVDos+g:HFkDOPRGWla4WFXHtJcwYbwVDoq
TLSH
T1D47302A4EF2D1D2DA3E9F5713A80ED15BED5DE0AA84F51F07A26F5A20E80EB0D347440
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 29KB
SHA256 988487aeb57d91b053c9310a5bfe74f20786efe9b6030ad55c14126d0bffc21f
MD5 3f821d48f675b26e410b8e85e6851e4c
SHA1 0dbddaa72bcf6d06f6711b058b3943a36d68f706
SHA512 9225a1c13ca400d2d3cd607e5efe9dc3c2a368ac4a6dfb966472281c17fb38b8bfb2032678181f7175314c9a5da9dbb887356a7d144d8f3d33e086a8501525b0
SSDEEP 768:oiIB2tIf9HXNrah34Uq0YFtd50eRNuB6XOT089Ot21kPOhlOY:oim2yf9HXNrl0YFJ0eRNFh89OtvKOY
TLSH
T1A2D2E11EA1FBE5D58C2F4ABB8AA6B4CD25071B321902C765C3601AC194139FEFE1D1D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 18KB
SHA256 b558dcf593bd2d76ca0deb1e88da74ff30bba0182fcdf329f5fac944071bd31a
MD5 32250cfe7da756147405b5447d3a8e07
SHA1 79cc302c34d512f8a272503babab42cf9dba7a44
SHA512 b6956eaa3e3a7bb794246c0614cee51a863a33251c63959f8115284382b66acdcb3fc1a9cdf811d6b9424ba834593e9fe88fd2e5e17236e801c060263e07e0bc
SSDEEP 384:2aJptluRvCeRcYxOKPJhZyQHAtiSDhF1my0VGbaGWnhsnuB4Pv1f:2aJCCeRcCOYPHAIwF1wsbaGW9Bix
TLSH
T14382D1AFDF0DC0221340B6E48EC473F504CA6456B628FD542696BD2A0AC17BDDE616FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 84KB
SHA256 b28732b8e1d8e006528aadfbbf509bf66bb183c3ba14c569413f156e58b9d537
MD5 839131b9728e88600766711c53959089
SHA1 8c32552434c760f737485f9cc865ef25985033ca
SHA512 93befecdfe869020eb1a0499f9e6664aea91ba205f12e171cabcc675c0814f29d75f18a5293a78b0d856fcc4d5c126307e90cf23e96cfaa29cddf6289313bef1
SSDEEP 1536:GHyl3DbCYMhgw7xgHagg/Y2xufDYJbtaWyIyOWHuwyllOl15m+KNKE9sNSk:SgfCYMLxgHagUY25p4WyIgnylwl15GNE
TLSH
T1D68302A4B56FA179D8373B364ADC1C84EA3A2FCBFD99638EC4037B50B906A811E5410D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007e
Size 26KB
SHA256 47fb42f84758bed3afbe4f76038b06016d262605cfe8c69281f1ea2cb0608e55
MD5 a324b24b052e13f002363c2aafc5db24
SHA1 32a54f6368bf9015a7d1752bc7ea43c547f0a59f
SHA512 2e7e92034947db98e73e1728b4f962e364da9d2e5d41127e5bf93f9c474985beb75493578f693cb84b178eee6f172de6cf3bb8d251d0f44e01ad5ce70dc86926
SSDEEP 768:DMWowCC6R+dhbi3B9axF6NhAQ157Ewix+uzcq3Uf6:lXCBYzO3BbNb54+CX3
TLSH
T12DC2E11FF0B46D1E5E69AE2D6943B9CCCA88137816A5324B0E2FCFEE15A885471DC3D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007f
Size 44KB
SHA256 16eb60e929a4ccf8bd8f0bd364f7477bbd498768f0a1cf0340ce4574bf3cbe27
MD5 8933bcde4461bfec22dd8adc794d8487
SHA1 82b9b6060ba620a96581743269d8a4f75f7f77a3
SHA512 e426f06b2b08ca3b604d6bef3c15575f068ff1bba0e691765af4cc6119a3327f0470e9f9e62c37dac0dc8c1a14e01263015f7707d7443bc8777ab0934987579d
SSDEEP 768:FXJDGnyRK2hU2ytHWRhj83Q+OJnPo2iaEtobSo7JjeJNO1qU8cA1eaYpUElx:Fh1RK2+tHWIpOJPo2lETo7JH1IctUElx
TLSH
T1DB23024367CFEE8E058317493F5308419B6ADAA750235D4BE69D14364FEF4CA18E934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 272KB
SHA256 efa03118ef390ec23a0b40f57567d210aaa3ead96ed1402a65cc0e65c0a24a09
MD5 df9b7597885b340546c4924123e20171
SHA1 2556909adc597950b69ebb15874eb3bda57b9271
SHA512 36248a97550e8b876e244cc836efd28617df035e88d6024fcbaba72796c5da81bbc97c360fd46e742a875a07a336d103de03d467ad6d7d4751afaf2a617aa6b3
SSDEEP 6144:Cx6OrfSabWoqQ4F1eICt1W9u1LXC5txhMAgFFCnMYS:Gnr60WPQ4FUIg1mgLXcfHgzCnMF
TLSH
T1E854236D55A1CF9CBDF220421A9C60C0F80EB763CD37D2F4BB6D221CA5C53A6E583692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 45992e28a5cd538a44fda260b6ca228c0963755451a9f44defb44c03ff272186
MD5 3151b3eaff2f8c06da8868e91e04eb59
SHA1 1f96dd61262f0694353d0258be014edbca012178
SHA512 4a9b23790164a0738bb5b3188a2a89285416cda01fd2361bcdbb5c6d7defd157dad4d346b2fecb803371790f3364951035f6ba192b7ef173a48cd46a267e4c7b
TLSH
T152615FC152B0486DFB68E37286FA1067B6348C728EE3ED72E454F8F95C0632071648BE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 77153fc704baf7997d7410d3a8e0baa32dd11428bb6d468c328a01e5387403a2
MD5 9f544c6c7d058b694e73c4a6d4defcc1
SHA1 79875361c1b0c8dabf1a8514813776a4386f9438
SHA512 b5250321a6224a779163611de1f1c73f331d285e18a94051ce69c2bceed6a332fbce59679611ee666d47a76cdf875c29bbf45af1f9e0f666e9c960b2f33489a4
TLSH
T1C271A5C166B0485DFBA9E37246F5006B75384C728DE7DE32D554F4FAAC82320716487E
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 4927392ee34ec9357036218d763a624139965118b15acd24637990be2abe5a87
MD5 51ee37c4bc9cf7f92ebfab5157ccdbeb
SHA1 8f671ee23737154a205ae2581c5bc4699ae76d6c
SHA512 9ed9b0f7d974f4be01d167513e030d139c6fe97a48f0dda63b6cfb3e1e37197ae06d2d375bc0e5dcafd5ed04956582467d69164a253e1afb2d95b8a73be5e16b
TLSH
T1EF71C7C662A0885CFBA4E33146F5506B76384C325DE7EE32E544F4FABC82720B16487E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0e7a023308bacaba8fe2c4d1831e1bac3fcc1e30d07a8c7de4c7fac5586feb2c
MD5 68aaa5e345eb2d5b9bacdac26612685d
SHA1 047ad0a0c55acbb6557c4274d32b11fc4aab5db4
SHA512 0156a2ba331cd3ac6f74d388ac3c990bcd015271eca02f6e1f61fcc0eec9e85439a405581072420ddc4434d5dea4d0e8abd98282ad7484cf973745e2780443d9
TLSH
T1286150C152B0486DFB68E37286FA10A7B5348C728EE3ED72E454F8F95C0632071648BE
MD5 SHA1 SHA512 TLSH

