01e4d316084d1d7de645b4371d7c98404ac14dee2e303d0cb7b13916e434e271

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 65KB
Sample261002-g4zwcssbkf
SHA256 01e4d316084d1d7de645b4371d7c98404ac14dee2e303d0cb7b13916e434e271
MD5 4602807bcec0b19aac301eb6355dba6d
SHA1 580011f3ddac08a78826687298465c126d84a974
SHA512 bbfcfa0fd6e7ecd266aab8d93c544600e31a0211da020d390815014198dfd9a62b50d38f0375010a6c8bf898e3c7090a79c8a13fde238ec79a086436b15f9976
SSDEEP 1536:p6ypaaII7xJE8V+O4w+ldfIw+VRJ3A63qHyIrqPk3nRqnQ:pzxnE8V+O4w+ldfIw+VRJ3AyaDrq83nL
TLSH
T13A63FA37A4F580361397C2CC45AFAB19A5939207E9074611F1FC12DCAFF8EA6A56312F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2320	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{F096EB1D-9C46-4638-8AF4-B82F2C613951}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe
4604	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 1700	4604	msedge.exe	86
PID 4604 wrote to memory of 2320	4604	msedge.exe	87
PID 4604 wrote to memory of 400	4604	msedge.exe	88
PID 4604 wrote to memory of 400	4604	msedge.exe	88
PID 4604 wrote to memory of 400	4604	msedge.exe	88
PID 4604 wrote to memory of 4804	4604	msedge.exe	89
PID 4604 wrote to memory of 4804	4604	msedge.exe	89
PID 4604 wrote to memory of 2192	4604	msedge.exe	91
PID 4604 wrote to memory of 4312	4604	msedge.exe	92
PID 4604 wrote to memory of 2192	4604	msedge.exe	91
PID 4604 wrote to memory of 2192	4604	msedge.exe	91
PID 4604 wrote to memory of 4312	4604	msedge.exe	92
PID 4604 wrote to memory of 4312	4604	msedge.exe	92
PID 4604 wrote to memory of 4044	4604	msedge.exe	93
PID 4604 wrote to memory of 4044	4604	msedge.exe	93
PID 4604 wrote to memory of 4044	4604	msedge.exe	93
PID 4604 wrote to memory of 2764	4604	msedge.exe	94
PID 4604 wrote to memory of 2764	4604	msedge.exe	94
PID 4604 wrote to memory of 2764	4604	msedge.exe	94
PID 4604 wrote to memory of 3216	4604	msedge.exe	98
PID 4604 wrote to memory of 3216	4604	msedge.exe	98
PID 4604 wrote to memory of 3216	4604	msedge.exe	98
PID 4604 wrote to memory of 456	4604	msedge.exe	113
PID 4604 wrote to memory of 456	4604	msedge.exe	113
PID 4604 wrote to memory of 456	4604	msedge.exe	113
PID 4604 wrote to memory of 1064	4604	msedge.exe	100
PID 4604 wrote to memory of 1064	4604	msedge.exe	100
PID 4604 wrote to memory of 1064	4604	msedge.exe	100
PID 4604 wrote to memory of 4316	4604	msedge.exe	101
PID 4604 wrote to memory of 4316	4604	msedge.exe	101
PID 4604 wrote to memory of 4316	4604	msedge.exe	101
PID 4604 wrote to memory of 5084	4604	msedge.exe	102
PID 4604 wrote to memory of 5084	4604	msedge.exe	102
PID 4604 wrote to memory of 5084	4604	msedge.exe	102
PID 4604 wrote to memory of 4672	4604	msedge.exe	105
PID 4604 wrote to memory of 3432	4604	msedge.exe	106
PID 4604 wrote to memory of 4672	4604	msedge.exe	105
PID 4604 wrote to memory of 3432	4604	msedge.exe	106
PID 4604 wrote to memory of 3460	4604	msedge.exe	107
PID 4604 wrote to memory of 1404	4604	msedge.exe	108
PID 4604 wrote to memory of 3460	4604	msedge.exe	107
PID 4604 wrote to memory of 1404	4604	msedge.exe	108
PID 4604 wrote to memory of 1404	4604	msedge.exe	108
PID 4604 wrote to memory of 4120	4604	msedge.exe	109
PID 4604 wrote to memory of 4512	4604	msedge.exe	111
PID 4604 wrote to memory of 1384	4604	msedge.exe	119
PID 4604 wrote to memory of 1384	4604	msedge.exe	119
PID 4604 wrote to memory of 1384	4604	msedge.exe	119
PID 4604 wrote to memory of 2712	4604	msedge.exe	121
PID 4604 wrote to memory of 3620	4604	msedge.exe	122
PID 4604 wrote to memory of 3928	4604	msedge.exe	123
PID 4604 wrote to memory of 3108	4604	msedge.exe	125
PID 4604 wrote to memory of 3108	4604	msedge.exe	125
PID 4604 wrote to memory of 4144	4604	msedge.exe	132
PID 4604 wrote to memory of 4144	4604	msedge.exe	132
PID 4604 wrote to memory of 4840	4604	msedge.exe	135
PID 4604 wrote to memory of 4840	4604	msedge.exe	135
PID 4604 wrote to memory of 1016	4604	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffed3dfc188,0x7ffed3dfc194,0x7ffed3dfc1a0
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,6215905141260227426,3966957665335197934,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,18373456826240329689,2581541502806846558,262144 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,15569732440923894643,12773127001912817539,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16910423697623973271,9705526128952793922,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,3819689194121027,17900497340416730985,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,14468438534387103375,3768917613573238710,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,6426636651544126776,4360614325794472840,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:2
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3448,i,12207842854773791502,3642970586059323230,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4876,i,11475563241318128063,1030462405870416311,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5312,i,1381200314724025313,4396302592224043192,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5520,i,3552076575068054414,16147450187949185719,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5184,i,15284306644307089677,13472454120333606648,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,226610123791058433,6769541941627722687,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3764 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,5121191085978624222,8679246404056578132,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,14411991726625424135,15249646709045077837,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5332,i,17194899639328021279,8341099400543060231,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,9056621293700550818,10924330426092780555,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,6442818395241540961,17929688069703195056,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,6442818395241540961,17929688069703195056,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6980,i,18003974478426974633,4000253802037590589,2097152 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,18146820535393365250,11144066689048284954,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4400,i,16356726073656691204,6671020187519504199,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,8458692284131241334,4602092175206796331,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,10568518515694845492,14979567077440738678,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2844,i,4720586456508387366,3023668156858697195,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,6332281153063761772,10013657235806217382,524288 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6760,i,15200436151624422558,629410719005228319,262144 --field-trial-handle=1984,i,199397393429158803,7400253996807986987,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4852

