hxxp://tcnoqxjtpl[.]1aheimarbeit[.]eu

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 10:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://tcnoqxjtpl.1aheimarbeit.eu
Sample261002-l1pcnsfc88

Score

6^/10

microsoft discovery phishing

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
119	api.ipify.org
120	api.ipify.org
121	api.ipify.org

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
57	3992	msedge.exe
57	3992	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3992	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{46F5B30E-E181-4A33-B1B9-747531C32C8A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5328	msedge.exe
5328	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe
2460	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 2128	2460	msedge.exe	87
PID 2460 wrote to memory of 4436	2460	msedge.exe	89
PID 2460 wrote to memory of 3992	2460	msedge.exe	90
PID 2460 wrote to memory of 4436	2460	msedge.exe	89
PID 2460 wrote to memory of 4436	2460	msedge.exe	89
PID 2460 wrote to memory of 1336	2460	msedge.exe	91
PID 2460 wrote to memory of 1336	2460	msedge.exe	91
PID 2460 wrote to memory of 5084	2460	msedge.exe	93
PID 2460 wrote to memory of 2700	2460	msedge.exe	94
PID 2460 wrote to memory of 5084	2460	msedge.exe	93
PID 2460 wrote to memory of 5084	2460	msedge.exe	93
PID 2460 wrote to memory of 2700	2460	msedge.exe	94
PID 2460 wrote to memory of 2700	2460	msedge.exe	94
PID 2460 wrote to memory of 3216	2460	msedge.exe	95
PID 2460 wrote to memory of 3472	2460	msedge.exe	96
PID 2460 wrote to memory of 3216	2460	msedge.exe	95
PID 2460 wrote to memory of 3216	2460	msedge.exe	95
PID 2460 wrote to memory of 3472	2460	msedge.exe	96
PID 2460 wrote to memory of 3472	2460	msedge.exe	96
PID 2460 wrote to memory of 3444	2460	msedge.exe	100
PID 2460 wrote to memory of 3444	2460	msedge.exe	100
PID 2460 wrote to memory of 3444	2460	msedge.exe	100
PID 2460 wrote to memory of 292	2460	msedge.exe	101
PID 2460 wrote to memory of 292	2460	msedge.exe	101
PID 2460 wrote to memory of 4572	2460	msedge.exe	102
PID 2460 wrote to memory of 4572	2460	msedge.exe	102
PID 2460 wrote to memory of 4572	2460	msedge.exe	102
PID 2460 wrote to memory of 2816	2460	msedge.exe	103
PID 2460 wrote to memory of 2816	2460	msedge.exe	103
PID 2460 wrote to memory of 2816	2460	msedge.exe	103
PID 2460 wrote to memory of 2572	2460	msedge.exe	104
PID 2460 wrote to memory of 2572	2460	msedge.exe	104
PID 2460 wrote to memory of 1452	2460	msedge.exe	105
PID 2460 wrote to memory of 1452	2460	msedge.exe	105
PID 2460 wrote to memory of 5100	2460	msedge.exe	109
PID 2460 wrote to memory of 5680	2460	msedge.exe	117
PID 2460 wrote to memory of 5688	2460	msedge.exe	118
PID 2460 wrote to memory of 5696	2460	msedge.exe	119
PID 2460 wrote to memory of 5476	2460	msedge.exe	129
PID 2460 wrote to memory of 5476	2460	msedge.exe	129
PID 2460 wrote to memory of 4676	2460	msedge.exe	130
PID 2460 wrote to memory of 4676	2460	msedge.exe	130
PID 2460 wrote to memory of 5652	2460	msedge.exe	133
PID 2460 wrote to memory of 5652	2460	msedge.exe	133
PID 2460 wrote to memory of 5652	2460	msedge.exe	133
PID 2460 wrote to memory of 5328	2460	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tcnoqxjtpl.1aheimarbeit.eu
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc7cc1c188,0x7ffc7cc1c194,0x7ffc7cc1c1a0
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1916,i,10307813062620997396,15766866290159447551,262144 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,13399613761780384918,5486358709620506270,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - System Time Discovery
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,15159833648777793664,10190016470989797983,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,4527967164392976425,2973190511086635428,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,11695508292456301376,4433685864382189785,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,10198269028494437323,15967055042656494493,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,9008409042176416883,5161117955882682678,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4972,i,13547112720831046133,6013942748497402347,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,7182298738827552064,18284746575990408429,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5316,i,17007707826319627734,10755418323642482357,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5416,i,15206794011706484870,14507184323849037060,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,3982653462740090742,11549766783422288415,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:8
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,4300340165845862599,11400506604956403615,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,12554234315088018302,4944676978795644932,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,12554234315088018302,4944676978795644932,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,16298030148783658661,5167273241710809247,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,3865197012871444121,15195302982694910110,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,11086058375927125188,7116007776360571949,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,15192080868111327462,12739386686375428083,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:5476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4432,i,7811470126806990024,4791822842348010509,524288 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=7224,i,8664954982328045863,2119441652457275666,2097152 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4408,i,3385588703676274793,10830397629337112086,262144 --field-trial-handle=1804,i,6272518891504602741,11681772882845166372,262144 --variations-seed-version --mojo-platform-channel-handle=7308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5328

