hxxps://t[.]infoemails[.]microsoft[.]com/r/?id=h17ffbb89,50e29d11,f0ba93e

Analysis

user interaction
yes
max time kernel
898s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.infoemails.microsoft.com/r/?id=h17ffbb89,50e29d11,f0ba93e
Sample261029-2gexwstvaz

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1624	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{02325450-E126-4B81-B260-FBEC16F01022}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe
3968	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 2856	3968	msedge.exe	86
PID 3968 wrote to memory of 1624	3968	msedge.exe	88
PID 3968 wrote to memory of 2896	3968	msedge.exe	89
PID 3968 wrote to memory of 4768	3968	msedge.exe	90
PID 3968 wrote to memory of 2896	3968	msedge.exe	89
PID 3968 wrote to memory of 2896	3968	msedge.exe	89
PID 3968 wrote to memory of 4768	3968	msedge.exe	90
PID 3968 wrote to memory of 3452	3968	msedge.exe	91
PID 3968 wrote to memory of 3496	3968	msedge.exe	92
PID 3968 wrote to memory of 3452	3968	msedge.exe	91
PID 3968 wrote to memory of 3452	3968	msedge.exe	91
PID 3968 wrote to memory of 3496	3968	msedge.exe	92
PID 3968 wrote to memory of 3496	3968	msedge.exe	92
PID 3968 wrote to memory of 3020	3968	msedge.exe	93
PID 3968 wrote to memory of 3020	3968	msedge.exe	93
PID 3968 wrote to memory of 3020	3968	msedge.exe	93
PID 3968 wrote to memory of 540	3968	msedge.exe	94
PID 3968 wrote to memory of 540	3968	msedge.exe	94
PID 3968 wrote to memory of 540	3968	msedge.exe	94
PID 3968 wrote to memory of 3872	3968	msedge.exe	98
PID 3968 wrote to memory of 3872	3968	msedge.exe	98
PID 3968 wrote to memory of 3872	3968	msedge.exe	98
PID 3968 wrote to memory of 5000	3968	msedge.exe	99
PID 3968 wrote to memory of 1204	3968	msedge.exe	100
PID 3968 wrote to memory of 5000	3968	msedge.exe	99
PID 3968 wrote to memory of 1204	3968	msedge.exe	100
PID 3968 wrote to memory of 4928	3968	msedge.exe	104
PID 3968 wrote to memory of 516	3968	msedge.exe	111
PID 3968 wrote to memory of 908	3968	msedge.exe	112
PID 3968 wrote to memory of 4888	3968	msedge.exe	113
PID 3968 wrote to memory of 3684	3968	msedge.exe	115
PID 3968 wrote to memory of 3684	3968	msedge.exe	115
PID 3968 wrote to memory of 4684	3968	msedge.exe	116
PID 3968 wrote to memory of 3524	3968	msedge.exe	117
PID 3968 wrote to memory of 3524	3968	msedge.exe	117
PID 3968 wrote to memory of 1076	3968	msedge.exe	118
PID 3968 wrote to memory of 1076	3968	msedge.exe	118
PID 3968 wrote to memory of 4452	3968	msedge.exe	119
PID 3968 wrote to memory of 4452	3968	msedge.exe	119
PID 3968 wrote to memory of 2520	3968	msedge.exe	122
PID 3968 wrote to memory of 2520	3968	msedge.exe	122
PID 3968 wrote to memory of 2008	3968	msedge.exe	123
PID 3968 wrote to memory of 2008	3968	msedge.exe	123
PID 3968 wrote to memory of 376	3968	msedge.exe	124
PID 3968 wrote to memory of 376	3968	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.infoemails.microsoft.com/r/?id=h17ffbb89,50e29d11,f0ba93e
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffc66c1c188,0x7ffc66c1c194,0x7ffc66c1c1a0
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,4281350018542115787,7124608527523290788,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=2996 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,5207011518978126622,12579358762299842377,262144 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=2964 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,15920599358866669500,2713883461104921743,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,1976501713895894038,11656338363297707803,2097152 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,18411413230094912919,16696337000411324825,2097152 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,12973231008339372922,6690418711296569308,2097152 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,5616317875130645655,5984503762860445569,2097152 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:2
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3672,i,15667010402941642660,7394635141236518327,2097152 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,4421775544352992230,6063329901856243432,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,4817778917519002261,10082161089375322680,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,9568771381754981806,9233546652014926368,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6100,i,9568771381754981806,9233546652014926368,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,13620651776860721378,5720484440076267508,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,12380845072370389562,14360421815777060808,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=4888 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,11561824973826326642,10404179864674758851,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6176 /prefetch:8
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5936,i,898705673677433163,10505412722574408911,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5080,i,516659609571564691,2898266629530232218,262144 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,14348598696967275479,16818990330788587658,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,15810566526269687562,12995860290619761532,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=4016 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,15208873014096082720,372460614764091313,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,10786423442028122074,5737594885152684367,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,18001390117804138528,18422451457794683550,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1040,i,3841850222200825905,13869616147047045096,524288 --field-trial-handle=2968,i,6154179949690795099,2580222585094545060,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:8
  2⤵
  PID:376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

