hxxp://files[.]catbox[.]moe/t47cyh

Analysis

user interaction
yes
max time kernel
66s
max time network
67s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://files.catbox.moe/t47cyh
Sample261027-tzx77aea57

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5180	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{FCB8C3D3-803B-458F-B6F9-1A27C9C71818}	msedge.exe

Suspicious behavior: EnumeratesProcesses 53 IoCs

pid	Process
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	5660	taskmgr.exe
Token: SeSystemProfilePrivilege	5660	taskmgr.exe
Token: SeCreateGlobalPrivilege	5660	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5172	msedge.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe
5660	taskmgr.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5172 wrote to memory of 4608	5172	msedge.exe	85
PID 5172 wrote to memory of 5180	5172	msedge.exe	86
PID 5172 wrote to memory of 5820	5172	msedge.exe	87
PID 5172 wrote to memory of 4584	5172	msedge.exe	88
PID 5172 wrote to memory of 5820	5172	msedge.exe	87
PID 5172 wrote to memory of 5820	5172	msedge.exe	87
PID 5172 wrote to memory of 4584	5172	msedge.exe	88
PID 5172 wrote to memory of 2932	5172	msedge.exe	90
PID 5172 wrote to memory of 2464	5172	msedge.exe	91
PID 5172 wrote to memory of 2932	5172	msedge.exe	90
PID 5172 wrote to memory of 2932	5172	msedge.exe	90
PID 5172 wrote to memory of 2464	5172	msedge.exe	91
PID 5172 wrote to memory of 2464	5172	msedge.exe	91
PID 5172 wrote to memory of 3448	5172	msedge.exe	98
PID 5172 wrote to memory of 3448	5172	msedge.exe	98
PID 5172 wrote to memory of 1544	5172	msedge.exe	99
PID 5172 wrote to memory of 1544	5172	msedge.exe	99
PID 5172 wrote to memory of 1004	5172	msedge.exe	101
PID 5172 wrote to memory of 5392	5172	msedge.exe	105
PID 5172 wrote to memory of 5392	5172	msedge.exe	105
PID 5172 wrote to memory of 5392	5172	msedge.exe	105
PID 5172 wrote to memory of 5980	5172	msedge.exe	106
PID 5172 wrote to memory of 5980	5172	msedge.exe	106
PID 5172 wrote to memory of 5980	5172	msedge.exe	106
PID 5172 wrote to memory of 4208	5172	msedge.exe	111
PID 5172 wrote to memory of 4208	5172	msedge.exe	111
PID 5172 wrote to memory of 4208	5172	msedge.exe	111
PID 5172 wrote to memory of 3592	5172	msedge.exe	114
PID 5172 wrote to memory of 4780	5172	msedge.exe	115
PID 5172 wrote to memory of 5108	5172	msedge.exe	116
PID 5172 wrote to memory of 2688	5172	msedge.exe	118
PID 5172 wrote to memory of 2688	5172	msedge.exe	118
PID 5172 wrote to memory of 2688	5172	msedge.exe	118
PID 5172 wrote to memory of 2408	5172	msedge.exe	119
PID 5172 wrote to memory of 2408	5172	msedge.exe	119
PID 5172 wrote to memory of 2408	5172	msedge.exe	119
PID 5172 wrote to memory of 5308	5172	msedge.exe	120
PID 5172 wrote to memory of 5308	5172	msedge.exe	120
PID 5172 wrote to memory of 5308	5172	msedge.exe	120
PID 5172 wrote to memory of 3644	5172	msedge.exe	122
PID 5172 wrote to memory of 3644	5172	msedge.exe	122
PID 5172 wrote to memory of 2472	5172	msedge.exe	123
PID 5172 wrote to memory of 2472	5172	msedge.exe	123
PID 5172 wrote to memory of 2400	5172	msedge.exe	124
PID 5172 wrote to memory of 2400	5172	msedge.exe	124
PID 5172 wrote to memory of 2400	5172	msedge.exe	124
PID 5172 wrote to memory of 5592	5172	msedge.exe	126
PID 5172 wrote to memory of 5592	5172	msedge.exe	126
PID 5172 wrote to memory of 2732	5172	msedge.exe	127
PID 5172 wrote to memory of 2732	5172	msedge.exe	127
PID 5172 wrote to memory of 2732	5172	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://files.catbox.moe/t47cyh
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x210,0x7ff896e6c188,0x7ff896e6c194,0x7ff896e6c1a0
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17896252579685035794,16885466666808703,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,5433438321982624249,2800636082405612675,262144 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=2592 /prefetch:2
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2320,i,17922783534559897516,2242892005175996595,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5692781487756139673,18250868690747237164,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,18192354665853812697,14224371378433333228,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8828223557438319420,15183243075397076277,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,18155827626975756858,4597201199332729607,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9717966029244273835,15047481914473954267,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,9717966029244273835,15047481914473954267,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6140,i,7832530146568040596,12423093657721915046,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:5392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3564,i,1903538374495956703,4198487439742998686,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6132,i,2924782627214177264,1878892878711600329,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,17745723669025967140,5706636768392759182,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,9826960026368632718,5272510499468444147,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=564 /prefetch:8
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,5363688041317646286,5345751626786183149,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4964,i,10186784793911209848,9517475860002832627,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5404,i,11394982815391999591,6527574322471214826,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6212,i,3655820328346878409,11750105911279895827,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5720,i,7327381138365875780,4529500507166745590,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,12221702681270882194,6510227373731730934,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6836,i,12141498389826327121,7651372475380502589,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=6872 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,1387120747917726692,7649378830676286506,524288 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6036,i,7153905982994967608,10530791533090266382,2097152 --field-trial-handle=2596,i,8926021809833159776,12016354290628611297,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1616

