hxxps://forms[.]cloud[.]microsoft/e/XrHGkJYnZ0?origin=lprLink

Analysis

user interaction
yes
max time kernel
46s
max time network
48s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/10/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.cloud.microsoft/e/XrHGkJYnZ0?origin=lprLink
Sample261002-lrnd1sfb72

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{272469A2-7BD1-4EC9-B048-80026AD62F00}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe
1792	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2620	1792	msedge.exe	87
PID 1792 wrote to memory of 1868	1792	msedge.exe	89
PID 1792 wrote to memory of 1600	1792	msedge.exe	90
PID 1792 wrote to memory of 1600	1792	msedge.exe	90
PID 1792 wrote to memory of 1600	1792	msedge.exe	90
PID 1792 wrote to memory of 2768	1792	msedge.exe	91
PID 1792 wrote to memory of 2768	1792	msedge.exe	91
PID 1792 wrote to memory of 2384	1792	msedge.exe	92
PID 1792 wrote to memory of 4052	1792	msedge.exe	93
PID 1792 wrote to memory of 2384	1792	msedge.exe	92
PID 1792 wrote to memory of 2384	1792	msedge.exe	92
PID 1792 wrote to memory of 4052	1792	msedge.exe	93
PID 1792 wrote to memory of 4052	1792	msedge.exe	93
PID 1792 wrote to memory of 3156	1792	msedge.exe	94
PID 1792 wrote to memory of 3156	1792	msedge.exe	94
PID 1792 wrote to memory of 3156	1792	msedge.exe	94
PID 1792 wrote to memory of 3212	1792	msedge.exe	95
PID 1792 wrote to memory of 3212	1792	msedge.exe	95
PID 1792 wrote to memory of 3212	1792	msedge.exe	95
PID 1792 wrote to memory of 3904	1792	msedge.exe	99
PID 1792 wrote to memory of 4248	1792	msedge.exe	100
PID 1792 wrote to memory of 3904	1792	msedge.exe	99
PID 1792 wrote to memory of 4248	1792	msedge.exe	100
PID 1792 wrote to memory of 1624	1792	msedge.exe	102
PID 1792 wrote to memory of 1980	1792	msedge.exe	109
PID 1792 wrote to memory of 1980	1792	msedge.exe	109
PID 1792 wrote to memory of 1980	1792	msedge.exe	109
PID 1792 wrote to memory of 2844	1792	msedge.exe	115
PID 1792 wrote to memory of 2280	1792	msedge.exe	116
PID 1792 wrote to memory of 4820	1792	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.cloud.microsoft/e/XrHGkJYnZ0?origin=lprLink
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x268,0x7ffb8ef9c188,0x7ffb8ef9c194,0x7ffb8ef9c1a0
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10325723814898873159,6466489218771322944,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,339167626656456238,2422876896939804670,262144 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,3728499932110209958,14704916352259540340,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,4923437134376299936,9057491423576289446,2097152 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1062022146018447636,11522712393417431053,2097152 