hxxp://www[.]yahoo-cdn[.]it[.]com/setup[.]log

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 16:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.yahoo-cdn.it.com/setup.log
Sample261027-tq96dsvxft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5552	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-650287814-2715975232-1279715623-1000\{A522406E-D545-4556-8B2E-423EB44CA2D1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
612	msedge.exe
612	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe
4640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 992	4640	msedge.exe	89
PID 4640 wrote to memory of 2956	4640	msedge.exe	90
PID 4640 wrote to memory of 5552	4640	msedge.exe	91
PID 4640 wrote to memory of 2956	4640	msedge.exe	90
PID 4640 wrote to memory of 2956	4640	msedge.exe	90
PID 4640 wrote to memory of 5136	4640	msedge.exe	92
PID 4640 wrote to memory of 5136	4640	msedge.exe	92
PID 4640 wrote to memory of 248	4640	msedge.exe	94
PID 4640 wrote to memory of 248	4640	msedge.exe	94
PID 4640 wrote to memory of 248	4640	msedge.exe	94
PID 4640 wrote to memory of 208	4640	msedge.exe	95
PID 4640 wrote to memory of 208	4640	msedge.exe	95
PID 4640 wrote to memory of 208	4640	msedge.exe	95
PID 4640 wrote to memory of 3044	4640	msedge.exe	96
PID 4640 wrote to memory of 3044	4640	msedge.exe	96
PID 4640 wrote to memory of 3044	4640	msedge.exe	96
PID 4640 wrote to memory of 4836	4640	msedge.exe	97
PID 4640 wrote to memory of 4836	4640	msedge.exe	97
PID 4640 wrote to memory of 4836	4640	msedge.exe	97
PID 4640 wrote to memory of 1408	4640	msedge.exe	98
PID 4640 wrote to memory of 1408	4640	msedge.exe	98
PID 4640 wrote to memory of 1408	4640	msedge.exe	98
PID 4640 wrote to memory of 3024	4640	msedge.exe	100
PID 4640 wrote to memory of 3024	4640	msedge.exe	100
PID 4640 wrote to memory of 3024	4640	msedge.exe	100
PID 4640 wrote to memory of 1932	4640	msedge.exe	101
PID 4640 wrote to memory of 1932	4640	msedge.exe	101
PID 4640 wrote to memory of 5692	4640	msedge.exe	102
PID 4640 wrote to memory of 5692	4640	msedge.exe	102
PID 4640 wrote to memory of 5876	4640	msedge.exe	104
PID 4640 wrote to memory of 1392	4640	msedge.exe	107
PID 4640 wrote to memory of 1392	4640	msedge.exe	107
PID 4640 wrote to memory of 1392	4640	msedge.exe	107
PID 4640 wrote to memory of 4728	4640	msedge.exe	108
PID 4640 wrote to memory of 4728	4640	msedge.exe	108
PID 4640 wrote to memory of 4728	4640	msedge.exe	108
PID 4640 wrote to memory of 5340	4640	msedge.exe	109
PID 4640 wrote to memory of 5340	4640	msedge.exe	109
PID 4640 wrote to memory of 5340	4640	msedge.exe	109
PID 4640 wrote to memory of 3080	4640	msedge.exe	110
PID 4640 wrote to memory of 3080	4640	msedge.exe	110
PID 4640 wrote to memory of 3080	4640	msedge.exe	110
PID 4640 wrote to memory of 208	4640	msedge.exe	111
PID 4640 wrote to memory of 208	4640	msedge.exe	111
PID 4640 wrote to memory of 208	4640	msedge.exe	111
PID 4640 wrote to memory of 3524	4640	msedge.exe	112
PID 4640 wrote to memory of 3524	4640	msedge.exe	112
PID 4640 wrote to memory of 3524	4640	msedge.exe	112
PID 4640 wrote to memory of 3628	4640	msedge.exe	113
PID 4640 wrote to memory of 3628	4640	msedge.exe	113
PID 4640 wrote to memory of 3724	4640	msedge.exe	114
PID 4640 wrote to memory of 3724	4640	msedge.exe	114
