98c239e6eaaf4a455beaec3a86d2e5774a8e70375e42da8a7e62d15f6c0f06b4

Resubmissions

09/10/2026, 16:17

261009-trtj2a1w5n3

09/10/2026, 13:49

261009-q45ahsys5n3

06/10/2026, 19:39

261006-ycy87af13l3

Analysis

geolocation tags

eueuropelondonukunited-kingdom
user interaction
yes
max time kernel
127s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 13:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
r6_internal_113.dll
Size 2.7MB
Sample261009-q45ahsys5n
SHA256 98c239e6eaaf4a455beaec3a86d2e5774a8e70375e42da8a7e62d15f6c0f06b4
MD5 a3dc5779cc553d2a72f4a5f92e653b92
SHA1 17a44d98b1f622da95c8a273bedd7dab0feb92b3
SHA512 d20e22d6bb838e426d097ab6fc2cf8a8ae83db36902d6460599c696c5a8f2c8d5e1c562ee49bd3d61e8caa73299943af4814298cd6644405c4d348abe01986c2
SSDEEP 49152:PycJQ8S95fGFgbiUL5mdbnQ2ZK5kAECgH7iAlTf47557P:65u+5kAECgH+kf857P
TLSH
T1D5D5C003F365C2ADC42A683486E6DB97F77578401B1485CB73992A589FA73F00BBB2D1
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5460	msedge.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 4 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	taskmgr.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{E5634919-3DB9-441E-9443-DB78A249E53C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3548	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	3548	taskmgr.exe
Token: SeSystemProfilePrivilege	3548	taskmgr.exe
Token: SeCreateGlobalPrivilege	3548	taskmgr.exe
Token: 33	3548	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3548	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
2076	msedge.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe
3548	taskmgr.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 2076	5032	msedge.exe	117
PID 2076 wrote to memory of 3536	2076	msedge.exe	118
PID 2076 wrote to memory of 5460	2076	msedge.exe	120
PID 2076 wrote to memory of 5388	2076	msedge.exe	121
PID 2076 wrote to memory of 5388	2076	msedge.exe	121
PID 2076 wrote to memory of 3124	2076	msedge.exe	122
PID 2076 wrote to memory of 5388	2076	msedge.exe	121
PID 2076 wrote to memory of 3124	2076	msedge.exe	122
PID 2076 wrote to memory of 2468	2076	msedge.exe	124
PID 2076 wrote to memory of 2468	2076	msedge.exe	124
PID 2076 wrote to memory of 2468	2076	msedge.exe	124
PID 2076 wrote to memory of 4760	2076	msedge.exe	125
PID 2076 wrote to memory of 4760	2076	msedge.exe	125
PID 2076 wrote to memory of 4760	2076	msedge.exe	125
PID 2076 wrote to memory of 4124	2076	msedge.exe	127
PID 2076 wrote to memory of 4124	2076	msedge.exe	127
PID 2076 wrote to memory of 4124	2076	msedge.exe	127
PID 2076 wrote to memory of 4216	2076	msedge.exe	129
PID 2076 wrote to memory of 4216	2076	msedge.exe	129
PID 2076 wrote to memory of 1688	2076	msedge.exe	128
PID 2076 wrote to memory of 1688	2076	msedge.exe	128
PID 2076 wrote to memory of 1824	2076	msedge.exe	131
PID 2076 wrote to memory of 3776	2076	msedge.exe	137
PID 2076 wrote to memory of 5776	2076	msedge.exe	138
PID 2076 wrote to memory of 4360	2076	msedge.exe	139
PID 2076 wrote to memory of 4556	2076	msedge.exe	140
PID 2076 wrote to memory of 4556	2076	msedge.exe	140
PID 2076 wrote to memory of 3904	2076	msedge.exe	146
PID 2076 wrote to memory of 3904	2076	msedge.exe	146
PID 2076 wrote to memory of 4776	2076	msedge.exe	149
PID 2076 wrote to memory of 4776	2076	msedge.exe	149

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\r6_internal_113.dll,#1
1⤵
PID:6132