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24c0612a-412a-458a-a0cb-ccfe84238512.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\24c0612a-412a-458a-a0cb-ccfe84238512.tmp
Size 8KB
SHA256 abe337e3090c56ff0e216e085033781aa5ec88f0993e2bdf3192941e200bd197
MD5 78933c8d1544585064d4d1a304e48474
SHA1 cccce90d303ad792d852c8d0436ed0442c5b76ac
SHA512 ab6da778972fb1077309302db8c1b84217e4bb0f250c405212e53173c5ed0558804753c30f77cca985e7a194bea7f0631507877c710387be1d0367a5befe90d0
SSDEEP 192:EONX6nnHGQmiUydpQYcX5hQDP1njzorBRGMchUU6:EONX6nCIQNX5+DtP8yCU6
TLSH
T10402DC35BCA86C7B8AF3AE45B44637139FE5212BA5956B80DBE81F1C00D769C2306933
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d460c01-4d76-493f-af78-66c3d816f714.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d460c01-4d76-493f-af78-66c3d816f714.tmp
Size 18KB
SHA256 75f814f3cf0aefeb0df8f2921b1bbbe06b2f249c2d1614038cf58aae3434d1f2
MD5 284b657e3c420617ca27dc30fc6fa1be
SHA1 7de5aeedc0e0bda44972d822911eb62690cdd21d
SHA512 09159eb5b26cb20c253161e51aee57b2c1979dc50e0cf9865ac47d7e641bc9210f185512182b0ca8581ae0570d3802b139920d47955012afcaf8b2275fc58de9
SSDEEP 384:YZcIQsNFmAluULiqxJuQX5+DtP8gXJdrtgOIwZOyRJog:mQwluwffkDlJdrXsu7
TLSH
T1F4829F36ADB85C7B5DF7A545B18732135FB4A027E6C4AB80D5EC6F1C01D96A8130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72b1627c-aedf-4e70-b151-f6cf24c39dd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\72b1627c-aedf-4e70-b151-f6cf24c39dd4.tmp
Size 8KB
SHA256 7e5e682cd7027c75c916041ac33e3fd3dab07c5b27bd1af759a75eba25a8437b
MD5 438f384771d9c6b2b269d35a97743c92
SHA1 077019087772267870921fad6746e10662a96dfb
SHA512 fc5ca5a16a032a21a22905b78c1952c6e525f9260bab417e2ed4693d9583fad00932748e32e5cc0becc1fd31c0c137b1428d82fb9f9a37eccad923dcfc55b7ee
SSDEEP 192:EON46nnHZQmiUy7pUYcX5hQDP1njzorBRcX1ejg3urq5rU6:EON46nXaUNX5+DtP8gXddrU6
TLSH
T1F1121D35F8A8AC6B5EE3A995B0873213AEA55117E6847FC0D6EC1F1C01DE65C2349D23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d52be39-6758-49c0-84bb-a9e6342a06d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8d52be39-6758-49c0-84bb-a9e6342a06d5.tmp
Size 18KB
SHA256 dfbf2bc5bc046dd4fe9592b0b58050caa518c6b19a7899a829318f64443620bc
MD5 8b1eb94ef2dbcb3d428ba22b7f559c4c
SHA1 d1025405d20357c423b7bf0ab89b1a870e274cf6
SHA512 9e910936a031434c15f6f81f0446674e77fe16fd402f5a577f7cf58a49c3a78cf573287b8d96c0d2974eefe70458e1baa273248d1221f990f674a2e85d74b5c6
SSDEEP 384:8ZcIQsNFXAluULiqxJuQX5+DtP8gXJdrtgOIwZOyRJog:qQPluwffkDlJdrXsu7
TLSH
T1E8829F32ADB85C7B5DF7A545B18732135FB4A02BE6C4AF80D5EC6F1C01D96A8130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

