b5628bb09ed9c234706e78362c31fd1152dd8ff3ac1954dd95da351ea5291f48

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 12:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fitsal.html
Size 11KB
Sample260511-pcnb9acv4p
SHA256 b5628bb09ed9c234706e78362c31fd1152dd8ff3ac1954dd95da351ea5291f48
MD5 47c5b05a9c38a63981fb2af7d3b905fd
SHA1 7399b838a4c486df9c770148532c060a1e3b14de
SHA512 eda68bb693c17d854d0140557691f45a9a58e10a20535340c454860678ababa5be2be96bc75f7f47178ddb5e7d13e18ce5f9d7d97076f500cdb5828b0914ff1d
SSDEEP 192:772q6mE94jTZLox1JJx4RWUSR2zu70emijtmFZHKizLiTiT4BdlhwTXih:7ylR0emi8zKi3iTiT40TXw
TLSH
T1D832D8627688043D66B3C1A971B5AB44FF36C107EF41019A34AD2A971FFBE414977BC8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
54	api.ipify.org
55	api.ipify.org
56	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1204	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134229753550096842"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2023547815-1162023398-1465618254-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2023547815-1162023398-1465618254-1000\{A679DB61-34E5-4F74-8CF0-3CAD91EE36AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe
3948	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 4708	3948	msedge.exe	85
PID 3948 wrote to memory of 1204	3948	msedge.exe	86
PID 3948 wrote to memory of 1252	3948	msedge.exe	87
PID 3948 wrote to memory of 1252	3948	msedge.exe	87
PID 3948 wrote to memory of 1252	3948	msedge.exe	87
PID 3948 wrote to memory of 4400	3948	msedge.exe	88
PID 3948 wrote to memory of 4400	3948	msedge.exe	88
PID 3948 wrote to memory of 2688	3948	msedge.exe	89
PID 3948 wrote to memory of 3108	3948	msedge.exe	90
PID 3948 wrote to memory of 2688	3948	msedge.exe	89
PID 3948 wrote to memory of 2688	3948	msedge.exe	89
PID 3948 wrote to memory of 3108	3948	msedge.exe	90
PID 3948 wrote to memory of 3108	3948	msedge.exe	90
PID 3948 wrote to memory of 3932	3948	msedge.exe	92
PID 3948 wrote to memory of 3932	3948	msedge.exe	92
PID 3948 wrote to memory of 3932	3948	msedge.exe	92
PID 3948 wrote to memory of 4136	3948	msedge.exe	93
PID 3948 wrote to memory of 4136	3948	msedge.exe	93
PID 3948 wrote to memory of 4136	3948	msedge.exe	93
PID 3948 wrote to memory of 1708	3948	msedge.exe	105
PID 3948 wrote to memory of 1708	3948	msedge.exe	105
PID 3948 wrote to memory of 4392	3948	msedge.exe	97
PID 3948 wrote to memory of 4392	3948	msedge.exe	97
PID 3948 wrote to memory of 3940	3948	msedge.exe	99
PID 3948 wrote to memory of 1920	3948	msedge.exe	100
PID 3948 wrote to memory of 3940	3948	msedge.exe	99
PID 3948 wrote to memory of 1920	3948	msedge.exe	100
PID 3948 wrote to memory of 708	3948	msedge.exe	102
PID 3948 wrote to memory of 4476	3948	msedge.exe	103
PID 3948 wrote to memory of 4476	3948	msedge.exe	103
PID 3948 wrote to memory of 1816	3948	msedge.exe	107
PID 3948 wrote to memory of 1816	3948	msedge.exe	107
PID 3948 wrote to memory of 1708	3948	msedge.exe	105
PID 3948 wrote to memory of 1708	3948	msedge.exe	105
PID 3948 wrote to memory of 1828	3948	msedge.exe	106
PID 3948 wrote to memory of 1828	3948	msedge.exe	106
PID 3948 wrote to memory of 2272	3948	msedge.exe	108
PID 3948 wrote to memory of 2272	3948	msedge.exe	108
PID 3948 wrote to memory of 5016	3948	msedge.exe	125
PID 3948 wrote to memory of 2924	3948	msedge.exe	126
PID 3948 wrote to memory of 412	3948	msedge.exe	127
PID 3948 wrote to memory of 2612	3948	msedge.exe	129
PID 3948 wrote to memory of 2612	3948	msedge.exe	129
PID 3948 wrote to memory of 4024	3948	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\fitsal.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa77d9c188,0x7ffa77d9c194,0x7ffa77d9c1a0
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,13441421607084707968,9669656223026975043,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1912,i,12123744090033122656,8259206395749001572,262144 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,9878362077874238048,12324111108154796140,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,6333077171398356732,10620728213437237288,2097152 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2137172955105600501,12179950691025430553,2097152 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,8578918197461798273,16516848988512389373,2097152 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,8523921887712627026,3705897989984909607,2097152 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,10265429755802070064,7664741601527114940,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,8968023238818004412,4661155372777992339,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,6802429412870862884,9420266488854756198,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,8846893311198621496,14513956347525471767,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6343916519159178298,8901920952294177712,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,6343916519159178298,8901920952294177712,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,14440603051391129128,5571415224518327575,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,6865532633240296656,2949116209555683585,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,89631820357171465,688607687599073271,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,9074431607451387106,10277031931347280589,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,7595810696845833115,15938374794944823005,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3436,i,11475859861688922476,11277099963206510581,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4176,i,13025116947319692473,16643014382707280419,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=4776 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4684,i,9236029042667396743,4096100631414584088,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5756,i,15806837397930553788,3723822925557035517,524288 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5308,i,4838833448915870596,11408046309508652612,262144 --field-trial-handle=2288,i,16950800285199485339,16971267307241538011,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3488

