hxxps://www[.]cheatengine[.]org/

Analysis

max time kernel
300s
max time network
269s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.cheatengine.org/
Sample261027-22jftaxtht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5236	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4280978039-528710165-233981602-1000\{948A540C-1630-4424-8DEB-22C8D13AE1D7}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4280978039-528710165-233981602-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5632	msedge.exe
5632	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1060	4404	msedge.exe	89
PID 4404 wrote to memory of 2232	4404	msedge.exe	90
PID 4404 wrote to memory of 5236	4404	msedge.exe	91
PID 4404 wrote to memory of 2232	4404	msedge.exe	90
PID 4404 wrote to memory of 2232	4404	msedge.exe	90
PID 4404 wrote to memory of 2076	4404	msedge.exe	92
PID 4404 wrote to memory of 2076	4404	msedge.exe	92
PID 4404 wrote to memory of 4664	4404	msedge.exe	93
PID 4404 wrote to memory of 4664	4404	msedge.exe	93
PID 4404 wrote to memory of 4664	4404	msedge.exe	93
PID 4404 wrote to memory of 1076	4404	msedge.exe	94
PID 4404 wrote to memory of 1076	4404	msedge.exe	94
PID 4404 wrote to memory of 1076	4404	msedge.exe	94
PID 4404 wrote to memory of 408	4404	msedge.exe	96
PID 4404 wrote to memory of 304	4404	msedge.exe	97
PID 4404 wrote to memory of 408	4404	msedge.exe	96
PID 4404 wrote to memory of 408	4404	msedge.exe	96
PID 4404 wrote to memory of 304	4404	msedge.exe	97
PID 4404 wrote to memory of 304	4404	msedge.exe	97
PID 4404 wrote to memory of 3048	4404	msedge.exe	98
PID 4404 wrote to memory of 3048	4404	msedge.exe	98
PID 4404 wrote to memory of 3048	4404	msedge.exe	98
PID 4404 wrote to memory of 2568	4404	msedge.exe	100
PID 4404 wrote to memory of 2568	4404	msedge.exe	100
PID 4404 wrote to memory of 2568	4404	msedge.exe	100
PID 4404 wrote to memory of 4196	4404	msedge.exe	101
PID 4404 wrote to memory of 4196	4404	msedge.exe	101
PID 4404 wrote to memory of 4196	4404	msedge.exe	101
PID 4404 wrote to memory of 4212	4404	msedge.exe	102
PID 4404 wrote to memory of 2164	4404	msedge.exe	103
PID 4404 wrote to memory of 4212	4404	msedge.exe	102
PID 4404 wrote to memory of 2164	4404	msedge.exe	103
PID 4404 wrote to memory of 4916	4404	msedge.exe	105
PID 4404 wrote to memory of 444	4404	msedge.exe	109
PID 4404 wrote to memory of 2692	4404	msedge.exe	110
PID 4404 wrote to memory of 2080	4404	msedge.exe	111
PID 4404 wrote to memory of 4824	4404	msedge.exe	112
PID 4404 wrote to memory of 4824	4404	msedge.exe	112
PID 4404 wrote to memory of 5632	4404	msedge.exe	114
PID 4404 wrote to memory of 2620	4404	msedge.exe	115
PID 4404 wrote to memory of 2620	4404	msedge.exe	115
PID 4404 wrote to memory of 2620	4404	msedge.exe	115
PID 4404 wrote to memory of 2532	4404	msedge.exe	116
PID 4404 wrote to memory of 2532	4404	msedge.exe	116
PID 4404 wrote to memory of 4936	4404	msedge.exe	117
PID 4404 wrote to memory of 4936	4404	msedge.exe	117
PID 4404 wrote to memory of 3424	4404	msedge.exe	118
PID 4404 wrote to memory of 3424	4404	msedge.exe	118
PID 4404 wrote to memory of 1568	4404	msedge.exe	119
PID 4404 wrote to memory of 1568	4404	msedge.exe	119
PID 4404 wrote to memory of 1568	4404	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.cheatengine.org/
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x264,0x268,0x26c,0x260,0x28c,0x7ffbdf73c188,0x7ffbdf73c194,0x7ffbdf73c1a0
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,15240731459739212389,2841096056828199465,262144 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,1910014684661420095,2918532170074381227,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2248,i,13113354358545236941,10707122257201500455,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=1408 /prefetch:13
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3544,i,5223087684998809904,10190995085460183418,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3548,i,14920548668654841310,6433660973432696078,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4348,i,16294545201263329274,14584822535796638432,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:9
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,9829602150537137628,1307795972139647493,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:1
  2⤵
  PID:304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3780,i,16625245534544797223,10494449804102736673,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4280,i,17376768508157903715,17717480808022526490,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5512,i,10073209390194797632,9871759042645645311,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,10907007248214974331,13928418735274671129,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,10428781812400106459,15183345377010249721,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,7560661136880535513,1310767403626679840,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,7560661136880535513,1310767403626679840,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4148,i,18303603699964463477,7531712311618078921,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:14
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,9001387802922755186,10206839605209359509,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:14
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,3372984725462667782,14723791115270498355,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,13137942076009363290,17990988942366814427,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6580,i,6865995597144085753,14436108290075123154,262144 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6860,i,16797285309313254280,14864839241938482307,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,8190945549900197327,17135634596113303663,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7312224569324610776,17579611669208254987,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=7144 /prefetch:14
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3816,i,2528823589774651769,7618678084086171818,524288 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=7088 /prefetch:14
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4088,i,10351791697404588984,2862013047999310728,2097152 --field-trial-handle=2432,i,4824302306906343382,17560681307953688658,262144 --variations-seed-version --mojo-platform-channel-handle=3848 /prefetch:1
  2⤵
  PID:1568