PID 4640 wrote to memory of 3724	4640	msedge.exe	114
PID 4640 wrote to memory of 2268	4640	msedge.exe	115
PID 4640 wrote to memory of 2268	4640	msedge.exe	115
PID 4640 wrote to memory of 2268	4640	msedge.exe	115
PID 4640 wrote to memory of 3468	4640	msedge.exe	116
PID 4640 wrote to memory of 3468	4640	msedge.exe	116
PID 4640 wrote to memory of 3468	4640	msedge.exe	116
PID 4640 wrote to memory of 4912	4640	msedge.exe	117
PID 4640 wrote to memory of 4912	4640	msedge.exe	117
PID 4640 wrote to memory of 4912	4640	msedge.exe	117
PID 4640 wrote to memory of 2852	4640	msedge.exe	119
PID 4640 wrote to memory of 108	4640	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.yahoo-cdn.it.com/setup.log
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7fff6b94c188,0x7fff6b94c194,0x7fff6b94c1a0
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,4917751538098895324,11958773417981293645,262144 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,3549077129800844194,14935763569977390482,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=2204 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,7984818275664545872,1669323080238296700,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3160 /prefetch:13
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3624,i,10972945302650147473,13940790558334940622,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3672,i,8092867708004129317,5806179261495272124,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3772 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,15548506066853592197,4197215693061997129,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,14615510698235479919,7222904272532242499,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:9
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5260,i,10751087422122369934,5611688418989199758,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3840 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3816,i,3023713193393839238,17619927658360246837,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,17901119487072893381,9654270996539596193,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7084912254256734621,13650018861053099563,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=5552 /prefetch:14
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,12724310843377470945,4772311833672173238,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,12724310843377470945,4772311833672173238,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:14
  2⤵
  PID:5876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6588,i,13637958093713579714,16779792877539518562,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3764,i,12814118792573101594,11592551934973292595,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3788,i,10444336674079001826,8322854643489861558,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6260,i,9506887682063051342,1891752617296810101,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5188,i,12382904246590301158,16617731238368379640,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5252,i,10929166478883370190,3526980837608101734,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,4484181392276314846,4484024781272608689,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:14
