hxxp://wgc[.]wtf/ | Triage™

Analysis

user interaction
yes
max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 16:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://wgc.wtf/
Sample261001-vafsaattfv

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
141	discord.com
142	discord.com
144	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1136	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{C5B59D9C-7356-4D13-94EE-BCF746AD4C16}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{6DF10720-2D5C-411C-83E3-F75923CC7FF1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe
1452	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 5956	1452	msedge.exe	86
PID 1452 wrote to memory of 1136	1452	msedge.exe	87
PID 1452 wrote to memory of 1680	1452	msedge.exe	88
PID 1452 wrote to memory of 640	1452	msedge.exe	89
PID 1452 wrote to memory of 1680	1452	msedge.exe	88
PID 1452 wrote to memory of 1680	1452	msedge.exe	88
PID 1452 wrote to memory of 640	1452	msedge.exe	89
PID 1452 wrote to memory of 552	1452	msedge.exe	90
PID 1452 wrote to memory of 552	1452	msedge.exe	90
PID 1452 wrote to memory of 552	1452	msedge.exe	90
PID 1452 wrote to memory of 4064	1452	msedge.exe	91
PID 1452 wrote to memory of 4064	1452	msedge.exe	91
PID 1452 wrote to memory of 4064	1452	msedge.exe	91
PID 1452 wrote to memory of 3020	1452	msedge.exe	96
PID 1452 wrote to memory of 3020	1452	msedge.exe	96
PID 1452 wrote to memory of 3020	1452	msedge.exe	96
PID 1452 wrote to memory of 5012	1452	msedge.exe	98
PID 1452 wrote to memory of 5012	1452	msedge.exe	98
PID 1452 wrote to memory of 5012	1452	msedge.exe	98
PID 1452 wrote to memory of 5456	1452	msedge.exe	100
PID 1452 wrote to memory of 5456	1452	msedge.exe	100
PID 1452 wrote to memory of 5564	1452	msedge.exe	101
PID 1452 wrote to memory of 5564	1452	msedge.exe	101
PID 1452 wrote to memory of 5332	1452	msedge.exe	103
PID 1452 wrote to memory of 4504	1452	msedge.exe	112
PID 1452 wrote to memory of 4504	1452	msedge.exe	112
PID 1452 wrote to memory of 4504	1452	msedge.exe	112
PID 1452 wrote to memory of 2492	1452	msedge.exe	119
PID 1452 wrote to memory of 2492	1452	msedge.exe	119
PID 1452 wrote to memory of 968	1452	msedge.exe	120
PID 1452 wrote to memory of 968	1452	msedge.exe	120
PID 1452 wrote to memory of 968	1452	msedge.exe	120
PID 1452 wrote to memory of 3752	1452	msedge.exe	121
PID 1452 wrote to memory of 3752	1452	msedge.exe	121
PID 1452 wrote to memory of 3752	1452	msedge.exe	121
PID 1452 wrote to memory of 1040	1452	msedge.exe	122
PID 1452 wrote to memory of 1040	1452	msedge.exe	122
PID 1452 wrote to memory of 1040	1452	msedge.exe	122
PID 1452 wrote to memory of 3456	1452	msedge.exe	125
PID 1452 wrote to memory of 4744	1452	msedge.exe	126
PID 1452 wrote to memory of 5468	1452	msedge.exe	127
PID 1452 wrote to memory of 1392	1452	msedge.exe	130
PID 1452 wrote to memory of 1392	1452	msedge.exe	130
PID 1452 wrote to memory of 1392	1452	msedge.exe	130
PID 1452 wrote to memory of 1828	1452	msedge.exe	131
PID 1452 wrote to memory of 1828	1452	msedge.exe	131
PID 1452 wrote to memory of 1828	1452	msedge.exe	131
PID 1452 wrote to memory of 5200	1452	msedge.exe	132
PID 1452 wrote to memory of 5200	1452	msedge.exe	132
PID 1452 wrote to memory of 5200	1452	msedge.exe	132
PID 1452 wrote to memory of 4620	1452	msedge.exe	133
PID 1452 wrote to memory of 4728	1452	msedge.exe	134
PID 1452 wrote to memory of 4728	1452	msedge.exe	134
PID 1452 wrote to memory of 5188	1452	msedge.exe	135
PID 1452 wrote to memory of 5188	1452	msedge.exe	135
PID 1452 wrote to memory of 3016	1452	msedge.exe	139