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12290ec8-beb4-4d44-ad91-0dfa7f64286b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12290ec8-beb4-4d44-ad91-0dfa7f64286b.tmp
Size 34KB
SHA256 b6b1b9939cda9783231539f079efa3f63b248be8494d238e3b546b953f7487ba
MD5 aa82b35d96c4de21e921dda7f289c433
SHA1 e8addcdd844b275eab1515b1f3808f34a392530a
SHA512 cc7883f5242e8eafedbb5c3695269e1bdb42de1a519c2ada22221dd19f5acf74ddafee45138c80217f6d789a8b64d854147619a3c7b15d89de665f4729cd76aa
SSDEEP 768:xn3XLPwwOU5tFsQEf5fgGM1TnXMqOap6iUjLG:xn3EvRfgt1TnxOqlUjC
TLSH
T169F2BF32AC956D739CF2D281F21AB193AEF08167D5841EA8D9DE7D1E01CB29E534BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8a4de53d-c35d-4b93-9807-cb2ce298fbf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8a4de53d-c35d-4b93-9807-cb2ce298fbf3.tmp
Size 37KB
SHA256 66234901979b774a2bb8a417a5685308b502e5c4f22fa85373417bac0a3e36cf
MD5 aa130c7166b6779b5bbff60c2a1a3f65
SHA1 193f8c32b61f6629e02b5f1338d6e697fcc6efeb
SHA512 51616173034996a5de12e073825ba55a4fafa86ef0c78b7904330194b02d7d201e0fc842b62fa789a4376a1495a74482bbd9a84e35ac1a319b23af161c6a4f42
SSDEEP 768:5/UxvxjgC+93ABwOU5twu5fgGM1TnXMqOe6AaP8:sZj3+930cfgt1TnxOJAG8
TLSH
T15B03CF36AC556C739CF2D384B30AA397AEF240B3D1C52AA899ED3D0E058B25D530BC53
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 08b551008bdcc4de6c80e8d8ffe37c1b7477ababb9604ca97c52b81aed70fdae
MD5 4cd8e5e902146ba19eacbbf4f2e5586c
SHA1 94f807b68c16fd008173350beb37c8686810bcbd
SHA512 6381a86b9ddf9099cf403e36e8c774a996a2a9e547c95e0b2070ef6e2e5e94028cf8284c9fb284f5f80b523066ed68d34895e768192628c20598a4e881c034ca
TLSH
T1D5D02BF4B7DCD543C084507400F11574113571306918C2F02311E18805042810512329
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6a4f25194d7df920f023b94035789770d82b866f099f5b5c173cc54b917115
MD5 3f1c1794ec8ced524804973bbce2d4ac
SHA1 6590c89953e8a722e5a484b9a6cf54a706728368
SHA512 4d64e702748a9bdaaf0d9e615e1a53c00d60b36678bc7c8cbf081669c63c3b8c23886cf0b3633e50e54853f273a2e585b73bb1a35f53ef1493bf40ac357ee359
TLSH
T1F1D02BF0B7ECD443C084507800F21574112571301518C2F02311E18805042810511315
MD5 SHA1 SHA512 TLSH