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,17995018429869538735,12035489907005313215,2097152 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,8346611620914425663,15807381539872556177,2097152 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,13941857179589544057,1274364487247402454,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11526363799622229115,6346255266266978910,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3639771328139456845,12039242719840540308,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,3639771328139456845,12039242719840540308,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6240,i,11057660214628910073,6009755049331547592,2097152 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,14199830027643521620,12740338885031819542,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,1794916373108510553,12385890161328500993,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,2248032004187024959,3059261958401111197,524288 --field-trial-handle=2316,i,9880020130079492160,4925154414491830872,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6cced746-70cd-48a1-b6c9-49f68fbf58c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6cced746-70cd-48a1-b6c9-49f68fbf58c5.tmp
Size 8KB
SHA256 66d3be6ec6968a6f3b2255ab0b0669ff0c16c6ce2566b80ed00bb88b64f787b9
MD5 5981888e64a69ce2d9bf18b1806450e1
SHA1 63772af13b69112e67d59d6aa2924e14c262de9b
SHA512 98602bac7aa40a0392c8c226fd9366ba81286efb579739d77d4fcb3eb7c47f0c823db2fc82790a35f202b996e5ac1b2cbdbd38a2148c22dc71d51d73b7402f6f
SSDEEP 192:EONg6nnHGQmiUy85QYcX5hQDP1Djzor63I3cMcBF+8U6:EONg6nCxQNX5+DtT863IYZU6
TLSH
T18F02EB34BCA87CAB8AF7AD45B08633139FA5217BE5956B80DAEC5E1C00D765C2306D33
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96ed09e1-8e4f-4859-98eb-cf149e17518d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\96ed09e1-8e4f-4859-98eb-cf149e17518d.tmp
Size 8KB
SHA256 5d9da618cddb799fbf64fd2199607e6442ba7ea90975fe6616c55df4ecbc807c
MD5 a6236550c6c1662adae0540e7132dbcd
SHA1 bb782e685e34c2fa7357f6fbcdc4a985022e02c5
SHA512 2a0ca026230ed16e309578a71e5ba984894cd06c2b1353dac40a2d64250ec36621cdaa972be9c276fdac89563a657e1e18423dab4cfb6a2e623f35818bed3292
SSDEEP 192:EONM6nnHaQmiUyI56YcX5hQDP1Djzor63I3wXkeYg3Qq5BU6:EONM6n2X6NX5+DtT863IAXbrBU6
TLSH
T1F6121C35B8A8BC6B5EE37895B08732139FA55227D6847FC0D6EC1E2C01DE66C130AC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7481989667805f861819a64a3969aaaf46d409d3cc4fe4b19154b579a00c6e16
MD5 a70a868c80f3eeab924f0b5bd11ac679
SHA1 22ca93079bed2cfcd0fa02ef66751ff5288ac608
SHA512 380ff0ee96c6b0037a0ca6f886ef323cc451588842ad026ea5bd4a5e33587abc8a13aec63444eb9137cad40409498bf6e0730b0a623f020bfebec6de03bf7d19
TLSH
T1C8D01103FB828A2CC8C008B2002C822C0A8AF8000A00A2828030228A8C28A00A02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

