hxxp://www[.]aunna[.]com[.]ar

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/10/2026, 16:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.aunna.com.ar
Sample261011-ttpzmadb73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-747854149-4118156852-591593384-1000\{06577716-8122-40B8-8C10-E9DA3F8CC71A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4348	msedge.exe
4348	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4408	3424	msedge.exe	85
PID 3424 wrote to memory of 1704	3424	msedge.exe	88
PID 3424 wrote to memory of 408	3424	msedge.exe	90
PID 3424 wrote to memory of 408	3424	msedge.exe	90
PID 3424 wrote to memory of 408	3424	msedge.exe	90
PID 3424 wrote to memory of 2144	3424	msedge.exe	91
PID 3424 wrote to memory of 2144	3424	msedge.exe	91
PID 3424 wrote to memory of 1340	3424	msedge.exe	92
PID 3424 wrote to memory of 3920	3424	msedge.exe	93
PID 3424 wrote to memory of 1340	3424	msedge.exe	92
PID 3424 wrote to memory of 1340	3424	msedge.exe	92
PID 3424 wrote to memory of 3920	3424	msedge.exe	93
PID 3424 wrote to memory of 3920	3424	msedge.exe	93
PID 3424 wrote to memory of 1204	3424	msedge.exe	94
PID 3424 wrote to memory of 1204	3424	msedge.exe	94
PID 3424 wrote to memory of 1204	3424	msedge.exe	94
PID 3424 wrote to memory of 3956	3424	msedge.exe	95
PID 3424 wrote to memory of 3956	3424	msedge.exe	95
PID 3424 wrote to memory of 3956	3424	msedge.exe	95
PID 3424 wrote to memory of 2344	3424	msedge.exe	96
PID 3424 wrote to memory of 2344	3424	msedge.exe	96
PID 3424 wrote to memory of 2344	3424	msedge.exe	96
PID 3424 wrote to memory of 3268	3424	msedge.exe	99
PID 3424 wrote to memory of 2904	3424	msedge.exe	100
PID 3424 wrote to memory of 3268	3424	msedge.exe	99
PID 3424 wrote to memory of 2904	3424	msedge.exe	100
PID 3424 wrote to memory of 3368	3424	msedge.exe	104
PID 3424 wrote to memory of 3476	3424	msedge.exe	118
PID 3424 wrote to memory of 3392	3424	msedge.exe	119
PID 3424 wrote to memory of 2036	3424	msedge.exe	120
PID 3424 wrote to memory of 3392	3424	msedge.exe	124
PID 3424 wrote to memory of 4928	3424	msedge.exe	125
PID 3424 wrote to memory of 3080	3424	msedge.exe	126
PID 3424 wrote to memory of 4928	3424	msedge.exe	125
PID 3424 wrote to memory of 3080	3424	msedge.exe	126
PID 3424 wrote to memory of 3080	3424	msedge.exe	126
PID 3424 wrote to memory of 1568	3424	msedge.exe	127
PID 3424 wrote to memory of 1568	3424	msedge.exe	127
PID 3424 wrote to memory of 1212	3424	msedge.exe	128
PID 3424 wrote to memory of 1212	3424	msedge.exe	128
PID 3424 wrote to memory of 2344	3424	msedge.exe	131
PID 3424 wrote to memory of 2344	3424	msedge.exe	131
PID 3424 wrote to memory of 4348	3424	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.aunna.com.ar
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffb68fcc188,0x7ffb68fcc194,0x7ffb68fcc1a0
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,1946158615119359662,11619121244757314352,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,13030544334935708914,6527438360491812625,262144 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2416,i,8324802072563562966,5477527387769979903,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,5630710910562292052,14812324574827583047,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,11463885845490131648,11792470998342055803,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,724656675629567279,2853555057080977533,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,16364840285281557268,15222603806220686479,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,15551883130353954274,14417915835239692785,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,17188614320355517553,7988006505129129794,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:8
