hxxp://stukachab[.]club

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/10/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://stukachab.club
Sample261007-qqt8dsbs9n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2716	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4003929486-1233426720-3594832368-1000\{DCD96AD3-1270-4F02-B330-48185A069CA9}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
664	Process not Found
664	Process not Found
664	Process not Found
664	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe
3032	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 4860	3032	msedge.exe	83
PID 3032 wrote to memory of 4568	3032	msedge.exe	84
PID 3032 wrote to memory of 2716	3032	msedge.exe	85
PID 3032 wrote to memory of 4568	3032	msedge.exe	84
PID 3032 wrote to memory of 4568	3032	msedge.exe	84
PID 3032 wrote to memory of 2540	3032	msedge.exe	87
PID 3032 wrote to memory of 2540	3032	msedge.exe	87
PID 3032 wrote to memory of 3896	3032	msedge.exe	88
PID 3032 wrote to memory of 3896	3032	msedge.exe	88
PID 3032 wrote to memory of 3508	3032	msedge.exe	89
PID 3032 wrote to memory of 3896	3032	msedge.exe	88
PID 3032 wrote to memory of 3508	3032	msedge.exe	89
PID 3032 wrote to memory of 3508	3032	msedge.exe	89
PID 3032 wrote to memory of 1096	3032	msedge.exe	90
PID 3032 wrote to memory of 4384	3032	msedge.exe	91
PID 3032 wrote to memory of 1096	3032	msedge.exe	90
PID 3032 wrote to memory of 1096	3032	msedge.exe	90
PID 3032 wrote to memory of 4384	3032	msedge.exe	91
PID 3032 wrote to memory of 4384	3032	msedge.exe	91
PID 3032 wrote to memory of 3424	3032	msedge.exe	93
PID 3032 wrote to memory of 3424	3032	msedge.exe	93
PID 3032 wrote to memory of 3424	3032	msedge.exe	93
PID 3032 wrote to memory of 864	3032	msedge.exe	96
PID 3032 wrote to memory of 864	3032	msedge.exe	96
PID 3032 wrote to memory of 864	3032	msedge.exe	96
PID 3032 wrote to memory of 3324	3032	msedge.exe	97
PID 3032 wrote to memory of 3324	3032	msedge.exe	97
PID 3032 wrote to memory of 3324	3032	msedge.exe	97
PID 3032 wrote to memory of 1380	3032	msedge.exe	98
PID 3032 wrote to memory of 1424	3032	msedge.exe	99
PID 3032 wrote to memory of 1380	3032	msedge.exe	98
PID 3032 wrote to memory of 1424	3032	msedge.exe	99
PID 3032 wrote to memory of 556	3032	msedge.exe	103
PID 3032 wrote to memory of 1212	3032	msedge.exe	110
PID 3032 wrote to memory of 1260	3032	msedge.exe	111
PID 3032 wrote to memory of 3096	3032	msedge.exe	112
PID 3032 wrote to memory of 3712	3032	msedge.exe	113
PID 3032 wrote to memory of 3712	3032	msedge.exe	113
PID 3032 wrote to memory of 5116	3032	msedge.exe	114
PID 3032 wrote to memory of 5116	3032	msedge.exe	114
PID 3032 wrote to memory of 4916	3032	msedge.exe	115

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://stukachab.club
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ff995e7c188,0x7ff995e7c194,0x7ff995e7c1a0
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1908,i,13416136460214286064,6032397817051128323,262144 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2040,i,484034701110048957,16728509912933187443,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2536,i,12601992052474968057,11343673551148713984,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15066793976310131453,5434057347105625340,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11683466880939556826,3403512533234899401,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,3877466344325858325,8621807538454316086,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,9231918629982285219,9203460733975645774,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5032,i,1119051472360866644,7564734671457467139,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5272,i,5769097481183850946,1406956494806122030,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3384,i,12140665490987339602,14682052486331463255,2097152 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,11445382362148204667,8720118080554571582,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,3612470255162600256,4083626936919433285,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13021019626089193643,1152153609769563036,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6284,i,13021019626089193643,1152153609769563036,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,8040659196214282301,13756284120187837300,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,4669442835113206761,7973735048396434045,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,16435469719404843555,5644547066430052192,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,12542943299034787505,6952777009482122944,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=4716 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,5966191872480052954,255474860664344031,524288 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6612,i,9162977725520315748,10985248184850349481,262144 --field-trial-handle=2300,i,5253550442537366622,12705580062741384526,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4916