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30b6b9ad-65a9-47fa-a81c-89c2ea5141c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30b6b9ad-65a9-47fa-a81c-89c2ea5141c3.tmp
Size 27KB
SHA256 4bc5224fbf12337dc493cf320bb71f9cbe7d981a7d271ba6952a34ebc4160d40
MD5 4d79cc762510db813ea7760b2cc41082
SHA1 af3ea49d0be2a6a08de119b0e9e0ba69dd0d9bd1
SHA512 7964296508a4f2286d996a0027439904a57e7fb317ea80067ce498d714def7848473c614e6f3b47173f7ed2206c51a7719a2f7816cb852bc4db81d96a928df62
SSDEEP 384:nWiFzQkUSv3R3sNa8TUNTUlI445mg60oK2fMBVp1yqcVyKSKuovaTZcwgL/7IzIA:9Fdh33wgY+BBV6dwKuovaTZcTLQ
TLSH
T1BDC24C32E898DD77DDFB8EE5A34A3A43DEE04253899C4AD4D9C95D5C00DB1AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

485d8296-2b30-4a63-83a8-e418d5f567bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\485d8296-2b30-4a63-83a8-e418d5f567bb.tmp
Size 392B
SHA256 705a1d486fe37e339a9d073739bfe5bb4bb138bd58065e4c028091b0da42fe7e
MD5 ae111202e42eac889ade2c1bb2e1aeb3
SHA1 5059ab516cc38ef72d576d3d22e7718a1a87693c
SHA512 e4deffb302c6d08bf2a3c953bfb0358236a7f66fbccf80145907f45fb72d44cfb1f68be56d70764c4655e91b78ec3fbd367b7d0f58f32c127965f2452da55745
TLSH
T196E004111341117DC01403F510C75F3057D1D03001F303050531017C1C133001730F40
MD5 SHA1 SHA512 TLSH

Submit Download

4c120964-1b4c-4c62-a7bd-59ed521fb741.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c120964-1b4c-4c62-a7bd-59ed521fb741.tmp
Size 25KB
SHA256 01746d3c8c4dd3f61a83660f8c3a53b3041fdda2a1af9510a977e7c1f6872fce
MD5 cae24f1402f372ec269c49b296a415e5
SHA1 af37866fc99a39a2a0416ec9189bdd3223d209da
SHA512 3d34030e6fb86aea5a8f69a04f76ba18bf6160bc2470eef360f5dc68e7ee8c5f2f67ddee9fdc752b51b36d45c620637fcd5d657655a264141c74afdfe5cd9166
SSDEEP 384:n6iFiZcI63sNP8TUNTUlIm25mg5hnK2fMBVp1yqcVTKn7O6R2FeoibgL/7IzMoc:xFQ63KwgSEYBV6dTKn7TRn4D
TLSH
T1D9C24A36DC94DABBECFA8FAAA74A7A13DEF05163859C4AC0DAC81D1D009759D1307C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