232dc3f7-27b6-4d70-bdc3-b2200d68172e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\232dc3f7-27b6-4d70-bdc3-b2200d68172e.tmp
Size 8KB
SHA256 7087673cea2972f2173054bad133cbd5ff85965a3c248cc1e0dd98ecce921069
MD5 83f8afa5b9159a4b9896f726fca88642
SHA1 2f4edc328c67c61319ca0e08f24854e2267db009
SHA512 33d2a258bb46eac5aec03963b779a49e4c961b8a7ffa54e861320849581fc72ef811aab2455c56ecef0be1001a1589ae3c8ec57ba366ca6f5f3736216dcb0299
SSDEEP 96:KqONk0QsjpfbUmjH5ih/cIPURHl8h4otop5zaDtBKP4v+Y1xf//ojdixHeYMyw3C:BONU6JUm0QmiUygzso//gyw3BC33U6
TLSH
T14202C735BC28BCBB9EF2AE45F08777239FA4107BA6951F80DAD81E2D01D715C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4dddf22b-f816-4347-94e3-cc51e2f46b0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4dddf22b-f816-4347-94e3-cc51e2f46b0b.tmp
Size 18KB
SHA256 a029ddf28d4c7b5c73958e72f13d6922fc8f3facbb5cd03dd4259a3ec55cd183
MD5 6280dae9274f23e2e6545e43a03f2fdc
SHA1 c2b250401249b65b69b0d8198ecf372eba37c69f
SHA512 51d1b674f2ffba2ccf12b33b98de36e1182bd1bb2c321b65f66f34ac92ca28bc533713a08c49d26f97de1be5622067a4bfebb10a01ab5a22b5c8fd61dfb54054
SSDEEP 384:taQkUSv0sNDULpaxXbDXJuh//kTP1PvaTZcqotIIl6:tC0pax34/yPvaTZcqotLQ
TLSH
T1E6826D756869AC374EA3A190F14B3603DE74946BEAC41F94D5DDAB2C02DE1AC6307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4fb4b3a1-0d7e-4583-87ef-838ce064c8e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fb4b3a1-0d7e-4583-87ef-838ce064c8e7.tmp
Size 8KB
SHA256 0f5ce7fcffff87fac4e57795dc82583cb7831ac28f8a0d0b1143f5eb975042cd
MD5 2fffcdb14b600737d86ce1ebe5a46e91
SHA1 828f259d1f3e6a9859f76481a93f402fba520224
SHA512 31291aba0d6b5d7164e6bdbb604282b98ae8d026bd5be3c6bdb3fc4f651f12f74327ebbe15f331e3651ba1188c1bebeebb5e82eae6ab228b7c19b17a419a387a
SSDEEP 192:HONZ6JUFQmiUy/zUo//gywTPAbNxSq/U6:HONZ6+jwUo//kTPGPU6
TLSH
T16312F935B864EC7B5DA3A595F08336139E64407BEB896F90D6DC2F2C02DB5AC6307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94b3bab1-4d8c-4eaf-afb2-02e677613aff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\94b3bab1-4d8c-4eaf-afb2-02e677613aff.tmp
Size 105KB
SHA256 98d027a7d5f34317602446091fe5e8214f7e942ff9ef737ba4d84e1e3d5595bf
MD5 8f3342292c3866482651f7779a119225
SHA1 4913b3a3b3dbc7ed6a23f06a3e43a7fb771af8a5
SHA512 5ac909173ab373dd81244ae41107fd57459d8168297be5c68fdfbbe0e0d6bba188b269540254cf5084284313bf648a5ee3587eb3073c307b59f64cfeafed06a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7J:fwUQC5VwBIiElEd2K57P7J
TLSH
T125B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