Submit Download

c1be464c-db9b-4f84-b031-40061592f642.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c1be464c-db9b-4f84-b031-40061592f642.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

75363aa5-feb6-42c0-890e-1adf55dd2755.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\75363aa5-feb6-42c0-890e-1adf55dd2755.tmp
Size 5KB
SHA256 672e1b80412794aa79c270b3acdb681ecc87747b766143fff2c16cf182f1718f
MD5 d12feb9446b89a3118c4fc57a3fce752
SHA1 1acbe5071fa15d07fd251ae6d0df72200a1e2500
SHA512 817d92cfd4058fd4c5c25f1a4eae9e64da5c55c83718194c93629f4fc82c7fdb0034ba2a3375c737d29f248ac35a91628a4036cf59d240920de1d07fde3c80f6
SSDEEP 96:DgOjdhvVtqNr4zljWVZz09RBOPHQNBxRBCwFoSXZF:D7jdhttqNr4RWVZz09RQfQNBxRBCEoMF
TLSH
T1B0B1BDF2CAE8852C9C2256F0BB657E6BCE1D085956283D1A8CD4EF4B93D2471E24174F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95eb191f-bbe8-4347-9ab8-a6c65e40d709.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\95eb191f-bbe8-4347-9ab8-a6c65e40d709.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

b9707776-3a19-4f93-87b3-41138c83d132.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b9707776-3a19-4f93-87b3-41138c83d132.tmp
Size 4KB
SHA256 d1d4a85d40bf288310db169b1eb14bccfcc19babcf5ec5b08ea3ad4de22925a1
MD5 7fbc33c81599c8320a6d5c7fe64967d2
SHA1 303fb20f7aced5d7b905b5e28042d4158143fc8a
SHA512 83b4f08c912a6619e8d06aacd1790a1f41ae254c79875b205602443a5b22706d233d820b8d5f892fb8d64f12f4bfe972bc1506d77e52c94eec23310287dc7ccf
SSDEEP 96:DgOjdhvVttzljWVZz0BGRBwNBxVxBCwGSVPQ:D7jdhtttRWVZz0BGRaNBxVxBCj84
TLSH
T1BAA1BDF3CBE8852C9C225AF0BB656E6BCE1D085956283D1A8CD4EF4B93D2471E20164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c24539a8-9191-4f44-bcda-fd5512858977.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c24539a8-9191-4f44-bcda-fd5512858977.tmp
Size 10KB
SHA256 38286f759265f03c3c9daa6bf30159f0f802e2fac7ad618ecd74126f7dc9d6a7
MD5 c089b6e718ea4e6fa5bfff72d5144aee
SHA1 1602023494a66a965ad582270bdf64bb6bd3b642
SHA512 6e2ffd093c0c39b4567805a6e07b635613f43dfa05aa05ee424157b64f2239a1c664d9190dc6ca4b30646c9aaa9c489ecfe82110c8134e5356d7481ad1f40ba8
SSDEEP 192:sxZHRTWR/f5s9bIdpalfHW6+WNdbo/YrSpNCIg/OJJ:sxZH8R/f5s9EMHba/KWz
TLSH
T1BA22C8126E38A97B4CC7D20DBE25BF53D5FA5072A5D51E48AAFC861C05E6BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8b2117d-8b82-4cc3-b97d-6f23dc8424e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e8b2117d-8b82-4cc3-b97d-6f23dc8424e0.tmp
Size 10KB
SHA256 5499c9772ce7578f9bb070f57e0797b289070d9a657cc2504a26cd054d1e53ff
MD5 f39937321ef1dc99fb512c10f23efe6d
SHA1 0ed023743abb2ed7fdb4c0367e9b2d85361189bb
SHA512 b292ff486f421e2616d0278dcf4147e2f43a8c74951136b59bde3d699151555f90fc64539d73a7cf24b9904c8d2f61c8fe3694c22f0b0a4d4781184db5e2fd44
SSDEEP 192:sxZHRTWR/f5sM2IdpgluYHW6+WNdheFYr3gNCIg5tOJJ:sxZH8R/f5sM3SHb+FsGz
TLSH
T1E632E9526A34A97B8CC7E20DBA15FF53E1F5507265E51F48AAFC861C05E7BCD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

084a7343-cf85-4a2d-859d-d7a7c2f850ed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\084a7343-cf85-4a2d-859d-d7a7c2f850ed.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 104d0071bdc36d273116648faaeafadc46104ea7ff5140f8b681520cdf8cd768
MD5 2b4407a7283d4e20c67460fb01af847d
SHA1 924748f985b3cc429fccbf4b0a2eb3ac185334ab
SHA512 d3ba00efba88d47b8edf9208a6d8daad86c1ecd0235db7a18c3f981b2914db7517a0e593172e43b02fba175182e926295b9dc0363c6c8247cc5aa6bdd31a9656
MD5 SHA1 SHA512

Submit Download

a9b3639d-675c-45cf-88c0-f19470473c17.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a9b3639d-675c-45cf-88c0-f19470473c17.tmp
Size 18KB
SHA256 a02aa0b4b76e48025e1895bca0c0624ee262eac31f1256886e39328154a4e59b
MD5 02859a9982643f636d341b616da90b08
SHA1 ab618c813cb5497ec0429b04b053e9417fff3d4c
SHA512 7a458f74bea80c99bb082637bec8465eafdda369266dc4275c9f624139781ba0318bbefbd2572ab13ddc27ea8c176b5946dc95b2df59b205b82ffe3c3da9f450
SSDEEP 384:QQkUSvx+sNY5oLirZsZM2HX58EA8xJjXtY2IKIIlLr:4wxr+MQaqtY5KLt
TLSH
T1C2827D36A8A87D3B4DF3E140F14A3603DFB48157EA985F64D6DC6B2D01CA2D9235BE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adc70710-56ad-4557-9e0f-ef62838e7f06.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adc70710-56ad-4557-9e0f-ef62838e7f06.tmp
Size 26KB
SHA256 33f5544b7a6f859ac3e008acc6f907871481394798d8fd2f849e31421ceeb934
MD5 15b946fd912d5974fb9929dbdda4ac3b
SHA1 bac6d981319b20c1fb24c75d6090dd1220817e8c
SHA512 3257ba40515ab9e7dc222289ee2745011904a8f9bf832b7977b1cc31087725fbfc50c722f03fc20f615d17f7a26351992e14ad9d2192ff48e76d5463b1186077
SSDEEP 384:viFzQkUSvjg+sNI8TUNTUlIl5oLirZsVnHX58EA8xJjX8Y2IKIIlLr:6FdrRwgrrW3aq8Y5KLt
TLSH
T19CC217F298D7A93BD9AE9743A33D2D038EBCC057F9545A50B388591CCD8A1BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d87112ac-ac26-4ef7-8e3c-7055273302c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d87112ac-ac26-4ef7-8e3c-7055273302c5.tmp
Size 8KB
SHA256 963de7c881c9203e90f4ca3b73cbcaaadd3b04860de0cab8720bd56a4706a019
MD5 4136de2821799779c05de9278b5eb857
SHA1 7b8b0562fe23bf35bc4077b133b2ec32eb6ac350
SHA512 ad0cfa7ff254aa4a827c569eef308d6d94b0cebaba6776b7e79e00584d70172b5c6b533879970254baf7c82f675f5a3c7750174535e1dbb0fb7fd8c1c99d81a9
SSDEEP 192:uONR6wlDQQmiUyOiJ4X58gZYjzorxJjXxve1q5U6:uONR6kQeJ4X58EA8xJjXAYU6
TLSH
T106121836F8A8BC2B1DE2B444B48732139FE55127EB496F90C6EC1A1D01DF2AC530AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e8fca2c0-596d-495c-8e7f-97d3d3649f3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e8fca2c0-596d-495c-8e7f-97d3d3649f3d.tmp
Size 18KB
SHA256 2ef4fcd5b42b8e69358ae1bb821a15571fe5f3c48d1814f75e0f1b471141e5fb
MD5 c37a5c8e99f33e2d536c319da48863ea
SHA1 9e1bd1c01645bba8a40001e99b4435a92bdbac08
SHA512 1b2b3faedd41791a042d80e026633d605cdff627bf61ea6d4e722561095383e134647e2cd22668d0724c3c0a50ef18b6e85d9b74d89b428a11af776d529081c3
SSDEEP 384:HQkUSvx+sNY2oLirZs2LHX58EA8xJjXtY2IKIIlLr:ZwqrhTaqtY5KLt
TLSH
T1DE827E35A8A87D3B4DF3E140F14A3603DFB48157EA985F54C6DC6B2D01CA2D9235BE12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3751a722-fc08-4062-bdf6-a846ea24b93d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3751a722-fc08-4062-bdf6-a846ea24b93d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 455b299fed537f267e3d83cbcaf4039ff881b17c82097b9f78b27cbcd7bc0b67
MD5 a64e4c14b5cbf09bd5bad06f8a18a3cc
SHA1 d25bf1010d38a8f4f9558000b4998b57ce8afdc0
SHA512 f97174b5e7310486a9e9fb3fe0f42339a42879fe726bae5da5c5da50667f7050e991b6682a78721e7691875caca2c9b029ac0a406dce23b65d2ea6ed8fc9eb1c
TLSH
T11B414758F6E91148B3B72F5AABF768AD447FBD332F46D15E10010E4F0A26A00C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download