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3548

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" "https://www.bing.com/search?q=cwa2xz.exe cwa2xz.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch "https://www.bing.com/search?q=cwa2xz.exe cwa2xz.exe"
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x2ec,0x7fff0298c188,0x7fff0298c194,0x7fff0298c1a0
    3⤵
    PID:3536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,915313571380702362,3609797099668408747,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=2872 /prefetch:3
    3⤵
    - System Time Discovery
    PID:5460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,15213116463978827976,14927197479947303536,262144 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:2
    3⤵
    PID:5388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,12349459106211411300,15951862208966778338,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,15607492216919107057,1687218297793883860,2097152 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,9129330530932750967,1342288295262356706,2097152 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
    3⤵
    PID:4760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4980,i,7599507926419246721,4275772240790322750,2097152 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,4467649792372251039,12696778138079259305,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
    3⤵
    PID:1688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3792,i,17744577498161547847,10561865933798651880,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=3832 /prefetch:8
    3⤵
    PID:4216
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2510581074516635500,14299551406611509810,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,2510581074516635500,14299551406611509810,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:1824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,667371921238402301,10866016369095381026,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4848,i,1241461818207725242,7090614338985238474,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
    3⤵
    PID:5776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,11166725694693556178,8296120022022379337,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,11846116597800670211,14799140080971347749,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
    3⤵
    PID:4556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,14695650127382154958,10349163120946409653,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
    3⤵
    PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,2115176486886277701,7343566444418637022,524288 --field-trial-handle=2848,i,4670045633114898324,6574026253906899351,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2da23699-f2d0-4030-96b9-03aa998160a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2da23699-f2d0-4030-96b9-03aa998160a6.tmp
Size 32KB
SHA256 3138469c2e5cedaba06bbe35eb262e5046f5af8f4639272457600ce23a6aeace
MD5 c6b94f610c9b1f9819e24b792e93196b
SHA1 1289fa7782ca8b6d385387bb75d649ec649be49e
SHA512 6dfa86fd57a63426c65171a5f7969df3f0eb84afdaa2fe60e01e1ac3042cc42dada4b24579313ca4fb445fd29742287041b43acd40c3ede080fc7eb98f8d1560
SSDEEP 384:n+iFTZcIOcsNo8TUNTUlI4j5mgSDzIBK2fMBOHLtuVnpdYogL/7Izi:VFL1JwgzgaBOHLtGYt
TLSH
T18EE2B2F198D78977E9AE8B97637E2D029AFCC153B5885684B7C85D0CCC961BFC306812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

560272ca-ba08-411d-8038-0838d93fa47c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\560272ca-ba08-411d-8038-0838d93fa47c.tmp
Size 25KB
SHA256 1afbe7b30f1c3a0d1b5fe74810ff71ec3f015ece291f5fe79e1a2ad82bfd940e
MD5 3cc72740079a9241c63d3c600ad36907
SHA1 a1a70042125fd5b565e2fd1457b242ba0a14113d
SHA512 142859290e90cd157511239f55d2c68e15d875284b70a6a5c34a1e89beda9b0684fb392a2b15546cc7a0a5148ee45fc693b490395ec84ad593f1eee0658f540c
SSDEEP 384:n0MiFiZcI63sNw8TUNTUlIm25mg5hnK2fMBOHLtuVnoP7O6R2FeoxgL/7IzKoG:03FQ63RwgSqQBOHLtRP7TRVl
TLSH
T100C24B32EC94C9BBEDEB8F96A74A7A07DEF00163959C89C0DAD85E1D009759D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6dc2303b-6b1a-48e6-9667-ed308c04d4d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6dc2303b-6b1a-48e6-9667-ed308c04d4d7.tmp
Size 27KB
SHA256 0fea2bcaf107143595504b1ebd2ca81649365f7c9f600986077d27191e6a42fd
MD5 9de0d5a452110173ab643497fe931561
SHA1 de5dac7a1df39b0144d79052053b459f86ca219f
SHA512 400c0172f9ac11e3df1cf988142d35613b1f0cf5a66e1274a237af4dc9751082d1734e50a2c91aea835a8bc99e830e7d85bdba9f96382a7c5e0d592584c552f1
SSDEEP 384:n3MiFTZcIKsNo8TUNTUlI4j5mgSDzOBK2fMBOHLtuVnpAYogL/7Izi:33FLKJwgz2aBOHLtpYt
TLSH
T1DCC25B32ECA4DABBEDEB8E95B24A3643DEF0416396CC9AC4D9D85D1D009719D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

