hxxp://innovatemine[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
296s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://innovatemine.com
Sample261029-basbjav1ev

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1244	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{BB87B5A9-D4E2-4E57-870E-D76D60A932A3}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{F8073CD1-A6C2-404B-8D3B-37F94CEE04D9}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of SendNotifyMessage 34 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe
1776	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 1776 wrote to memory of 2584	1776	msedge.exe	83
PID 1776 wrote to memory of 1244	1776	msedge.exe	84
PID 1776 wrote to memory of 4704	1776	msedge.exe	85
PID 1776 wrote to memory of 4704	1776	msedge.exe	85
PID 1776 wrote to memory of 4704	1776	msedge.exe	85
PID 1776 wrote to memory of 4916	1776	msedge.exe	86
PID 1776 wrote to memory of 4916	1776	msedge.exe	86
PID 1776 wrote to memory of 1996	1776	msedge.exe	87
PID 1776 wrote to memory of 1996	1776	msedge.exe	87
PID 1776 wrote to memory of 1996	1776	msedge.exe	87
PID 1776 wrote to memory of 4624	1776	msedge.exe	88
PID 1776 wrote to memory of 4624	1776	msedge.exe	88
PID 1776 wrote to memory of 4624	1776	msedge.exe	88
PID 1776 wrote to memory of 1824	1776	msedge.exe	90
PID 1776 wrote to memory of 1824	1776	msedge.exe	90
PID 1776 wrote to memory of 1824	1776	msedge.exe	90
PID 1776 wrote to memory of 4404	1776	msedge.exe	91
PID 1776 wrote to memory of 4404	1776	msedge.exe	91
PID 1776 wrote to memory of 4404	1776	msedge.exe	91
PID 1776 wrote to memory of 3352	1776	msedge.exe	94
PID 1776 wrote to memory of 3352	1776	msedge.exe	94
PID 1776 wrote to memory of 3352	1776	msedge.exe	94
PID 1776 wrote to memory of 3648	1776	msedge.exe	96
PID 1776 wrote to memory of 4992	1776	msedge.exe	97
PID 1776 wrote to memory of 3648	1776	msedge.exe	96
PID 1776 wrote to memory of 4992	1776	msedge.exe	97
PID 1776 wrote to memory of 4988	1776	msedge.exe	102
PID 1776 wrote to memory of 4264	1776	msedge.exe	109
PID 1776 wrote to memory of 1264	1776	msedge.exe	110
PID 1776 wrote to memory of 2148	1776	msedge.exe	111
PID 1776 wrote to memory of 2300	1776	msedge.exe	113
PID 1776 wrote to memory of 2300	1776	msedge.exe	113
PID 1776 wrote to memory of 3228	1776	msedge.exe	114
PID 1776 wrote to memory of 3228	1776	msedge.exe	114
PID 1776 wrote to memory of 3228	1776	msedge.exe	114
PID 1776 wrote to memory of 4268	1776	msedge.exe	116
PID 1776 wrote to memory of 3424	1776	msedge.exe	115
PID 1776 wrote to memory of 3424	1776	msedge.exe	115
PID 1776 wrote to memory of 4604	1776	msedge.exe	117
PID 1776 wrote to memory of 4604	1776	msedge.exe	117
PID 1776 wrote to memory of 4164	1776	msedge.exe	118
PID 1776 wrote to memory of 1424	1776	msedge.exe	119
PID 1776 wrote to memory of 2228	1776	msedge.exe	120
PID 1776 wrote to memory of 1424	1776	msedge.exe	119
PID 1776 wrote to memory of 2228	1776	msedge.exe	120
PID 1776 wrote to memory of 4472	1776	msedge.exe	121
PID 1776 wrote to memory of 4472	1776	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://innovatemine.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbd7fcc188,0x7ffbd7fcc194,0x7ffbd7fcc1a0
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,4034776398323574479,1961468627263232268,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,6113344822692418388,12001225922447011218,262144 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,14300826267085991607,4262742333913886160,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,4274903851153670170,15825912768279605035,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,440601321988530487,8837924813323170018,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,9370440029375771719,14502076091655272952,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,801618662093717116,17370015428148025181,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3652,i,6332223589924565773,17704711585874395853,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,10817450023323227478,10052183518956308157,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,1387074302775897481,6541133964112009064,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,8360340227748320941,15458113303248796960,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,8360340227748320941,15458113303248796960,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,5450698412751053287,2557875739404908309,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,6815792684860745358,5620081495927958351,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,8891798514372010838,5124422265373204516,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,224151576149970751,4417679134424896011,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4456,i,11753341759134426638,8323022900561549858,2097152 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6440,i,6871702818364472517,12024042261222094586,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,8672159622932989057,16133141287200431514,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,13703085947800838279,16440700673017689550,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6760 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,11394209201378344277,17092328497119164022,262144 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,16985383096640748728,4381352636175607810,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,9670059365450334406,4298552167251068038,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,15436820614673959111,8848566969251723622,524288 --field-trial-handle=2344,i,17751629159540817974,16957876658503165975,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

