dcd2d2738b33a3d55c5edae6f4269b7ab370cfa365ec54a2ea96e040518c467d

Resubmissions

08/10/2026, 13:32

261008-qs5rxafa8310

08/10/2026, 13:24

261008-qnrz9azs2l10

Analysis

max time kernel
598s
max time network
472s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/10/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 17KB
Sample261008-qs5rxafa83
SHA256 dcd2d2738b33a3d55c5edae6f4269b7ab370cfa365ec54a2ea96e040518c467d
MD5 2cace2179f1a97fb3fd4da726bc15d36
SHA1 f0ae389e8874d4b7a4b1d25dc3030827c3aca1ea
SHA512 c4201e9c325baa43a7e2791dc60bb7526c11a31302e78b72e2a8511e3653ff7a678b8fad5601e0a9172bccad67f276d80d4bfaa805fddffa3ea0209f6dbdb5df
SSDEEP 192:Gx2PUx2Sx2Bx23Bx2QGx2qOBx27TiD6oUoNoMocMo27MoR189w:G7BmOTc7OTr6ryoMbMb7MuKK
TLSH
T1B3721E47F2D00901ADAF4C60A457377E3A3C86C79B664C7469DA3B7F5A8CCE286C1399
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4872	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{488B94CD-DC28-4AD3-BD64-FB0AB00372C9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe
2444	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2268	2444	msedge.exe	86
PID 2444 wrote to memory of 4872	2444	msedge.exe	88
PID 2444 wrote to memory of 1552	2444	msedge.exe	89
PID 2444 wrote to memory of 1552	2444	msedge.exe	89
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 4928	2444	msedge.exe	90
PID 2444 wrote to memory of 4432	2444	msedge.exe	91
PID 2444 wrote to memory of 4924	2444	msedge.exe	92
PID 2444 wrote to memory of 4432	2444	msedge.exe	91
PID 2444 wrote to memory of 4432	2444	msedge.exe	91
PID 2444 wrote to memory of 4924	2444	msedge.exe	92
PID 2444 wrote to memory of 4924	2444	msedge.exe	92
PID 2444 wrote to memory of 5048	2444	msedge.exe	93
PID 2444 wrote to memory of 5048	2444	msedge.exe	93
PID 2444 wrote to memory of 5048	2444	msedge.exe	93
PID 2444 wrote to memory of 3496	2444	msedge.exe	94
PID 2444 wrote to memory of 3496	2444	msedge.exe	94
PID 2444 wrote to memory of 3496	2444	msedge.exe	94
PID 2444 wrote to memory of 4992	2444	msedge.exe	99
PID 2444 wrote to memory of 4204	2444	msedge.exe	100
PID 2444 wrote to memory of 4992	2444	msedge.exe	99
PID 2444 wrote to memory of 4204	2444	msedge.exe	100
PID 2444 wrote to memory of 2876	2444	msedge.exe	105
PID 2444 wrote to memory of 3384	2444	msedge.exe	112
PID 2444 wrote to memory of 3972	2444	msedge.exe	113
PID 2444 wrote to memory of 808	2444	msedge.exe	114
PID 2444 wrote to memory of 5040	2444	msedge.exe	116
PID 2444 wrote to memory of 5040	2444	msedge.exe	116
PID 2444 wrote to memory of 4912	2444	msedge.exe	123
PID 2444 wrote to memory of 4912	2444	msedge.exe	123
PID 2444 wrote to memory of 1368	2444	msedge.exe	124
PID 2444 wrote to memory of 1368	2444	msedge.exe	124
PID 2444 wrote to memory of 2740	2444	msedge.exe	128
PID 2444 wrote to memory of 2184	2444	msedge.exe	129
PID 2444 wrote to memory of 2184	2444	msedge.exe	129
PID 2444 wrote to memory of 1636	2444	msedge.exe	130
PID 2444 wrote to memory of 1636	2444	msedge.exe	130
PID 2444 wrote to memory of 4556	2444	msedge.exe	131
PID 2444 wrote to memory of 4556	2444	msedge.exe	131
PID 2444 wrote to memory of 2112	2444	msedge.exe	132
PID 2444 wrote to memory of 2112	2444	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffd2f29c188,0x7ffd2f29c194,0x7ffd2f29c1a0
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,10908909741685198166,5932100634697231366,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,854011924438546979,16588977124347163247,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1584715830424772350,3593565450716507294,262144 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,18141154703831914016,12987080662319300605,2097152 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,6515823457431062860,14770302385405815013,2097152 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4044,i,6726454853474764272,12530811134835786097,2097152 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=4052 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4088,i,10227218444293341729,4145704437721874843,2097152 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:2
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4948,i,6728629448134261622,13913438082784904859,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,15622608479531625428,2712774436483717387,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,3911251539528369198,4202188716229939155,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,3911251539528369198,4202188716229939155,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,1918781212373514443,6025474980488228655,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,484330003615657445,8031340780915035816,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4100,i,2834483874267923337,10326557088495696379,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2836,i,18145692724781365152,10813484172494576296,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,7371615743040654361,16851808268671464741,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,5368725332492072787,14041479287710314378,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,4099640544073426210,7756075450334434570,262144 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,16626545763702772003,17035317893731884942,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1332,i,10200309852202236997,3103395464422365921,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,7663660784048481403,6605821783190520129,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,14997996892923427122,314405167848102671,524288 --field-trial-handle=2612,i,11491227280656400686,11780482992229699782,262144 --variations-seed-version --mojo-platform-channel-handle=1520 /prefetch:8
  2⤵
  PID:2112