Submit Download

495f1761-a7cd-44f9-973d-af3fca6e2512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\495f1761-a7cd-44f9-973d-af3fca6e2512.tmp
Size 11KB
SHA256 9a5026ddafbf83fb739bb0efff5046cbdf418e8b40ee156e5b482e0cec03250e
MD5 c84c63da2b040b8d916971d1a21a6d00
SHA1 8b26d830e52e8934c28bcf2347b07fa9b1ca7788
SHA512 12e3a9c1e50bb75bc6356ec416c96c0902ded31d93e6a11ff9a09252b7f3a44ed147ef3486391519dc1b683142e0831f44d02ca2597ae076d5699559c59f5419
SSDEEP 192:sxRYRAbG/fIshvqGzoA8pU+e/g6+WNWKp/YRf8Z3jhNGkIgD3J:sxRYoG/fIshKM/5F/XhHF
TLSH
T1CB42C8159D28B97B8CCBD21DBB65BF53E6F91032A0D11E48AAFCCA1C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6509f672-1718-44c0-9427-c62e0a159b4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6509f672-1718-44c0-9427-c62e0a159b4c.tmp
Size 11KB
SHA256 676e5665cae0bb3ff6b627df92e4b473d942ac1fbae3f2dce4809efc37c30dad
MD5 0eed5fdad7532a3135a169987491f7c2
SHA1 74362fcc5bcdaf8333e7bd864101af9bee0a0547
SHA512 f0ea56d34ba55f476551237cb9928051dfc2c64bb2a291cf8b283bf9f1324245466f97baefd73fdd4d4ca259c8a21c36f8d069a80f2b750f17714b85325f0331
SSDEEP 192:sxRYRAbG/fIshYqGzoA8pU+e/g6+WNWKp/YRfFD3jhNGkIgDhJ:sxRYoG/fIs+KM/5F/ghHH
TLSH
T13642B8159E28B97B8CCBD21DFB65BF53D6F91032A0D11E48AAFC8A1C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76c9ee62-4d63-4062-8f72-4513421c65cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76c9ee62-4d63-4062-8f72-4513421c65cd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90ce24f5-9110-4573-b501-875e972be5d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90ce24f5-9110-4573-b501-875e972be5d0.tmp
Size 12KB
SHA256 1464f7a5e3efc7752e7f66b3397f71dbe9ee1d0e54d82454b68898dc97779df1
MD5 e379a9da6d9aca502a3917d804edd415
SHA1 08107eb7d529a7f4cacbd33a4fbec5f98e30b468
SHA512 11db7d6fb2f752eb659fdb409bf1ead262a12e9af200f74a579fd603872ea842a8d0ed5ddeefb7cdbf6ebc81e8a74ec51f91e01b954d97f1e59c583ff7b0b13f
SSDEEP 192:sxRYRAbG/fIshvqnzoA8p+eqeH/g6+WNWKp/YRf8Z3jhNGkIgD3J:sxRYoG/fIshd7/5F/XhHF
TLSH
T1B742C815AD28A97B9CCBD31DFB65BF13E6F91032A0D11E48AAFC861C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 34f166f7bca5187c2feb914a9cc0340619c08641e82c55cf12b7c6f178ed58bc
MD5 b4f8347aa91b96c71184eae767ec73d7
SHA1 b2166f16dc5bc29b4cd144a72b57a4747f71b75c
SHA512 c344f2f96dd9a669b2abaf3630f8ed0038691406b1592ee88582b011d73994eed3488fc953d9487bebefb680d47d5918854e964772b4bf3e06294ade6b8c0a15
TLSH
T198E026D415CAC33FB23C65C7817C538D8382361E9AC86D2E9F04C5C87087640A6CBFA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 33bd6e72d2e4eafdde9553ed55952c9b085c00644553158ee424a70978824ff1
MD5 0e6a947ac7e83d7134dbbb8bf7eefe8d
SHA1 daf83643cac03be546a7eed8af012bde882379ad
SHA512 19688be719cfa31e479a3ecd1cce497c8bcb4c772ca26bf5f5f278d2059d95784f1b29207ec20f31d6017e7936d67340f5e8af1d14f59ef82ac6e6cf02abb83c
TLSH
T1F671824717B14054CB9CD03493F112A73A385BB392EF1E1237B8EAB469967B94224F87
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 44e66de3c3c0045c5f37c62dde8ed2cac234093d2a29e44ac7b6591d2f69bb0f
MD5 ce998a35250e6c56b9ad989f119e738c
SHA1 b9fb9d284273ed7a3a230278a96c765ae9ccf83b
SHA512 030ed84f11fc7b0bcb1cfc0f5a2b4e8ca370eb2ecfa88e76ff8c45e4f12562f56c6c079cb6d9b77e0d085d4615b836c35d731b71bf2248b50a86d3696697f03d
TLSH
T1D761814707B14054CB9CD07893F112AB36389BB3A3EF1D1137B8EAB469963B44224F87
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f3e517502587b2c2278afebd71bd9b670d8d46bde3c79f6d89d3a6761960d146
MD5 deb70d10fdb6094f914f32b3ddc68e72
SHA1 d7fae8d186db02ac3dde64c0dff95c245ccabc91
SHA512 834bdca0b64bb26444e864345f25da9a7d789a09f40ffd6f9f275bb72cb9dd53438af193e5a0e24ade384f18ea2e70da807f23978c47e4412b1b72da52e108ed
TLSH
T1EF61934707B24054DB9CD03493F112AB36384BB3A7EF1D1237B8EAB469963B44224B87
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd3ef83fc4652cfd119b178ee07a779ef822c72bc7f323ad032e4f3677892d99
MD5 5ad84f7279f32578264033bf210738ff
SHA1 eb3b5af2a8515acdc592137f3c84981188bb8b65
SHA512 dcf1a760706cda24e72dc3906ac18f827ff7ef046fa8233fa82277f8f73fae56c2bfd91ce2e3f165832ff288248c47584625dd9a82a15b2cb2cd1c28e03ece8d
TLSH
T1A171834717B24054DB9CD07493F112A73A388BB393EF1E1137B8EAB469967B84224F86
MD5 SHA1 SHA512 TLSH