276f7d9e-bdc9-4e71-b98b-bd64ab590d50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\276f7d9e-bdc9-4e71-b98b-bd64ab590d50.tmp
Size 9KB
SHA256 84586ffe745d6f5e920aafcaea8e96c6f20a0004941fa1991b79c418c05b2f6c
MD5 046f58c846ba1d1316d34b64306e9b80
SHA1 bdb41506758294a2a28affdcf2376e55c3cdb724
SHA512 21da67d7a1da90e3fa2ba40530fd62b6b5439dc5b150535c68e8795753b9d5e838accec8ec3335bd51df46ab91857e6073dc955c75d7572191f00921968648da
SSDEEP 192:sxZfRNW4/fVsXTIdpwBHW6+WNH5FM/Y36A6lM+QIgrJ:sxZf64/fVsXMsHbQ/XsF9
TLSH
T1AD22A652AE38A97B8CC7D20DFA25BF13D6F9503251D41E48AAFC8A1C05E7ADD520780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

310073c8-ca5a-449e-b1ce-9de57c2fc71c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\310073c8-ca5a-449e-b1ce-9de57c2fc71c.tmp
Size 27KB
SHA256 a5287701f2fba3ccfc7ab67db6c4db044c612c86c7ad40e094ab943710509a27
MD5 aff6083f6cac3ed3da30876109111e20
SHA1 4206f72bdb0fdcddd261065b1337d3993ebdb540
SHA512 89736fefae6b48118905ab86263c1ac15cdc546d1db35694c5c6c6e6ee3d53139474d1cbafcb47e4cbe52d67ef3276807df1bea646d2e90d70b8158c471b0a1d
SSDEEP 768:JdKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/kroo/pe:JdKlm7QWvUYe0u1ja8/L/E/vo/pe
TLSH
T1CDC2FB3B640CCB7E4FC05A9DDC5A6F976EA802C7A6588D4047FA984C02C77EA91274DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 844f7bc5f8164cb338ecc380e0f6cba6f4e668e7f11836997133025859ed3a69
MD5 0e1639f499142c2e6500c2f429cfa035
SHA1 ac5a497f9a483b64b554c0d495e82c60bf355d1c
SHA512 1bf71e4e7bb0a8df25f454ce375e6a97c7b0d183eedcef7d113a779a2652a73a1d0fb28e8c291456ce2ed7750c9bd181d0e4f4e338d40be6305103463d35e7fd
TLSH
T154E0D8CC84C4C3DD930C6447426CC30CC7C2266AE7C0E95A2700DD45B185064A2C25B8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 76054201267bf40bcdc902afd99bed10ae1c3ddbeaf2608ada2da07fce26ea21
MD5 21972571dd78785b3b18b36d5267fdb8
SHA1 bdd720a7bfa592dbb946dd4adc79418a945546f4
SHA512 8c4d344f887adbcd46b51ec19ee034ac99ab068595654c9f20dc39d2c8ad1016b1d24e2ca766597407b5c3a7ad798f73c9a7a9711512b2cdebd38f766bc72447
TLSH
T16CE020C895C5C3EDD20C654751AC930C8F812A9AE7C4FD5D2B00C945714505066D35F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 935867ae5ba0ec5d28ae154bb7214030d65455402a68c2269ac7a0a43a477b82
MD5 0f2d451cf4809439e534fc924acdd611
SHA1 4edcd389a95d1d0cf43a36287d8c38801eb994fe
SHA512 857db4fb2cf7b764468c2f987b5bd3b4e7100f79b11c45bc70e908215d5d7599e18a62d87539cc0d9111c2b52cb4107afaf9ce22bf207253abb116165227c205
TLSH
T1CEE0208884C4C31FD24C654B41BDD30C87902B9EE3C0E91D5704C5C5714558462D15E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 7d9728701321282f42e7aae947e8c087dfde8718eb393a9c992951aaef17dc96
MD5 f5fdf7662d1b6eb052b231426b122c3c
SHA1 e841dd425c363c9974f62e04fa7817eb43f84f60
SHA512 ed73f013700edfb69efdd3e75605bbc97766668ed49d276af98387f1cb53cd5f96642fb807127eda56377f2baef41cd7a487bcf150d1b5990856a826010b20fa
TLSH
T1AE616E8050E0C0A3EB989771F2F2928F3928657245CFAD5A60F6C5BF4B0BB5CD3D50A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6abe763f7d10548baae8dbd906e577891af912c86ca1d20274387a0da86f4d69
MD5 903161dd6722f1f60391712622298269
SHA1 7593eb661e4d7606dd6de19542122738afb0f766
SHA512 d6c14fffda1fd2d4c4f1d25acfbdb235b61f558a2408eb5be1f09c307cf67d5a7a615bddc8aa3e1ba4d330c6a92f64400b553a65a1d0540b4f3cb97eac414482
TLSH
T199614E8051E0C0A7E7A8D670F1F2528F3928A57145CFAD5A20E6C5BF4B0FB5CD3D50A0
MD5 SHA1 SHA512 TLSH