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c893fe6-95dd-4331-b6e9-a992ba10e617.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c893fe6-95dd-4331-b6e9-a992ba10e617.tmp
Size 18KB
SHA256 af9a0b7bfe708dc2c1a04d77d914b40adbd275b75ffbe52f1844d4c3e4b44021
MD5 43042bff53f14c60750ef342864d5680
SHA1 12fa4fd63f421d25d02b7fe392463e21709e6266
SHA512 4e645ed9f295a0ac70b28db47f063fe7db9f18a82463d0a49c4a40cee07095096f31afb5723128a0f78f1219bad10f03799d1d10ce0c9be8c66051b83d0ce5f0
SSDEEP 384:CZcIhsNqfgU4ZmLcplKHX58EzO/AiBMTGof:whNqVmakO/tBMTGo
TLSH
T143827D76A8B8ADB75CF79144F44A3203AFB8A063D6846F80C5ECA71E05DA69C130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28a0e1df-8b63-4300-81c1-a302817049c1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28a0e1df-8b63-4300-81c1-a302817049c1.tmp
Size 8KB
SHA256 605c81ecdda25255dffb61b01cab9d6356abb7c471051a2dbead2da941c24ebf
MD5 277292f66188982c65ebf448868cbbd4
SHA1 5a9bd394e7d2fad3f8c81086eb6722c6ae3a3eac
SHA512 1d6c6e90c321e2a104f8929248809a5f7c298b360aeb5bfa8cf1645de426a77effcfe24df74cd28d9d694b3e44a1e3a1fdc9303c4440bd87b4b5dd3619f3a714
SSDEEP 192:1ON36wlDgQmiUyfvW4X58gZrvOKG/DlFvU6:1ON36kg4W4X58EzO59U6
TLSH
T16202D934B9687C7B8EF6AD09F58B36139FA4206BE6556F44CAE81A1D00D779C2307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