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:1816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cb613b38f1a2ef1d7f968013bee137482fd7f1b9ac432a185349ca7af1ddcc5c
MD5 5dfb75fa7d9c19610e7a0e36c8fa9ace
SHA1 2f2d9fafddeb0f80dc320ff1d41637d357584567
SHA512 2904ecccd4a8f7dfd1766d00e6bddd938f2984761d9b3102096a47d7382d9e1cc7e5e47e090e15e9a0a873b8b21bbb08944fb8fabdf711977ca38d16408fc276
TLSH
T132D0228820080C32E0AEA033888ABBCA2008CA0288038AB200B3288C0C830A0220A08A
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d704323915043d1e8ba1ac67c2c0cea4747fce2ec5dd1d452c54d67cdaa364da
MD5 9ecee64956ff7a6628d57b9d63536204
SHA1 124118908026144deced68554ae4d8aee4ccaad4
SHA512 5b6dcfdfbbcda770e04e542bfabf560ed4c2de634818798ce6a80545b8d4d2d3490a5dbaa210ed0a734269aee2b39bac9064b4c4a1b15d7894df5aea29ed2ac0
TLSH
T15CD02B8810440C31D4AD603344897BC61004C9014403C7720073144C0C430A0220A046
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 12cde70a93f670be4f1d41a7e26cdd1bf2dfb92619d1f9e186a095913db63169
MD5 2f9631551e4ea16071f7ec3b4f0ec02b
SHA1 a27a8c6cac671ce3ddb0431334fbb3acd841cd8a
SHA512 022ee4b16f3dea385ac1e366af3e9541b4a028225568be3dfdc6519b0b7176a146cb49d4d861f12a659cdf1b2e4b98a25c0f563a830fd555f856b840f6d5c0f4
TLSH
T13B61D45981988048EFE485B69E99109B73B1CB1F31EB5E6A32F2477CEB9EE1E0344700
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a5ff.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a5ff.TMP
Size 3KB
SHA256 60719f2c5f9238702e2d5718f99410093a4502a30f41e759bc0d5d0211b3b791
MD5 3ec37096af783896c46a3a91655c224c
SHA1 0820cf095ed04de054606f033c4488d873a978d4
SHA512 8641438f4e1fc560ce51da62668f98a1c15f315476fac86a02ac3cc32001dd49f92971833c672a4f03373421cb8577709cc222f11d812624abd47c3982462dce
TLSH
T17361E44981988058EFE441B59EA9109B73B1CB5F31FB5E6A32F1077CEB9EE1E0384710
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0e246897-cc72-4407-92b4-dbd0aded6843.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0e246897-cc72-4407-92b4-dbd0aded6843.tmp
Size 3KB
SHA256 82e41af4ae5377be8195f19a7d0fd45a253063f03fd8b05389f81b50a6fe7bdf
MD5 1995a8226e7a1d89a512925dde4f4201
SHA1 2c2cc5ea41bd6a7a6664e08f886b83b8fac325bd
SHA512 d385823ef5dfe69c49e176a043733a270d48dc19831b3e165d082a39c771686f4ce9e260a6857dc6295b24f6d3d20d1a440c7ce0b31f72e0dc2f51e6f8cef62b
TLSH
T13171ADF7C3D8866E991155F0AB256E2BCE1D0516832C3C5AC8F4AF4F67E24B0E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 9c8bb6989d3af156ecf96f796dae3784d1ff0edfc94582cc1f4904d709b75709
MD5 b506c3805e326b4c2b935042dd4b534d
SHA1 316a331e6e9dbda14efa1fd4ce47c3deaaaffd39
SHA512 e52fb5e9ac924a050f09930ddd1339a3a3715a01739a314665ec0ed42ec980c2178c199fcd96aeb2395ec27ceddc9e585b9fd29b6191a2939d59aa199c900f4d
SSDEEP 192:sxZ5RDyM//K1Ml8Mkd/fLsQVqhD0/ul6WIdpdjHW6+WNGtOhBkhad7Ig4J:sxZ5BMd/fLsQVqdam6XRHbGIc
TLSH
T1F252FA567B385977CCDBD219F645BB53D6F5053292500E48AAFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e778557d13060f9f5e49ca6253db78aed44072336a4334bc2de2966e6d007e98
MD5 8f5294cb484689676263308a6102a199
SHA1 65db538eb788b065a0cc8257df2a89b3777def1a
SHA512 d312b7bee101eed3326f8945ac9aa329535d4a3ae1d85fee9d779a4a0cb80ccb19c26bd30c011512caae2b0b41cd8608306024758efd1068d4926048b8223d65
SSDEEP 192:sxZ5RDyM//K1Ml8UQ8kd/fLsnqqhD0/ul6WIdpHjHW6+WNGtOhBkafg7Ig5vJ:sxZ5BqHd/fLsnqqdam6XDHbGNv
TLSH
T1E762F9567A3859B7CCDBD219F645BF53D6F5443292900E48AAFCCA0C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 e638d3b79c1f2f83bf20eb16e8abeed40c4797b98826560637356f74d4ac239e
MD5 e57c92749ac0f118b7a012d0a337dc9e
SHA1 3dd9a11d281ff9f905b04350ae38127300ee4be6
SHA512 0414d1b1aba9ceba2c8dd441bc47824ca16c6e15def268676a825585269345ef7446afd52254fc9c8d7a19bcbc02eef514f17341bced241c933f5c7e5130f7d0
SSDEEP 768:x9U2JTV7pLuLn7nWvB3u/8F1+UoAYDCx9Tuqh0VfUC9xbog/OVbI0sLl4CpRmro+:x9U2JTjEn7nWvB3u/u1ja+I0sLiaRdds