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=3792,i,751112110558064101,14395605774908518040,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3788,i,11458469938751141202,1729617236198340294,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3948,i,4288518918104214839,9624222516204057514,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6692,i,16513102476535186431,11227286726382925819,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,13570593547493631392,5744041186213791225,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:14
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7080,i,16437979085760202539,9117409676652166481,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=7016 /prefetch:14
  2⤵
  PID:108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7092,i,11119132440527252850,16351840258138625157,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=7112 /prefetch:14
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=6800,i,11569733709091037916,15951367680537699182,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=5224,i,4601767532529548772,5930458325018956266,2097152 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,1490351851303965657,8562062009074989791,524288 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6228,i,10092652171324342434,937273421756990595,262144 --field-trial-handle=2152,i,5104431299931090784,10748206133338440097,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:612

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0a068d23-8fce-4d44-9d6c-16bc0634d904.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0a068d23-8fce-4d44-9d6c-16bc0634d904.tmp
Size 38KB
SHA256 8438275d4e18a0e293666d75c7a0ff842d4d978516cbaad8cda091c7319c3128
MD5 233e83e7c9795502d40f7b539cae4e9e
SHA1 aa78c062c5005975fe0888a4db64671c6e1eae30
SHA512 f7d0234b57a9768432c8179b418fa356946abbd303d0a98a30fc17d99862f48dd15afac17d67728a08718e126da70a4972240786d251deff746e82b4ed75d776
SSDEEP 768:k/UxvxjgC+k3pGf9c90rhtIyEMbxyJugQVTJ7vvmeOuSHtBk:RZj3+k3iFAyEmxyJJq17vXSbk
TLSH
T1E303D0369C759C3399F6D2843649F783EFF506A384C62AE448DD5E0D168B7AC130B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b490842-e66d-4f61-8019-1887762fa7de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b490842-e66d-4f61-8019-1887762fa7de.tmp
Size 34KB
SHA256 b4ea150d10a20bf819dac831aaadc8bd2e3cdf4926b78b3f522775a6eb7ded08
MD5 c75238d6a8a66b22af0ed4f1c23334e5
SHA1 bcafe492f7f7c5c3da6edaa312db106ae4ad2c9b
SHA512 6ef5bb9f05db76644f71ff83553732016341c43a7907ea9c725dd81b8cd5844207411945d233aeb61eaf4dac267d20e9ae26556e533baa22b9f499f613838503
SSDEEP 768:383Irof9c90rhtyyEMbxyJugQVTJ7vvmeXuoaTZcLHRLb:383IuFayEmxyJJq17vc9qxf
TLSH
T1EEF2AF7298659C738DF6C2907245B6C3EFE04263C8C91B84D9CD9E2D019B7AD274BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5e328288-701e-4e4f-b627-57ef4b5427ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5e328288-701e-4e4f-b627-57ef4b5427ea.tmp
Size 40KB
SHA256 1b9ad1120262f6b3c8b4422dee9c1d69c32de20430c2a90981f619733b66da62
MD5 5ddad171119e4086df5962399351ce7d
SHA1 52542e3fd5c7667895d3f33a499d75df651fd462
SHA512 c3ea473d9c9c5f197a5b6df6634de75318a2fac205ab18df4fc6b7d9af1063aab9d959e2ff7d2cb817c5fa542c67d37a52306b6c82523fb51f9a417e55b324fb
SSDEEP 768:R/UxvxjgC+Q3jwof9c90rhtbyEMbxyJugQVTJ7vvmeXuoaTZcLHNI:kZj3+Q3jlFjyEmxyJJq17vc9qtI