07a715df-fa36-4df5-a34a-4958713017d2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\07a715df-fa36-4df5-a34a-4958713017d2.tmp
Size 10KB
SHA256 44eb7f6e672b2f5e8ee1477b3304abcfc5b95b52d11104902149f26e13e23b30
MD5 b152de310b59116c48649c40a21e758c
SHA1 015b5767b6443de38b26e3cbdf3b6dd55b3cbef5
SHA512 d4b4a103821336738d7d5aa3032db15224fdc04934d069d6f42dde311fcf0830e1fb14606f7cc4f4cff162a3a191f6703f5e58baa0ef987c51ca07f68acf63c4
SSDEEP 192:sxZxPRRWIVA/foesqnoV3IdpxwWWHW6+WNIufdlI/YYB/9rIgrJ:sxZxPKIu/foeseoOgHbIp/f59
TLSH
T13722D8516E34A97B8CCBE219BB15BB23E6F9513251D11E48AAFCC61C05E77DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

757a5b51-7e83-4ef6-b646-1d24bf0aed3f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\757a5b51-7e83-4ef6-b646-1d24bf0aed3f.tmp
Size 11KB
SHA256 a2d1bc94ee4e3c264a6fea38992f6d926a4cf3bda5fdc5d747ccdf61e2157415
MD5 a3f2d145cb882af58291dc829f9d5e52
SHA1 35ddab6a9bb620f2f40f139d647cabd39e920bab
SHA512 12a5367d1340bbee26957ea938e0195452355dabc32c1f776c9086e5820d10c13c45d3bf439305a954bd27ec1a635110513b81cd7cfdbf0a6e1fa41af637f0b3
SSDEEP 192:sxZxPRRWIVA/foesMWoV3IdpxwWWHW6+WNIufdlI/YYBt9rIg5gJ:sxZxPKIu/foes1oOgHbIp/fX+
TLSH
T12232C751AD3869BB8CCBE219BB15BB23E6F9513251C11E48AAFCC61C05E77DD230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c32edd8-1521-416f-9eb6-bbcfb5c1bbf3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c32edd8-1521-416f-9eb6-bbcfb5c1bbf3.tmp
Size 10KB
SHA256 a5f2d66a45aee9ddf603e0eca19a4a43213631c6b87fbef950fe167a08479628
MD5 51dcf4eedfa0719648238be7171ec1c7
SHA1 7c3309f6d543622c08415b20c7d70985a98b36a3
SHA512 882530018192a8d2ba6b7f9eba7121797cad97a70be3dfadc7bb65e3207ead8c9f439360b40416089eca8f4cf122a71e44ed2bed6f1e9680d4c3ca2de60c3608
SSDEEP 192:sxZxPRRWIVA/foesMnoV3IdpxwWWHW6+WNIufdlI/YYB/9rIg5KJ:sxZxPKIu/foeskoOgHbIp/f5U
TLSH
T17832E851AE34A97B8CCBE219BB15BB23E6F9513251C11E48AAFCC61C05E77DD230381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 496ea443cbaea17d0a4c6d05c21b1c990c81ca555b42748319c123cb860174d6
MD5 6698c6e25f357180fad6e84fa69f7f1d
SHA1 7af7bb4bfc9d1f5b8fbb3f73e995afbee96ddb2b
SHA512 bf18992373a72dcf5109f9ae24a7d1ab2a339f9692415999cfe540d9d13caccdd42b264136d4606c8d51d8ef75536d1f3fe4ba1d8f9c6bf455ad80432ed91167
TLSH
T14A61C7D2D4E169FDFBFC07BAA5C53B87B73895C279875D230064D5BA580A3DAD282070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b9a212c73bbe9491d70e8eeff410cb58299e0ae797f025b31aae40f2e37f45c
MD5 a6afda856ae7b3cc50f7a3b9ab456c13
SHA1 a2b17e6ebd5ddc3caf83d3b71e49bf6ddaef6ec5
SHA512 5ecc176fece8a231c3ed2245291eecee80adf06752e473786a147e4f8d29837ed6dfcb8d46ec2260b250c66d01916d2c79ee63ef71ec872c372a5346b71467f1
TLSH
T12361B4D2C4E069EDFBFC43BDA5D53B83B73895C2368B5D2300A8D4BA44063DAE282070
MD5 SHA1 SHA512 TLSH

Submit Download

bdeac251-6f37-4a41-b5e3-056458aa3cc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bdeac251-6f37-4a41-b5e3-056458aa3cc9.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