1d1670b4-3d28-4fad-917c-2cc3cabb978c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1d1670b4-3d28-4fad-917c-2cc3cabb978c.tmp
Size 16KB
SHA256 c120b2c020658043bf59508a95841759b3158ee57cd61ac3758b3be9544ac497
MD5 97e21b949ee23b379f5c4fa379aa71b8
SHA1 ded1865a595fd5cd8ef50fbf70519253c806d5d9
SHA512 4aeefb5afb21388348329da72049c0e18cb68720424852265b48deb6b913b6aa57ec33815a659b6d0a7ad029d4d4daf7ca771be62a48c5b32ee44209b4f5b0c7
SSDEEP 384:sxZDAOF/fqscOZA6Bic+HfDcn/FEY6bNY:srvF/fSTHHfMFENY
TLSH
T18A72D712AE24D97B8CCBD519AE35BF51D3F950239C950E4CAAFCC91C05EA6FD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1edabcd9-a330-4899-ad33-304087efd743.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1edabcd9-a330-4899-ad33-304087efd743.tmp
Size 13KB
SHA256 4c1d545c97d9a76412b2f20e77b7de1d17787318b663b9f80e3fadfab3287a5a
MD5 aa276b6d0775e8d090d89746085f456a
SHA1 d858d3746336a94de01bc6aff28395f89b7bdfbe
SHA512 10d1b1eaef9768dbf5504704f3bd77aa97737a03c0f7e813e833addd2b8537d84ce072befca784e8b097221f5e6b61a68412ea0a9967900929dc6bf8f741ba58
SSDEEP 192:sxZDRrWOF/fqsjgQZZRuE9YsPodp4sgPHfu6+WNPDnqDIc/YbIGt1YSXIg5t6J:sxZDAOF/fqscOZQEzgJ+HLDcn/FEY6b2
TLSH
T16052FA15AD28693B8CDBD119FA15BF52E3FD5033A4940E48A6FC8A1C15E7ADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69e1f921-57cd-45b2-9428-01a999596330.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69e1f921-57cd-45b2-9428-01a999596330.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d5ad92c-3fcc-4e11-93fb-6b63568e4463.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7d5ad92c-3fcc-4e11-93fb-6b63568e4463.tmp
Size 414B
SHA256 8c42c0d851b24e3d0ab2471ef70705da083077f673d423536b72eb5406a8c631
MD5 42d70f591baf8acfb2cf2bb17eda0e7e
SHA1 dd93c9caa27047bbd5e59cbdd9987159f39d4eff
SHA512 f843c6ea2c7e8d48d32f28072f7fdaedb22ea40187699f5f666eea1dcdb8d25f00b206500102d812c25bcb10b134c5b89b4f226c41b84617ebf981d04c589d89
TLSH
T1B5E02BE9C855AC370CFC0B1850540685EA4103572A80C88F3B3C801D8FB1A7741868AC
MD5 SHA1 SHA512 TLSH