TLSH
T13AF20B7B3C4CCB7E4F804E9CEC2ABE8A6DE8018B96D8895447F9844C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 99bd79baf99b94aabd810fbf87925f7d1f1a5a8ecdefc8239fc939ac01ebca07
MD5 cadf519ced5d52180495d36025c03afd
SHA1 9ce8a6f78a07ea24c06dd68efd47168be7775c17
SHA512 4335427388eaf3bd52d0f54e0cb8f0bab31b09bcb141f87baa6df1c92fefb57e449cb2b13d0634ddfeb6be352b2b569e70bc12e5048410e05a678001555f5a47
SSDEEP 48:K88IXKFGcky9bIFKI0YnycDIZKMAEfytDI1KwUIe:K88gKFGNWbOKI0ajDWKMA2mDuKwUd
TLSH
T1F2C12458317F02613A7E298D9491B52F56C135A77068E42B7FB800A64F2BE20DDFDCE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59427e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59427e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ee85864d0a58caf37a6eab23021f6910271b58cc3a2bfe2b8a7156d63448371e
MD5 652f6ce1e8f3c26e128b2efefd9d8be9
SHA1 32351ebec891b16cdaff389796a920602100ac14
SHA512 6a402e982616077aa0f8c881030bb7438912ddfafa46581260f4b3212e023824918a366b6e0cab2eff5f94c697b116aa06c42174d5bc1b257f78b5cf0ea12c0b
SSDEEP 384:nJCcmyWCXsNymqhCcnHvPh/j2sbusENuCm2+ce4KV8p07Am:QcpXUqtPZ/51ENacI8p08m
TLSH
T15F827E717C3C6C73DEE26A5AF14B26174EE4603B56906E54DADC9F0D01DB6AC230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 99ae3a9e4e7d95c4e66a28ccbf338de25c70f4df2c03c53ff788e81f5f44105d
MD5 1aec42508efbd32ee863a28833d35c72
SHA1 1883ff99a1b5cc01d76b0e47f9f37a9fb867c83c
SHA512 f0d486f79901c1d12ce379e1a13390c249e6de15ed7873465bf1324b8d0f81e0c69a0f1265f16804e293ca8af41a21b05ecca4237f1425815f27a0129a957e30
SSDEEP 384:nyiF9CcmyWCfsNK8TUNTUlIlHqhCcnHvPBDfct/j2sbusENuCm2Ice4KV8p07Am:5FccpfHwgJqtPit/51ENkcI8p08m
TLSH
T161B23976EC68D97BEEF35B86F60A76578EE0106786889DD4DAC85E4C00C72ED130AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c404562fc9d38de5cb6709c3c46490d8ef7c7f2500f38b3b2eabd698387a6f76
MD5 489d96ab53c0539ce2e0e903dc6c967e
SHA1 a9447fda496e61059f588002a4344986734a5be7
SHA512 6a9e0fe34d4779b0f8104a74293a7e812a3845dbbfa3fb1f8aed9cde0faae5ec66fa4663d7c118b2381c2a1fff16861a1e3ccabc9e613bcd552fcd9ef7140206
SSDEEP 192:tONS6xIQmiUyiBM8R/j2wzwSus6HlmWHKRU6:tONS6aLMW/j2sbusEB6U6
TLSH
T1FD02D739686CBC77DEB3AE45F68636235F95103BA9552F48DAE85E1C00D759C2302C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 51e06baebb67b3eb93fc9f89f609a1b09ebc1e705155e7a4cf6498c5a2ce84fb
MD5 84979975dfc899a3e7ca17001283968a
SHA1 bef67fe9bd9aaec1348430050f4e56528481e875
SHA512 fbe3bc044cca818289199c4621e5f18bb38234600920e362c6ab88a366e2892ea1caa9dc90013b0aad215f89460573a2b955ba5dcd455fde74688fcba222b988
SSDEEP 384:nzCcmyWCXsNyHqhCcnHvPh/j2sbusENuCm2+ce4KV8p07Am:GcpXRqtPZ/51ENacI8p08m
TLSH
T1CE827E717C3C6C73DEE26A5AF14726178EE4603B56805E64DADC9F0D01DB6AC230AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97820c39fbd08e7f7a68aae5515718307e9d6fd025034729643edf0e63f13df0
MD5 c3c330bacac8b59fbabb84cfea91e427
SHA1 efe05f27954bf52b4f19e4178ee8fb4da086be7f
SHA512 dee0b7c5100946a604efacdf923b678464c10d542069b2d96b9c00d9d392036b921f0e91992939a8b3bd087698a1a65e04db02f6d7417418d087edbd941562d4
SSDEEP 192:eONb6xnQmiUyhBN8R/j2wzwSus6HlySuCm2Fx6seq4U6:eONb63WNW/j2sbusENuCm2ncU6
TLSH
T19312F8756878BCA7AFF36E56F14733239FE5202BA9456F44DAD84E1C00DB66C2316C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dafe610e-5600-41a3-b9da-a95bee2e6164.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\dafe610e-5600-41a3-b9da-a95bee2e6164.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 79949e9f404fe19eff4c5ec01dea4fddcc41f580420f9d6191900b4caf8e090c
MD5 8111707295698726490c4e522c16dde3
SHA1 cb75d1387600703472b550269562c6773743f8c6
SHA512 274cfc3c260d6b0033140c797f0b778f265f827be02b695dab5f96fd58ba27b80e91ef7b56bd63e5740b269be46d71d8543a1b02909ee4676ed8244bc6d98da8
TLSH
T1B6412A9CA6EA214CB3776F5A9FF6B92D447AB9372E06D45D00110D4F0A63B41C9B1733
MD5 SHA1 SHA512 TLSH