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://wgc.wtf/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffeb03fc188,0x7ffeb03fc194,0x7ffeb03fc1a0
  2⤵
  PID:5956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,14849303255802202529,16101425992043491774,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=2880 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,7223088518126035457,4848858100759815276,262144 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=2848 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,9610352026849465239,8379279792076777559,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,13883227429602010510,10458259613438861993,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,4090396550834307798,7871492683889910621,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,7375576130064703570,6880528723335872125,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3568,i,10079930633727103927,11874578462884235368,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3708,i,4186246828802157401,7456123581822934047,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:5456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,899688043170706565,11496164306445303354,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:8
  2⤵
  PID:5564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9547135986093248986,9615769076991264582,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,9547135986093248986,9615769076991264582,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6076,i,13467809170072089267,5058048994633620579,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3452919033495081839,14714652576339328841,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5192,i,1155932978994774401,13376986234297750972,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6332,i,8930741262429679594,12007417507591637966,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6284,i,4899848516300533138,14375408967608192876,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,6324162552759000673,4690820352628479404,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,5805218736343188700,14902901060379519991,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,11684424245421835903,7853329454517077299,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5292,i,12099580922978678365,14414569106843719981,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6312,i,18066784566645238451,3554694404692942793,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5172,i,11960636575265547729,6222895288152263081,2097152 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3648,i,17080855228084806217,4807596023283182322,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,14760065705743456490,9424620377905040826,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,4387685116803251184,1998696109419917197,524288 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6080,i,5735212639834848577,14946384572155178008,262144 --field-trial-handle=2852,i,18244835439708318406,6307508990522484618,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

088189f6-0564-4878-954e-54fc2200ead1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\088189f6-0564-4878-954e-54fc2200ead1.tmp
Size 25KB
SHA256 e318c92be7e7355246a35dd332ba093307d51c03a299021888f8131fbaed1c9d
MD5 3508570015f957b831cb5d25efc5d26e
SHA1 155185d776d5863093faab1eb793b2bb34e9477a
SHA512 45f6e97d623d9c73bc6f7c7c0b70137cd5b15a34632160441c9ed708d7036e3a14fe931d5b41a184d30a0eb4740cae96589a846c933a2e70237c6e7526a1ab64
SSDEEP 384:nQiFiZcI63sNp8TUNTUlIm25mg5Bn4zfMBhFd1rv0cLMYt2sa+VYdzgL/7Izhop:rFQ63wwgSCxBhFdOc4Yt2hg++
TLSH
T11BC23972EC94D9ABE8EB8FD6E78A7A03EEF0116381DC59C4DAD85D1D009719D1307C2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26452efd-5ec9-46b4-9e89-a2c9111b4441.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\26452efd-5ec9-46b4-9e89-a2c9111b4441.tmp
Size 26KB
SHA256 a0850d7e41ea0f13723a243a7c89ff6a38adc220b5fe6bb44104409d4ff1b800
MD5 b5bf66df6175e24c0582f58d608bd848
SHA1 6c8fe1f20149ab618f065f6855543de3f40b4023
SHA512 ccd4f5a0a632c1631d8af6ef43f3e2cce55cdb516538fad07947cf5243e14a9bb3ce2b61f3bf7559e4ee508b71eb6ba15211009577be61839fd503cf9eeb59c8
SSDEEP 384:neiFiZcI+3sNE8TUNTUlI4p5mgJ6G4zfMBhFd1rv0cLMYPC2VZh6DKhHH4gL/7Ik:1FQ+3ZwgtfIBhFdOc4Yq2fYGHHDP
TLSH
T123C24A72E8A4D9BBACEB8AD5E74A3A03EEF01153828C9AC4D5D91D4D00D71DD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7154e7db-d813-42fc-807c-af0ce1d00725.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7154e7db-d813-42fc-807c-af0ce1d00725.tmp
Size 26KB
SHA256 c4a075e039b275ec304c0029bc0327d1a3d7059f4d23a7b446a2923710cd43d1
MD5 93f6693a745a67917b4ea3abfa595dba
SHA1 31ab2275ba57ebfdae74cb4a962b544b9a106b08
SHA512 d2adae29761c969230e295e1219052736e04892f8d89e0a157b20a7bd1b2f76881747bd7d25d063d43274c8522721965519ed408cc2e07a02afebed757b6b2ae
SSDEEP 384:noiFiZcI+3sNE8TUNTUlI4Q5mgTXG4zfMBhFd1rv0cLMYPC2VZh6DKhHH4gL/7IP:zFQ+3ZwgGsIBhFdOc4Yq2fYGHHOP
TLSH
T1ACC24A72E8A4D9BBACEB8ED5E74A3A03EEF05153828C9AC4D5C91D5D00971DD170BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dbab084-137e-42b8-9256-8904c8e4ad08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9dbab084-137e-42b8-9256-8904c8e4ad08.tmp
Size 31KB
SHA256 ea4852f7f066ad8d22836e83a4850a0f4854fa0c5e6870434aeabe444f007319
MD5 5c43ded80579b2d5cb2d86e14cd013ab
SHA1 5dd3fb56f02a80518d74d5af9469a7c19792b2a1
SHA512 357f71a8633c5efa84375d530be992314fffebdeb6d0daad3643cddcda33c2f5fb30f313439563e6ea46f0c1761c45290e6f75ea53f797bf84ef8e7098210fb9
SSDEEP 384:nbiFiZcIXYsNE8TUNTUlI4Q5mgTOG4zfMBhFd1rv0cLMYPx2VZh6DKhHH4gL/7IP:2FQoZwgGJIBhFdOc4YJ2fYGHHOP
TLSH
T159E2C3F298D78977E8AE4B87A73D2E0299FCD153B1885984B7C81D0DCC961BFD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