Submit Download

f_00004b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004b
Size 120KB
SHA256 ad58ca73f2b8f132ed15ee724e1731cbd7510af65eea7ef3c93e5ac2a5ca3541
MD5 7e2cf6f35e336618dcedac5730c99c6c
SHA1 3233e5cb89aaccf454652e61ab18672211f9c828
SHA512 ef54e061a31a472968702739f08552eb9eeed7b712affabdb8f4fc66c3a285d6f92bc9701c984d23738e1877332b06c58c690c3c4666d7ef19ddd538a6c57420
SSDEEP 3072:sQboBWR4jxw4c570csihKUJs+iOYmoIDT4LPd2ZeYNscm:9oBWi2570csjUK+iOYmr3yY3m
TLSH
T13CC312FB58A89632F2AA0AB4355A73515DA3762F034C4BC597B130D16AD2E80D2B6F0D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004c
Size 31KB
SHA256 a258dcaa34219a6253250fd12bd905eb92d8faf13288b909af829d53945a8e86
MD5 c229b974a1531c851b4bb7c133930dc0
SHA1 7fb9eed0376d3812c03174d5fe740dea3e1f5249
SHA512 ea267a9005fedbbf2ef9d4137f580451ea13449ef6bd84f5685194d2cc054d7c256758d3cf3ba868ba0ec77197509ca32931af4fbd82bbd38b2249c54ee22cf6
SSDEEP 768:yMpfRDTUuuCnzekb80O5Q1ul718L1fBzrPFCW4l0sXtDkk:yMpfR+Cnzek80O5T7I1fBn9Cbl04Ck
TLSH
T163E2F26A379BF03082C70CA379D7A5C2B11174B8DCFDD176581C599D24E86B3971AE0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004d
Size 122KB
SHA256 ef1a2f53f01371a3c7a10563c4c4ee74f1a3a211ca6f4aceb71846eb9a954e49
MD5 d4e144a02d294475a1f77a7d3358f484
SHA1 9114582dbb3ba3e960c29094464d77c741c721ab
SHA512 fc97f0fd1182b07c403e89a2b24a13ad906d92e508b9d73094a49bda3b70431b4956876169e3541ef59327b0acfa5b2b556e8e8e390d6b2a0e91c3a3f5a040a4
SSDEEP 3072:BNXqGH+MBVnUMJO1s3+nLHOfhXUmw6FNrrJh+r7n+:BFZBzJO1hHOZ6UZrJh+rb+
TLSH
T1BCC3122FBD7164440B9E63E244C0844365EF760DFA5623EF167FA863C7CD6D8146429D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004e
Size 101KB
SHA256 ce8b5b974c2a6468f5130e3c3d7ca9e0d7097a14e52d0858cbcb918ef5754088
MD5 9357569c4b378556d6eb9e7ebeea7f90
SHA1 a6563977179b1738a8943b807e9f0b1bbf5066c2
SHA512 7a4e9fd6eada3628d8520847cf7d4161f70bfdcbc1b648f74cf126eb38ca5ff144b0051ad318d196bd6d765011d44d81a82b762c20a2f4f5a040016ddfd888e6
SSDEEP 3072:8pl8y51AZoKKcpF07XRUTGt438o5KbUGzV:8D/xKv4OKdjZ
TLSH
T198A3123507B825FA188D64FAD1D570EC63F2FA8548B120BA6128F7DA7D47F26601ACCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00004f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00004f
Size 240KB
SHA256 8649501bbb4c56331d227519c54e9206a3aa439d78a1af45c9780ba117b3ea1d
MD5 19eafda434f55caaf65b216f0cf4d781
SHA1 f13f8764f6622467b8273852025c59fcf82cd04d
SHA512 a2eea8261470c41244a9333a6259767fc714787111ff0c95b20eb3ff7bf6d9d99a8e7df360f15db76abc7fe4ea887d2ac063928f76201217d99a154d97c16d7b
