4618bb258dc2a89ab3bbc49e99fdb686581c8df7ee793c2d0b99559ee4917fa5

Analysis

user interaction
yes
max time kernel
300s
max time network
293s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
watch.html
Size 889KB
Sample261110-sdctpabt9y
SHA256 4618bb258dc2a89ab3bbc49e99fdb686581c8df7ee793c2d0b99559ee4917fa5
MD5 23d234d9f1a00065a8a734eed0b48168
SHA1 f43c4b25a4b3f64a0df560f6c55bc7f356b1232a
SHA512 34c7952ae5cd1ee22d2871dfdd3a2c70715065ceafc48b501884dbb7af3ad49eeef53cb435f3aac5a797fecd3d1503a13068ad3045e34a2524e8c839232761fa
SSDEEP 12288:xJvDPvD/vDhvDzvDKvDCvD/vD/vDevDAvDsvDpvDFKc4:xSC
TLSH
T1DA153E54086868B29867A547DEF5FF3E5CE007394BC9DAAEBDB7D39C01EC6400DAE412
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4932	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{A490DB81-6314-4DEF-8878-366A13044C92}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 1092	3468	msedge.exe	87
PID 3468 wrote to memory of 4932	3468	msedge.exe	88
PID 3468 wrote to memory of 2276	3468	msedge.exe	89
PID 3468 wrote to memory of 2276	3468	msedge.exe	89
PID 3468 wrote to memory of 2276	3468	msedge.exe	89
PID 3468 wrote to memory of 4716	3468	msedge.exe	91
PID 3468 wrote to memory of 4716	3468	msedge.exe	91
PID 3468 wrote to memory of 2684	3468	msedge.exe	92
PID 3468 wrote to memory of 4496	3468	msedge.exe	93
PID 3468 wrote to memory of 2684	3468	msedge.exe	92
PID 3468 wrote to memory of 2684	3468	msedge.exe	92
PID 3468 wrote to memory of 4496	3468	msedge.exe	93
PID 3468 wrote to memory of 4496	3468	msedge.exe	93
PID 3468 wrote to memory of 2644	3468	msedge.exe	94
PID 3468 wrote to memory of 2644	3468	msedge.exe	94
PID 3468 wrote to memory of 2644	3468	msedge.exe	94
PID 3468 wrote to memory of 4436	3468	msedge.exe	95
PID 3468 wrote to memory of 4436	3468	msedge.exe	95
PID 3468 wrote to memory of 4436	3468	msedge.exe	95
PID 3468 wrote to memory of 4032	3468	msedge.exe	98
PID 3468 wrote to memory of 4032	3468	msedge.exe	98
PID 3468 wrote to memory of 3088	3468	msedge.exe	99
PID 3468 wrote to memory of 3088	3468	msedge.exe	99
PID 3468 wrote to memory of 3032	3468	msedge.exe	101
PID 3468 wrote to memory of 4624	3468	msedge.exe	109
PID 3468 wrote to memory of 4624	3468	msedge.exe	109
PID 3468 wrote to memory of 4624	3468	msedge.exe	109
PID 3468 wrote to memory of 844	3468	msedge.exe	111
PID 3468 wrote to memory of 2592	3468	msedge.exe	112
PID 3468 wrote to memory of 4952	3468	msedge.exe	113
PID 3468 wrote to memory of 2112	3468	msedge.exe	115
PID 3468 wrote to memory of 2112	3468	msedge.exe	115
PID 3468 wrote to memory of 4592	3468	msedge.exe	116
PID 3468 wrote to memory of 4592	3468	msedge.exe	116
PID 3468 wrote to memory of 4776	3468	msedge.exe	117
PID 3468 wrote to memory of 4292	3468	msedge.exe	118
PID 3468 wrote to memory of 4292	3468	msedge.exe	118
PID 3468 wrote to memory of 808	3468	msedge.exe	119
PID 3468 wrote to memory of 808	3468	msedge.exe	119
PID 3468 wrote to memory of 3088	3468	msedge.exe	120
PID 3468 wrote to memory of 3088	3468	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\watch.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffca980c188,0x7ffca980c194,0x7ffca980c1a0
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1984,i,4889917399705065995,11521751885078550678,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1864,i,5120367234772381140,3601902673877026715,262144 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,11330477165645409237,12889074110597071615,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,4170002087324695934,9856563421121978355,2097152 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4636858129218834712,5518118504101373247,2097152 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,6551535263693428756,3768128368922060944,2097152 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4208,i,11393831499917743091,16374600592337269602,2097152 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,10000963610011503975,16336786324868704118,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,5580735816390940743,15438532575323407634,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13783073841046242727,1202566919592102367,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,13783073841046242727,1202566919592102367,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4752,i,8220804740075558220,5963419428966216803,2097152 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,8437194516414787350,2167473896029917076,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6208,i,3215639264570842259,419620048844493766,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,15849701649121351105,16478987710492833294,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,1205374530420564178,17149006493915787399,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,1747504447843217598,7096099694192613364,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,1439416758003046476,16554539722256758271,262144 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,2160913152419636460,8399476462488510212,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3412,i,8485874660055354065,9445563059292374715,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,13335804704269027700,10295146393536385572,524288 --field-trial-handle=2388,i,4865138010697371117,15153075604081698191,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:3088