Submit Download

94bc029b-6624-4682-9513-40082ae18498.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\94bc029b-6624-4682-9513-40082ae18498.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

0a102748-5675-4afe-8478-d2043e48adb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0a102748-5675-4afe-8478-d2043e48adb2.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

4c4bb864-cd26-475c-aa29-40af6d78807b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c4bb864-cd26-475c-aa29-40af6d78807b.tmp
Size 2KB
SHA256 371332b19dab09d8ef0adbe0b6930053781972f3ae396d41d84700d155f1c24b
MD5 5b6ad78293a0f816bc8ff64e18b52887
SHA1 df7d801ebe3d740fdf5f73dfe0a046249343907c
SHA512 562d71799c38547f694e1d6b702ca018fb4bb18f1b387e35c70223654918b6dc9fa383dbf6ce98744a9187b623300ab102e4fdb20ca8d1ede566a9550f13b8ca
TLSH
T12C517BF383F5C66EDA1197F0AA147E2FCE1D0514422C78AA89D49E5BA3E34B2D041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

501889da-52f9-4f60-b975-af09e0d675c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\501889da-52f9-4f60-b975-af09e0d675c9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

a688be6f-863f-4f0e-bb67-3f0e451da9a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a688be6f-863f-4f0e-bb67-3f0e451da9a0.tmp
Size 12KB
SHA256 4fbcb96f755641edc97a512cc04006681e181744d09cf36fc7cd393b71712556
MD5 1ab15d923696d9ab433e6e682a00a48f
SHA1 57bac772e6564819378bc8c7c9e7409a6ec5ae3c
SHA512 41acc2ae0b7a0e18eb34418d0d4f0cf1970bf2c58cd50bb10faab20cfa0d59acda72f53c5e7800dfbb6ef3ede2437434a52bf3bd7e70f22e567cac609221a5e4
SSDEEP 192:sxRYRAbG/fIshvq9zoA8p+y9/g6+WNWKp/YRf8Z3jhNGkIgD3J:sxRYoG/fIshjp/5F/XhHF
TLSH
T15F42C815AD28A97B9CCBD31DBB65BF13E6F91032A0D11E48ABFC861C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b2d11574-d2d2-40e1-ac12-b3dbaa077bc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2d11574-d2d2-40e1-ac12-b3dbaa077bc6.tmp
Size 23KB
SHA256 969a76250c2e44a646a97176440f57b7aed10cbced65193d24350831a4a8e87c
MD5 23a6aa0b0962cf8ac2d0d6f7afc922e2
SHA1 c90ecb18236a2fdae56748402a735b36ef5bb405
SHA512 c79472080b082df1c6ab923adf8139b3fdd1b0994d52e1da963188bc4592d03ec770850d03358720624871233fd42f31be58b4fc4a91264b6923dfeafa5db610
SSDEEP 384:Ua5g+TcfCtgflFfzHKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwE9tTRkyroqmV:UEg+TuWgf/fzH8F1+UoAYDCx9Tuqh0Vt
TLSH
T151B2CB2F644CCB7E4FC10AAD9C1AAFD76D9802C797548E4047FE994C02C77FA921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d646a4b4-2843-40f0-80f0-ada2f557a094.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d646a4b4-2843-40f0-80f0-ada2f557a094.tmp
Size 11KB
SHA256 57db8941363aee4b768c3834b32eb1f547c13446610770ec423e43c3cdede975
MD5 253c03aec9312a8acd01b17fec9f2007