Submit Download

5db4db4a-e1f0-407a-896f-f8662bd54167.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5db4db4a-e1f0-407a-896f-f8662bd54167.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1af522d0-69cb-4302-a899-4fc073b4de94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1af522d0-69cb-4302-a899-4fc073b4de94.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

36db373f-b1ab-4c85-b375-539e06187fe9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\36db373f-b1ab-4c85-b375-539e06187fe9.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

3867c03f-f3b5-4556-85c1-e37913be59d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3867c03f-f3b5-4556-85c1-e37913be59d1.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

4c747466-907e-4578-b1ed-5b7941109541.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4c747466-907e-4578-b1ed-5b7941109541.tmp
Size 1KB
SHA256 d68e4925aaed54b117d67e56bc6730943d464b43a2fb1422f556ad281433555e
MD5 e0021aae201db842c3c35d29e52a30eb
SHA1 41c4fc2c927ace945b6515d2567dde1616c407f0
SHA512 dac72b1032c510998e4997c9e529901cecbda91b898ba57b65364d6b018018e53b002b797567248217c3b15805455ee01a1659752ecca19697f9ddc40a724e9c
TLSH
T1A4319CF787A1856ECE1196F09A18DE2FDF2D0216431C7C298AD4EE27D3E3072E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

f20661f6-d450-4eaa-8654-ca0d75e29e34.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f20661f6-d450-4eaa-8654-ca0d75e29e34.tmp
Size 1KB
SHA256 a1f5cb00df31108437a2337ead7454a34551d4d2fb1fab79ec9564038dd2064a
MD5 d22b5b8999ed3053a9acf589c13475d9
SHA1 6ea2d24e06080618ae3a2696649d2db685b80e36
SHA512 ebb173bb9cf878403b47b8ec3023d57e49c3b5fdafc115c7172e731be17f6f74422cca3bc62c2625415b96fc5a3de6899b3396588d8ce5ca7c22784a6fe3976c
TLSH
T1A9315DF747B1856EDA1196F09A14DE2BDF5C0116435C78698AD4FE23D7E3072E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\97197f9a-9b9f-45b1-a9e8-697375751dd8\index-dir\the-real-index
Size 864B
SHA256 6769cc11bf4a3520887a5f45c112bc6d9984b7901c59860c9f384687c62a1799
MD5 ed8f158d7db87339d1570918a21d0b29
SHA1 25b390520283a5f23c63e11fe8f8de205642d620
SHA512 5b093a4aeba7598f1e986ec0569e165978403c8ae59ab1a2fa9a286430efcb39831e8f5ad40156bb5a9425cbb2a6dc99f49f8b62bd882b02d54abc80688325a9
TLSH
T13A1102D70D535F17EC440A75A43CA989A67042DC62106A9F51FFC02E9CD2B84AEC1298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\97197f9a-9b9f-45b1-a9e8-697375751dd8\index-dir\the-real-index
Size 864B
SHA256 d815b38a07d4299ec8300cbf7d5d56f5b824b4ed4e9f0f26634a176a5752a61c
MD5 99dfceb900208e977b491556aa4c3934
SHA1 eba70b15026916290429d913e81d99dbcefcd547
SHA512 64b943f239e04beefc7e12405113fafa9ce66a03b3a23d6f325ccd7670407d2ffa13b3d390ec36f0432de61d8a10cd020c26a7a72d3def319687b442b7bbb108
TLSH
T14E1141E901538B46EC4803B0DA7CA946717582846344674FE3EBE12ACC82B84AEC2FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 9d2707229eaf52fb780299861dcec0c439446b35317c6748ae570f3fcc37f7e9