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0615efeb-58c4-4d62-a81a-ed668489d237.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0615efeb-58c4-4d62-a81a-ed668489d237.tmp
Size 8KB
SHA256 0ebc82e3476516addf11c37ae7ff66910cc19885133d4cefdc82685ccdfff7b6
MD5 cbb2edb315fcd47e07da1f31a22e93d5
SHA1 5984d64c9d6b908c8ebfdcf8f56c9f4a023dd826
SHA512 4a8c8137da399d9f4a3a06044b7930abacc618dd18d2c68c2864368e51c1c0210b3551e642ca694828e1ace5b9af29ba23df8736f824aa0bed89c2b01483148e
SSDEEP 192:0ONr764AbQmiUyLYqHHqqpXIP10COql+8PhSJrQxhZZqJU6:0ON/6nNcYWHqqpXItFOe+8PYJr+ZUU6
TLSH
T19C121B35B968AC679DE6A584B0C735235EA85137FB857FD0C5EC1A2C01EF26C130AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57633472-67f0-4cb5-9f39-615b3d2fb10e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57633472-67f0-4cb5-9f39-615b3d2fb10e.tmp
Size 18KB
SHA256 28aef55d0bdca171324e98a2b9c5ee614f2aca56894cf540dec508e79c0e76fc
MD5 64f48455a3c3defca9f0d0a9609e03d3
SHA1 63b7fc2c38bbf9140d25c1bf229edc0ce24e5c48
SHA512 d69a97cecdd46cf1e3c36a5c4cc864a4de204964008ff36710f1d80e4cd48c4b2880ac3773110ef38370b00f9c0167a01de04c024754db38bdaa99fe928bc6f2
SSDEEP 384:8ZcIhsNOkNgpaifYP1BqpXItFOe+8PYJrVZUPJAxJ+wykok:qh1saBIXOe1PYhVZUPkJ+lkD
TLSH
T110827D726D74AD769CB6A244F08735034EBC9037F7C86BD4C5EC6B1D01DA6AC131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d19cb6f-9947-4a7e-be79-d40cb93ed91d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d19cb6f-9947-4a7e-be79-d40cb93ed91d.tmp
Size 8KB
SHA256 23f28a94c7b4d6a7e6389a47552e85d56841f8ce8b99d45a63ee49ddaf13433b
MD5 dc39ff62f61820645ab57d66574f8b0f
SHA1 c2a21af6ffeddac70441d94f45ac05e32fd3cc17
SHA512 baa1c63ab20984465eab81d362d66a4a5768ac697ea7bac3026576d5a4a5587747bab90979fa0ca834e26f8e985e7c76a0e4fcb3acbe9bc15de7779cf30e4f81
SSDEEP 192:0ON964AeQmiUyw8HMqqpXIP10COql+ntyZW9U6:0ON96najcMqqpXItFOe+sZKU6
TLSH
T17202D935AD696C6BDDF6AE49B08737235FA5203BE9952F84CAE80B1D01DB24C1306937
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d2da8ff-ed95-4a91-9634-2cc53748bd9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7d2da8ff-ed95-4a91-9634-2cc53748bd9f.tmp
Size 25KB
SHA256 dd5c4d30c40d0e472736b8d1437df72baf033bfbe7bf13e74e05557c9ab3cda4
MD5 3073787952af372b420e6729425c4db1
SHA1 cd1e4695cd6beb577f748fda44186a8b83909a6c
SHA512 078c176f243760e06df9cba4204d0b742041b0e951f83b8ecaabbcaa48649db6d2ed3ea725024ebf02a963eacf51f1273ec99227ab8f1a14a81911e5c5b27c63
SSDEEP 384:aiFiZcIDzsNe8TUNTUlIlkwgpaifhP1BqpXItFOe+8PYJrvZUPJAxJ+wykok:RFQHvwgYdaBIXOe1PYhvZUPkJ+lkD
TLSH
T1FCC229F258D79976D8AD9747B37E2D024EBCD023F5846A90B3985A1DCC8A1BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e94ba02-4b5e-47e4-8cfe-0c403667c183.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\7e94ba02-4b5e-47e4-8cfe-0c403667c183.tmp
Size 105KB
SHA256 10bf49f629ba90a1161d0117602435d1a511d1f7a5e47b20fe3a693551550e5a
MD5 71eab00578b8a3050d0ce445655db7b7
SHA1 5d8b06f8805760a18e17cebb8bf5d7f5043e6b1b
SHA512 be43de9b4dd545f3d61990b5e57cf08e702bc1c9f282e5e78b4586dfb34cb8ef3bc6ed1dfaeab69e5117101a833b785cd1e7e844338056be3018d33e6c4afa51
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
TLSH
T1A7B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 bbd402c0b7a0d42beb3fc1631bb5e18da9257cdab7b49d89b398ca944edf461c
MD5 55c99f51ba2f31012f02aa31f3cafed1
SHA1 0f68e60c24df2398b699fccd6cebaa40b4ea126b
SHA512 7243b14a6af5f235342730f66e47c36e1b65291c3431ac3aa4ed77d40b947ca337f2ffffdac9f77dd3bab7a8ca1e4e08d3ac7bf28c92b02b8580e25f240df656
TLSH
T190D08055CDE55AE1F035343D51324900774D65839E025187D27146394DB01C31490DF5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d1c4b8cce31539f0d5bcd84945be8b47e4a7d8e745906a0f2c3136a815024ced
MD5 4df6d93c72b0b35ea429d00fa8d44c4e
SHA1 14b26cd574a47394e17afcf3b1f8539382eac18a
SHA512 bec1a58cd64bb4b95c2d295eb2181678e3a5c466fac5119b0c0273c3ef793de019b85323832613dd188b16138c66bf6bdcd8beb7144c514703189f99cd831b63
TLSH
T17CD02B988DC48561E0223438403349053349A4408D029093C1B10339088018204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7151f70a488efbce3d8d739a772444f20cb6a1ab3ca6bfbc3b269ea0535e48ec
MD5 3e729d9d2671674f3bfd818755ef402a
SHA1 3a2a8608ee6c0f8b397447816a250a15fe9bd66f
SHA512 d898a2368beba75703ead1a291c199153e41c8eb12d7aaa2fa01f99dd0bdf61950f4b55199f38ebc728b139d91a778299ce88c18c63bc0d298061cc4554fc1ac
TLSH
T18ED02B984DC48961E4223438403249053349A4408D02D193C1B1033908811C204504B8
MD5 SHA1 SHA512 TLSH