412eecaf-fbd3-4ad7-a0a1-ab13b628c947.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\412eecaf-fbd3-4ad7-a0a1-ab13b628c947.tmp
Size 11KB
SHA256 5a3423d5da7c344e3cdc7c9d02a86233a25eed4b8ceec5f5f4b021ab897b849c
MD5 c54a525eba1fde3d971fe074400b48fa
SHA1 b8039b19317a33fa814ef1d50d93bb1172a80a83
SHA512 23c190fd1da970d8f92c0dcc38bed5f94a8329e170d3665e10b38faebe8ef827bc8b4d7b5ba73ea52c609a6ba72fe843a59860538b1066b1136ec488f208c6b5
SSDEEP 192:sxZeRvkv/ffsaQZZ9FzodpIjH6n6+WNGYbIa6YSwIg51gJ:sxZeev/ffsaOZ9OaHVGFJYFzE
TLSH
T11442E955AE28A97B8CC7D21DFB55BF53E3F91032A0951E48A6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f298da9-5a6b-426f-b574-48727b76ac81.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5f298da9-5a6b-426f-b574-48727b76ac81.tmp
Size 11KB
SHA256 ce4006dc268359ea681d130aecb3090776d6a1ab3e6e5aee1e6c2e837e7f1ba8
MD5 ea2f1c3bd8c80861ae9e6c2154d1d6b9
SHA1 5ca6039d81a2d00ff24d8986a22db066f25e1cbd
SHA512 a13940e8672d71a8f5d76826545f2dc8843b8da34b8ce41720703701150b484d7c4267cd7de6510cd451f4560ca32f4754b83d7bb3b322fec8bb803f2e7ba93c
SSDEEP 192:sxZeRvkv/ffsxQZZ9FzodpIjH6n6+WNGYbIa6YSwIgjgJ:sxZeev/ffsxOZ9OaHVGFJYFjE
TLSH
T14A42E955AD28A97B8CC7D21DFB15BF53E3F95032A0851E48A6FC9A1C14E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 9KB
SHA256 495225c2a6bc0d671a36565cb04c976a7fd7104c85e71f50e147abfe2304e023
MD5 5b9e61f2c8cef831763fa1fc21c49c13
SHA1 0a7847e67c8b46ed2020d3c00e3c6331a57de9d4
SHA512 236e1fa17bb21f4cfc74889b4f78d67c0f24e767e9ef29abbb6285b16de91207faeddac7fe65017e58b6e00250c41e65e80802778575192a1cf54a05dc0252e2
SSDEEP 192:jweALqS2rxbMdVRFcGDCVnhdCnxsfT4x871vmHfFKWBTSdYfIRSI:c112rJMdRpYCnSrt8NVTSiIf
TLSH
T10A22F96160937491FF9C487285E826CEBBB4417435B30EE2C45ADDB6BD3A3B8C45688F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6ffa6e8e0ca765125aadb0f98b729c9849abe441fe5c013b90e849b59dce1222
MD5 2c0c0e8d1c8ad824b1290f66d45d0375
SHA1 9530ea5992e82f694fe2a228ef9ac88af09e12f8
SHA512 fd9bfd83bc3f8b84b0b75fa653cad00484d856d196b12843a166dac57b9d921f1e90409036644b4202546ba02fb5e94c25a6559eb780d6b67c6a0ace5237d710
TLSH
T13151D7B8BA9088D0FB6C4831D9DC2287FEF485843E935E461597E8B8AD7A77CC0B1850
MD5 SHA1 SHA512 TLSH