10112eec-10cb-4353-82a3-6756087d4a00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\10112eec-10cb-4353-82a3-6756087d4a00.tmp
Size 8KB
SHA256 c80215ed2adea1dc0cdaa6ef733851e7951a1eac8e805abdc7224a2a262c2654
MD5 a8d59a18df82dfda54e60d95d4b40246
SHA1 160230855652f3a0676bb38aae401bfaecba9045
SHA512 a4a49fbfa708754da38215362e700154ca78c0b0a1e58684b6dda2aaca6df78d0b4555c70e272146d3bc68bbd31b3e1b434ad2e9866ce1f1b473f7a0e07d4b94
SSDEEP 192:1ONV6wlDgQmiUybAbAW4X58gZxjzorvA7wbDl4YU6:1ONV6kgQGAW4X58EN8vAU9RU6
TLSH
T1FC02E735F978BC7B8EF2AE49F48A26139FE5102BE6552F80CAEC1A1D00D765C1347927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45d98aae-4774-46af-a9fa-a529fba84c8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\45d98aae-4774-46af-a9fa-a529fba84c8c.tmp
Size 8KB
SHA256 ed5a2aaf78b315e76270c7767fea0a190156ce7e6e8af06ebe3fe6ff86b9aaf3
MD5 99f2ec57f0e138846db02dd3f9fef907
SHA1 34648488e9dfe502cda2a4d74ee4ec72c5dfde79
SHA512 9e4ab85f0cee96877d689c29f8a4ef6b4922a6212ca71b3411a7d7a591bcadc95c959ad7cd5dff7c5e51cd2a4589931f043fe7142c5d0ca9737abd2d36591fef
SSDEEP 192:kON+6wlDdQmiUybsGbAc4X58gZxjzorvA7w0XN7R+2EveFq1U6:kON+6kbQlAc4X58EN8vAU0Xf+2vkU6
TLSH
T1E212F835F468AC2B4DE2A585B08B35139FE5511BEA897F90C6EC1B1C01EF66C534BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

06292b84-26dc-4887-a2c4-ee562b6f1435.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\06292b84-26dc-4887-a2c4-ee562b6f1435.tmp
Size 9KB
SHA256 a338644daf6f3cf5b1e046d6d0da448610b649788fada9f571e737643ed6a0ad
MD5 abfb217ca3765b2964b61453db3f4cd9
SHA1 a0461e1e0d88fd0ebce797f3132e06c8d8872238
SHA512 8c73838f210be5754af35b3c5ae0b6161dd688f1f14c1bce60a577aa0800ebc11f3af0d11c2c8ca4b93a2b77d017dd10128d031dd015d627119f23b184eea65c
SSDEEP 192:sxZwgn6R3wWH5/fnRsixKIdpVgHW6+WN6rA/YreXwtsIgrJ:sxZq5Z/fRsi9eHb1/J9
TLSH
T1F72297526E38A97B8CC7D20DBA29BF13D6F9503255D51E48EAFC861C05E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