Submit Download

09ff19bc-07e0-4508-b5b1-eea4017f978f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\09ff19bc-07e0-4508-b5b1-eea4017f978f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a1bb7ff-2d48-49d1-b592-269a17fdcf8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a1bb7ff-2d48-49d1-b592-269a17fdcf8e.tmp
Size 10KB
SHA256 72d4efd887d5647b25ddd5fc49cbe00ce2217aacdf74bb70a3b5c02a946816f4
MD5 5ece7c43111b74af82e654abe78a5c59
SHA1 5fe02fc797b079c3420901f2fee0b17dff08442b
SHA512 4768e95789ba21d8b913bbf043e2fc108469a0d126b11f4ff7ba4bc0220ec6a6cd776d97f47f5e005d6ccc3454286dd3a42229e1da13ed72632b73af3ddcdc2d
SSDEEP 192:sxZwR9Wmb/f7srMIdpFcHW6+WN5She/YL3ttIg5aJ:sxZwSmb/f7srVyHb5J/2w
TLSH
T1E222C9516E38A97B8CCBD60DBA15BF53E6F9503291901E4CA6FC961C05EB7DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

14079f9e-c995-4466-b788-2efa2ee9f2f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\14079f9e-c995-4466-b788-2efa2ee9f2f2.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d2cae6185a8074b34b5c1fb4397a5f11226818f71937bfab288b97bde7d71c35
MD5 5cc39db44f4e9388cfa6e46c0d7fb210
SHA1 5502e0590ceb1a6e60b6bcef8d08ecf209335e02
SHA512 ca68678234f4296186edc9d74e7d854de117f349d22dbefd39b739156003982e6c09a201a2be9b03ad669487de96000aea35135dde49c5a8ca14bb4705c73b66
TLSH
T195E026E489CAC22FA208A447026DD30CC3C13B1FA2C8BE9E1B04C6857B87440A2C76A0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 ee61f86fa075987556c947d2c1863bc9e4e090159ea13463a15488ceb13bfeed
MD5 b9812ff7758c4de070a68e56a7f6af13
SHA1 e36327113fb2dc0d4b2586df5b3803fe440fc306
SHA512 8326c7ca8570887dbf35f502c31746cd87dc4ecad3a6ff1ea455aba46da3099d7411d9e97830f78a867951c5b6983ab8696089a854fc563dfc5a2cd87f4626b8
TLSH
T1D7610A8D70A1ADC6F7E850B2BEDC308F367059A4F6432EDD02E9DC78A706F355214A64
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d77411c478edb28f3fa968df67be5fe8e3807042f0c3b1e7274c9d6d0b3da567
MD5 a4d913edc98bd4638706ba2571d71a0e
SHA1 7beed444a381f07de9555de73b7f8b2706c8cb6e
SHA512 37c2744034acfb5f62fae8d513aefceb20898ebce6e5e49bfd2f02fb644bf682d2a40113a4a689ef778ca09b6fc9d7300bd383fe6e84f7ffd0720eb7186f782f
TLSH
T18761EA8D7191ADC6FBD810B2BECD308F367055A4F6432EDD02E9DCB8A706F355214A64
MD5 SHA1 SHA512 TLSH