762accbc-18ec-4670-aae1-1cdf23d5d590.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\762accbc-18ec-4670-aae1-1cdf23d5d590.tmp
Size 8KB
SHA256 df2a476a876b23e697f54cc5025b7e227606dcacae5923c0a7473586e786c9b5
MD5 c84a2740be2c23dde6f8e83d01be48d9
SHA1 2fbc12d2d91fa74193d89f4d474daa2b383957ed
SHA512 40dc21f0cab79ab676391ccb784a2e1342abc0e69a74aeffd6e42b2ec5abf686d07cb4f343c883543e77d23fd57c1b2b151f0bc3583ac5931c334ba42bbe505a
SSDEEP 192:1ONj6wlDlQmiUyKXvlW4X58gZrvOKGPaN/vetqYU6:1ONj6kDRflW4X58EzO/AeBU6
TLSH
T183121936B9B8BC6B5DE3A544F4873113AFA85167DA497F90C6EC2A1C01EF25C530B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80586772-f659-4b8e-9b46-76820d0da9f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\80586772-f659-4b8e-9b46-76820d0da9f6.tmp
Size 21KB
SHA256 f20e0cd641c406557ff5330433c21e1d427fbb92c37cf2ef64f5f7474008ada0
MD5 18bb182d1217681407c1abdcd7913c7c
SHA1 71dc2271a9f2db87200e1a6f29371166b41113b9
SHA512 f2545caf2e61e77e174562f3778746a59ace2b7fe6e8ddc3c7735827fc64e33315262f75671e67a8cec025d356fae725c644d2d74f2dfbe7a5bd6ee4292749de
SSDEEP 384:5iFiZcI8zsNy8TUNTUlIlWgU4ZmLcplKHX58EzO/ARBMTGof:QFQA3wggqVmakO/oBMTGo
TLSH
T147A27E735CA4DDBBADF79A44F54A3203DFF890A3C684AB90D6DC9A1D019A2DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

826a1ee7-fb6c-4709-b775-713ad57f9327.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\826a1ee7-fb6c-4709-b775-713ad57f9327.tmp
Size 105KB
SHA256 9ea13bef147b77cf059af0bbd32c4029231ee71a5eeb87da41465837f995c823
MD5 57517d7e9ca7c7dbf0369b56fc0b7190
SHA1 a15c2c9123a0f7f8e518a208d6f83aaea1923b00
SHA512 b584ef39e653fe4d5ada82f1439bada3ed13f5368752b2c2bfc5418788b2c6d6c615bca5636bbeb2f36bed6c3cf3f63c9dff735604a91156a020790610f0581d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7u:fwUQC5VwBIiElEd2K57P7u
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db998f2ab3bc4e87d03b65e45c5cbb178df73d3cf3485b0f37651dcc2814f3c4
MD5 5f5f54c76a35e981894cc5fb6daba05e
SHA1 f502dcb8644de3724c621965a3a911c911ca900d
SHA512 5b35d9868c8c7bc14be58b8d1c82589ffa8c6d4d639a122de36a7603d6e1fdaa95347b26ba4692476227aad23f224b54f96b3ed88d347aa1c403e5ce05da56b9
TLSH
T16FD080B5D9756AF4E465253C02230604714C95425D433105D55145960D9D7C354D7DE9
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98f220c14bd3d385f1dd482d8b868745c75685e4a2573b4336f235cf3bdce6c1
MD5 6ce50f5d79ab86d6489a63e08ead9ec4
SHA1 d52fb22446c08230d0edc8374b1dcaed1af585ea
SHA512 fd66aaada3f82de40a9236f167ecb23bc285a49f72374f567e078118a8bdb229e4fadc26c639553cfacaa7d7ba44e0419f17b4bb4a9a8999b51bdd037a28783a
TLSH
T189D02BF4E69455E4D441283C11130304314CC4001C033010C46141D21D8D7C2009A068
MD5 SHA1 SHA512 TLSH