146d356d-c7ae-455e-b6f1-985fcda80028.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\146d356d-c7ae-455e-b6f1-985fcda80028.tmp
Size 10KB
SHA256 e5c1704565beadc134751a5bd5094bacdd4d73c627be3c3df75d8f10e881547a
MD5 398ed3b6b5761ee455d7afd10e591a8e
SHA1 1c1a7da8aa056d850dbd6707144708f94af81ff6
SHA512 0a2675bf9a4f1fec6bda396a7c41eebb9b200e43d7c873ebe6494596e89583de583d936ae0bfb2951d98f23886d252e4d1d346cf8f818d001f545c04a3698e3d
SSDEEP 192:sxZwgn6R3wWH5/fnRswxKIdpVgHW6+WN6bXIXYr+XwtsIg5wJ:sxZq5Z/fRsw9eHbEIXpu
TLSH
T16022A7526E38A97B8CC7D20DBB15BF13E6F9503291D51E58AAFC861C04E76DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c7ccb98-517f-486b-ba24-7d14bb3dc0b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c7ccb98-517f-486b-ba24-7d14bb3dc0b7.tmp
Size 27KB
SHA256 1175ea24b25573fbd2397dbc3d269fcf96749b8321778ba9b8ed7c4004f83da0
MD5 fe18260feec35cf4309e3208c982848f
SHA1 b58b84c26fbfef74f8f2dbec617a8bcaa4f28e81
SHA512 f6485060e28ad4e04305afec348c1c267daf8b390587f49de637403fa194dca9f794a8b140532a7f3f8b9032367225e63ef03bc76f06f6c44b9bd764a42772bb
SSDEEP 768:nUy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbsroR/h:nUy4J/DWvbtBhu1jajiLm0b3dh
TLSH
T190C20B3B684CCB7E4FC00A9DDD5E6F973E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

78c5495b-4883-4378-9288-cd74202187d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\78c5495b-4883-4378-9288-cd74202187d2.tmp
Size 10KB
SHA256 13f7d4180de15c317fc0ad001e8af20351c88533e813bfa27e57a93862860a30
MD5 d2c603dd939b992acf5446f0dd4e43ab
SHA1 c4d4dc1015f96ead6826bcba89ad2194a0c8b0b8
SHA512 a26f6f2b32f37367b57cf432635eb8a4f02099894ded01fcdc48aca0736c83bde3a63b75b7f3e5e7050d8c99407da2900abab8e7fd5a5afe072b1a0976a0ab80
SSDEEP 192:sxZwgT6R3wWH5/fnRseXOEKIdpVPHW6+WN6bXIXYrydwtsIg5iJ:sxZG5Z/fRseXO8JHbEIXvc
TLSH
T19F22B8526E38A97B8CC7D24DBB15BF13E6F5503291951E48EAFC861C05E7ACE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b5e813af8bcbeded2b837fa0358c32dd759cf90cb6034dd73783066b4d2b01b3
MD5 55da4bccf9844c4dabe159aaea2eedf0
SHA1 99be5334ab3d3ce71f646dd733a97f136322d52f
SHA512 d0a86baa32555c78ebc0620dcf8381ce98ba20af381bbc4976d08d97c3f1691a2e0e644cd5d210a477053d58fe331dec529ba28bd1998e10d1681aeff3f27bdb
TLSH
T109E026990AC8C22EA3097747157C838C83B0265BD3C4690E1704C5897046040E2EEB94
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 99e44274eb1f754bc6640e5dc1a32d0a1bbf5b6489b5524da646555706e1b99c
MD5 4e9dab2c94a2a1ddf2e3a87a8a8c25a7
SHA1 991a507837bf8e19a2094c200cb9273d1b5989bf
SHA512 e4b6e4a995fb2ad334c2ca805ca7e1ff969e45f99c4e99fd3dade0073fe0ab4d4bb7e3698e4fee26cbc1328075cbc99365b0b2beafa7f01941f8721cc17c389e
TLSH
T10581986EFB46D69FF7544030E9DA2B97B93C0DA378CBDD0335ACE67A6446BD54112020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 398b16a7c10364d3b2f36cb5124358bbdb769046a5746005c6318f0f1ebaf91c
MD5 97d4bb693f014fba69de91a95f2dec5d
SHA1 6679bcb1144d0afa0874caf01facfc99799add47
SHA512 d59209b95c5f0d6dbce4cf8edb520e1c1652e0519df6cfc0d8ed710e79000a9b42e1fb3c797062ca8631d46b9aaa1d4e21385b75acec10844ff04cebf35b7fa2
TLSH
T18F6153AFFF5AD66EF7944070E9EB2B9B393C1DA338C3DD1324ACE67A64463584112064
MD5 SHA1 SHA512 TLSH

Submit Download

43de815b-3bf2-48bf-a879-0359442e78e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\43de815b-3bf2-48bf-a879-0359442e78e0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