af18babd-10d3-496f-8ee0-bdea03319405.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af18babd-10d3-496f-8ee0-bdea03319405.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ce0830c6-cc73-4cda-a8eb-2464af7366f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ce0830c6-cc73-4cda-a8eb-2464af7366f5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b4a80b7e88b8b9a499ecb8d300e86cf2616ded7260caec8eac64a0ef84275170
MD5 bf32e162b446e64d3c891cab51039615
SHA1 7ba43a99bea772296576ca94ebfb98a288e3228e
SHA512 ff06fabf1f4697d5fd47c84982b28ece2f7116c8068061ea0c70d96752de5893bff4f11ca7dc80dec02194b139240c69ab862a10948f3e2da8504ce693ebaf99
SSDEEP 96:KwhQwKpq+nvKFxvV1xQRAsyJxKa4yPx+Hf4J5z2J1zZ5xUVEsudxKG4uTxKbY:ITnvKFxvV1+RAFJL4yPoHf4J5z2J1zZ9
TLSH
T153917511367B026438BD2A4C46B4C72B829235B33114EE2B7FBC52655E6FE045DFE8D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e70dac32-47b8-4f25-9523-a565dcb53339.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e70dac32-47b8-4f25-9523-a565dcb53339.tmp
Size 27KB
SHA256 ffd2f86b7a7074b5b368a2027594197ab5c24c1efe7a93ac860f1b6d52b3167f
MD5 4d0d3e8a8659c139d040193658dcce16
SHA1 d307ffff662083093678636df5e9075ad45d735c
SHA512 8c2c7248fadde99b031a44af7dbcecfba81dd9ca4e510ba02b8aad45730ef4d565caec227406c40f6188bb99d0da8eb5097f23a3bafc4df617ecfe4b8996fb1c
SSDEEP 768:RKyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXuropK94:RKyYR7jWv3NpBu1ja/CL8OXlL
TLSH
T128C2E92F640DCB7E4FC01E9DDC5A6F9B7E9802C7A6548D4047FA944C02C77EAA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f85915cb-974b-4a94-9efb-588d7e930e36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f85915cb-974b-4a94-9efb-588d7e930e36.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ce26d501-0d28-4533-ae7f-d4925b33fbf0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ce26d501-0d28-4533-ae7f-d4925b33fbf0.tmp
Size 18KB
SHA256 7ba767b5c974c6e74c7bc1fa7c44bcaeda6d671108d4c01421c58c1c5c500c3b
MD5 0c2b052f949d8775f520c064a5f26613
SHA1 19417dd531412256b1ce8c074951a8b4f8f018b4
SHA512 18f9884c3c59c80a353893dc5fbe1ac36e10d9e4f581d12f2fbbec123c8d5545d56fb4144240621916731a67d8f982b2d4f9985f53606a3af48873f39a288082
SSDEEP 384:hZcIhsNxAiPbiHuy+QX5+DtT863IAXKrBtgOIwZOyfoXoQ:phUwVVkDLjKrBXspXn
TLSH
T1F3829F32ACB8AC7B5DFBA445B18B32139FB45167D7C5AB80D5ED5B2C01D95A8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ef95571a-d52b-4f72-b895-0f26140d680f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ef95571a-d52b-4f72-b895-0f26140d680f.tmp
Size 18KB
SHA256 84f14a6f1f0f7067fa97f9b6da700c644592cc3f2d40c5463bb6f68d8d4db496
MD5 e13fa40c06cf2dbe3337fa96f8aaad38
SHA1 f3e90e072e6e57482cf50409706692e5124b80f2
SHA512 664b99017f93a2955135c9b8565ce61642bd28a98e7be1224a58c0003dbf5d34636a10e02afe83ae4a47603ea8922eccfe7a9eeff544dc18906ae7608a580939
SSDEEP 384:HZcIhsNxJiPbiHuy+QX5+DtT863IAXKrBtgOIwZOyfoXoQ:vhfwVVkDLjKrBXspXn
TLSH
T104829F329CB8AC7B5DFBA445B18B32139FB45167D6C5ABC0D5ED6B2C01D95A8130BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

678f84f3-2e3f-4893-939e-56e05a49da15.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\678f84f3-2e3f-4893-939e-56e05a49da15.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 47e6f15921f2d238c8f00e388e132c296319b215b32c7921bc74f2c276a6f3ea
MD5 95989de556408d68e1d6d926061df7e6
SHA1 0a99b54bb23a8c1bdea7756122eb0b5590bd7df4
SHA512 62e08323c91cd65e2e13f2c24111eaad9c81e83796d9a29d5e3337e02db9cabb3bfe8d6b192e5e9895a6c560d69beae6a073e5a69b5fcc30593ec6dfc7290d4b
TLSH
T151413D58A6FA1144B3B7BF5A9FF6A86D447F78732E0AD55D10110D4F0662B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads