c8620e21523ebdcbbc0cc218b81079ff5a87c06ab82b19ca0f914fee4e72282a

Analysis

user interaction
yes
max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 11:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
RoZWDR5Y.html
Size 2KB
Sample261024-n1ppjstyht
SHA256 c8620e21523ebdcbbc0cc218b81079ff5a87c06ab82b19ca0f914fee4e72282a
MD5 2af85896fcd79601a2b60b2196a05a75
SHA1 a7310957715e79a07e13c63d1e3c6ad262c9498e
SHA512 dc83171e02e5c1a8d58370606598fb54ddbe13bdfee1f823c6b75306660bfd16926e2ce68284a5d38ecfed965cff3daaeb917398f5eaa1a322621a5308f13b14
TLSH
T1A0413023D50580254665E285B0F9B72D806397CFDB32884167B4A1EBA1C7FE1C2B63E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{133EBA92-023D-41E0-9286-3223C17B72B9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 4576	2228	msedge.exe	88
PID 2228 wrote to memory of 3060	2228	msedge.exe	89
PID 2228 wrote to memory of 620	2228	msedge.exe	90
PID 2228 wrote to memory of 620	2228	msedge.exe	90
PID 2228 wrote to memory of 620	2228	msedge.exe	90
PID 2228 wrote to memory of 5052	2228	msedge.exe	91
PID 2228 wrote to memory of 5052	2228	msedge.exe	91
PID 2228 wrote to memory of 308	2228	msedge.exe	92
PID 2228 wrote to memory of 308	2228	msedge.exe	92
PID 2228 wrote to memory of 308	2228	msedge.exe	92
PID 2228 wrote to memory of 1224	2228	msedge.exe	93
PID 2228 wrote to memory of 1224	2228	msedge.exe	93
PID 2228 wrote to memory of 1224	2228	msedge.exe	93
PID 2228 wrote to memory of 4008	2228	msedge.exe	95
PID 2228 wrote to memory of 4008	2228	msedge.exe	95
PID 2228 wrote to memory of 2116	2228	msedge.exe	96
PID 2228 wrote to memory of 4008	2228	msedge.exe	95
PID 2228 wrote to memory of 2116	2228	msedge.exe	96
PID 2228 wrote to memory of 2116	2228	msedge.exe	96
PID 2228 wrote to memory of 1704	2228	msedge.exe	99
PID 2228 wrote to memory of 1704	2228	msedge.exe	99
PID 2228 wrote to memory of 5088	2228	msedge.exe	100
PID 2228 wrote to memory of 5088	2228	msedge.exe	100
PID 2228 wrote to memory of 4872	2228	msedge.exe	102
PID 2228 wrote to memory of 3996	2228	msedge.exe	111
PID 2228 wrote to memory of 2768	2228	msedge.exe	112
PID 2228 wrote to memory of 2064	2228	msedge.exe	113
PID 2228 wrote to memory of 4392	2228	msedge.exe	115
PID 2228 wrote to memory of 4392	2228	msedge.exe	115
PID 2228 wrote to memory of 332	2228	msedge.exe	116
PID 2228 wrote to memory of 332	2228	msedge.exe	116
PID 2228 wrote to memory of 1308	2228	msedge.exe	117
PID 2228 wrote to memory of 1308	2228	msedge.exe	117
PID 2228 wrote to memory of 3216	2228	msedge.exe	118
PID 2228 wrote to memory of 2344	2228	msedge.exe	119
PID 2228 wrote to memory of 2344	2228	msedge.exe	119
PID 2228 wrote to memory of 4948	2228	msedge.exe	120
PID 2228 wrote to memory of 4948	2228	msedge.exe	120
PID 2228 wrote to memory of 1256	2228	msedge.exe	121
PID 2228 wrote to memory of 1256	2228	msedge.exe	121
PID 2228 wrote to memory of 4392	2228	msedge.exe	124
PID 2228 wrote to memory of 4392	2228	msedge.exe	124
PID 2228 wrote to memory of 4836	2228	msedge.exe	125
PID 2228 wrote to memory of 4836	2228	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\RoZWDR5Y.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7fff744ac188,0x7fff744ac194,0x7fff744ac1a0
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,9987993671601773744,4185239483613466010,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5235168455470567225,15334887905979180793,262144 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2624,i,10668949847088598637,14241131440580122274,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,6095650579818728797,15688577413677191803,2097152 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,8811323805583610233,17107484790149053872,2097152 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,7832933870661776454,18269599170895131045,2097152 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4284,i,7590394007255630641,14448587411788912172,2097152 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,13721076178182035358,14259877554464991650,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,17488326023098014859,8903861979284431764,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17627330107996796677,18436806633434414677,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,17627330107996796677,18436806633434414677,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4560,i,7810020488605070767,4621850592136496771,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,2159797547655687512,2621153928601397335,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,14526506247045098961,7960470873347712850,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3048,i,9042630414287410638,17004271731139182514,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=3388 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,9798548637759790154,3615304792094032676,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5332,i,8649607908567931222,1369322139887037642,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,4217845015105793577,16288373774300865179,262144 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3096,i,15418173732503550124,17843090233068970721,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2318355576150427190,15487064868613378421,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,14842834775435060603,4764990887404577885,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,7527940244592282044,9544370308343159113,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=3252 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,15696180871242842174,7153859427212405988,524288 --field-trial-handle=2236,i,12658543317328145725,7577814278528617124,262144 --variations-seed-version --mojo-platform-channel-handle=4012 /prefetch:8
  2⤵
  PID:4836