Submit Download

69530298-26d4-4e62-a9d8-7c8f4d93c525.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\69530298-26d4-4e62-a9d8-7c8f4d93c525.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

11e5abab-9b7e-4aed-a7ca-681c52583ec2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\11e5abab-9b7e-4aed-a7ca-681c52583ec2.tmp
Size 211B
SHA256 9543b7e1e5fe7371f02712040577120c74c29dd8a16322dc27d64e8d0609bc72
MD5 ca2c4ac81a8d7f0ba00c5969042a5da4
SHA1 8bb601b5bfc7a2dc398b23870d3e418aeb08bd48
SHA512 1c769ae135cd64f50177a0932c9ef0c3dd96ca5b3e1125e1ec74073ed43b1bb0691d802e12f2c79da785677b593be37b14fa6c05abc7777733d4ab9e43d3a917
TLSH
T1CCD02223270830F5A57CFE85906EEC8FC3A710200982EED850E2DCEA0A3546D9A9714A
MD5 SHA1 SHA512 TLSH

Submit Download

45d692ea-834b-49a1-98ac-adab0467a86e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\45d692ea-834b-49a1-98ac-adab0467a86e.tmp
Size 3KB
SHA256 bc71742bec2307e40179c7c4d900d19a3288496f49eca22869166cb0e0b95c84
MD5 69b28e7404d8fb67acc32eb6d9e150e3
SHA1 216f5b5a244eb7311f9e8ba6613b8bc739fc6a0f
SHA512 85a187b713d5e3ec3fc13da84acbb66862f696c6a5153dddb76a86d0ff171facb507124a36a3f2d1218b5b5392b6cea04b749005c1da5751bdf86547b02caef1
TLSH
T1A9819DF3C7E8862DC91556F0AA18BE2BCE2D0954432C3C2EC8D49E5B97E2571F181A5E
MD5 SHA1 SHA512 TLSH

Submit Download

92b1a6c5-ad26-429a-be96-c52f0699b195.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\92b1a6c5-ad26-429a-be96-c52f0699b195.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

b1a2db0b-2a8d-4ec4-b8ea-942b2865b9c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b1a2db0b-2a8d-4ec4-b8ea-942b2865b9c7.tmp
Size 3KB
SHA256 bb3d850e122de34ef16e63af9918ee0a41053ef840542d349d84990abbf8b93b
MD5 bc6d3769429b0532a5c3118b6d313150
SHA1 7a26392e03da73ff9ce99453004158e760a8d456
SHA512 d90bbfe2c436602b27d2bbbb392155c11b4a46db8fd3a315b01c8aa068109ee0b3bc25e9c3d1043016a15c9b2b75b2c129a47c8e14d12ba027609dc42f791285
TLSH
T1AB51C0F3C7E8866DCA1152F0AB18BE2BCE1D0955432C3C5AC4D4AF5B97E2471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