3bc7ee13-5470-466b-81fe-776b3b42161d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3bc7ee13-5470-466b-81fe-776b3b42161d.tmp
Size 15KB
SHA256 91d8b1d6402e2e2160e3c69736248f640c1bda45bf2648c0d5a33a3d585cad92
MD5 e9140325d63e57c44ad87a6d4968ace5
SHA1 3f2d453f2c7a1ab56e8766fa33e87441879e2b73
SHA512 ba73cbb2e6453b170a664968788b311a060b7b5e2632b000410a752468064e3f6894116a56d14613af65f9491636eab265b0d9244415358afe4bca10a3602228
SSDEEP 384:sxZsomz+b/fnstOZNxTQHbo/F5YigURIr:s0omzS/fQ8kHb6F5R6r
TLSH
T18A62F8566924D97BCCC7D619AB357F12D3F9503398911E8CAAFCC91C04EB6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45153427-2a52-4544-b90c-238f19484477.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\45153427-2a52-4544-b90c-238f19484477.tmp
Size 15KB
SHA256 a7227f71c798db0c5b30e5c98e965a72f54722a0c84b8010ece1494fc3c849ae
MD5 0beb5299178e8c2c17ad3f2357b9c600
SHA1 6a72489824e52d47be530e32013f974d52097b26
SHA512 57b78e133d15dff33e5019efe81f1ff5dfc61bff09efc3f5e4543d8088b6939b05cf2aa7b84b4b62b91ad8de411378a15e48d57ca172741c56053cb16bc8bdaa
SSDEEP 384:sxZsomz+b/fnsIOZNxTQHbo/F2YiwCRIr:s0omzS/fd8kHb6F236r
TLSH
T15762F8566924D97B8CC7D619EA797F12D3F9103398911E4CAAFCC92C04EB6ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b5f8b04-3cec-4ab8-8022-7ee83fe29902.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b5f8b04-3cec-4ab8-8022-7ee83fe29902.tmp
Size 649B
SHA256 471d6fc3272969edcb62c16ba08e98f88b0e830356939bf24932dc9b3b96d460
MD5 19fdbf0e43ebfb07e0ae3f5bcd691e96
SHA1 0ecdcf38df263da1092b5b1d33ea1400eeac5443
SHA512 9ffcf0d87db15ad89547dad223a912fea7e5b722dfdcf3e2f8693f5c02888fa982ec28bcfc60821d8bf9aa9c3588c64aa4780c21aeeb4bf64c88c48c5d6bde89
TLSH
T153F02DB5CD25BC3B08FC5B1C10D50A46E751135B3780888B3F3D910D8FB1677854691C
MD5 SHA1 SHA512 TLSH