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

26170dd8-06da-409b-9e42-796fa79c37ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26170dd8-06da-409b-9e42-796fa79c37ae.tmp
Size 21KB
SHA256 3ca6bf671b5ab9e79c9c3fa6d8cc2e19a7f3b11fb6e34b83234e27ef0211c0f7
MD5 33e275a328e19573ad20db040a017dc1
SHA1 38621b06db22d6638689bef1c6dcf03fe6a52ad1
SHA512 127ba57594bdcc71ab402692dfab9fc171ab38bf558d01660ba0fcc40eeddae75d589929fa51ec7a755cfcc0eeda81fa52b427643f11a6b23351cda34ca41cab
SSDEEP 384:+iFzQkUSv2zsNc8TUNTUlIlYWX1dMvzIGmh/qP+kibx62IAIIlX:VFdGJwgVc7eCWki165AL1
TLSH
T1BDA24C728CA8A87B9EF7AB40F54A3503DDB45167D6C9AB94E7C96E1C00DB1DC130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3a3ffadb-7796-4d9a-840e-7d83de3d4ea2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3a3ffadb-7796-4d9a-840e-7d83de3d4ea2.tmp
Size 8KB
SHA256 e39ace47f299276ea5d2a399152c64c719e9d4931885f98b50b2c514e8bf0dff
MD5 d4d3455e4e3067db7b3089227cb5d037
SHA1 9830ce12b2ef748773e1b72537059ce058e8c0ca
SHA512 4c67882e8a3c775757ae842aa9706ca9f6dfc9d2af658e6a7f95d32c0818b04a05ee6f6464d3e49e842b3ee81a1fa576a097cf23708cac3a5f57145a87a97e03
SSDEEP 192:aONZ6IE7QmiUy5aTPuIGmhQRx4LC7sbq5U6:aONZ6DtvPuIGmh/UsbiU6
TLSH
T19D02E935EC787C7B9EB3AE08F4877A236EA5112BE6D52F84D5D41E1D00DB25C1306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