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3856

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0856f1d4-a5d8-42ae-a2d7-fa983571bf61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0856f1d4-a5d8-42ae-a2d7-fa983571bf61.tmp
Size 8KB
SHA256 0596df11a3786f55bc1dc332bbf0678ce7473468beb187c9ac9ef434908ea86f
MD5 00317f992a56a781d0d3101c198b57dd
SHA1 947b55cbe1e1f7b6a7b94b2a7552d9108f9e7f63
SHA512 31370811a48b28592d2ebde536d4accc6536927669904689c7d9d36f6979b7a376cea555ed32001a5a55fa583077fcc16eae75892bcf826bd8826ab7cfbba15b
SSDEEP 96:KqONk1QsjpfbUmjH5ih/cIPURHl8h4otop5aaDoBKP4v+Y1xf//ojdoxyqsoeQBI:BONl6JUm0QmiUyHcso//TeQBCxVU6
TLSH
T15E02D839BC787CBB9EF3AE45B48777239FA4106BA6912F84D6D85E1D01D725C2303922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

17a601b9-8fec-4028-a31c-25dac28539a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\17a601b9-8fec-4028-a31c-25dac28539a5.tmp
Size 8KB
SHA256 8868922676c67d502a1843e3b6b5fb684cc4755b4235d2dab14c717044623bc4
MD5 6868a142050b7b8a7a0d8f541b29054c
SHA1 c8078b8669f0ac94ee47ecf30a400a2c1e02eaaa
SHA512 c56130d248dfd6d97b91be9c9d60cec2decd20e19b5eeafd34c6f8ae2016e98575869c4405ba43d3fb6adb85d42156c209e668d8a2ba46117abaf5bed70d69d3
SSDEEP 192:OtONG6JUW4QmiUy3cxQo//Tet1NxIqNU6:cONG6+THmo//TydXU6
TLSH
T164120A35B878BC7B5EA3A984F48736138EB04127EB856F94D5DC2B1D05DB2AC6307913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

387c651e-bd79-4333-aa47-e31e6b977a6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\387c651e-bd79-4333-aa47-e31e6b977a6d.tmp
Size 21KB
SHA256 994fa56b14d17c582ff95d1c39dea684d526e37562e2142167ac1a59521cd169
MD5 8b45c336578a9272150ce46600872b14
SHA1 2d9e8997f7935aec596cc2e5acf9c3a245612f33
SHA512 ec3d3e540ebee7922c90666ea1a4474af96fd6f936c0ad9d45b4c176b31f3527199ef0d8a19f9ed3b1f9e2629b7347011ef0066d1be4eda1b886406b9c8014bf
SSDEEP 384:EiFzQkUSv3zsNl8TUNTUlIlhD/xTvobDszuh//TypXvaTZcOu+QIIlh:fFdjswglTvJy/bMXvaTZcOYLX
TLSH
T141A26D3398A89C7BAEB79A90F54B3207CEB08067CAD59BA0E7DD9A1D01D71DC2347D11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