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,12909072260556957430,7891263836902533205,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6669420528597967649,745007693836057482,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,6669420528597967649,745007693836057482,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,3677020664305906902,2981211675549917730,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,17209118233875590023,14656179945436860157,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,8711365735268948324,5993872291520346525,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1852269919875758384,17944932911806503398,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,1852269919875758384,17944932911806503398,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,15650110867174748519,9708110216167410089,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6224,i,1893269053450251673,793977386112343411,2097152 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,8701885980831150993,1339409924991470521,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,17093183830363860759,4845829915024592676,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6192,i,17624896709693831090,12063424443706848649,524288 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5128,i,9565949626894254197,8800545999761442822,262144 --field-trial-handle=2308,i,3990353347694707079,8259497709688034603,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1f0abdc9-bcbf-4f3d-9221-d502d7ddabc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1f0abdc9-bcbf-4f3d-9221-d502d7ddabc9.tmp
Size 8KB
SHA256 c3655cb767e4a0403f57a96ebb874a35c406140321f9529feaf6f5516f929f6a
MD5 c8d768d2a9bbb790877ba98541dd2f54
SHA1 85b19a6489969eb7c52b9a0d6f6daf90ac766ffc
SHA512 6b958feac8fdca2d82978ca7f93862b496f056a6938c896a27bc949bc66faff1cdd25e0766b37996d99ca8ecb8fd32440af9e099ebc1a715b7c3e9440bebcc8a
SSDEEP 192:LJONI6DphmqQmiUy3aq8wGYX59ezWC+m4Mkk7TZU6:lONI619pRwGYX5EfMq1U6
TLSH
T1D2020A35ECB87C7B8DF3AE45B48B2A175FD8212BAA952F44D6D81A1C01D768C2307837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9a3b20bf-4cb9-4e7d-bac1-b12db3255e33.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9a3b20bf-4cb9-4e7d-bac1-b12db3255e33.tmp
Size 18KB
SHA256 15c9003d973001aa4930e42c7c4561647a3470a6edb01ec4b44d1b889d5a2385
MD5 6ec5622cafb141439c7b522025b1cffc
SHA1 9bb0cb57e5c90eef7dc4aeaab2a86176c673df56
SHA512 0f43ba2a9f8bb1ec874eccbe50ffdca97183108045d3f7c20667757ba9561e40a989f0103ef4cb64a059f6c0d36754fe01073628761b9ebcc8c229fcf40df68d
SSDEEP 192:uRm+xasuheOwQxMysNIgQ0iphv40EPQmiU1xwe9n4BGYX59ezWC+m4gx+eZkX1es:7ZcIpsNIgE5cRzP94BGYX5EfMgxA9MT+
TLSH
T17B828C7298B4B93758E7A555F48B3A175FF88027BBC42F8096EDAB0D01DA1CC1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a62a1faeaaa56a5f5375b4d4921e6b263c0bc10a5ecc1f991894c66c32a88aef
MD5 64fcd85513a139bcf5844ab49aea8206
SHA1 3c834eccb77da48c4abac17c440971305fd9b653
SHA512 cd1b39ff43d56158fbb01c5408a5bf247d5bd82279b205a914ab4cdccfece77a5399e430bb26db6f7d10e70dc3503c3bf37c5de59e23cb8f62d6337066c4114f
TLSH
T15DD02232EBF00E82C00B0032082282880F08C03C08003222A23C20AE3A80CEC2E23000
MD5 SHA1 SHA512 TLSH