TLSH
T10C13B0329C69AC3398F6D280724AA7C7EFF4457384C51AD488DD9E1E168B7AC174BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6ff73de37e74e04bc32af0dd2dd926bcd2d6c623deb8eb066c65071254002178
MD5 a569aede49695d8fc8b039ab7024fd75
SHA1 de14644ea578b78d3cd08753552602517297fd30
SHA512 b87c4dc8e3e3be51d402a4d2d6166ca389ae05ea059903425483e2dcc38b0f2394d29a7a81921700d62e2a403e94a7b3e6c02c186966742a945996df580c0065
TLSH
T18FD02B71EFBB6C03D184207C100282C01610FC406B6902C4170041B4042C5444313201
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e0217c0f2953c25b5ecacbfc82728d57c809cf5450e9203a48d2faaff8836c2b
MD5 04b3b3f543557524e135a08dac44efda
SHA1 4f856c66c17971828ff8fd245186ea6b1b303bc7
SHA512 a11f6ce9f676e6157f7d9b86de7e7c3f0b7758052de5b00121c54342e363951818cf7787ed1baf39e636241455a76f6b90dc0405f5eaf0361a7c1056c3560c1a
TLSH
T1F5D02B71EFBB6C03D184207C100182C01620FC40BF6902C4170001A4042C5444313205
MD5 SHA1 SHA512 TLSH

Submit Download

0cf5d654-7acd-433a-8a41-0ffae08f766a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0cf5d654-7acd-433a-8a41-0ffae08f766a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41b71d92-55bf-45a0-a51f-39338740a1c9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\41b71d92-55bf-45a0-a51f-39338740a1c9.tmp
Size 11KB
SHA256 160c20f82007bdc4fe252f7cea75819f738b32ea832834c3ae69f24b4a49dca5
MD5 106570abca84defc6b98914a1b07a973
SHA1 321390fd87e810e194ac790bf7d568e35258d929
SHA512 a7c5c926d3d987fb4e209b0acd5a6cf6ad2ae1b62d3288dad6fa4ad4e761630a91382d67e79eae9c1b617bba17f40c4c34ecc32b96b7f0894222ba5ef529b7da
SSDEEP 192:sxRmRfb6/fqspn7zoA8ps9Sn/nEG6+WNm4X/YFnU2GqIgDiJ:sxRmp6/fqspnab/Ux/ei
TLSH
T1C032A656E928AD3B8CCBD219FA55BB13E2F95072A1951F48A7FCCA1C01E76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

673f7d8e-c817-4eb0-aa7e-79c3a5ca32e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\673f7d8e-c817-4eb0-aa7e-79c3a5ca32e3.tmp
Size 10KB
SHA256 31e2c4f133a78fdd8958b02135fe72a63fd242aa64b5f6ab56c81b7b303ee556
MD5 474487f2566ac33440bfab9437546285
SHA1 2cc31014012e5f81c260aa38aacaf12ab09adad7
SHA512 63aa83901973454348f5a8982a3e0bf73aefa44d8e56eee8a193ce7799c6a6c85b214515815dbca2ed6d2abb373d17780a0551bc2d13ee22bf09763fa987f450
SSDEEP 192:sxRmRfb6/fqspBTzoA8pRs/nEG6+WNIYF5K2GqIgDAJ:sxRmp6/fqspBC+/UI4o
TLSH
T123329515AE28A93B8CCBD21DFB55BF53D2F95032A1D51E48AAFCCA1C05E76DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 54KB
SHA256 3ac4d3acd1c0f478372c86ee0c6298de01178d221c3173a583802f11cceeda06
MD5 18710ae20ac7fcfb9cd860002434c7ca
SHA1 c3b18985ef8df7abbca38be75c6112ac89e4b062
SHA512 af658d68badb6c98e1371f57d01ac37d0867ad4b4a58ce84b3bc27c632e17ac8c4910c9e5c001191f5b30a83aa5953f7b9a64708b41b32f11e8fa1a280030114
SSDEEP 768:T66QZt1cIXDbu8GbTqBtlj0M7OE4KpvfYvo7Y+QZWkXvXv5Jm0uVrhE0Cof0T3mL:T+ZkEWTQ9OhKlfHAAg7m0Ur+0CLWkd+
TLSH
T11F4302138CE5389FE4FF21809B81E2DDD05C1B8E6881BAD9EB6B5B5758803750E1B526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000080

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000080
Size 346KB
SHA256 0f8a0722302d1b8e1050f1c7882af2c0feb056752c3feddcc0b4316891d60d44
MD5 cffe89fe76f974f10f591767becdc8ea
SHA1 63d099b0fca6062bb726f3c8bbbc704a1611182d
SHA512 69a6672dde71770eef237d7bedfb1a82317a68339abd399505acf995dc2132b0ef4e4fbd36b8453c8b9556877ba778722662b901166c77ef2c38a8d88a0a8a3d
SSDEEP 6144:kEen5NJZWrGd8LABzhu4/tZvMBhSoAxh/u0jd33ScBSNFWMI+t4A9AdHgndKrRqL:ktLWrGDdlMBhSoAxU033ScoNFWMmgnEa
TLSH
T1E774230B2E1DCA322357475B503E382845454A294BCF27921B689BE8853C9FBBEF51DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f597bc9fd99940f05d772968b47b3415c41132b2931327321a17ea4a58504cbf
MD5 27c2a67ec4c685425f3b56c36c75258e
SHA1 1f60982446ba7caf415190e61f8b10dbf3630e43
SHA512 71846b027436d74a4fbcd91cefd78b064c2b750f23534f1b33c6a39cb9fe5255cabf65518c52040af79a50a9ca2ecc30f25831e12bfdcd893004bd2b15f5d76b
TLSH
T17E81967957B40C01DB9E223296F060BB3FB4EBB15AC3ED537418C838545632A22EF088
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 484be223a27b615d56d03dbfa242834336e590ebeecae60670b422a748d22800
MD5 a4c7dce546337945d2a9fa9525c578cd
SHA1 cfd401ec8d38735a39bf1f559e4048d7c2120071
SHA512 3452cef6af13621f6b024fd91beb6c87b8368cd0fccc5255fab61cc9484a3090a048f1e56f559053d816ecd13d9c99ce3e946f871f3f5a957ea3722e41429fd2
TLSH
T1B9612F7A6B781C52DBAE2271A5F061B73FB4D7B2A6C70D523818D479506A32602CF18C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 06a712431b054d986d737770cea02d8ffc1c67ea2bd1efb3f61dca2bb74e4ab0
MD5 6b5167d061a699963c27311df093052c
SHA1 fd559c85150031c2fc37c454654920662a88df2e
SHA512 bea8b0e050740c356972aa1554e8a96ecec7c3929cdd867eea1ad73e9ef8dabaf4f31db2961d17dc83fc501464f184ff14301fded115e3c23a415316f1ddaaf0
TLSH
T1F3613F7A6B781C51DBAE2272A5F070B73FB4D7B1A6C30D533818D479506A32602CF18C
MD5 SHA1 SHA512 TLSH

Submit Download

22b074c2-3d41-42eb-a527-4957bcdbab8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\22b074c2-3d41-42eb-a527-4957bcdbab8e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1d232f62-8b71-4a2f-9218-7b2fccd6c3f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1d232f62-8b71-4a2f-9218-7b2fccd6c3f5.tmp
Size 6KB
SHA256 d81db7adb9472204ebfdbdbb84e5c3c22724568228612f912d84ee3b0a67932c
MD5 9522f7fd22581d4be5a6fb474da7173e
SHA1 1bb677fe97fb3f4d1e8f6463e93dd4912dfaa2ba
SHA512 49fc88c6fc40764866ede5cc8cd1324f5af3d995233cfbed28f897c70ea84cfc1d78a8ca7a2f5a602b97453489530713f96b82684a7ccaf604808a648d7769ea
SSDEEP 192:DCnEkYo0pvfe1OaVZaUHncf1mEy7t5UB6xROVf:DCnEkYo0pvfe1OaVZaUHnw1mEy7t5UBN
TLSH
T1DAD1BFE7C7E9CA2D895156F09A187E2FCE1D0716431C3D2A8DD4AE0BE3E2471E11265E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

571a93b0-9c43-4404-9765-fb4c18aa8acf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\571a93b0-9c43-4404-9765-fb4c18aa8acf.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 dfc06d4a599a017e89abdc249d72ca9461cc0490afcd410c96fdf4dce535ecd1
MD5 b5a27828859cc2acd835a9bfb359158e
SHA1 4ec323f248afe66218a305a34258d4db05aba5f1
SHA512 94cf5e35c9e37361fd22bcd746b027111d8a20f0c87ec4f77d1de401d8f12d16b852af86eb0e43b6fb6bd86cab210363421612ae4f450533b0e1932d9126bb74
SSDEEP 384:+0e2P7wfCtgwiFf4eKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVS29aSRnNro+Pb:+l2P7KWgwef4e8F1+UoAYDCx9Tuqh0VA
TLSH
T1A8B2DA2F640CCB7E4FD04A9DAC196EDB6DAC02C796588D4047FE994C03C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c5bdcac1-6aff-4d30-9628-491c562af86c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c5bdcac1-6aff-4d30-9628-491c562af86c.tmp
Size 10KB
SHA256 9b0e49cf3b0c9caf587e64ac4752d9e0862fd1d8523f0d51b7312fe0395681cf
MD5 fbb0a2905770428fecdaf7b104655237
SHA1 c228c1705dd31ea751800ee9302dde07b9822ef5