0a159022-8def-4351-8788-09ec5a4733cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a159022-8def-4351-8788-09ec5a4733cf.tmp
Size 9KB
SHA256 aa08c25e22465244b973e4476ed3538acf1a3378d69660d5ff08b44198eb3c21
MD5 3b3b76ec7a1b2825783d618ae69b5430
SHA1 c19d8a359b6d439ef0a8347bfd7d129509f16c06
SHA512 c0f316ce828adfddc71b8d1bd381a69fb167984076ee440597463269cb9c1df44a3506f74c34288f8d745929decf80fe6a15726ab2021d60fa7a16c3d88ddcf9
SSDEEP 192:sxZhR5W0/fIsR+OQIdpdaHW6+WNGY36Wb5hIgrJ:sxZhW0/fIsRZxsHbGXo9
TLSH
T19F22A7516E28697B8CCBE209BA25BF53E6F9503251D11E58E6FCC61C05E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13176a14-3e09-4b04-b60d-2b42aed7ad6b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\13176a14-3e09-4b04-b60d-2b42aed7ad6b.tmp
Size 10KB
SHA256 56c7ac9094c532a76d9d874ef6fefa392997a060b8c1e766d13e30c3ffe9a7a7
MD5 26d6b106afeee15dbbc2fb5f70ad98cb
SHA1 ee580a40b9b0063959389ab1e2557c78b397fbe2
SHA512 ac0ad6d7e3df44d7d1d2aefc73526d4decf817948130fd8929e70f9b02debfac247aa978e936e8f9b98629a1e80b3ad2801440c30225b1fab24044e9972f05ed
SSDEEP 192:sxZmR5W0/fIsAvOyIdpHaHW6+WNGY36kwrhIg5gJ:sxZmW0/fIsAG76HbGXJC
TLSH
T1A132C7526D38697B9CDBE20DBA15BF13E6F9503290911E58AAFCC61C05E7ACD234780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b3efe42-c0dc-430f-bae5-8f023627c14f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b3efe42-c0dc-430f-bae5-8f023627c14f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