SSDEEP 6144:ir5U36J8oGUFPJVfttDey7YDRDE9oAuC4zbEfckCjcGNSZ:iUW8hUFjLYDRnAozAyjcGUZ
TLSH
T1D33423A35564527392C8E257138EC74B84C2D79E78D949B45333D8F2FEB00986D33B6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 20KB
SHA256 3aacbcd81ad6ae1761ea657e53aa6ac03e279cb47cfc2fbd6524bde7cce68b17
MD5 2af2be0651a488d15f87aadbee775f4b
SHA1 6da37d1d9fd929a8c79ce771dc565d2f554e9d9d
SHA512 d532f7200f9655de22309bff4d2676a1c72c7d04ef5e50e66c4c9de71f4ff835bb8ff82066014fcdb21d88ce04a43f96e7e4260fd651f47736cb7e365ad25651
SSDEEP 384:R+ouqO6S2dxUPYYchyHCYfJFLI4+i+Qzrao5atCv5+JQ9TU2M:RtuedxXDfIFLI4xlz2catCvMJQy2M
TLSH
T14A92D06ECFAED5241F5B1ADD5ECC2AD9066AE5DD6CBE53C7AB723270D9C0D408809230
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 16KB
SHA256 e6f8deeeb0e0a44e1325dd17247f28ec491018b57e301ad28e8c736c1ec8561e
MD5 fef434088fe7570529b771a4479903cc
SHA1 ddee0bf726ca69a1a7e62e0f9966b09260bde209
SHA512 abf196c2ba5f1ede7bdc6858225cb826e08ab98c8120162d6ec59e79d60a085e65fa02d1e2f0da8d38d3b1801667570f766de2a4c4c087bd87536bc21404c0dd
SSDEEP 384:yi2Y0hiz2XYMavYqbmNORgRMe9S/JtJIeCAm6Nojla69:y2vJbNgRMOS/JtJIoNo5aG
TLSH
T13172E047FE524A195918AE2692F03F2C2520B4C7B229EE92D55FF1249CF17AC18D076B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 36KB
SHA256 1e42cbbf4a86037acb0fa0d7ccf125044fe601702deb8a16bb8559f73d7aaab3
MD5 7889adc4f9b1c53564343fca9feb7829
SHA1 4705851099e44deedb71c29acdfc4759f61bef13
SHA512 8a4c08ea6e9b26222d7283dc9831d37e6b0e812f2ab1375117957b544e7fc25d9f0cd351d5d5c6dc74bf3018b92f6a77dd689c1a998f2f426ae50609f31038f1
SSDEEP 768:5wC3LLklTEgThARwXCfNkpRmRMWnjgt7u5USPKVnX57OTXiig:6C3LLkhvuRwXxRt5uKSPoX57OeL
TLSH
T1CFF2F128655C25D8180E23CF9FD76960785A03E12B4AF03348EE165833B376F9DEE782
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 39KB
SHA256 a3a6b80605e30311dcb005105df72e46ccfafc0e376efcfa142e602017868fad
MD5 0d60cbeb04ca1a5b23cbb170dad13270
SHA1 be761f6dca8764b42c197ba4ae8098ac32ef6819
SHA512 1a67bbfb8ba0112559b44c20c1ed5e2e5274e4330b64a85c782809784eeae092294022ef1a329e53b4f817bc31d43d95ab3b90827f8bcf5018c9c6015202765a
SSDEEP 768:BpFnjXMUSpo7dvwN3oTAtfRbJ5o4isLz4Z7vb6w2rmhR6UlxT+sMWh:ljXf0nJm4isLz4Z7V2rmdlbL
TLSH
T191030290A4BD1AC038C17785257D387DF11DCFEEC2201EA9E71A87EC0EF9232995A476
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d2dcbc03-bc43-4e8d-9068-5bae5a013f47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d2dcbc03-bc43-4e8d-9068-5bae5a013f47.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

c5220e9e-c7b5-48f7-a851-887aaa288cac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5220e9e-c7b5-48f7-a851-887aaa288cac.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

f092aca7-4bd8-456d-bad6-cf9289f58667.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f092aca7-4bd8-456d-bad6-cf9289f58667.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 b8c4c782b45c71c69d844c6770174837da171b258242022d3e55e6b36e830b2b
MD5 9aea3def2134497f61699311806b6f3b
SHA1 78f198fd076191c204b06e39ca82f9f5567e4e17
SHA512 a8fbe98b02dd292957fc6fc2b18e6d3ab1eb2c1ecf27fe1d5cd500d5849f0c7440a405f0bc7415e4ef680ac86bdeb88977451646d1dd156aef2ddd79c9b17f6f
SSDEEP 192:sxZiRrkF/fqsN4QZZD6zodp8PHfC6+WNGYbIts1YSXIgj6J:sxZiKF/fqsqOZDBiHXGFCY6j2
TLSH
T18542DA156D28A93B8CCBD209F755BF53D3F95033A0951E48AAFC8A1C15EBADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\17b78c44-d75f-4b1e-99a3-388539ad9899\index-dir\temp-index
Size 1KB
SHA256 c63a7f3f28dcd328e021210f5d34ef7ac2866700c181ed211f26dd6846defcc3
MD5 6410ece950d2c60b47088bd940f1c785
SHA1 762c06846634e9a4907035b4b6f6e2d6c9d39264
SHA512 b1a212217c96db92dfd8be8e03e899d7c8615fda6a2c0cdcd16411c85d6b4a180e416c3249ee26862fff0368f17b1e21bd22420fde67c1f6db942ccb113af1f7
TLSH
T1DF2125460E934E5BFEA47275043D585B7330D2DC13507A4F13FEA1399C57704BD86994
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\17b78c44-d75f-4b1e-99a3-388539ad9899\index-dir\the-real-index
Size 1KB
SHA256 da4ee31767097c80cfc3c27fc4f1a026cf3c1c0baab49b79c74c1b6f689a5d30
MD5 b0c33109b68270e34dbd7c5480c0ecdd
SHA1 5bd73463d52f9d1e155c1f165963e5497ed89b7b
SHA512 25d8ae7317b7fbb679b434c7ca2a78595f1333714d82514428654a18ed7b69161e9f6bb644221c5ac70fccd7cadf7a2afb3d0554de1f8a8b9f7b9670d1a408c8
TLSH
T17721846201631B67FC44237649AD68977330E54853443B0F63E7A03AEC82B80ACC6EE0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\edbc24c8-159f-416c-bdb1-4d2d00ee1854\index-dir\temp-index
Size 2KB
SHA256 3013cd4fba3d39e426e8e2dbc0d7e39757e81903de6d7e1b900f05f187ad4a64
MD5 5d57a52d7670da425a7feb9b915c65b5
SHA1 4c1f2ce5cd9c70eff62d13e84ceaafbbcd6c6e4e
SHA512 ba249ab8583d8843e8ce05f4850004a4f15d09f57267952b9715c6b3e705f8df413d9b979c3d2f1ea6a534697e62ea00df0eab53e2d2b1cc9292511aed5d56ce
TLSH
T16B51B68C5C0B5B25DC6912F12DB71980337908DC2EB84E4768DC4638B8C79AD69DA7BD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\edbc24c8-159f-416c-bdb1-4d2d00ee1854\index-dir\the-real-index
Size 48B
SHA256 1a9cb1c384dfc1207632280a3df8587a0beef7de92d8e38e78d8a06748817bbf
MD5 21c8ddaa1910b499b614cd8ed6832777
SHA1 510afbe389973f0dcf13415dd38917219ea3dcc4
SHA512 74175c0aab80ea5b8cdd6bc470b45ce28bb97b40426091e7fce26103022e0455ec56a22aeccc29ef6a664b325fad72202d4bc4049c2a22d2ffe33ce978b373f3
MD5 SHA1 SHA512