2ba8dcde-37e2-49cb-a1cc-f926e60060d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2ba8dcde-37e2-49cb-a1cc-f926e60060d1.tmp
Size 10KB
SHA256 9c00564bd68ac7edcfa8830370184faebadc934ec67a3712640262061dd0110e
MD5 5b08fef179f0e55783f182bbe54f9648
SHA1 318ecb9915200ad3e940eac09b7848e3c4fe874a
SHA512 771cc2a34584dea2188984142d701523f343dc25371d37c39c32d0b5f7f6d5369b5d27cada62c3f045444249ad8957fb02b294630d42f39ba0367386199ee8d6
SSDEEP 192:sxZDSRUnobL/fIJsqrbsIdpdT+HW6+WNGYYBapOIgrJ:sxZesoL/fcsqH1IHbGfV9
TLSH
T1C122B8556E38A97B8CC7E60DBB55BF53E6F99032A1D01E48E6FC861C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dface17-cdfe-45d3-8583-8024320c10a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dface17-cdfe-45d3-8583-8024320c10a5.tmp
Size 10KB
SHA256 cffddae3013b458720663509aa83043160111338029910c7b11a2b488b2caad8
MD5 effcc32dd19eadf77190ba59db030c86
SHA1 0f954e559f052dcaca8a7cbc554e8b940a5d572a
SHA512 a67e9a9f26b26f3da4c88022360ced10ed36d87d3c1cdc2339e9b73a499dabc70cf5d2350fbb844c707bd6fbb2be542bdef4fcc4d1d4ba646efa151d9fc5dff7
SSDEEP 192:sxZ6SRUnobL/fIJs1QpbsIdpdT+HW6+WNGYYBbpOIg5RiJ:sxZ1soL/fcs1QR1IHbGfcH+
TLSH
T11122A7556E38A97B8CC7E60DBB55BF53E6F9903251901E48A6FC8A1C05E77CE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6b8a11a1-7908-4b19-8378-815963b3910b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6b8a11a1-7908-4b19-8378-815963b3910b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8df41a45-5bf7-4f6c-bba4-37427a7c1a2c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8df41a45-5bf7-4f6c-bba4-37427a7c1a2c.tmp
Size 27KB
SHA256 6d893c66f961e25848b92e230753a07652fad50526e9b9514f424e4f35e0cb91
MD5 58c71d31272d5596b85b87d9a9c5febc
SHA1 a69e6526a67ab909ffed04325f87f56c3a736020
SHA512 805ce688b4e74476ec3c50218df3204c313d88ecb5fbc35e821509c0e3c793b33f65bccc3ba5710280b3d7389731c3c811afc0c37b9c1dfe033f9fc327fe6198
SSDEEP 768:AByYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXzropXnI:AByYR7jWv3NpBu1ja/CL8OXA2
TLSH
T177C2E93B640DCB7E4FC01E9DDC5A6F9B6E9802C796548D4047FA984C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 624002ca89bbde23d6e77e67329f26bfaf588688444a587933160d7b8f3498ed
MD5 b3e0caee4fc37b2fc303e5aa06b0f36b
SHA1 1422b7100ac56a3cad8688eb3d1df4dcec695131
SHA512 31a7681607c9088c2e89044ac7c80cf0a7e4a965489f988893a8a8ba1b52bece0fef2a950eb95ec8261eacb773b868f91f06e9b2286495da80ba0a38038400e9
TLSH
T1D9E026F844CAC33EB31C648B01BD570C83A13F5B93C0799E1B00C6C97A4A880EAA27E4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8026cae3f1b904078817986375ccf83010785bbd3bd952fc7e3ec5be9537a3f8
MD5 aa34465d2c3ab226fd2b03d307281728
SHA1 e409db342c7d69bf8f13142cd1dc88df5921939f
SHA512 032b4a6aa94a2067fbe83505ff5c6e1b0995f7b503a3311f4b16e088cc5313bdb731b3968390d317e9b496c8cbb07b971c10fb8b95ba4bce496e143ca378ed60
TLSH
T163E020FC08C5C25D715C648701FC570CD780361B97D0AD5D2754C6487446C8476B1770
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 1fb79d97dfa305d5a5d6489168250ce991bcf827fe6ae660db64a975c9f4ee44
MD5 cda740e061d2284fdffac22369a60b1f
SHA1 3f22d60c34f2bb03ba18fc780450b5e4d220aff0
SHA512 0b0edac3d6937fdf6e1e42d2ff8618cf7a70ecd2271393930f9b08080e49d4c063df923143d9315784e147d986fd50d817a069c56fb9aa30bc3c1d3782bb7d32
TLSH
T19351A4834A635D40F35AC07EDCF19A87363095E1C7E35F4210A8C5F86A77B358B44876
MD5 SHA1 SHA512 TLSH