39c1c626-85a8-4b58-a692-27c7eda7db8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\39c1c626-85a8-4b58-a692-27c7eda7db8c.tmp
Size 10KB
SHA256 29685a642ca4c58cf3f8da192b5f2d4f613dff4e685aea09be47982eff107803
MD5 8ddfa11af41b23622c4596fd006d1a86
SHA1 6ea7e1dfbaa1c0d35d76d504ee8ca212342c215e
SHA512 2391e481c217b68adbb2940eebe4b0f1e46b0c735da30deb3763669a36b2e3de98f68863fa279404e3e52cca59114262d7465fda071b511ecca37e46c5364817
SSDEEP 192:sxZmR5W0/fIsAvOyIdpdaHW6+WNGY36Av5hIg5gJ:sxZmW0/fIsAG7sHbGXkC
TLSH
T1CD22B7516E38697B9CDBE209BA15BF13E6F9503290911E58A6FCC61C05E76CD224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5c77024c-c9ec-465e-9f49-8ad41af4e852.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c77024c-c9ec-465e-9f49-8ad41af4e852.tmp
Size 27KB
SHA256 fc55467b3cda7de27d79ac725cd04a046dd7e7fc4f43febbd78c5260e90e8aea
MD5 8e73049e269c58709d4dd0c0c23a4dcd
SHA1 27a46b45ec1e0e5f3493d76a2cac6112cda80016
SHA512 00c82090716e3906b53d02f6bb31608d7144d5951bdfadca3260dad9d0e75f74225a1516fec6c0869d4951b1a0549bad5cf317a2c42aa16c0b9e65f8eeb3ea9a
SSDEEP 768:hVKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/KroHp:hVKlm7QWvUYe0u1ja8/L/E/hHp
TLSH
T10CC2FA3B640CCB7E4FC04A9DDC5A6F9B6EA802C7A6588D4047FA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8411234f9a4175b14c1a0c5f64119f66f591676a4700abce4573f752ae90b64b
MD5 74dbcb7b3b69e2f538971548adc33a13
SHA1 f888e652852d43921649fe65723fd04608af1a42
SHA512 a41b9c2f88fbd15f8b253866b8d6feba44da589a590075b8067a901b08ca6e0f66e580a31c6a7336061af432a1623c69dab5af73bc73372fee50b7fca87ae4a5
TLSH
T189E0268524CCC66EE348754743AC634F8BA0361BD3C0A90E2788C4C4F045A84BAE6694
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 467719a22403862a288619e21365d9868e5b3617468540aaf4f698d5c3f672bc
MD5 4e2b41fc9006e01c8e086911870cea4b
SHA1 e82bcb957b26c44ac048da5b9c7fe532b833989e
SHA512 6bcebc9da06a39fef7b3814854162b12dbd0a36f64092dd078c2a8590c7df99df22f858c2ec538144465d71794effa8de267dd7cf18cff9e24fca073b52e3837
TLSH
T12DE026C565CAC22EE309649707F8630E86B0361EDBC4E94E5B00C8C47005B48F6F37D1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 3496c7e4596b9bc5193207e6ad283d2290d31b27dd78fa99b943b31e492432ab
MD5 711f9a6f28f40c23d47c1d177f334993
SHA1 326950eddc3950c0c2f6d6b42247a47099f1146f
SHA512 4e9bc1298ccbcb2733d3f619b36be0209249c02758725cc3c03eee5f71044fc8c37e9c25200681df109a75d64b898e76af81e3ce895d37266def11e3da7a54b8
TLSH
T11F51C5C10D7302A0E78B42700CD3D9837634A87249832E1B1EE7C4BB5B4E76A4DF6344
MD5 SHA1 SHA512 TLSH

Submit Download

c20db328-3732-4da3-8911-3770bee5edd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\c20db328-3732-4da3-8911-3770bee5edd0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

45e048cc-357c-488c-9121-bae8fa53478e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\45e048cc-357c-488c-9121-bae8fa53478e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

80a3749e-e24c-4131-ab65-4f4904a5fe4a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\80a3749e-e24c-4131-ab65-4f4904a5fe4a.tmp
Size 3KB
SHA256 4b3fc555c6eac71b5c7c4afd01c22b3de2d79c8a6887426152b362e5a8636831
MD5 3ec5173854de4f25b4b075c696ea03cf
SHA1 5d848cfb39ead7dec3701121a1439df54631afe8
SHA512 eb26609045526bafa0bd4e019afc7cafc147a9d2c8d763243a5b189f2340dd03ed6f320bc757c47e6f62a3c56f5f274aa4d0e2944c32a92a140e2278da7e6486
TLSH
T1A8819EB7C6D887AE881116F45B25A91BCD1E151E82383C5A8CF4AF4B63F24B1D20129F
MD5 SHA1 SHA512 TLSH