71a582fd-3e6e-4e18-85e1-8aae22537276.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\71a582fd-3e6e-4e18-85e1-8aae22537276.tmp
Size 8KB
SHA256 5bbb953e36e5753ade4289e117da0677bb13f65c856e90369eb6cc24acbcbab6
MD5 b0db0c02ced4140e63aa52d4184bafc1
SHA1 9b93edd0e32fb1273dd6adce9257d231b0415c2b
SHA512 39952e6afc08828c79066762c2535809ad538ef3363a36b60fa3e1caa624a618667bcbcbb6c164d4f86440e9ca8303e91c3b8f3dc6de12fc6f1b864617f5da43
SSDEEP 192:pONt6IEfQmiUyhaTtuIGmhQRx4qPNeUo27Hbtqo6U6:pONt6Dh5tuIGmh/qPjHbx6U6
TLSH
T12612F9369CB8BC7B9EA3A944F4873A13ADA54227E7C96F80D5DC2A1C40EF25C130B516
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7fec38b4-9dd8-4e52-b4bf-31d9f61b85fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7fec38b4-9dd8-4e52-b4bf-31d9f61b85fa.tmp
Size 18KB
SHA256 a00a76124921a933110e236962c9fdcb8c1b4d0a5cfda6081b956b0375fd83d9
MD5 b9784f96c53293279254186c75ebce26
SHA1 5095d280cba81de3c0d7aaff97c25391641d8abb
SHA512 71a99988a6b3a32ea9fcba45e32b604d256dea322f93c88119070d5f4609307a7fb83f32f538fbc02343897591837d484ce448f3a9b47c1dffcdc05a3cdb2e34
SSDEEP 384:BQkUSv0sNUYWX1dMvzIGmh/qPwibx62IAIIlX:z0bc7eCYi165AL1
TLSH
T1F9826C719CB87C7B8EA3E640F54A3903ADA49217D6C85F94DADD6B1C01DE29C230B607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bc431b48-3c6f-4467-bea3-2f3474980973.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bc431b48-3c6f-4467-bea3-2f3474980973.tmp
Size 105KB
SHA256 9260436c94a1833abca9dcb8131c4cccc5ad060d971912bea100bd9a1f921659
MD5 af61b6d65ba3a3316e74e463b5701b5a
SHA1 6eb4c6b1f52ab93bd585b83e03db2052e8d9313d
SHA512 eb387117515b996bd2a3e1182f8a70e62ac5ce6630decd079365c2ee3e53d58b3e9e3b2cb9655230ce60582101fdeae974849f5c45568c2a24be3d96cdd59fea
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P70:fwUQC5VwBIiElEd2K57P70
TLSH
T1E1B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e411e40b2b1e7f1576e6c2cf3027d590d4c5916b7a5e41c1a711f9117d0f1e1
MD5 f86a69ac894860b8a7e2ac52b3c2987b
SHA1 835d87e07bf2af2a2410d66f27145dd25efdaad6
SHA512 6de1915f0367b482a80195c1b703b1007a524ab2a6815670db955de8dd4235e1faa888dde7fcefe1ccbf4dae73b9d41563a6a2f7e5d8d75bf2ff9783b485b777
TLSH
T1ABD02BF8DBD88120F033383400398283308C660420061120A873114C0C441C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18eb5a70b8dc14ee5a30ef2a54b3e14abbda2b2d751a8e8abad286d8e92d8872
MD5 a2b3071ef6468d20d3499dac11b0df41
SHA1 e96a1ba764d6003a0c508557df66dec18df2a1e7
SHA512 144677b38dc2433c6ce2cd569ea8dac3d5f5013e173fcf4e0e6d6d88ad42c12001c58ec8fdf8229ee7476fa921cb946792037c4914570deac4969d9365895b19
TLSH
T113D02BF89BD88520F433383400388283308C660420065221A873114C0C451C34225868
MD5 SHA1 SHA512 TLSH

Submit Download

4adca087-7233-4eac-87ad-31a3d5d1b5ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4adca087-7233-4eac-87ad-31a3d5d1b5ff.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6abefa2a-d8a4-4b1d-8ed9-15ea684b1c35.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6abefa2a-d8a4-4b1d-8ed9-15ea684b1c35.tmp
Size 10KB
SHA256 2af40395fd50f47f39d068f77f2ab7af110162c6fc4d520b8880c52775726ba0
MD5 6e6de91af10ad4e7e472d60f6bdab5af
SHA1 a91eb6009c378cded60762dec64e4177c830bcfe
SHA512 eec81747f883f08b2ebcdf272c5eae926726d5e698dbcec6c00209f928e33dcf0dc9ca9e0c15be6d90d38082dec7c565280a0fc9bcd5fb74de563ec26c58c2d1
SSDEEP 192:sxZkSR9WQc/fwJsmNrBDIdpHWHW6+WNGYapGM6eIg5eJ:sxZkSWQc/fwJsmN9c2HbGz0
TLSH
T10922B9126E3869778CC7E20DBA55BF53E6F9503291941E48EAFC961C05EBBDE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

74b9d890-e456-4047-b173-80f475fedc97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74b9d890-e456-4047-b173-80f475fedc97.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

79a721db-c6fc-436f-a5ec-dc0d5ecbad91.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\79a721db-c6fc-436f-a5ec-dc0d5ecbad91.tmp
Size 9KB
SHA256 d87d1b80f565739fdabab9ee9220a3ff0aec1c4927dd09ab6fee748109e52ad8
MD5 32b8aa891bdf9e96126c6f945bfdc890
SHA1 c479714766bbe520bc2b6f5132b251956df1c169
SHA512 f8c0fd7f8d192cef7e5c2a0e96b582e785cfaad9b7f3f11ba97a1455938bf490fc398b51022496474f82b8636d8fee4e5b982e664a3b12926e00c75b76e558b6
SSDEEP 192:sxZkSR9WQc/fwJsmfrBDIdpdWHW6+WNGYaplNteIg5sJ:sxZkSWQc/fwJsmf9csHbGS2
TLSH
T1F122B9116E38A57B8CC7E20DBA55BF53E6F9503291941E88FAFC951C05EA7DD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 3b167f198aeab02bec256500a8fefaf679a472083cec066ce3a14bc51d60ae21
MD5 f430b917e721b33284b3792b341e2708
SHA1 2eee42fc6b8df6edb32cec1d2f844047f5815fa0
SHA512 219cb9ccb1e10f732dd630227a1c1b1d1436bb5410b42f419a12a34370e5c601db6351307458ec61ec50561637e78e356c89700530da5a3480bcc92e7318bba1
TLSH
T1B4E0268658D8C27FA30864CB117C578C9BA02A1B97C0690E2704CAC8718D088B2A2AE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 be8f033c405c9bf86bd1a628392b4a179e664f0ceff877742ef1d4e90765747b
MD5 db2b10d9713a292c766e544eccd1883b
SHA1 e85bb05e340f9d49be981ef3cb1a0bb27a17dfa6
SHA512 40ed5edf09471c5d73b164ae5469d184e2ce2eefe303a641cb2d3959f0350362f1fb617050378d95458fbb2c9d00aa6d3301c77b0a4eba4b499dbe298ffcf49a
TLSH
T17FE0268888CCC23FB30BACCB02BC730CCB80261BD3C0698E9B00C6C4700A440A6E2ED4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2dc45ad09a6521d5591ecf31702ca6fb680b4cae0b4d1b34758de9526f5b5f59
MD5 fb1c75cfdce664d4e843379ed31dfe26
SHA1 ec129329d8fbcee729bf9831f118db0d479c8924
SHA512 09c2c33f64619bad4d9b62efa3ac0f917d9a5caf18c75925aea8966570942e57cdba417181339e2e5778e008fa38a261e2a1d9fa2b4c0654732977993074468e
TLSH
T185E086D44BD9C23FA31C64C706BD734C8B90266B97D46A4E2718CBC87149944BAD2BF8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e08ed7d76b0aab48967d802db68d7643d6625611fb45fbbe9219a68e3cfe2c3d
MD5 553ebbf5053b182fe7d7d01c92aada51
SHA1 c613414e2592667bc4843f6656c68261f50e2ad1
SHA512 67611a7716298555b03673dcb3fc193e33bba9e0fd0880abf756bd3e7fbdd771fe0a0549c592ef8cdf6e969246e457c3bbd7e99317748896dd1a3b1cd2b6bcd0
TLSH
T1DAE0209585C8C23FA304A4C701AC570CD781675B92C4BA0D3700C6CC710A1806A92DE8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9a6fc4f17fc2e47a66c49b077b1b64034cd8a9108dc661fb175fd51a085653ea
MD5 462209b6be73edc64e5575640e87fbbe
SHA1 48ad117a6c8c6f4d8960c3085b7e0a2e9360ee48
SHA512 5226ad5a2884fb47ddd8081ae7e3544938f292c49325a565a990baa69533ffc41be41891e4f685edd8239b62ff233eb156466bbc69b0fb8694326cc4c3be5df4
TLSH
T155E026C848C8C2BFA71C648B126C934CDBA0261B93C06A0F2700C6C570CA680A382EF8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 241885b50dd03ad14f086e30934b368488e5dae5d1a2b85bfaa5ca7da86b511f
MD5 863f130a05d5a7c22a59d702dd87e805
SHA1 7a2ead51d46e4c885d3e6a4ad6091f747c7dafb4
SHA512 236f645286d420b65ce2a9da8ee4308ed1ec095eb839f484f8c50c83f4079381546f634e902715d90ad745c863cd100957fa085fa4b91a5672005728a7bbec45
TLSH
T19251EA499688A8A5F7B81C7942F5A38B373869C1CDC72E371CACF93C3F8E7825102240
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 b5a6c9408e2bd3b3b92aa4e34d44fbaf439f37c5ff94ba91ad702e0be83dc40c
MD5 c1ca5facac539e2cdaa1ad7fea86bb98
SHA1 a7d9a7e10d907f89690b129819469f1af230a3f2
SHA512 fd4fd7fc09104c8f146ebcd92af6773994459212db40ac6d9a81cd28293644f3ff68c73f68dd17a662f8da7dc66d8e380ca1605f543094cc181e08e6836ec604
TLSH
T1D651CC499688AC65F7A81C7942F5A38B373869C1DDC72E371C9CF93C7F8A3865102240
MD5 SHA1 SHA512 TLSH

Submit Download

8d9d6549-6c74-4346-b1bd-e8f850a50899.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8d9d6549-6c74-4346-b1bd-e8f850a50899.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2959d3a8-c33c-4951-9bbc-0a96c0628722.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2959d3a8-c33c-4951-9bbc-0a96c0628722.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

71e02a12-ce8d-4934-bd80-a8fd384c1abd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\71e02a12-ce8d-4934-bd80-a8fd384c1abd.tmp
Size 949B
SHA256 10c08bf2972622bfe8f7621b545d21754bc54bcf9c9b802fbed49fb85bf56643
MD5 791293f45876ca3e5e695697a1db1fa9
SHA1 39ed34a95695266716f41b4cb06403a3e2732594
SHA512 b2f5b1300492342396bcdd73b63a60fb272a3b4cf13e8710c1b996ab0aad724cc85ae24b06633a01caeab0118fb30bee678a108382092b574cc1d95af11cb7c2
TLSH
T1E6117DF3C7D5856EC90156F05A28AE1BCE2D0605421C7C1689D8EF67D3E3476D00255B
MD5 SHA1 SHA512 TLSH

Submit Download

bd2d4efd-af42-4e91-9a7a-17f7439c7ccd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\bd2d4efd-af42-4e91-9a7a-17f7439c7ccd.tmp
Size 966B
SHA256 345398867e526569166959e4a7bdbffda48830b7cd3fe6801f1f68fdd2170514
MD5 5e5e96c6d701ce2c65c7f7cf5392ae36
SHA1 228b5c84e6c564cc6a450ac1df4673078a01a97e
SHA512 ffb8b8cab9cf8903701edcf4ad3f6e6db0f71ae5277ded5e60ba8c523e26ea97ef2bafef89599bb2f22041e77e84c022f750dd47f8b5a86d44cc9520b060a80a
TLSH
T1F611BDF387E1859EC91156F05A28EE2BDE2D0606831C7C69C5D4EF27D3E3036E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