Submit Download

619a65f6-ecb7-4037-9a6c-d9da8b8f83d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\619a65f6-ecb7-4037-9a6c-d9da8b8f83d4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3fffc767-1a0b-4c78-b2ba-8595b1846723.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fffc767-1a0b-4c78-b2ba-8595b1846723.tmp
Size 1KB
SHA256 78fe21ffc96ef82264dff763d91fbd562f08d8b1045e3bde20c4d7010458dd5e
MD5 681516f8f15004d47d85a34588dd2d72
SHA1 8c65fb814371abaf3435248cf110b3d7c4fdcf75
SHA512 661f28de365c2f76b151a0760917ddcc9c09a6751c37ef008fe22dc05e95e24e78b75985b569e1f5a65cd16717c42197d52d7b485f14f80273433cb41918a3a0
TLSH
T118419FF7C3E586AD891156F0AB186D17CE1D0A1A431C3C0AC9D4AE6FA3F24B9E10158F
MD5 SHA1 SHA512 TLSH

Submit Download

5617a782-8634-4060-ae43-884cc0a20d89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5617a782-8634-4060-ae43-884cc0a20d89.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e92f5cb6-6d2b-4888-80f5-374afb276966.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e92f5cb6-6d2b-4888-80f5-374afb276966.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 28ca1b8eddba07018d4fe8514d4923082da06ea5915dc84c0d7ec8d8e0be7aaf
MD5 cabb9446a94c6912a9e8c06e2aeae25a
SHA1 7eee52e094dd02c3e7ad5b05889f4f2c16993374
SHA512 e43afabc027a65fec902b9d20108beabc8b4cc032de4ebdf978a8dd0da877fa888da7060800c977060fb2102c180cb76b6b0f7b3380545fa8e38800aa81d63b0
SSDEEP 192:sxZ6SRUnobL/fIJsypbsIdpdT+HW6+WNGYYBapOIg5RwJ:sxZ1soL/fcsyR1IHbGfVHU
TLSH
T13D22B8556E34A97B8CC7D60DFB55BF53E6F9903261901E48A6FC8A1C04E67DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bd57d90d47265e9a1c5598d725282010b14a3eff41db69776b9727d04d1fb89
MD5 2d859f7cc75b42288e6ce7723de969b3
SHA1 61396d7d111cbd2597a6d875f2c46c8dee30a5d9
SHA512 ced24957d547f5953997f21180d6c716bacb9de79ace0bcf8e6f6251e6bd7fcb60142baac80796b615567116a16a4fba95b768819bc3af8bf2c7ab3499aac097
SSDEEP 48:Kg6lI064I5bkjUISs5K9Q1K5xipYb8IKyLdcRtfLPwbD2jISlwK9l1Hwx1gYmnrd:KsZmKKkaKGkKDScc4KBKiY
TLSH
T1CE914625757B530039BE299882B49E6B018135B73029EA7BBF7C8191CD5ED046DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ae74a1c3-871b-44f3-ae5b-452261c05ec9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ae74a1c3-871b-44f3-ae5b-452261c05ec9.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14ac376b-9b6e-4efb-9017-c186886b4db3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\14ac376b-9b6e-4efb-9017-c186886b4db3.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 b6b0b23a001fff01c291364409156f8a0c1bac2d03da68aea86a96423ed62e51