Submit Download

b0c90e9f-8c08-46f4-aaf0-8d847599d586.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b0c90e9f-8c08-46f4-aaf0-8d847599d586.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\67ff3bba-18e5-4c1a-b531-88ee750d756d\index-dir\temp-index
Size 1KB
SHA256 9d06685df2abb1e78407d723380b25ed025f2219ddaf9c5c3e35c353868cfb10
MD5 70649747e401ca2dcdbd1de2fa4f6aed
SHA1 502058adf83ea3977706f6e8428e86926617e958
SHA512 ecd5194cef0f34a58246c18b0b1834646be4556eec5fd8d1ecb4a218e21d96db045cb84a986160e7c31df2fa235843e01bbba82d5e6af5ec7f9ec5c2ce727eff
TLSH
T1AF31208CD8412BDED93021BB6A4C01B023B02D25FE0CC650A1F876BBB8012785383AFD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\67ff3bba-18e5-4c1a-b531-88ee750d756d\index-dir\the-real-index
Size 48B
SHA256 c73f48d3d387153e6d3cc3fffa5a1bb17a191e745fead93854bd9a28caa67def
MD5 6cd5824a1d53de5321176229401c99d3
SHA1 00eaefb401ce8d3eac407cc62d6752c02682134b
SHA512 98ad34ae1dbdd256a28030f5efd3c7f55c79b1155f49db7845ec9baf2280e4194cbac2cd31441ac8b4ad4c4b0d653a14a93dd0da2ca96c4ea6add95ec306378f
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 105B
SHA256 817af9125c22cc499615939955fe87988aedb3d0fedda6cd32a02eae71feca55
MD5 e4dedb6eb5727141e3bc45322a45a33e
SHA1 6572348a8de25dcc58e1a43913ed1281d27bb73e
SHA512 97fa5fb9359881895eb1966fbea4dbb353dcd7c6fed9e5c0ab1cd9812ff0518cb9155a5fedff96b485ea59d66cf4e959b91445adf5b417dfb76b50a0d68a9c1a
TLSH
T1ECB0125352320FA543A223B9C58E51871C2FCC3094047444F05D340930B9C3347D0EF9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 182B
SHA256 f693c074300d233ba4aadbe61ef1495d2ed876f946f14cb8100d33022fb2430f
MD5 a768b37af2a2b66043b25727af366d53
SHA1 17e32e238c95a2bd1d91f60850a8ab833fc3a3e5
SHA512 52b27575d490589cff2380b649581997129153d8c2d9515ba7f3c6ac12ce1aaa3233759959185ccd2df70d275cf1a3ad66cffbd18a0329672ed0d10386f8fa21
TLSH
T163C0228282724DA223A057A8814A80830C37CD21980A7448B844305A20B88318281AB8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 98B
SHA256 f54f58fa95395ab4cf7d38a4b668dfd3bf5ef8867db05b79e434d33ef0d4c327
MD5 d6f5c5c2a16fe4a452eea0091b4082d5
SHA1 debe6ed4f4d256e08bd965771877cf5e43d766bf
SHA512 90c04a4104b6f059b187bb159640f3157a181de1e1bdadec445698b68c5e377a391d186633329801001903d4f2911c868c4ad00c39b6e71aecad306ff5af366d
TLSH
T1D9B0129352124FBA43B567B8858E55431C1FC12091157444F05C140924B9C320AD1DF9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt.tmp
Size 100B
SHA256 d7250916567ddd40d72219598464faf8a34832cb42413cf94b447e487894218c
MD5 48b37c029e7608920a4dee6de7bf463b
SHA1 d8a95be0f8ab93ebf36bacb69f6ff86885395a13
SHA512 083d4f3435bdcc1f246822c5de86636afe37ce44a615094f929c700a85770cbfbb15aeaab481be3493a4bd6db8cd77a9909258c83138c2922c07cef8d6c6f841
TLSH
T1AEB0125352134FA643B567FC858E51431C1FD020915474C4F46C140960B9C320AD0DF9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 78981f58515152e1f6f0b70bba8ddc129a14a934926e56a252f1ae593b09544a
MD5 363654f49f943ccf3a3e07f8e7088f51
SHA1 ccd0546083a64cff5b5b6e8752def94411d70421
SHA512 c27c61fe5364e3da66b0142c291cfb33ce5767af8897857911f869ed57ffc08c3875a2ff498b1f26cb5d66e334b510d31abaaef1cfaf4ae3ecd51b113ac5c9b5
SSDEEP 48:K0q1YEqo4pb0TkIS8pK9g1apxS5YrMYayL2xMwuUUNb4PgISINK9s1uNxmdYHYo2:KIRyKqoy+h2KyQVJiKaYqH
TLSH
T13591EA01716B120039BD395984B5CF2B464231733419EB2BBFBD90B68AAEF145EFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c4d491fa-28a0-4c1d-adc2-74193b35430a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c4d491fa-28a0-4c1d-adc2-74193b35430a.tmp
Size 10KB
SHA256 340a502fd78e73201549938ae7b20138c24c305666368ad1f7575f1c252d222a
MD5 4d3bc2dd277e2a071770f8ecc2762ee8
SHA1 689e7b024e480b74b2f820f6840bc96cdcce24f5
SHA512 945bc4b6bce2a9038e3ba38688602a2e0cc2f93b0e2d01af00e5bd1313654ec3442e071ec44ad8bf221d5db3244694c78871034ede82fce965216448b83b7a53
SSDEEP 192:sxZhR5W0/fIsA+OQIdpdaHW6+WNGY36Wb5hIg5KJ:sxZhW0/fIsAZxsHbGXoY
TLSH
T12922B6516E38697B8CCBE20DBA25BF53E6F9503291D11E58EAFC861C05E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cf470958-c16e-4155-a2d8-c16afaf9d5d9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cf470958-c16e-4155-a2d8-c16afaf9d5d9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