MD5 3c400e4c142dedc669aedb961900fc17
SHA1 5060d94c6bf3be3c1d43cce9a15c323c8db3c6dc
SHA512 0a70dd75392a744bdbbad7080fe1484603f0da73e4474e1ce23e150e8a639b652615ba9b1b3ee4d62f654d429e93bf2d73a7e65463a31cf1b9661495f33b2db2
TLSH
T148E068763DB32420ECBFE7CA143168A00040B844E555FC1E542E99CB10A2306705AC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 17a504feffe224fee7ef6787a0a5326101541ef12026b021c94df84d31b796ce
MD5 38b43acd7d56988098020a1517520a37
SHA1 5b4f6777589070f16354999df5aa52c71969cbd4
SHA512 f3055dcf0755ead6ebba6bbe73fb0c1cbc42e31d415d5f1c0bce8aea8b04f2c265fc016ab5b23fc28c9c3a163accf0e7ca8a60108298b610372998912538e35e
SSDEEP 96:KMWEKbKmKSMKjCM44KJquPKLmqIgg+qwK:CDHkr/
TLSH
T144915444707B424038BE768D42E5A71A464235727016E62BBFBC40B58FAFE094EFF5CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a07e5c0b-4dac-4b76-9666-71693a34eef4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a07e5c0b-4dac-4b76-9666-71693a34eef4.tmp
Size 10KB
SHA256 d8ed03d1f368c4a60b16e087b34820a87447a3c00594f053339b45e113cbf822
MD5 d9f14521fb6828872d9a5adb3cb7a870
SHA1 290ad734d0cfbeac75b96e57c52fc7e31c1fae9b
SHA512 5609e7b764f1a518ae10617a311ba148fe67ac8df5d5279b8a56fd757da31a47ec76be3160699a1098aef2884a6489f25867cfc13acf0c67b2112098d6a9a681
SSDEEP 192:sxZfRNW4/fVsqTIdp6BHW6+WNH5FM/Y36A6eM+QIg5BJ:sxZf64/fVsqMGHbQ/XjF5
TLSH
T13222B852AE38A97B8CC7E21DFA15BF13E6F9503251901E48A6FC8A1C05E7ADD530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6db2cc6-6702-4295-9f32-769fa17480a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6db2cc6-6702-4295-9f32-769fa17480a5.tmp
Size 24KB
SHA256 e1c9d83b86516ef5a1505c1ac9bce7bbd26b3b963f08a706fdbc5d1973b4c8a8
MD5 102b780ee922c0d2cd31ffbeec74f117
SHA1 fff1a833761c17731ea7a49429057f7dbd2d0240
SHA512 cd6dd2827462e9a439cf63e33ec1fb5c64e7c4efab7e80cd654f2aca88ec39554dce3da85a509337e22499062cac0690cd6b5bf00916b6e3fc1732d853b0d21d
SSDEEP 384:sxZf64/fVsD66s8qMpRiYnazAW8pZS15posJWeT+/MGHbQ/XjN5:s364/fA4Mnc7WeT+/fHbSTz
TLSH
T179B20805A924D83B8EC39D18A43D7E33D9EC506222C5DEDE16ECCA1C029E1FDAB47457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aca93537-3be2-4ca0-837f-58519f9c74c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aca93537-3be2-4ca0-837f-58519f9c74c0.tmp
Size 10KB
SHA256 9ee02527d3035b597aa61c05e5441274f99434672d9f678adb3cd1cfd92a09fa
MD5 d31b8e4fad49147cac025e5f0fc694c8
SHA1 15d02def041fe02f7f00f23a8ada2f7724b1c42c
SHA512 eff8fa767da25b0173ec5a69eefb57d25b9bf07763afb1c0ec0151f92acb9c04c4e6e96961ffdf77f56998c0afc6b029b1afbf1f5af9e0c548691a82d0887b19
SSDEEP 192:sxZfRNW4/fVsqTIdpwBHW6+WNH5FM/Y36Ag9M+QIg5BJ:sxZf64/fVsqMsHbQ/X+F5
TLSH
T16822A752AE28A97B8CC7E20DFA15BF13E6F9503251D51E48A6FC8A1C05E7ADD530740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92b1d06-23a9-4cd6-80b9-be6738874f72.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b92b1d06-23a9-4cd6-80b9-be6738874f72.tmp