Submit Download

9631c0dc-b088-451e-a214-f46438f99d24.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9631c0dc-b088-451e-a214-f46438f99d24.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

35119d17-b8fc-48e5-82ce-d9da6984d98c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\35119d17-b8fc-48e5-82ce-d9da6984d98c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

8b01ab13-6c18-4991-815c-5a0eb1bc9a9e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8b01ab13-6c18-4991-815c-5a0eb1bc9a9e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

c5176615-94fa-4d51-8827-4648edbcceb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c5176615-94fa-4d51-8827-4648edbcceb4.tmp
Size 2KB
SHA256 6f729c04122964d234c0d1a2d5c537716c2c0e8a8725cbf150bf092d4f31f4ad
MD5 98ba9cca4ad5f30b4e3a89edb9ee3fe8
SHA1 cfc4fce0ec009ca1b8bf955d2640ed5b4f4b97d7
SHA512 b777889151d333927275a1db047b5079f6441732fe765257b0044e78734ad075eb1527bc522a9b0ff9e944435660affc1f74182120c4252a03db484679c5d7db
TLSH
T1AD5192E2C2E4865ED9165FF09F246D2ADE5D090853283D2B89E5EF8F63E2471D20164F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b379711f2d517db9c864024e2d47a6097caaba270bc26b3968f43d66b9cfa143
MD5 f5f461c71c0a8b4f3f892653e18d8f08
SHA1 9f55c8e0d70c6f4b9457ba767858cd9d0ba9eb66
SHA512 8417d29d12b74c0d55b175a583d663425d97b2ef87536f2d6bfe47a07a8ccfe77004f7c46cbdfb5e85ff531f24d5936f730502206a70c0b8283713ae9d7feb96
SSDEEP 24:K9j8H4fIfKThW1iSC97yXgIvvk9Ki16K2AFMvEMWIBKMhc1aSpqdyXnIccj9Bia6:K0oIfK1W87yVQJIBKac0DyZEIDK1asW
TLSH
T1CCA1E21672BB0201387D6D1880769B1BCA8631A37038E63B7FBD15B64E26E085DFE5D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a5899043-9f07-4f6b-aaa0-63b5e0ed6308.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5899043-9f07-4f6b-aaa0-63b5e0ed6308.tmp
Size 9KB
SHA256 c290864904d8d68e0b21be965678d178aa15bde967067957b9c0ad2b3fa28ff2
MD5 2482a857809e27448d6128d733d1df30
SHA1 ec6077b28bdd7d89ac0ead08975971adf73e6df1
SHA512 d6235f794fef1ca59666dd47357162b7e6a4cc8f6d85831a837379b3b2cc060afacce347e5342969575cc09323810959920eac677f7682706307f1b3c68785cf
SSDEEP 192:sxZwR9Wmb/f7stkIdpPNHW6+WN5She/YLzttIgrJ:sxZwSmb/f7st9lHb5J/G9
TLSH
T13122B8516E38A97B8CCBD20DBA15BF53D6F9503291941E4CAAFC961C05EB6DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7f1fe5a-1872-48c0-941d-06d32b2d5cd0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c7f1fe5a-1872-48c0-941d-06d32b2d5cd0.tmp
Size 27KB
SHA256 a5c8cdf30d141621bbd071c6aed124f9716301f27698dd71e36226846e9584b9
MD5 725639974946df254335422bbd834b39
SHA1 8c94c16f8c2cfa8811c102c7120227e428561b04
SHA512 76e33cc6a6350b905f916c5d9938385c0a565c33342c42ed9c519453857fd09b98c90c99e9b4ff92bb9ecfd589f84587ffe4ec13400838818361ce3a85e8a39f
SSDEEP 768:HJS3ELCWvWGEm8F1+UoAYDCx9Tuqh0VfUC9xbog/OV79Lld/u7orobHzV:HJS3ELCWvWGEmu1ja+9Lv27T7p