22a12769-7461-4168-ab93-ae8bb5942d12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\22a12769-7461-4168-ab93-ae8bb5942d12.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 af82e4ce2f0d455932372ce3abdb44bb21466ad603c6e03bdec22fd5c4f79b43
MD5 ec9754ec34fba6a8710b8d3dddfa1a10
SHA1 3d1972dad04296b4da57c60535ea08413a1768da
SHA512 72fede95224b4b9f9c66b6c7e5105cc6487b9f04307474daf576989f367b6f9d765aa2d4962f7ae777319bf2e5b47b2a0b639075d407377f96b85ef521658703
SSDEEP 384:lQkUSv0sNbhD/xTvobDszuh//TyTXvaTZcOu+QIIlh:/0cTvJy/b8XvaTZcOYLX
TLSH
T13B826C36A8796C6B5EB3A590F44B3603CEB0C067DAD41FA4DADD9B2D05CB29C3347912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c99cd46a-6718-4521-9d09-1783f96abef3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c99cd46a-6718-4521-9d09-1783f96abef3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f03be3cd-5722-45d9-bca9-4ac364d83ceb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f03be3cd-5722-45d9-bca9-4ac364d83ceb.tmp
Size 18KB
SHA256 8e0d82a328e2f2e7fa0604cd6f984bbea81a178c6f1dee79fca98c09961cdfd1
MD5 8b85a58d7718e3b2414dc932e20e12b6
SHA1 a0fa44f42c9015b16a437bfc32abaa5b1ae55942
SHA512 a4ad357c9771662dc14acd2bb445d621fffe3fd1b0757a3677555ccdbd75c4ca3ccd39666eb2650121f42101056f2df2303d25f4f99ef0cf58567597048c75ae
SSDEEP 384:bQkUSv0sNb2D/xTvobDszuh//TyTXvaTZcOu+QIIlh:V05TvJy/b8XvaTZcOYLX
TLSH
T175826C36A8B86C6B5EB39590F44B3603CEB0C067DAD41FA4DADD9B2D01CB29C3347912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d5d8871b70c78e7143893103d905e75e2fa1bddcc84635bbc80355d407555976
MD5 6f5ea63ceca939b724c7ab7f0c5693f4
SHA1 b52008c1ea120878d28c55881e809f9e2f27ae0b
SHA512 11edf92c733d0c6e9d19a2195824d1795b6d63b8aaa43a6b57b2f8f9e7187603d361bf9de1780dd8171fcdefbab33f5f32e9d231de6cac6f8827930ea56e2f5a
TLSH
T13741EB5CB6EA1148B3B37E5A9BF6A86D487E79372E07D05E00110E4F0A63A40DD71B37
MD5 SHA1 SHA512 TLSH

Submit Download