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 488B
SHA256 ec956f3f8427f5b484245a9b4121bf7fa37043bf394da0524e373c24359a5822
MD5 c6f5401fffda1072e9f5deb5d5d3f850
SHA1 7249ea93cfc6b9d61bd4229dddcda44c7f288122
SHA512 8e389861d6a3ae0f10395ff8606e4202c8a8dfd80eed8d810623079c0499f35f1c13e0dcb63492055d21d81674e0c4b9a42e0f5639502d351777dadabc2b891d
TLSH
T14DF0DCB22FF32510F95BD3E2687000F70219BC1A8A54AC8E609FB19350B33692098C7A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 386B
SHA256 751f4e7453d2514068d03bca831b56090c1966644cea016a864a3a102cb053aa
MD5 d676a317a637a23be71705d6bcfc4f31
SHA1 9446b39d97ad8bf7740a20ea36e7f5856be36ce5
SHA512 95b0721224ad40e2e4cd6760396dc4627f6065017e888c4d6818f77a5515b97cf7588dfb5e094e68a03fa1fb2cfd83f2fbd199f86b32fac219f58d840d59406e
TLSH
T172E0F8726FF22520E897C3C9AC7004B2020A786A8624AC8E109F518340A221810A0CAE
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 161B
SHA256 b8fcd67b695e3d31deaaa294fb87b944b8dc69bffadb9b2d3cd5430a73ffa641
MD5 db69e214a9da523a12ffcdafe2037603
SHA1 202f80ca595c151cc76230df206839c71e26e5ea
SHA512 5a290068c21ed19f643925ffcc124bc14f4f5b13f68107c1ef285e157454e84a2fd753d3987c0699585f668ebe9c36801c310c5dd075d3835051c91b8ac7eef2
TLSH
T1E7C08CB71FD42400EA42C3D9D02198AB6327BCCE4A69ADCE90AE5583916611864A2CA9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 259B
SHA256 fe8a50c2a7bad038f63e93fa6267ea3d11e1bfc87b9b7a7a544270325f3014b6
MD5 29953ac78da187079a158f7bdf114eb7
SHA1 0ba0c43f6ebcfdd1e7a52baf02e3a811497c6f37
SHA512 d2e5b0d20cd5e35c7d55fdc2e98f244e93475aec0adcd25553bb0dd58b36accfc3b93213194f38fb4c4de49c806a6c2031701d92a4a08bfdce5213c7273ae62e
TLSH
T174D095732FF13500F646C3C9D47144F643177C9D44246CCE509F55C392712045060C6D
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 95f716dafe86b23f32e9d561dddef87efbd60196e659c9703c6d6a55f76abdbe
MD5 c36c80d86b3533ba64fedd6fc7fcc8e3
SHA1 8116ae22d4cc4144ddae3bc209245499d96931de
SHA512 25a9ab771609bfd76636a8b00c75d033afb41bb5b531ca2a1567864a61d98124d7ee18b8eedb083bbd8b52f49171478a4d616bacf12e969a47d85290e8d5c10e
TLSH
T1CAA002508543120DC0D002F6B99643F93231CE60C60E7692D0A80067ED687604332650
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 edc08c52b222d1f4b1f21351a20999f85a816953e3117cc067318d66e202d306
MD5 ace7a95fbf954711aa452de834807577
SHA1 d6debc3a44232562a391ed8b3e1304895d12c395
SHA512 535c400abf3e498881bdca269109599f314dc01396bb054f3d0eff4ed2f212a12371e6dd5110efb58ab8536f85268677ec69eee4a836e234e4b3d7abcbbfc98f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 53bcdb33e8137b3626acb2702d5a3754e899be362a59ba891b4db38b47e39465
MD5 e54182e1e7344be14cda457e489dd81c
SHA1 70965881a29d52025cbf9ee120ed72ae46d1db62
SHA512 e8d5e98f23c6019a849fc243ce36b48b008040e516228a5363b156aa52ddd75b87e9e47bc6a685ed2521f1eecb5745cf13813cc4c412c639d768822f2d15b789
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX6mh6:OtfFvpopPxrB4Rhf6a6
TLSH
T18DB2341571BA021038FE790881B6972F068232B33158E67B7FBD15A69E6BF045DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a781148b-097d-4e50-83af-34389ebe4c76.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a781148b-097d-4e50-83af-34389ebe4c76.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

c916ac58-e031-40e4-91d0-e36c8193610b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c916ac58-e031-40e4-91d0-e36c8193610b.tmp
Size 12KB
SHA256 616552983c298e22f5f07c48c483213dc7dfb5fce20fc4c5863e0a9a78c254ed
MD5 2026b76d44c995dda87df36d3ba6866a
SHA1 f46a27802677c4f96a27bef9496eb3c40fb22d37
SHA512 cdaecc5aba21bbc206d7fe6ac8378a9fdfc54d50b57b8607b451fd116f11748323471e4ba4fd11acee13a09e56d08c2bdc04389c37944332be65fd717853441b
SSDEEP 192:sxZiRrkF/fqsj4QZZD6zodp8PHfu6+WNGYbItt1YSXIg5t6J:sxZiKF/fqsUOZDBiHLGFpY6b2
TLSH
T11D42DA15AD28A93B8CCBD21DF655BF53D3F95033A0951E44AAFC8A1C05EBADD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bd5e82ba4cda39fbc520699545938ceec9f1789b593d489738f41720a8651323
MD5 cd742a167b3c71ab9ef1c4fe105eb0bf
SHA1 306b4bc2ce8306aea121ea0583902f3184ce434c
SHA512 38410c8927e0ab9238e565e498c95d6c52018ec2e2f66cfc9c1b3d722a8a1f13c870b1afb55b46f9a4101d117ea8c44356cd43127cbf61d5ae3cd3e1844be422
MD5 SHA1 SHA512