Submit Download

02eab4e3-b2bd-4993-9313-501a5c3b18fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\02eab4e3-b2bd-4993-9313-501a5c3b18fe.tmp
Size 27KB
SHA256 803b59fa9ba4de3b42696a451477547e446f447f525d29bf122acc71a712bd5e
MD5 2efaa5fae5fd049563242505b7d82c87
SHA1 43c818b76bcd8f4215a7405ab4877ecfda42bbf1
SHA512 24b746e48650dfc3e9f050d1920ef216f1a6b02a9f1f2dccd578d1e86a2ebaf066a18af23b6d6247d084e3c9cb646adf8f419773b25828ed4f9b79d0d2f43214
SSDEEP 768:S7y4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbhroRjZ:S7y4J/DWvbtBhu1jajiLm0baJZ
TLSH
T102C2FA3B684CCA7E4FC00A9DDD5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a934870-ec7e-4746-87ef-d8cef7322546.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a934870-ec7e-4746-87ef-d8cef7322546.tmp
Size 10KB
SHA256 8df56107d74239666872931962db4cfb4790e629b34177cfed515d5a3fed22ed
MD5 21d44bd3e119ddc7a4a880875fb7b2de
SHA1 6e5346f039cbde37d441d4c5c90566b8525d23e7
SHA512 7137bea3a402f0da9f748f8654d70910860aad53dca8ac6c7900f8b1b325c7e22e44c2e225783f0c9027f2688ed3361888c0d077aaf2283792b202c40a56d48d
SSDEEP 192:sxZ3RbWn/fesDXtIdpdNHW6+WNGYrbjVfIg55J:sxZ38n/fesDXOrHbGGfJ
TLSH
T1A022C8526E38B9BB8CC7D60DBB15BF53E6F9503251941E48AAFC861C05F7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7e0c61b3-8a1d-4924-955d-c43e55a7713f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e0c61b3-8a1d-4924-955d-c43e55a7713f.tmp
Size 10KB
SHA256 a9f934b9ffc52fca3eca8ff152c9791fba1a657d0879c4ef398f6ad67fa69ca7
MD5 a36d2c5151d637ff59d28cdeea3232e3
SHA1 29d581ab3a8260e702f854273f28a4f7f1558eb0
SHA512 4dc6d4ba16bf3b1a99deaad899cba306e371f0626269743efcdd241bbba958b810ccff6f9e5ea106fd9a3bddb7a8fb2c086dfd7c1e51ed23b245c4daade5737f
SSDEEP 192:sxZ3RbWn/fesQXtIdpdNHW6+WNGYrpjVfIg5jJ:sxZ38n/fesQXOrHbGuff
TLSH
T18B22C7526E38A9BB8CC7D60DBB15BF53E6F9503251951E48A6FCC61C05F7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 4fc8595c8f3e004ca67ec6ab029e4a977f37debebbb5bbacd173ee875f61f64c
MD5 1d92fc0fd9374f03892444f56a16aad5
SHA1 bbcaa4d2a6c2af35f8f18440bc0532b872b18d60
SHA512 bb1fd2706c5bcc15008fb45984361532f42665cabf4fc95db055b3d28b2dbaea3eed00d66ac9abceb4e38e37f8d0cd7b014d1626c72d3bec61c50f384bf1c0bd
TLSH
T1C4E026F404CAC23EA60878CF417E630D8BA0371B93C0E90E6708C5C47C87480AE8BAA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 017fa2d40674ee33990d553f7a52e4c9ffc0cd0973592edf4cd70a365d03452b
MD5 55554774c6612408be3dc1957dde4875
SHA1 f2b091567c1536fd5fd7dff010097833a019ea47
SHA512 d1250a12fcbf7e32ddd992a2953eab207cdb9e4ce658fb298fd3161e6fecb9d6c84318282a636f68c9d8f9afba4c78ad8e44944ba47d28064b9a9a83a497bb0b
TLSH
T171E020D805C7C21F7514688F12BCB30D87903E1BA2C0EA0F1704C5C57C064446A8BB64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 35f36a989c27fe5c5a8d737a79e762cb359a763f57be8844ed60aca8da4e9606
MD5 9cbfd8f22d299139558921d4dbf9fdda
SHA1 f953f02776b1195d8799ccad5fa9e4e8e670b463
SHA512 b645da173dba72302e0d066ead52e3e413989afb052794130d344d0e75cec716f81427e6ad8e32b645b3df5d86dc0174b81e432dfc713537a41270d2574c6861
TLSH
T143E026E504CAC22FA64C748F01AC730DC3A43A5FA7C1E94E1708C98A7C0A980A793AA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 918e2b87c7959243993e9252d7db799b47503d1846babc72f706227e2fcfc17b
MD5 09370e1e5b4c228a9537e57750755eaa
SHA1 2b4c5c0026334ff0f8bfd6e6d5346a7034208405
SHA512 3104bd17c08b374b9ecad495ae648934460ca4c10411814ba68fb8c5ba5f8e6df8b98a3e1497b022d501ecb17cf4175feb360e63222c2a339595c69e6c6cebcb
TLSH
T124E020E805C5C63ED644E54F01AC930CC7A0361BFAC0A94D2718C5857847540AA8B56C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 b338efb2cdc8e8a66f003a33275367e90b0933bd89f27673cade8c02acaa42d7
MD5 e6594d1c6177327c53fb663a997c78e2
SHA1 dc4c670ab25b0ed86007cbf0424e267c30651bd4
SHA512 e7b1723e90ac39dd01974d6258c4caf70efd7e2f2dceb7d2d1c74d35f7c49ebfe5bda5a752756ca123708e851b5410b0537cdaee991313830d929b93c3829cd8
TLSH
T1AA41D887E7F5B055EFAB473189D114B7363898B2ED47ED12D4B8C0B97B4EB0692042A3
MD5 SHA1 SHA512 TLSH