Submit Download

9a62d39e-6d26-42e9-af5d-7101735be37b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9a62d39e-6d26-42e9-af5d-7101735be37b.tmp
Size 15KB
SHA256 f26522c64d90da8303c78d483f68b929a8921722cd4c4958ea4362d385feb4fc
MD5 96aa77d7ee75a192e8d73059d7fbb831
SHA1 a362c7f8957da0fafe5ce1324ee9c058e99c417b
SHA512 c2540cedd992d1aedfdaee007d3a5809213af517e9321b10f927caebf2fa4eca5ee07799a729b0f4bc2c7720abbdd56c848b766c2537cf2788d0a2e72289bf4e
SSDEEP 384:sxZsomz+b/fns6OZNxTQHbo/F2YijCRIr:s0omzS/fn8kHb6F226r
TLSH
T17D62E7566924D97B8CC7D619AA397F12D3F950339C911E4CAAFCCA2C04EB5ED220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 089ca0e32c93e49fb6dda5f3c124c7a40f3580360ab853a94d8d3eab9b94563e
MD5 96ed2624edd3cc98cb1d594ce51e611e
SHA1 50e7ca7a1604f7aa0a801179c30324d30b9b8db7
SHA512 98ff3c57b6c1d9796d24808280841c960007f4f895f1c5af66ae32a5f1cde1e9858522d254a642f5894b926c7126420a0df6563c5db1a04edddfd69d93c2b4b3
TLSH
T16EE0DFE846CACA2EA21864C74278A70C8294365F92C0AD4E1B00CDC97806948B7CA6E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ff8bb20e27e618d19e4d96d043a66e2e148683a5c90689f65f32bb13d71b3788
MD5 b4302c14351388c36bb127df8b713287
SHA1 91b196bca7db136ca7c2053de8805502f1db160a
SHA512 bd79e292281788644821c92e2891213e2cb71743373546c33dfcf204b07cf7ed99801528a8fa905d7d78c1b03d8beec52c3fd112a725a7eb09a43e74121d3fcb
TLSH
T12CE0DFE84ACEC62EA258749702B8EF0D83E0365F92C0E94E1700E9847805C40B6E66A0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 19KB
SHA256 c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f
MD5 2e86a72f4e82614cd4842950d2e0a716
SHA1 d7b4ee0c9af735d098bff474632fc2c0113e0b9c
SHA512 7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1
SSDEEP 384:eV4Eqc1qgk/XDVGi8m7JEM9TUKPqivdjfommfP974oNF38:eV9qlxhVEM9UKPpMV74kFM
TLSH
T1D692D043765579E9AF1280C82397E6A4EAAD9A88D6C0FD0950F56CBECF708D32261825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 68KB
SHA256 9a184f33ae7f406bc55bb497748336469980585b53ccc41f863c96306dbf238a
MD5 0e776a9829f2513dc6b150e6e74178aa
SHA1 60fcee40a3ce00c80e125cad5c0a55fa02d15f2e
SHA512 39f0ccd6a44b69d59611679d725ad12187393d9628d977f9848796d5855fb145f3bfe2a3998bd2bbf8b5240c33cd6ecd9d49ed09f4d0270d5ae40558cf7acb54
SSDEEP 1536:H51miTVgrQ7JaUf76Z+AGYguWv0KxwhGPkMxOIdzz/SIWT27zQMPvp+elQDQ:ZYMR78X9GjuW8KxwhGPkKB5JWTMzz5+e
TLSH
T1026302329668F371BDE5B98DFECAD32F58485C204207CA11167E3DF3852549954D8C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 45KB
SHA256 a993c24e8345b81b770b78f2c8bad3108ec74feb51a0bc037dd76ef514a3b5ee
MD5 79a4cd31fb373126f5e2db099f228387
SHA1 8ce66bd75cfb6b55525ee4e4345d28cf30257cac
SHA512 761ff9ed792b3e1beebdc2ef529781733a5b741a43cbf5bade38bd969b45f36e8b408ea986edeab008152cc3cd0a6f026be3dd2c8c0c3debc422ed5afe3faa36
SSDEEP 768:Wtx6+ec0/Z2U/0UDssrWqrubptxrrvBRa7qaTRLue2Mk2WjpML0OcZxWYG:WW+eZPVDssrWeutz7BRa7RLuezoj24m
TLSH
T12F23025810C5307961D073A987F25FF5F18DFBF05D6B972250A39132C1979A92E3BA07
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 5049eded53b083f2698a26682b316ce17de4817a2c13fd512cf7197a76eda870
MD5 98f47780dc484889c45957d6f195771f
SHA1 3e7462cd196d971a0b61787da709d75be3dde717
SHA512 86d08f9be0a26024c61ac69a293df9f50734460eaed43bae14877417d7f279369dfc3706c6cc16f71a0bae2b9f6aead5408d67cc72138abad60fc199c9a11b90
SSDEEP 96:6Dm4FHQK8J6KKmh1f9iW4p/6cj4Z8tvWwOWJiA:IdFwK8tz1f9iWG/6u4WXiA
TLSH
T1D991A48848B89265FB5B2DBC90D118EAB47427905F433E0A0164F8F9BF367A12D5AF43
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a3ecaa59f7305a5b5586e93c8bea1160029f63d75ff0dba2d594416358360a44
MD5 e25abf1fc0a565de7ff6188baca9fab8
SHA1 7ea65afdaedd1dc0a86b929a85c78da80c44eb82
SHA512 0337115e7081b00f77d16dd9132b9f9baf3d979872ee160a389907bf368332e7a6259438ac734bc9e42e95f1ce0bbb96520f8fad26fd4665ed4be0f1b2520c85
TLSH
T18161FA8D0DB497AAFB9C7DBC91E11DCBB4B815D093831D0A0264ECF9D8367B12D4A480
MD5 SHA1 SHA512 TLSH