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3576

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37f1cedd-cd8d-4c4a-8240-3932b3816ec8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\37f1cedd-cd8d-4c4a-8240-3932b3816ec8.tmp
Size 8KB
SHA256 0546b8fe94ad0fbedda57d4073fc9d2126b2c8eb4c81e4622ccff8dd9245c636
MD5 44bc49bcaa6c06f62d1e27a8e3735587
SHA1 a26ee0d78e0a723afabfe7b19245c9e1d2f9706b
SHA512 826dfbfada1271e9f2b3977f7e889203a9e1e43b3b71ed012cf26a856550b8c557a908d4efad38b718aafe565c0ce10308dd3f81dc34b10ffe1666aa2664b0f7
SSDEEP 192:LJONT6DphuqQmiUyq8VwGYX59ezkCERtZikII0UqzxU6:lONT619UVwGYX5EFcZz0HU6
TLSH
T19B120936A8B8AC7B1DD3A951F48735135EE4521BEB85BF50D5DC1E2C01EF15C130A927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5f236b3d-e266-420f-a4c6-567f2e482229.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5f236b3d-e266-420f-a4c6-567f2e482229.tmp
Size 18KB
SHA256 21eeda78e8a48cda6421ef9cd8461334b2d2b721420d3ef1dde7b998a98c781d
MD5 d5b5e61d3e19a28f7447bd693f038c47
SHA1 e19c118054af1c03e343f9b00f49ca554a5402d9
SHA512 c201fd5373e21c274628777457b3c3bbe50f66744d25dc60d62807cef2d0df739182c8c27cb60b09a7f36dda0674d291bf212209f5ca666620ad2d763a04278d
SSDEEP 384:JZcIhsNikjc5BPnBGYX5EFcZrX0HVZh6DKhHYo4:BhocvBGYuFc9XOfYGHYv
TLSH
T193828D729C786C7B1CF6A541F8473A075FF89117A7C96F8481DD6F1C01EA6981307A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73443ef9-8ffb-42f4-aa46-ba077c094b0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\73443ef9-8ffb-42f4-aa46-ba077c094b0a.tmp
Size 8KB
SHA256 050f07fcbec8797e2b4496c2eb239480e6aafdf6db09a342465f24f1fd6a00b1
MD5 6733ea94d92e613f12d2cb75e2ae6638
SHA1 0d081b7402b66415ef3c7b81cb5dd3620381c9ca
SHA512 88ac58f3db61af69fc33948aceed236edae9c9001ff2ab6cadcf9b120ec1797d0543ad5974f1a3848a2624c8c5707d60a1eaad3e3720ea31eb2241bb4ee89cd1
SSDEEP 192:LJON06DphmqQmiUyd8q8wGYX59ezkCERnkk7j0MU6:lON0619RRwGYX5EFWQMU6
TLSH
T19002E835E8787CBB4DE3AE45B54B2A175FE8212FAA916F84D6E81E1C00D764C1307937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

218da94d-2e6a-4ebc-aac0-bffc029ac9a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\218da94d-2e6a-4ebc-aac0-bffc029ac9a0.tmp
Size 10KB
SHA256 92b62766c5c741be5c1f1f6156a3024d570a6f279466f32368f0ce376256b1c1
MD5 76ff1fbf86f83fbec371b70c648c3964
SHA1 ed44b3a845abf180ea71ee865413a15e43f33642
SHA512 3476acd4aaddd1539925fbafe37fc7c9e40be54cb8d2a8d46862c231759381c207e94f17b94d7f35d04fdf40eb746f95f7cbcf11db957223b1b1e28dc2fd645b
SSDEEP 192:sxZjrRCWW/fXsqr/IdpD/HW6+WNn0G5XYgaYd/Ig5yJ:sxZjrHW/fXsswrHb0wXs40
TLSH
T18822A7126E28A97B8CCBD20DBB55BF53D5F9513291D51E48EAFC8A2C05E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

26620020-1a75-4247-be56-4ab879d43199.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26620020-1a75-4247-be56-4ab879d43199.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2dc7c9cc-eeb9-476b-8a6f-b025d09bdb0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2dc7c9cc-eeb9-476b-8a6f-b025d09bdb0b.tmp
Size 27KB
SHA256 e304db18adbfb34f1200a295ef37a4d72dac75d8f3a9b9b2c60fdf606f3ad547
MD5 b59f7717d59065944dc52a1774b35230
SHA1 7a0b56e6ecba15b1a8cff41a6d7057df8f504b82
SHA512 dc6afa212860f83768f2c175399bb67b2f2ebfa95ec9eb09c0cd02a01c8eeccbbef0af51854a9b87fbcef58451be150272c5615c0e98dc13e9816dfb1ba47d66
SSDEEP 768:L8ichfPWvPZhl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzAroi0m:L8ichfPWvPZhlu1jan+LKgzL3m
TLSH
T12EC2FA7B640CCB7E4FC01A5DDD1A6F9B7E9802C7AA588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

34f6d1fa-ece9-4314-9032-78c77c8dc832.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\34f6d1fa-ece9-4314-9032-78c77c8dc832.tmp
Size 10KB
SHA256 9dea49483fb7754603783b6f0a9bc3187ddc34e7f8e8044d242d0f612bd22249
MD5 8ed9791c686258ef14787b59d0a2e5b8
SHA1 d5cabf5d6323bac7645eb7b35147ddc63d58fefb
SHA512 9434b61e7cffd17a9855d488013e178b1196ea377fe7c085d6bb1bce083c87917e8934e395955bdad9e1be66c47b9f1dd7f83e0670825457d5cf3509d5c32c24
SSDEEP 192:sxZjrRCWW/fXsSr/IdpF/HW6+WNnMjZYgAd/Ig5YJ:sxZjrHW/fXs0wZHbsZee
TLSH
T14E22B9126D28A97B8CCBD20DBB55BF53E6F9513251D51E48E6FC8A1C05EB6CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54afe400-bef1-4a38-bc9a-f859abed5db9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54afe400-bef1-4a38-bc9a-f859abed5db9.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

72b17b71-b84d-49d0-9710-89c1b811e5b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\72b17b71-b84d-49d0-9710-89c1b811e5b7.tmp
Size 9KB
SHA256 0d9ab6c3ae3eadbe6a101041efb312ec644d4e785d85d48d8aefd5339ace731f
MD5 ef8cc374fa8531cb943826d89d521519
SHA1 43485a57e4e68a52d8b5ea96bde49aa9bdf984f1
SHA512 0dba1ac56e88b870111ac162fbd9fdaf11139060f05bfd488f5ee0ac160512790f6cbda459b0d2f44c87277635e4f4bf46d522604332eba9541af95ceae9da3b
SSDEEP 192:sxZjrRCWW/fXsSrcIdpD+HW6+WNnyK/YgSd/IgrJ:sxZjrHW/fXs0F6Hbr/k9
TLSH
T14022B8126E28A97B8CCBD20DBB15BF53D5F9543261D51E48EAFCC62C05EA6CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a95ee93-e7b0-4ba2-80eb-dc86942e109a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7a95ee93-e7b0-4ba2-80eb-dc86942e109a.tmp
Size 10KB
SHA256 6a0337cec57763442cd1a13558ac0076a7d7831e24166c1c7bd1689bf984d725
MD5 fcdc8c00d5c7229e0576ee132e7afa33
SHA1 535df9b08de05827b2feba24b0b6b9798eca8d06
SHA512 18549654e0865dae047db35aa5a68d338f0bef34101ef066efb2122f1f354532611a96beb0bc62c1832c8f5123dc8c4139b3233e45ea85effb0d8776853c673c
SSDEEP 192:sxZjrRCWW/fXsSr/IdpD/HW6+WNnMjZYggd/Ig5YJ:sxZjrHW/fXs0wrHbsZGe
TLSH
T1F222B8126E28A97B8CCBD20DBB55BF53E6F9513251D51E48E6FC8A1C05EB6CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f8d085c92dfa1af0eea090c1f7e2c8648eb41b42ea1e6f7660492095e1ec1e00
MD5 db5ec35439b5aa3e7a22af602914630a
SHA1 64200b040c852b2d8ed5c5a72623f884caf97de7
SHA512 67deb51f5cc12023c38b0a54aad241874ae515a16d678dafb0891987b15730df839cb6f33704db83ff5c633652a360042ed2d60e5a236a0fdd4f462d4e1aea11
TLSH
T1BBE0DFE506C8C22EA20A748F4268670C8790361FD2C06D6E2B48C984F405881B2A66B1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 331e02ab640aa84d8c6151b07008632e7d5e9db033702a7b4a5c63aebf784841
MD5 5fd2e30c2b6527a7def847bc6c7398df
SHA1 12087a0428f931ca176e86b0429f8b3b6b258a6b
SHA512 56bcab79e8bb6640ca76d31dc5b96f048049c5d3f9903228a1f342f309794f726dbe5af8ad1cc46c398098829fcb2a961fb73c0f990cfedf4d274893a1f6152e
TLSH
T17261704166124C17F7A8B1FCFDE91C4B3634E99B14876F121868DD3BB87A3251E0B85C
MD5 SHA1 SHA512 TLSH

Submit Download

a119eee2-759e-4ae3-83da-7e3b2d95b1fd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a119eee2-759e-4ae3-83da-7e3b2d95b1fd.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

8ebb8a95-c5c9-423d-a9e5-aeed86e53444.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8ebb8a95-c5c9-423d-a9e5-aeed86e53444.tmp
Size 4KB
SHA256 ceba6300b68762164481a595bd8b265d97c02d9a017c1a46f88d1ae0423356ec
MD5 803a10607a1723e59069f21582e9b121
SHA1 b04649d6091f34ce7adcf2656ddba063a649707e
SHA512 b0d10f79f595787784b2347afc44e1158e1275e536cdc0b5f2332e48e5bdd480ebfbe98aa7d8a55e0351af27c32545bf02fb395b91d2fa4dcd990dd46c6cb321
SSDEEP 48:YALlNPOjPj6tjQMFjijOsezBYQsBzsiCKswts+ksGibsYip1CsKa4GEs0nwha:D5ObgcGm0zBA33Ryitip1ktGYnwQ
TLSH
T19F91DEB6C7E4CB9D881206F15B28BE5ACE5D190942293C1ECBD2EF8F63D2071D10168F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

e28b05c8-5623-41d4-a21d-43ce813a896f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e28b05c8-5623-41d4-a21d-43ce813a896f.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f4d669cfc00e396924eab6d0ae1c04cc02a40975a2fac3ee34e0c7be77c73167
MD5 4c304cd5adfeb15e1af64aa8ae8d702d
SHA1 9fee8c49228c99e3c00bcfd059bfffcfc59c1e9e
SHA512 4f2a1380c2d55a56cbc3e792e7b9f9f8c03038bf5392e20f317a9bacdef722140ad8c036d77748f666067ca98a61014ccc70faadc5a16a1de53df0e954502ad2
SSDEEP 48:K0LuvL1ttOb9wVISrOK9715OxjeY4JbPyLFk51Hznob7+7ISNoK9t1foxt4YufOM:KU0AKtuuKWEKLCo5+KKoKi
TLSH
T16F914411377B1200387F25AD42E48A2B5E4235B7355CA92BBFBC50668E6FE149CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\3\FileSystem\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

bfcc5058-fb78-48df-b620-e7f8df404cc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\bfcc5058-fb78-48df-b620-e7f8df404cc5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b9235f4e-1261-4315-a0d5-eba59ce14f89.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b9235f4e-1261-4315-a0d5-eba59ce14f89.tmp
Size 18KB
SHA256 ba53a44a26f01480bff51f45ab4c443c77a69980825c5d8c950feebd314750b3
MD5 c19f0992c48740801453af7a2c469d75
SHA1 75849c26c86ea9f713bda78472e8552de639f8e8
SHA512 f0bec09c12645ef4f31649575b3c70a4c08c050ab8cc92359fdf34b9694e00e1d6e592d4593fa50462461110c53e45ac8d0a046dec157e3e4dd5371e66350e68
SSDEEP 384:fZcIhsNidjc5BAnBGYX5EFcZrX0HVZh6DKhHYo4:3hLcgBGYuFc9XOfYGHYv
TLSH
T1A6828D72AC786C7B1CF6A542F8473A075FF89117A7C96F8481DD6F1C01EA6981307A2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eda38880-b3fd-4903-ae5c-bc5571dcb3c2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eda38880-b3fd-4903-ae5c-bc5571dcb3c2.tmp
Size 26KB
SHA256 46961c31c0f69e69e221e1b8c8a283e188b15930251b7b597cf2c535464205eb
MD5 00631a03abfe17c3dabb9dc3fe0cd44a
SHA1 f49e201ea4e42c90ce36d83e1224cbf26ffe2bca
SHA512 66cda9b476f52e63c5889c9b5215436edb9761a452dc5ea2e38f4fd55495436a86537904537ba60b627c8dd5ef3730773d78ef3b498ef2d6d8f9f9d82ba90f17
SSDEEP 384:5iFiZcIHzsN68TUNTUlIldjc5BpnBGYX5EFcZFD0HVZh6DKhHYo4:QFQTjwg3cJBGYuFcrDOfYGHYv
TLSH
T1ECC23BF248E7987AD8AE9B43A77D3E034EBCC153B585AA40B3C8591CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

661700ff-f48b-4a9a-8fa9-fcc209d866a4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\661700ff-f48b-4a9a-8fa9-fcc209d866a4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 37f47c159f609755ab7789dc7375dcf319280fa2f698150388823f72b652deb6
MD5 dfb1dfbd90137a2907127d36a10adc7c
SHA1 2809aa213e1f6c9089a02bbd0c5c6a5d041d0453
SHA512 fe054d5a2b3ce90c364ea5cc5294f30ac68d8fd858e1c3b89124cc4079182d4c46ffd33a1c91a30b1da4d5b072d73a5c0d1d7467e5203620c5c7e4ec156182f1
TLSH
T1FD412698A7E91148B3B36F0AABF2686D487BBC372E06845E00110E4F0667A41C8A1733
MD5 SHA1 SHA512 TLSH

Submit Download