Submit Download

5a90b3ff-49d9-4d4a-a1ba-5695cd7d3e62.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\5a90b3ff-49d9-4d4a-a1ba-5695cd7d3e62.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1fa802a4-07d8-434c-bf35-2f46a2f33641.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1fa802a4-07d8-434c-bf35-2f46a2f33641.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

7eacc07a-27b8-431e-b884-52f3ceae7803.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7eacc07a-27b8-431e-b884-52f3ceae7803.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

a36b539a-c7ea-46a7-a3fd-6f03486ade30.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a36b539a-c7ea-46a7-a3fd-6f03486ade30.tmp
Size 928B
SHA256 fed80eedee2be0f080f6a0f8f187d0a109d0eea591ce5e3c5dfbddb138a2037c
MD5 90b42736c85531f65bdbb7aa3af783f5
SHA1 519f516811cb63b530a9240ecd92509c30f45105
SHA512 266a2dde97c88784f5d80e64570a8002fdfb98052b8c2e7fddb324ba7944cffb58cd361b02e21cdc538d4fc268c2e0d106d549419424acbbba7aa88abe66f817
TLSH
T16811BAF3C3E5926EC90112F09A286E1BCE2D0946821C7C1A85D4AF2B93E2475E14299F
MD5 SHA1 SHA512 TLSH

Submit Download

d93bc843-aa83-4255-aa4f-068a725a1f6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d93bc843-aa83-4255-aa4f-068a725a1f6a.tmp
Size 733B
SHA256 7c572465d5aab994ee52eede9b98060897fbc5ee1fa4e2c8b16360ff9a449803
MD5 8e693174167a86f342e3a50b4361e122
SHA1 fbfc0dd9e293dd32d83faa74c9d5ca7615d8a9df
SHA512 d152ca6d53143e917dfb49ef6818fe676e633667202ed8fbcf4b592f3d647740ee3ec99c456c0d67b5ada983bca5d48b22764e51d7ec000789ef83c3f7e99d8a
TLSH
T17C019CF7C3E4966E8A0092F06A18AE2BCF2D0546531C7C1AC5D4BF2B93E34B5D10189F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 a58e1839ea4848df9fdd5352f051ded769a0ef1b257cb9a27224f4178fde2b99
MD5 29595f20f77a51613648f13cb9835cdc
SHA1 5dcd8e9e195dd68d39777e7681412c7182b5122c
SHA512 b28e7c8a1f086ad9ba414531e92e517136aa491ecf387dd5d1fe4642e837e13d88990b339fc4c0a02aeac48e3c57007ddc02594ff8f19d8f6812d749d0fbd027
SSDEEP 192:sxZ3RbWn/fesFXtIdpdNHW6+WNGYrbjVfIgrJ:sxZ38n/fesFXOrHbGGf9
TLSH
T19722B7526E38B9BB8CC7D20DBB15BF53E6F9503251941E48AAFC861C05F7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8187aa0796fb1a618beee09c5fb2798e411bfbeab808c65f92c4e7747f6d081b
MD5 1d061468ba6f4374e5671c5aff20de77
SHA1 bf319708f2a4001b5ac6c4800207ac1b0e819c17
SHA512 45c4e9bf9dcf5b37429c16681488ff08419560f7d8e48246538965c06a1cd15665cde1649a0fdff21d770e25b5a5232c0caa816de82f625c6c82abb297d3be99
SSDEEP 96:KIDCKs0+aCYKjilmBA9xvDnk3DePdJkKlBdHk5Rx+vzR6KaM6qEQKxyZ:E53smBA9xvDn6DelJFBdHKRx+v21vO
TLSH
T1ABE1E15134BB020038BD769881B5872A52433677701AEA3BBFFC40A68E6BE445DFE5CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aac703ff-05ea-4c69-b874-76b0b85729e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aac703ff-05ea-4c69-b874-76b0b85729e6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