MD5 f881b0fd0d720e05c7faa6e200327793
SHA1 67a1c46b94304dc4df7979aef6f1ba65a5fb2383
SHA512 ab332ee5a9ace41d060cf4e260ad7aa6a50365cfd01e9ded0fda4698e9ca0f6b80e27ea39acbea68b13768a2907e0a98f072952677e003e78a5b0dd237f9f03e
SSDEEP 384:YZcIhsNFmAluULi8xJuQX5+DtP8gXJdrtgOIwZOyRJog:mhwluwlfkDlJdrXsu7
TLSH
T193829E32ADF89C7B59F7A585B18732135FB4A027E6C4AB80D5EC6F1C01DD6A8130AD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

db3d6e25-b82d-49b4-8e8b-d9ebc6a2230b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\db3d6e25-b82d-49b4-8e8b-d9ebc6a2230b.tmp
Size 26KB
SHA256 e8910ee4a69bb916f6fe94e5dee82e74fa51d25957f9d898f0251d957db6057e
MD5 75ee2f06acd8f232ce2dfeb0da233d31
SHA1 c4682921fe5c69f924d39de70387d81370fe7357
SHA512 ad3e03f500d8347e0e296c7f46876e23e06de8c7bbbfea3417deca026de398f77554630c2017ba8daba8003f388a74c6680d0ca0c6a5d78d897b0cacb3e78ed2
SSDEEP 384:+iFiZcI/esNf8TUNTUlIlXAluULiq1JuQX5+DtP8gXrdrtgOIwZOyRJog:VFQ2uwgGluwTfkDlrdrXsu7
TLSH
T179C24BF258D7887BD9AE5747A37D2E038EBCD067B584A680B7985A1CCC451BFC30AD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a60d5b7f-716e-4465-9d69-52ab43e698c3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a60d5b7f-716e-4465-9d69-52ab43e698c3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed96948ef3f2957f9d326c05412c5e3bf145cfc3ab4d37087493b9647aecbab7
MD5 a1626ca47ac7efaecad2d3ed68c0d85b
SHA1 4e2e2fda2427721f83add82c328265c8b86be9b1
SHA512 c1d5f1ca293e0723c5f4dc1a7db83f94b07ca16fe3545d5d0ebbfd50ea6426e4f38f8ae681573fd0de049266a6a542434a0b093c3774c46d14fbcf4843a631cd
TLSH
T1F041164CABE91148B7B76E5A6BF6A97E487B78332A0A949E10110E4F0623F44C961737
MD5 SHA1 SHA512 TLSH

Submit Download

37795c24-7a1e-4758-9f9d-f577ada090c4.tmp

Path C:\Users\Admin\Downloads\37795c24-7a1e-4758-9f9d-f577ada090c4.tmp
Size 42KB
SHA256 7ffcc53cc8a9dc641d05a98244d9dfc53ba6c748d22252c889f8f8e8be259c7b
MD5 756cc45c4a51fb466e3235589835b7ed
SHA1 c8f869a8c3ddf70b249f49398e29d7ddc9516cbf
SHA512 2166e1488027f359f8cd4710af5efdbc9647028e1cecd9f4bdd600c59f821a95ead140083cfdc24970f6fcf3000f49d8c7dd41871c967dbad10b79ca9a89914d
SSDEEP 768:24DZdypa9PaoaIID9RJxA63qc2ylKr/SPk3nJ+b0vLBC:26ypGaIIpRJxA63qHyIrqPk3nRC
TLSH
T14013F77BA494406137AB83AC859EB708E0A691079A07DA65F0FC605CEFE47F600F725F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4512-192-0x0000014D54100000-0x0000014D54249000-memory.dmp

Download