d4699b58-9f7a-4389-b49b-f7d76911a62f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4699b58-9f7a-4389-b49b-f7d76911a62f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 138B
SHA256 6aa5f3cb93ac9f28827dda7b21157b724364d3f43d501ab7738a3e062f035603
MD5 fe3540f1491719b739d90aadfd65c972
SHA1 bdd46a811bffc8fe9e249bd67ecec8702fc8419e
SHA512 e19334dc22f57b7d6537a25d7a3cd35a3850011d2ae657eb54f5497f7d1288e1287275432aea1e99eb51ace1f0303a15aa9e02aaa4a732709973568e4ff5e0ab
TLSH
T13FC02B6BF2400941872243C00333015C43092CCC0885C08D740330282178F637205FE1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 233B
SHA256 1b4cbac2ab701a0cf62279c79328f144f134b6ac0ad682e222f07f1528de0011
MD5 462ed0fe365690399934180a7a3e5c1a
SHA1 fb68872424821eb5304160033083681d33c0a307
SHA512 6f460f2edd6b7002a8629886f93a9003ceb20fbce497eae641380a34cc92014ab29978ba5dcc78b6905f43826851d1f8c1e32158b8f5948fa65b4087cca25c71
TLSH
T15FD0971FE2120880E3AE8BD02723015A076A2C8402D2904CF483303C0DB8BA7A229FD3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt.tmp
Size 226B
SHA256 84bb5a5970fe5ad9a92b6a74d753dbd76b34b934335b758883741fe7b1feb070
MD5 630df0f628822af1cfa8a56fe062bacc
SHA1 ab60f93cd6ca2607affa1e75ae0ef5262d200f8b
SHA512 27b07306d9093fa0af0d006d63ce04d84e259b4bef42e4a5035e4b1126a06f90d9a4f1410fa9a03cbac6d9087a16e4601958f60f9cf7add6245eaf28cd491f18
TLSH
T186D0971FE2010980A2EECBD02723002A031A3C84029A808CB48310380D98BB7A22AFD3
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 20fe8466a0a02d7948dc8c602093ebec3c43b10815e933acfe51b30bdac0d32f
MD5 708f0ddc706098f3c55e91aaeba8d42e
SHA1 c49bfac0d34f844d5438f9f93b06ea8dfad90d19
SHA512 353d829478f4cc4d98b7db9f68ca97125ac98988700f64ebb3cca9448f82b056c6e0e036b75e46e2f1a8803f240bd05b6f39f05683cbba539b557551b3ffae25
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXgDP3:OtfFvpopPxrB4Rhfgr3
TLSH
T1CBB2341571BA021138FE690C81B6871E064232B37158EA7B7FBD14B69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ad6cd62b-1c9a-4452-9914-3040dc108c66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad6cd62b-1c9a-4452-9914-3040dc108c66.tmp
Size 649B
SHA256 5a0850a58645462a6c7e3bb8211ae1cb3d4ca880439cd26858cd8743ccb45c6b
MD5 9908fdc3030d219342b766b379f950de
SHA1 ed487239ea3f39423e21c418879c6dba6fc00db7
SHA512 e1fc6eb984f718367a46a36583c5afb9768b551f8cf888dfecb2a36d961ae3aaef2f3256a875bf4330b6c4119411a2803a9f4a56abe47dbc0adddfd04807d820
TLSH
T114F0F9B5CD25EC3B08FD1B2850544646F75113572680888B3B3D950D8FB5A37868A95C
MD5 SHA1 SHA512 TLSH

Submit Download

b73b45af-f542-40b4-996b-c6f1f4cdcd83.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b73b45af-f542-40b4-996b-c6f1f4cdcd83.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbea56d0-f68d-4195-8424-5156cc60ec18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cbea56d0-f68d-4195-8424-5156cc60ec18.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f57d10df-9284-4b7c-9f4e-0f1fc0cddac8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f57d10df-9284-4b7c-9f4e-0f1fc0cddac8.tmp
Size 12KB
SHA256 183a57b9ead5f33ea3663f2b078fca88578ee1a5986c77d977daa84c1091716d
MD5 888700b48da9df0ca40b13e6545e80c1
SHA1 bca3fc48d1937544a0027acb1a59394e71139049
SHA512 cf36ee9c33cc3cd3d92ce791b5d42031cd2b385d2137b37c78ce86eaf0a13cc144de3ea3f14bec853cde82e1570a8f22f0b922708dfb10b6f1846f7c0af90686
SSDEEP 192:sxZeRvkv/ffspQZZ9FzodpU4jH8Jn6+WNGYbI26YSwIg51gJ:sxZeev/ffspOZ9O/H7GFVYFzE
TLSH
T16542E955AE28A97B8CC7D61DF754BF53E3F92032A0951E48A6FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fd139e0818d50e22478985b73e48ecea6f02caa653d961a1af5517059efcdd00
MD5 80f185f33849767a641c40d387f6fed3
SHA1 17c8189ca4820641ecc25703442e4534b859e277
SHA512 f392f78e98d36109711353844a39ec9e565589314d81a72ae80a9d9903e5af4c358dd90c495175f5b4a248fa99932398ef0f6c59c05a52a2f1581a3a32abbd7b
TLSH
T14141E958A6FA1148B7B77E5A9BF6A86D547B78373E07D49D00010D4F0563B40C972B37
MD5 SHA1 SHA512 TLSH

Submit Download