Size 10KB
SHA256 7f3f8aceba09628545c5bc91b67f5a4f6d5da511754e8d0e968f3992e29568c0
MD5 e13154cb85d52a80eb1dc89609d38797
SHA1 69d6954e4743f249dbafe9c4081866a20cdfbf2e
SHA512 0ec2a89fa24a8e887240eabfaaa4b0720fca4c83038f64b0ce806d24c575a8c68f9983c9508c27b6fd90f8fe876bf94e85bf3250a1d191f88231be4a5cd43f25
SSDEEP 192:sxZfRNW4/fVsmTIdpwBHW6+WNH5FM/Y36A6lM+QIg5zJ:sxZf64/fVsmMsHbQ/XsFH
TLSH
T19A22A652AE38A97B8CC7D20DFA25BF13D6F9503251D41E48A6FC8A1C05E7ADD520740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5482713-bb08-41df-be72-82765c977c63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5482713-bb08-41df-be72-82765c977c63.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c769934-4010-466c-bf55-8417d2ae3652.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3c769934-4010-466c-bf55-8417d2ae3652.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b1344c87-5135-42ab-bb53-15f83cb28a0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b1344c87-5135-42ab-bb53-15f83cb28a0b.tmp
Size 18KB
SHA256 cc146fe50ddf16a7d55401800e111ad3dc46159c5cd154d6a4a7ac9b9b02eb8f
MD5 59e72ca354233304ddea676293015e33
SHA1 64b46d0d910e1c1900795343e15eda1f5871835f
SHA512 27d8a9f14bf7e6f5193368d10773c51b61d4634d48820598db44f6f220ca6a8713146b410a3f82c7f0fa8f790c8f9b914e8bc5038d3d337d35803bdcb0f64ad5
SSDEEP 384:YaQkUSv0sNDUCpaxXbDXJuh//kTP1PvaTZcqotIIl6:YC0Wax34/yPvaTZcqotLQ
TLSH
T175827C757869AC374EA3A190F14B3603DE74946BEAC41F90D5DDAF2C02DE1AC6307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ee1f10f0-87db-4d80-8c14-6095c62fd764.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ee1f10f0-87db-4d80-8c14-6095c62fd764.tmp
Size 26KB
SHA256 ade27345b725351a9df0933a36fda6da42366104568418b354960e97a2d21baa
MD5 ab661ae26c83791bcdbc643971a516a8
SHA1 4feb11392cc6167c263148fd8f962f598b7509c8
SHA512 14245d5f2135fb4127908c600eed19d718f5b1dafae789693232b3f50b351d3bed3364bf868249ba4bf3039d1a049ddb3588909037b2ed2be5251e3ea63a94eb
SSDEEP 384:QZiFzQkUSv0zsN48TUNTUlIlCpaxXbDoJuh//kTPxPvaTZcqotIIl6:QwFdINwg8axI4/MPvaTZcqotLQ
TLSH
T1ABC2F7F258D7983AC9AE5793E33E3E038E7CC067B5805A50B789991CCD9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

82003bdd-cbd6-4ef2-8a42-ceda1e3b85ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\82003bdd-cbd6-4ef2-8a42-ceda1e3b85ba.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4ba736e70b92532defa8703b6d7b6b337dc0fca8d14fcb608a364897f4991815
MD5 254277d6803e901c245d3c2703ff4eed
SHA1 214684d4d14cae3058508ca0206b77aca80e1dd9
SHA512 ac0a288fb4b9f96441d3183cc374e76ef36340fde59bb8d71694eccb16282d4e05c44e4fd4fa00f74c676578ee269cc386982ff0b59926dd60e4dad20bc13a94
TLSH
T19541295CBAE91158B3B76E5A9BF6986E487FBD333A06D16E10110E4F0623A00D871737
MD5 SHA1 SHA512 TLSH

Submit Download