b2e42dc1-989d-45c5-87f0-28825c67c30c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b2e42dc1-989d-45c5-87f0-28825c67c30c.tmp
Size 10KB
SHA256 e569cfecad498a8ca531277150a124a87a8a3395dd01ea15a69cc7f1308d6599
MD5 41f4e862ee40c52cb9434206be29c658
SHA1 515287721d071727ea5915f1a79851de03412d32
SHA512 3516afbdb7e71b273f66e997a739e7e3eb8fe917d56ef7808cdc4c95be2afe656b51a98ebb95f120e35c57a6099ad7c92eee1faa29c0faa26c8e4211ebf604af
SSDEEP 192:sxZ3RbWn/fesQXtIdpHNHW6+WNGYrljVfIg5jJ:sxZ38n/fesQXOtHbGyff
TLSH
T16322C8526E38A9BB8CC7D60DBB15BF53E6F9503291951E48A6FCC61C05F7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d0029988-5909-4b59-827a-93b1fbea7250.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d0029988-5909-4b59-827a-93b1fbea7250.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4068c577-b0cd-4855-bb14-059dc00fc277.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4068c577-b0cd-4855-bb14-059dc00fc277.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d4028854-2c12-4426-819b-385896076d66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4028854-2c12-4426-819b-385896076d66.tmp
Size 18KB
SHA256 ddee14d3a67e4017d44146c367c32628ca39fcf22e2b24e25f4bce943a83a08e
MD5 673ae74dd32cbf3d605c9931c2ee5a88
SHA1 d83c4a1f0afaccdd3ab086dbd85ef0ab1956b826
SHA512 5bcbb3c604679805d5527f7fbf85a68ce7cdbaf57bb3197df3402ada6591067df72f1d9c4f4e69cfcd6d8f854a405f54e2dafb35d929d5cdcf2d3fd9e19dba61
SSDEEP 384:iZcIhsNqWgU4ZmLcplKHX58EzO/AiBMTGof:QhIqVmakO/tBMTGo
TLSH
T1C5827D7668B8ADB75CE79144F44A3203AFB8A063D6846F84C5ECA71E05DA69C130BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a0e877e-4f4b-471f-a4c8-bece48af0c78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1a0e877e-4f4b-471f-a4c8-bece48af0c78.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e587fed9cf31179d2162dfc943e43b0437333e16e5231166f1854fdda9d5d4e4
MD5 d53a51fcf6ead2bdfa352f25ea57c245
SHA1 eb8617a32e0fd5d63fc0d6140c673e5865f57441
SHA512 3364756d8daa146b9176832b235f630af6061247d0e310c15a0cf922c4464e2a7c54a08516225076ca06e1869436adf479e907d69fb5f88943460f2577fe3ab2
TLSH
T16841195CBAFA1148B3776F469BF7B86D447E7D772F06D49D10010D4E0A26A44C862B37
MD5 SHA1 SHA512 TLSH

Submit Download