TLSH
T1C8C2FA3B640CCB7E4FC00A9DDC5AAF9B6EA802C766648D4047FA984C12D77EA51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c84fbf7a-bd98-4139-bc9c-42029d3581e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c84fbf7a-bd98-4139-bc9c-42029d3581e2.tmp
Size 10KB
SHA256 63d13c73f2793beca8788e69522a58274383eeafae3dca81de5db37b3df4e013
MD5 a010453f50e2fda590a3ac287bd55a40
SHA1 52acb650b6cf04b9418710efbe53d4c150752077
SHA512 a4c8a2f069709dab255cce68da9e8923ea6943d0d75b07667587086b1b0f429f0c13612bcb4860a7db158328478a1c37a8365abfe73efa19a29636ed9313eff3
SSDEEP 192:sxZwR9Wmb/f7srMIdpPcHW6+WN5She/YLmttIg5aJ:sxZwSmb/f7srVUHb5J/Nw
TLSH
T17722C8516E38A97B8CCBD20DBA15BF53E6F9503291941E48A6FC961C05EB7DD230780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff0c999d-0f5c-4456-bc6e-93fdad668450.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff0c999d-0f5c-4456-bc6e-93fdad668450.tmp
Size 10KB
SHA256 8e7061c0e88a77a78f74e125e966d5af6b1b75781bec99610e058c376983df3b
MD5 6547d8a4c2813e4f7936e24789ab117a
SHA1 3af374ca6c3cc3a5b0bd907e425a6a6f2ce4a496
SHA512 6cf21da3949a5405fb8d428454acefe81a01f8be7750054cd7d2abc1e5c83382458546e5361371110fee7fb1a29b96029df7e1971f4e9b654d67d6ff6138d0f7
SSDEEP 192:sxZwR9Wmb/f7stMIdpPcHW6+WN5She/YLzttIg54J:sxZwSmb/f7stVUHb5J/Gy
TLSH
T16422B7516E38A97B8CCBD20DBA15BF53D6F9503291941E88AAFC961C05EB7DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d409d55-f9ff-44b6-83ab-53d35a1ed286.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1d409d55-f9ff-44b6-83ab-53d35a1ed286.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a132e4bb-f5fe-4a25-83a1-a2852280c138.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a132e4bb-f5fe-4a25-83a1-a2852280c138.tmp
Size 18KB
SHA256 a5dc3b32b5f46087df2af4f9bb1aade6b1789f5ee2e76fe0eb3cba0c94a7848e
MD5 770e7aa24683d2bb97aec57377213498
SHA1 4f49654f1b0325026981720cd609c0ee5b81fd8d
SHA512 96c388cbd3546a958ce30a4cd104c944952a55e522031c7895d8d43cd8ad24d5cd315f1af2e3a04a623412f01f5ee3fd0ee8e27a77dc76a16a0ae5e5ee3acd47
SSDEEP 384:fZcIhsNOkwgpaifYP1BqpXItFOe+8PYJrVZUPJAxJ+wykok:3hIsaBIXOe1PYhVZUPkJ+lkD
TLSH
T11C827D726D74AD769CB6A284F08735034EB89037E7C86F90C5EC6B1D01DA6AC131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e20d2ca0-844e-45d2-98a5-6607ddedca65.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e20d2ca0-844e-45d2-98a5-6607ddedca65.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 eb05a1043663a198f2fa3dbb16a48360a089fbffac6cbe8d68ac00b9ec574d3d
MD5 3e9f8dacab9abc1efc0b9d87a931d55f
SHA1 f7e6ee4f2d7acd0fe08da00b04f2659d25576249
SHA512 67575d174854ef123fbb5a63615eb0977189136817f17b83f8faf396eef0c0998e32dd8fa3ca43f226fe4d6d27891ebf54ad6148d592ba5637f4238ee840c68b
TLSH
T1DD41D65CB7E91108B3B76F5AABF6A86E447EB9762E0A949D10110D4E0622E40C872737
MD5 SHA1 SHA512 TLSH

Submit Download