e0e1a6b5-b195-4f6e-9d41-f9b21ae80e59.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0e1a6b5-b195-4f6e-9d41-f9b21ae80e59.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 271B
SHA256 d1859bfea4ccaa129247abfe5b46e8e88889fe4c887a31c67cf789a606e7743c
MD5 212bafee5639606f94cdde1b85ef7342
SHA1 1b8dd63594ba5420e4879fa01279d7e94230fe03
SHA512 e6971a0964ad435168c70d45f84e333a54fd76ac544b3f6bc69f5dc04cf52bdd11315cdcae72f669a90c8dff4f1e62bdfd28e75ecc285bb7efc0a69303fd50d2
TLSH
T142D02BBB199614109C6F97D5647248A046457850D948ACDE5028C2C32050F793403C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c3a724e62e40cf1cadcbad1bfc86d4310c930bd1ac29237e4b64106e3af89413
MD5 f8548f49596d63ebd6e8944c1272e588
SHA1 503c8b3f3e62eaf0b0648da6a879e78551dde3ce
SHA512 f549ac693bfe64332ebcf6a567f3acaee94266cd74a62e75f4a4d0474bc05ef100a826f84e311ca0e9adb6a37187ca689f7272add48c43795951bcb88fe50c95
SSDEEP 24:KB7EHsPITKbha1qSSpzSyXwyZPmPqE3w0gQo8GzIFqgKSThqMg1U6wSu+cHMity2:KsUITKda8/SyFFIlKGQ4XyNbIBKowEj
TLSH
T1D491D2513276128038BD2A199174872AB2423173361AF62F7FFC51A59D2BF194DFE4CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa0f1de2-6a99-40cb-bc47-6c3203bbc04d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aa0f1de2-6a99-40cb-bc47-6c3203bbc04d.tmp
Size 27KB
SHA256 ee34850d595261bc4efa4f989428b7b2f004b6a28a45c03180791cde43eeec6a
MD5 0f7e25bd74cb5fea4aa69c87149d4925
SHA1 1ebd34cec30f9555f0e11eb61ba5a7a93233e51d
SHA512 ec74b2f1b14c354df09314bad29b2b9c3d5b533cccf561a31c36d1e4ada30bf4bc4df242e32ba24fef4164364685e84313202fdf184f8f0d13c6c6953510279f
SSDEEP 768:IAWPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy73ro46fe4mRr:IAWPcLKWvKeEeu1jaClLiF7k46W4mRr
TLSH
T131C2EB3B640CCB7E5FC01A9DDC5A6FA77E9802C796648D4047FE984C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd0d1da9-662d-40f2-bbf5-01dda6e0f859.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cd0d1da9-662d-40f2-bbf5-01dda6e0f859.tmp
Size 10KB
SHA256 1c9b604ecd52f3a29ef9f1d8684f6ca62bcb4bfa22b74b887982b13170350be2
MD5 e0e4a1a9a17dcc767f7b92cd93bcd476
SHA1 52a0aa5d6d4f0a844effb1b41fd37aeefdc9637a
SHA512 39da0ff7bc2c0a4dd9be75a7be3e6a9e25c7623bc91cfd8d5cf2004eaf58790a55f7d07098111283a7790ee01c494e08cc93a28d182e1688ad3cff5bcac2c959
SSDEEP 192:sxZkSR9WQc/fwJsmNrBDIdpdWHW6+WNGYapY7teIg5eJ:sxZkSWQc/fwJsmN9csHbG/0
TLSH
T17F22B9116E38A97B8CC7E20DBA557F13E6F9503291951E48EAFCD61C05EABDD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf6e7b7b-a79f-4d15-93db-0f98c9e907ee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf6e7b7b-a79f-4d15-93db-0f98c9e907ee.tmp
Size 9KB
SHA256 72e20e0f33ab078b9f4f3e04b9e8db8a52c6d1ddc019fa813bd86dcf93e6b415
MD5 81a0e4812dfdff058c8954abbec401c8
SHA1 e5e322688247b7fc1ae877ceba1ff2df72a1c8e7
SHA512 7e21188fa61120dc4b4fa993fdfc3d5cf214e132b594db0f714bb8d023412f2b7c54704b3fc73b202f509595176b7b797685e2fd92a7b9042e709f09962b1dd9
SSDEEP 192:sxZkSR9WQc/fwJsUfrBDIdpdWHW6+WNGYaplNteIgrJ:sxZkSWQc/fwJsUf9csHbGS9
TLSH
T11522B9116E38A57B8CC7E20DBA657F53E6F9503291941E48FAFC951C05EABDD120B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d73e049-35c6-49e6-8de7-a09b0b84acef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4d73e049-35c6-49e6-8de7-a09b0b84acef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

ac202f48-e256-4639-88f4-fabd3cece66e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ac202f48-e256-4639-88f4-fabd3cece66e.tmp
Size 18KB
SHA256 aa2ca9d3a8c9eff24edc4f265f01ffaeec9ab886291f6fb5927700b7d5beb458
MD5 dc64103368fea8de76d3adfb5bf11652
SHA1 8a4412b7fb4b76253633cb691c2638d942759705
SHA512 8e9764209657d8d686b2d59562564bd8c75cf653baca4f6317e4ec36faf2b1859ea90bb25b4a0827799012e0c290f3c2c207566db2c3a1b17f883aa98dbe565f
SSDEEP 384:lQkUSv0sNUTWX1dMvzIGmh/qPwibx62IAIIlX:/0mc7eCYi165AL1
TLSH
T188826C359CB87C7B8EA3E650F54A3903ADA49217D6C86F94DACD7B1C01DE29C230B607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4a688cf5-b5bb-47f2-85fd-81fde6f49a88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4a688cf5-b5bb-47f2-85fd-81fde6f49a88.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 38e58aa4d2be3e0dcd97016b77abf371e2051aaaf27fa42e21247fdb6ae13962
MD5 0f5979e9a966179fc1f4dfe56842f263
SHA1 1ad40b05a03a41cc42e01aa90af19b7af3a7a604
SHA512 cfbd5cd994f64acbe210e0df6bee8ac0913131cdb74c9067d8aee187cab17135fdd5f73555796836c51a9fd82b48b79dfe81c72ae672287394c3bfe0051f7b8f
TLSH
T1B6413A58B6E91148F3B76F59ABF6986D487EBC372F07D59D00010E4F0A62A40D871B37
MD5 SHA1 SHA512 TLSH

Submit Download