618277d0-def5-4f07-8952-2cda08b46ef9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\618277d0-def5-4f07-8952-2cda08b46ef9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a313e346-1ac6-44be-a85d-202a4fbfb011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a313e346-1ac6-44be-a85d-202a4fbfb011.tmp
Size 6KB
SHA256 b60f4dfab3ce517022ea85f13f9e776566af02d8c65be2ac0f2eb64634fa1817
MD5 bfa341302067a6bdcfe203404d865f85
SHA1 c1bfd4a3b7b32e8463eda64f9ac097316c8c875f
SHA512 ce27271e9d435a8563ea556ef6772d6f3c369334bc6e86267d4b269765b218334e2fd65e422aa0aa49b973174d338f9d44cf82b901bd2d97c07209947242952c
SSDEEP 192:DJ7fkxA9+uEYLpkgIG3f+AVrYkk6cs+qERfidPWM:DJ7fkxA9+uEYLpkgIG3f+AVrYkk6cs+A
TLSH
T135D17BF3C6E4CA1ED82155F4AA146E1FCE29192843783C6EC8D5DE5BA3F30B2E14465E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d1da3fdf-d9bb-45a7-b531-54c898b0b419.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d1da3fdf-d9bb-45a7-b531-54c898b0b419.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fe55d30b-ad05-4571-9f08-cdcca64d6804.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe55d30b-ad05-4571-9f08-cdcca64d6804.tmp
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\temp-index
Size 72B
SHA256 d9f897b9a65a121bf0fee6557a94a208e1e237e4361ddf1e74fcb64de145dfa1
MD5 0dbe665fd9da09a6f17d437d297d6dae
SHA1 cf74d4e339bc0e49f264e89da5d46340b40a843e
SHA512 abfc839a72461b69e675f329654069c7504b69462e12eb27e3e89105a701fe3bace35805dc62beaa810e6c4a22170570b56affb120a7ceef03b32169c567460a
TLSH
T1E0A00258D2491117C5100B712557328063D4481515710241C8A0D0BD8C9B1C4A565312
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 48B
SHA256 a7923bdbb371e85d148ef0639031dc119a60746cd82d2884889033fe6773cbf1
MD5 c3ea370bb6b7bd8af69674569957dbad
SHA1 2a0b6587e82a7d422eab6bc4780b03d0bccbc056
SHA512 6e4411dba79b61ed7d37ad01c77dd05570c2f8c0635528b974515e4cecc9fce02be893866a40cf3f790d490b330fcd339990c94d57287c4939f3f915781dd995
MD5 SHA1 SHA512

Submit Download

ed7ef629-1cf8-4eea-9978-84e6f798dcc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed7ef629-1cf8-4eea-9978-84e6f798dcc5.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f12360e8-91c5-414d-bc11-97cf5893a2c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f12360e8-91c5-414d-bc11-97cf5893a2c4.tmp
Size 10KB
SHA256 06c56c2192d8d2a05b89ea66a1d41c2abf81bef99391a6cf956d207800d3cd87
MD5 e60228c5e1ee22ab1990b472639f6e35
SHA1 8c2c4f552719aeb40a0fb034f457278338554c33
SHA512 22ba8fdb2a76bff7c7d57bad7e41bda3fcc96dcf17c291fde47c7cde30f683a64f1fb9d65a811c8f2daff6f8ce515a17a5e5b9936406e5013f9cfc01eaba4d21
SSDEEP 192:sxZwgT6R3wnH5/fnRsewWEKIdpAKPHW6+WN6JxZYrQdwtsIg5pa8J:sxZGcZ/fRsewW8FHbaZBPag
TLSH
T16922C9526E38A97B8CCBD20DBB55BF13E6F5503291951E44EBFC861C05E7ADE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57ba5644-3412-4c1f-b4f7-f29f8d21a414.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\57ba5644-3412-4c1f-b4f7-f29f8d21a414.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 78e6bac5d4f07ff01fe7b5cf591c7b73e0874f2388e6238fdc9d47449fa4c36a
MD5 c63f6351397c4c0ae96955b852acd012
SHA1 5da8bbc46d5338412a061479d6fc9f8db81a46c3
SHA512 b30d730a2ee3fadea766ff67ee0ff9b5d97cf6994baead1ea8291531690aeac37916a329c39d7052c87fde21c36e45877fec1138e98224ea574a7f7609f2557b
MD5 SHA1 SHA512