Submit Download

cee1b1dc-cdc7-44ba-9be0-d03445cb70b0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cee1b1dc-cdc7-44ba-9be0-d03445cb70b0.tmp
Size 27KB
SHA256 e4993346c20e8cd87a7badc2b1f48872903f5c09f34ca04ea35a32459a958f27
MD5 95eaed6980ea7b5933922b752e17e593
SHA1 ac973c0ac260bf43264bd71d9752519d39ba8288
SHA512 b7677e451869df90b1e045e3a1eeeb00e14dbe989a4a737e7202bd9ba24e8c2447094d362d33f3e024a7d35d3f6fd26598103431da1adcc5ad0fc5f85ab275c3
SSDEEP 384:n4iFgQkUSvL3sNa8TUNTUlI4UTSmgdU6UK2fMBVp1yqcVyKUKuovaTZcwgL/7Iz7:DFIL33wg1ovFBV6dyKuovaTZcTLQ
TLSH
T12AC24C32E898DE77DDEB8ED5A34A7A43DEF04253899C4AD4D9C95C5C00DB1AD130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d49ed59b-a232-4dfa-8f73-db6fecf4315b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d49ed59b-a232-4dfa-8f73-db6fecf4315b.tmp
Size 26KB
SHA256 8fb6287198828be6ff14cd0e846d153f7abaa6aac81cd08e1c571a32dc240094
MD5 40ae0e8a0885b50593ff5f4dbdeadacc
SHA1 845fdaaa9c2cbfd10c4e03184e3add1eb20bf7db
SHA512 bacaf365cbceb530f94868f2546bbc118c6566fd63e132407c36226e7186e8ceeacab8104df1afc68d0cba7abe13fff0fa4ad0e34e8a61f45a40ae9f07566674
SSDEEP 384:neiFiZcI63sNu8TUNTUlIm25mgPqlK2fMBVp1yqcVyK5Kuo7O6R2FeoibgL/7Iz2:1FQ63HwgSTaBV6djKuo7TRn4D
TLSH
T101C25C32D894D9BBEDFB8EE6A74A7A03DEF04263858C4AC0D5C95D1D009B5AD030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e008f207-a47a-48b1-9514-d61df4d51fad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e008f207-a47a-48b1-9514-d61df4d51fad.tmp
Size 27KB
SHA256 12e0d12e5060ba4618bc1f7423568f27ebd6b51dfe038c0255a1d2ccf2885fdf
MD5 65bf77e9b1259e23c51e455b72c9118c
SHA1 dd13ef1f9da94f5ff1a3e1198b62052ea0639d8d
SHA512 d923166b405ce1a52fb0e4e41b9b43cdc49d06fb2478dfd4744a5f05cc5689c6714b6ad6629de2723acae9405b9bfdc2b688082b325e4b4a92878da4bc0efecf
SSDEEP 384:nWiFdQkUSvS3sNa8TUNTUlI4U5mgoi0oK2fMBVp1yqcVyKSKuovaTZcwgL/7IzIA:9FHS33wgEvjBBV6dwKuovaTZcTLQ
TLSH
T164C24C32E898DE7BDDFB8EE5A34A3A43DEE04253899C4AD4D9C95C5C00DB19D530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4f8ae7dc57360ba4289e486ba5065cb41bf749344cb341486553df4bd40a6d66
MD5 84e4aa4efa158e34c0348f60eb2df056
SHA1 9bf15d9c06c5fb212eb36e0ac1ef26ea715c8a48
SHA512 8404122169a75c83db7591cea4c6e8ec93b3d7020d0645c7952ba3c6ecabaf1ccd4b58d95ca0ca214ae44cc0bfd595c8d93422e6c9b4801243aa5fb71cfd1cbd
TLSH
T1A041285CBAEA1108B3B76F5AEBF6686D847E7C672F06D46D10110E8F0623A00C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1004-207-0x0000027380000000-0x0000027381000000-memory.dmp

Download

memory/5660-204-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-205-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-206-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-194-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-201-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-196-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-202-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-203-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-200-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download

memory/5660-195-0x000001424E1A0000-0x000001424E1A1000-memory.dmp

Download