SHA1 0da93ed1db1e35757a7b3cb6438487b4b4356c21
SHA512 9a4cca5a0b26266a70875a2f73ca8225b36840d45dab1b55f29935f9021ca8df5575afd43699d12e2d3c5287cc90a719cbecde3d1bfdfac5dd0abb7307c16699
SSDEEP 192:sxR7RAbG/fIsWYqGzoA8pU+e/g6+WNWKp/YRfFD3jhNGkIgIJ:sxR7oG/fIsPKM/5F/ghHs
TLSH
T1C132B7159E28B97B8CCBD21DFB65BF53D6F91032A0D11E48AAFC861C15E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b1d4399-f208-433c-85d3-7d4c1cd8e458.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2b1d4399-f208-433c-85d3-7d4c1cd8e458.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bad6c03e-9c57-4bfd-bf36-73412f300af6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bad6c03e-9c57-4bfd-bf36-73412f300af6.tmp
Size 33KB
SHA256 52d6b7634025ee84e988054e8064e0d697a1ca3ddc93bfeffc876e07a7499f52
MD5 498c7f57697e039a4ddfc9d4b97d1229
SHA1 6181ffd13190dc1baa11909ba82bb1329678e286
SHA512 c6671a75c6bd0f8113a77103f0b2ad4f82a5e393903957e14b01a77b92ad005168fe1eb4c2c61b8f775f6849079ba1ed1909635a273e77650dcb58fd93325939
SSDEEP 768:Vn3QLAwwOU5tFsQEZ5fgGM1TnXMqOap6iUjLG:Vn3svbfgt1TnxOqlUjC
TLSH
T14AF2BF32AD95AD739CF2D280F21AB193AEF08167D5841EA8D9DE3D1D01CB29E534B813
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6918c212-1038-44fc-969c-b295096072c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6918c212-1038-44fc-969c-b295096072c6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fba76edc-b32d-4c0e-89a8-767426010061.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fba76edc-b32d-4c0e-89a8-767426010061.tmp
Size 41KB
SHA256 8d48a40514b49f9fbfce81cad140ca1b262f33d1c1d8dfa65053a876b160d873
MD5 16cb0dc52cd83f30bd54957102cce66a
SHA1 934ad0f1f0648b8687d908f3e02190f902e8d7d5
SHA512 3fa55887e0ecbd695af7d4c2b95de4cfa7b6441ec4e2ee35ca93e65b87573d8e69f2d763364c13ac3c1150f32a31e6c24fc26943364bfa7e8583012c84330290
SSDEEP 768:RFdC3kwgKLewwOU5tFsQ55fgGM1TnXMqOap6iUjLG:tC3Tyfgt1TnxOqlUjC
TLSH
T1F81349F298C79937D8AE8783A33D6D529DBCC167F4805A54B7C9680DCD861BFD30A812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff49b355-a297-4641-bf8c-41051261e658.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ff49b355-a297-4641-bf8c-41051261e658.tmp
Size 38KB
SHA256 bb20f0d0ddf2f7e477337918abf144c000cd14511a347254b6d4c2757896f75f
MD5 0e3532636cf7173ee0739d1c670eeb48
SHA1 a02a95a39e5ff1830cac8f584465c2d2276c313c
SHA512 314d501b7a972542f5d90fda129de0cb3b1f163ce0b1cb692f46443cc17f2ff835b6c49d266807fe72d162862003fc774e684257366123fa2490129bbc792365
SSDEEP 768:L/UxvxjgC+93tywOU5tFsQEu5fgGM1TnXMqO/pAaP8:+Zj3+93Uvcfgt1TnxOhAG8
TLSH
T14003CF36AD556C739CF2D380B31AE297AEF540B3D18529A899ED3D0E058B25E530FC17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download