SHA512 7a39182eec81dbdb546283d2894e540c6c7c71030522a2f585cea071cd7bd40fce0551ec0195448fc6e0f60d2ab082d5ba26d422a072c8ccbf058cbe43b4476b
SSDEEP 192:sxRNRfb6/fqsABTzoA8pRV/nu6+WNIYF5K2GqIgIJ:sxRNp6/fqsABC//jI4s
TLSH
T155329515AE28A93B8CCBD21DFA65BF53D2F95032A1D51E48EAFCC61C05E66DD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1320c73-e56e-4d50-af66-373e05030cb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d1320c73-e56e-4d50-af66-373e05030cb2.tmp
Size 11KB
SHA256 471166d77b08c3b806a14310c4e602d3cc144b1be28bb170422f90889f4572a6
MD5 348c207bc4bb3c03f419a8610a81a38d
SHA1 037c1c4687fea8632b399eae9d0c586f2c1dba73
SHA512 4dcc803772df63de9408496d510860f0ae5a3bc647eef6faabd4ac0c3c9647ed5191359424b84592b6c8c313f63974f335166c6b2d02aa6565982149cd67c6c3
SSDEEP 192:sxRmRfb6/fqspnAzoA8ps9Sb/nEG6+WNm4X/YFnU2GqIgDiJ:sxRmp6/fqspn5//Ux/ei
TLSH
T1C332A716E928AD3B8CCBD219FA55BB13E2F95076A1951F48A7FCCA1C01F76DD120380B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

342c643d-4f5f-49c5-a1a9-3b87bd030108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\342c643d-4f5f-49c5-a1a9-3b87bd030108.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7c963c0-21f4-4ccd-af01-be3f20283c8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a7c963c0-21f4-4ccd-af01-be3f20283c8d.tmp
Size 34KB
SHA256 f47f6803978bfb5a7a0dc31bf30d9c706fa9c5e1c407ee65fbee0b01e89b8f56
MD5 aea856b9b7f535de6346807e66ccd65a
SHA1 04ffe1ea0a1ab8c120a00702207858d74cb45daf
SHA512 2e1dde61fa412f1768c2ace65b250507808208a7dfa0b21aa62e26db17fc2ee62f299a3e3c3c7a87afa9b268c08384f8371de19ca4260ccdde96c9674693fa6c
SSDEEP 768:G839nof9c90rhtyyEMbxyJugQVTJ7vvmeXuoaTZcLHRLb:G839SFayEmxyJJq17vc9qxf
TLSH
T1BCF2AF7298659C738DF6C2917245B6C3EFE04263C8C91B84D9CE9E2D019B7AD274BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0354373-733e-472d-9458-3115169a08a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d0354373-733e-472d-9458-3115169a08a1.tmp
Size 41KB
SHA256 694c5173205adf2bfb70491923c2d47586d305e4d8f669c7666abb0744b24956
MD5 ff38a30b617c1ba431b76467933eb744
SHA1 5d510655781eec44dd2323c1cef0cfafc13195c5
SHA512 db497b5dd13cf5bfcfe348846541cd182b07f4984a60acf9221b3a30731a9efaff016f04c857a9320ab8d8ca15859c4437c5491a90f663b3b1ce41d66f3a091e
SSDEEP 768:3Fdz3kwgf1Kof9c90rhtKyEMbxyJugQVTJ7vvmeXuoaTZcLHRLb:Hz3e1fFSyEmxyJJq17vc9qxf
TLSH
T19A135BF288D78837D9AD8783633D6E429EBCC163B4855680B7C9591CCD472BFD346816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1097a4c0-26fe-4dd0-bdc0-3fd5ca55195c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1097a4c0-26fe-4dd0-bdc0-3fd5ca55195c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f3f7777a-28e8-4082-ad66-523f5d7e0a96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f3f7777a-28e8-4082-ad66-523f5d7e0a96.tmp
Size 37KB
SHA256 0fa88911357ff5cd21fbba7863bfc8536dad3c1086ceeff5f02f08312c465d9e
MD5 5cbc1801494cbb08392b5088fd7cd278
SHA1 ddd81bbaa41ea6a133ff419c9e480549275c6943
SHA512 35d622c48ce7fb7b6dbe4f0e00fbe5a9050270abcb20b7ab40383f422f058753c2a60785dd89e69c7f854150f02ba4549413282f8ac712010648f1dafd17ee04
SSDEEP 768:p/UxvxjgC+k3+jf9c90zyEMbxyJugQVTJ7vvmevfSHtBk:cZj3+k3IFzyEmxyJJq17vhSbk
TLSH
T10703C035ACA59C3388F792843249E787EFF506A394C62BA485DD5F0E128B3BC5307817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download