Submit Download

00516efc-8d93-4dfb-ab77-76342aad9717.tmp

Path C:\Users\Admin\AppData\Local\Temp\00516efc-8d93-4dfb-ab77-76342aad9717.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8cc43e94-08a7-4258-87f5-fbf03a58c3f8.tmp

Path C:\Users\Admin\AppData\Local\Temp\8cc43e94-08a7-4258-87f5-fbf03a58c3f8.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

680d4a8d-6a5f-4bb6-aee1-d7418942fd8e.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_1033297008\680d4a8d-6a5f-4bb6-aee1-d7418942fd8e.tmp
Size 147KB
SHA256 3256621f3c706ccdf5802b36fb5c35251d354aed0d31ac9fc8eb7d7239312e55
MD5 9c670f04d98ab7404f16423f6ee6cdfa
SHA1 8d01079b2d065731df8a7ef52f447cd4b7add353
SHA512 102cee76d9dfcfe91e044f529672fbec042b50c5db55a3cc137197b2013dd7f81e47f50dbb0db96cb621c5732610e1eb553c4146837c11075c7c4dbd67546a3b
SSDEEP 3072:F7R0M+jCozOtDTsjMcT0JnFjkbxnEbm/+OdGmlVVklFHEpCm+:F7WxxzyDTM0JnRkb5bJdGmJkvkpx+
TLSH
T12DE3E16D3DE6DE1FC41B58F53E64708BC80E8F0B820A644FB64988345A60B5D1BD6AFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3948_992793251\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download