Submit Download

a2d3be3b-c841-45c3-8180-c26317ade617.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a2d3be3b-c841-45c3-8180-c26317ade617.tmp
Size 18KB
SHA256 055725c12b3be3e8e8252557808eefceaa227982693e3bc58f10e48e89aedf11
MD5 16bafa6a4e8ef7494a2a378371b3395c
SHA1 3b662849ef87d6fa27b4545672b5a999c09355b9
SHA512 02cc20e99cf84e804b0fe3141c1414eb823cecb3188b2401c3718d6786acc279db72bce14403088f6e19e19312074ebae093e56a088f2f1c6601b479b849c2ba
SSDEEP 384:4QkUSv0sNb2mHZL5gsMHX58EN8vAU0Xf+2rkvaTZcSvIIlE:w0EHzgsyaTcflrkvaTZc0Lq
TLSH
T196827C31A868AD370DE2A541F04E36039FF59117DAC55F90C6ED5B2C01DA29D239BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ab800b73-7a3c-411f-b297-ebde7a50519e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ab800b73-7a3c-411f-b297-ebde7a50519e.tmp
Size 18KB
SHA256 47611f46e7deb8e537094646a49331e04eedb83fd6c35bc435be808ede3a37a1
MD5 187d946b72a3a44f2eb4e71e463a7447
SHA1 29187fb85b40a9dd7eb4888013369e4fe760ec52
SHA512 d06e2092ced5a95014320538d6f06795d79243bba1fb1252cd8d1dd587b97efafa83570474e2a3b2496681064c26c104172fcb28f3eaa109fea71263245160a7
SSDEEP 384:pQkUSv0sNbzmHZL57sd2HX58EN8vAU0Xf+2rkvaTZcSvIIlE:L0VHz7sdQaTcflrkvaTZc0Lq
TLSH
T142827C31A868AD370DE2E141F14E3603DFF5911BDAC45F90C6EC4B2C01DA69D239BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c8fc95ba-81b1-4e85-9259-302c46844ec5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c8fc95ba-81b1-4e85-9259-302c46844ec5.tmp
Size 392B
SHA256 86c492053eb0287109c613f4824fff314ee0341bf5465e0b7714d1722c2fb219
MD5 9bd9e82ac75fc23e097a904ba01259b1
SHA1 e2569d47bfefbc5fdf94b2ddb39037e2d5d315a6
SHA512 d7dafcc8c4137d19bcc6242b6561bfa92526cf41e284fd616a8174d9be132e98ccb84e11a4ce418631da440edf973e7db7ed1ac0f195e823f094c9ae3b3742e6
TLSH
T126E00242D1010573C418073400831F125DD0851003B212050334016D3D323407630F10
MD5 SHA1 SHA512 TLSH

Submit Download

d7b0ac6b-0c90-4653-8e87-258c93811f9d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d7b0ac6b-0c90-4653-8e87-258c93811f9d.tmp
Size 26KB
SHA256 79fb33759edddd71a2b9968b097f08d613954b5cedeb8a4f20207a505a772a8f
MD5 50c8f7ed52cac8b018a3cb46af416b6f
SHA1 4354c74f6d7ed990d96d634544fa09d3f5393565
SHA512 1697bbb717bc0d17b0bf28411a4c0d86c17b9d08180a018852745a7d3e73d031c912805a2526898507bf5bc88ef146904dded3b36502ced0c16ebf124a1f6ef6
SSDEEP 384:FiFzQkUSvCzsNl8TUNTUlIlzmHZL5lsd2HX58EN8vAU0Xf+2kkvaTZcSvIIlE:MFdKowg8HzlsdQaTcflkkvaTZc0Lq
TLSH
T194C217F298DB993AC9AE9743A33D2D038EBDC057B9845A50F398491CCC961BFD34AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cca92229-a191-4c50-ae1b-365848430d0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cca92229-a191-4c50-ae1b-365848430d0b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1703e89558150bfd76af3462ee96806ee89bd8db3e9eb53feb3614e071ef4b56
MD5 5cf75b57a243352f2fbf54ff8111bc6b
SHA1 b5e8b68ab27d2ff70b493658f8c78242d4ed2142
SHA512 52709f6231e187ab0dc8c04e112180e9986f91897254b353e4e48b5ba99d600f83276274ded76ffd718c4259d080e08b2b7eebdcc75eaf07009f6dd05d2fcfc0
TLSH
T185414858A6EA0008B3776F1AAFF7B86D947E7D772F06D46D00020D4F0A22B40C961B3B
MD5 SHA1 SHA512 TLSH

Submit Download