Submit Download

141e7ff3-0eea-45e9-93de-dcbea1bcaaf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\141e7ff3-0eea-45e9-93de-dcbea1bcaaf5.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

2841ccf7-b581-4d07-a873-4cc99bd7d935.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2841ccf7-b581-4d07-a873-4cc99bd7d935.tmp
Size 3KB
SHA256 1a8ea2527ca77972e500f0440b2230429d456523ec7c2b4792c85808de871d5d
MD5 4c58ab693725f4b29454f7ac4e8bcce7
SHA1 a3a2fdf575fb3d6bde77fbe63c26924ac38a78c1
SHA512 75f6214d93e713fe8f71ed8179d3ff31895996c9df3001329d3be4097290ef424403074bfa8a6ff5c99cec940a67929039b24d4ec712c644e9583a545ff5d7b5
TLSH
T16461D1F7C3E8862EC90156F0AA587E1BCE1C0954932C3D5AC4E4EF1B93F2471E28199E
MD5 SHA1 SHA512 TLSH

Submit Download

755bf720-5325-44a7-87e6-bd1711d7f97e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\755bf720-5325-44a7-87e6-bd1711d7f97e.tmp
Size 211B
SHA256 8a06794675140afbc1aa18b2baacc3902cd839d3f54ca305122e6ee65195d88e
MD5 7af7498c14fda41dc408269a4c97969c
SHA1 4cceeec12222c3191835a9074bb27f18c9647969
SHA512 86790c463c3e24b669a79b9d9fd4b536f885294a19a94b000742f9840abcd6b05e790829aa7f5331fafd04313139229e62338e04a5a434a3684acc059c341c3b
TLSH
T148D023132115307569FC1D915475AC4FC73701711803E9D913D1ED98053556C0657182
MD5 SHA1 SHA512 TLSH

Submit Download

abbda8cb-3d8a-4833-990c-c77654a6ff93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\abbda8cb-3d8a-4833-990c-c77654a6ff93.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 61b67ee6348f376051116c621f2c65074aff95141fb76699bf49009ae72d0b8c
MD5 e7689d9d9df91fda23c75e8fd1804954
SHA1 817798f5f7a31e0b1bff55f00694d56083ec131d
SHA512 d4904effcc5d131cb19505ed925f896feaab0da21c83ac76f43400d621987a7c0cda407145d8d81b6d3e6f23897242fcc1e7f41186076e5ce1eb31c8172cb806
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIzZB:OtfFvpopPxrB4RhfIlB
TLSH
T132B2131571BA421038FE690C81B58B2F464232B33159E62B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b1a8c299-74b9-459b-ae64-710140d34e95.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b1a8c299-74b9-459b-ae64-710140d34e95.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

db618e27-9337-4a1e-ab02-f2de81a13fd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\db618e27-9337-4a1e-ab02-f2de81a13fd7.tmp
Size 32KB
SHA256 138b89a50b0731c7796a0e27d545420111996e3e22ca37c1d06c41cee55966fb
MD5 66eb84b9a2f160e70470b05d39c34fc4
SHA1 4441fcc71d8aef3e119cdd5ec29f14813a40a084
SHA512 6823783dff9f6f522b8346eac72dc5b7c76dcd7b67b2996defbb00d047fef0cf0f0fee8c8313880e1ffcca015107d60376a41c3b9eca5e72b17297a1622d2ac9
SSDEEP 768:0RyktjU7pLuLbvnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OV1wLWLlMC7fnroz:0RyktjYEbvnWvDBltu1jaIwLWLywf0LP
TLSH
T1D7E2EA3F780CCB7E4FC04E9DDD6A7F8B6DA802CB9598894047FA945C02C67EA511A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca809e6e-bc30-4f59-ba06-14646d268beb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ca809e6e-bc30-4f59-ba06-14646d268beb.tmp
Size 26KB
SHA256 b8f24c186f8cda2167a2c6657d8835e49c043e2878dff84b894ce63e40ab2e04
MD5 e5f4d8a8a14d736d644c6ec7596499b0
SHA1 711d408360e942479cea1517327f6fc4c25cfffc
SHA512 4953007b0af0128478e2146ec85d4cfc37efe4f645419106eaf0953360b90f8f2f0ebb053967e77a3da4cffe588f6ea199d253f3974a6909cfed90266178275f
SSDEEP 384:nmMiFiZcIesNo8TUNTUlI435mgSjzOBK2fMBOHLtuVnpAYogL/7Izi:m3FQeJwgnWaBOHLtpYt
TLSH
T196C25B32ECA4DABBEDEB8E95B24A3643DEE04163D6CC9AC4D9D85D1D00D719D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d129345b-5f25-4534-aef8-3996dac42619.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d129345b-5f25-4534-aef8-3996dac42619.tmp
Size 27KB
SHA256 ff0745a8238dd2fbac68d871df70989e0021949e040590f61e5ad68f5d01efc5
MD5 a320190c6a0293e9d600115731a1af57
SHA1 f397de2b2c318facc393980f4bc4e74e1590f1d8
SHA512 5df3410972fa53c00f84c91a6b5e3ea7bd58afd8727afa29942b82f9f4edce8c2a93726f53036b7bce0d4d39bd97a9606ff144784bea83f114691a6d48eb18e1
SSDEEP 384:nmMiFTZcIKsNo8TUNTUlI4j5mgSDzOBK2fMBOHLtuVnpAYogL/7Izi:m3FLKJwgz2aBOHLtpYt
TLSH
T1F3C25B32ECA4DABBEDEB8E95B24A3643DEF0416396CC9AC4D9D85D1D00D719D070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a158aee5ba4e74207e0d854b940c1811860a1e0b4c182d7cb58216ef697b4382
MD5 9bc163e5cc1a2223a88ac1a50acb081d
SHA1 0335b318272b24de3329afca89cedd0256aca3b8
SHA512 e75af1a120c233444382d75fd72eccd52b1c600efef006ac8f18914cd70ea799ab8956c44bf16a5d7711c4a6edd7631145395949881f2142a0fcc5ebab06da6e
TLSH
T169410B5CA7ED1108B7B76F56DBF6A82E487EB9772E06945E10010E4F0A26F40D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

cwa2xz.exe

Path C:\Windows\System32\cwa2xz.exe
Size 7.2MB
SHA256 8de080f3e99dc52ebcd862d643724eb29788d1cd8ea8ec0741f32b6c069780b8
MD5 f93821f2444d218d60ccc8e8236ce34a
SHA1 822fd9d95ae5fab684598c82c803e6a2abec2e5b
SHA512 a81daef755144e2a485d78b0c00e69eb1f3668661b008456715e2cbb7e90887764cf0c93bea89f35c95b7f6891972808e996a62ecec2b11ff667b8c4bc91439b
SSDEEP 98304:uoJhEPO306zsuYE+8ptinHgyACLuTVnLfM4Ec5Ilfmg:vK/6zz9aAy/C1Loc5Ilfmg
TLSH
T1DF767C43F85569E8C6EDD23086358252BA707C890B3077D32B61F3B92B73BD89A79354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1824-324-0x000001862A0E0000-0x000001862B0E0000-memory.dmp

Download

memory/3548-11-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-9-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-10-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-2-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-12-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-13-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-14-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-8-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-3-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download

memory/3548-4-0x0000021FC68F0000-0x0000021FC68F1000-memory.dmp

Download