Submit Download

0873bf69-f9e5-4361-b80b-16c53d0657b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0873bf69-f9e5-4361-b80b-16c53d0657b4.tmp
Size 11KB
SHA256 372ad32c6878bd2252c3b0d15ef0fb2a3d47d4f1131fa3c69424ee86f57b3690
MD5 6f6d6394888265a182b793abbf10565f
SHA1 798c0002b354896b3519aed16a9c39f41ed43fd0
SHA512 c22a8baec9505883a31163a338996e0ce297b3bec9636f77bd083892ef4e08640f955970a6c2727b4f10b4fffad460bc5bbe61c38c3a1d8e59e372fe28048c5b
SSDEEP 192:sxZHRQnD/fQs7tiIdpv2JHW6+WNgV0igddYgWdgDXIg5lHJ:sxZHUD/fQsZLv+HbgK/ddMOt
TLSH
T14432C851AD746A7B8CC7E30EBB55BF53E2F9507261901E48A6FCD61C05E67CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1aecf8b0-d176-45dc-8246-697271665420.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1aecf8b0-d176-45dc-8246-697271665420.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

409bbe7c-f016-4b97-8c90-9ddaa9bf0b58.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\409bbe7c-f016-4b97-8c90-9ddaa9bf0b58.tmp
Size 10KB
SHA256 26c072bf5b859e0025f018f26416667b51c9d990a3a2032881d4a82fe29541ca
MD5 3a0daf5bb3699d06c559be02eb8832e4
SHA1 526475ee289b7ec6832e37e78490aa1508be5fb7
SHA512 b4cc34614b32ccb8eca800ed94387728387e812e17f120496584c93bd708e8997bc3fa8eead9d388f7790b854eaaa6dfa6ed09455a506fbc53d8f671435614ad
SSDEEP 192:sxZHRQWD/fQsVtiIdph2JHW6+WNgV3D/YgqREXIgrJ:sxZHhD/fQsjLh+Hbgt/h9
TLSH
T1BF22C8516D34AA7B8CC7E30EBB55BF63D6F91072A1941E48AAFCD61C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8e5a0d1c-01a7-49b6-acda-cab518c1f10a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8e5a0d1c-01a7-49b6-acda-cab518c1f10a.tmp
Size 10KB
SHA256 a4005e52d1b5ad0bba114c6d0ed5d871ecd9848def0d77bed52d14478164c132
MD5 ef9507f3debd1202e854dd41e9418f1a
SHA1 89ea3a9e0bc153f6e717ff75d8424b869645a809
SHA512 d517bf789c8f52aef7632577bb0f4843017f0ab7a784e23437b63445b716cccf3327cf8d227641404327437031081816ef16e233c7ca3a64accdec48a9ff526e
SSDEEP 192:sxZHRQnD/fQs7tiIdph2JHW6+WNgVKBZYgaDEXIg5lHJ:sxZHUD/fQsZLh+HbgmZpt
TLSH
T16632B651AD34AA7B8CC7E30EBB55BF53E6F9507261901E48AAFCD61C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 508d21af8b12947066e078c47b7039f879a90d683a1387383adea1fdd797cb41
MD5 8158e104369d1e417fad577f16134d87
SHA1 e1de00769fbbc12cc86deb08eea7fb9a190b8770
SHA512 baf2861ae1c713d6641819ce6cc09dbc9124e4b17a1824ecbb12dcfdeb4a3e36663b9372f988e59c036d623ce7d7c016b0fe3120e13515f3a27dfecd65ffa490
TLSH
T163E026D405CEC36FB34CB4CB01AC6B4C8B98661FD3C069DE1B00CA847045244B282F91
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b1f5e9f38ecab20cca36524a7b57362bea6c6a099bb7a6107a27ba9f92f8d2a5
MD5 af95438cbacf9fa96a98b4b68634b875
SHA1 d0ac3fcdd9fd4d7752c91ed7429b3645911d2db9
SHA512 a2ca596a7979f254f36fb195b189db5231259946a932f5ed6508e3f87059fac7d08618193ad22371a81ce3b3483f426ca61c86739a79cc2f406b8d825a36df4e
TLSH
T11FE020C409CDC21D7B1D6487017CAB0C9394271AF7C06E7D1B04CB457005180F2D9BE1
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bd22c0886dd3d4f37365a2e22d350305d45840dcbcd16a28774b5e321997322e
MD5 a6f513f15c0bc161cdfe919b252898ed
SHA1 fc1876352d712ae59525774bd7e768ec521a0b8a
SHA512 d95de7de37c7fd899ee2535dd02e1ffb26e08f6074044e2e09c69532a1a6179c971e9000313ee6e724cdcc5ef36bc8e355d295e669e8aa36d7157ac993a5a44c
TLSH
T1D26150C4565860ABFB98717186D6F58B39359CB29483FE4E01F6E76D0CC6B97C30425C
MD5 SHA1 SHA512 TLSH

Submit Download

1506d422-b063-4b58-a8db-539f82a5a05e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1506d422-b063-4b58-a8db-539f82a5a05e.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

143357c1-4f48-470a-a8ad-38853140b3cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\143357c1-4f48-470a-a8ad-38853140b3cc.tmp
Size 1KB
SHA256 a93aa1dd001d0bbe27fbaadfb9a74a5e65ac1509786ba34c6cda1daca91ccf9f
MD5 50043e71d1110ed636f9e1eb9d834c02
SHA1 582d8be66aa617c9351cf6244bec921e95c01508
SHA512 6dd8fbb8b034f278734bc5b98b4769a3e93a619f6ce900525b5a45dc3cd2695fa35173aae43e98972e13ef50b003ab0bdb8085f563600a547378f493d244a948
TLSH
T10C116DF783E5966E8D0556F06A24AE1BCE1D0A15422C7C1A85D4AF2793F30B5E10295F
MD5 SHA1 SHA512 TLSH

Submit Download

2d45e183-c35f-4eac-8d74-cbf9bbf710e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\2d45e183-c35f-4eac-8d74-cbf9bbf710e3.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

5b663490-bdc6-458a-af6f-6cac68dc22cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5b663490-bdc6-458a-af6f-6cac68dc22cb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8ed46bf1af20ca1bcee73c3453e521b717a9610c548057ce851f1991cc5b8e39
MD5 d376882e75e5f320086bc80bbdece635
SHA1 a09dbe5080ab51a9e5ee3a8860242a246eb97e57
SHA512 56fea5850c5268bf42a62adadd2631ff8c6e5853e1bdfb0135d88535c3a00742b3c16aa3e19d26a2dcaa0700aed7139ec2164087d9337fb17a1184c859fd5453
SSDEEP 48:K0c5cIcVcpczc3cLckbc3cScPIScBckK9cB1crckxcJc0YcyczcJc5yLc0cDcCcx:KwvmKEsiyC8KXKIcQKJe6J
TLSH
T12991F05130A7020178FE66A940F8969A66A13573711CE9BBFFBC51624E2EE140CFFCD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b341f4c3-c6b8-4762-830c-d581bda54df7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b341f4c3-c6b8-4762-830c-d581bda54df7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

bdee716e-e4a8-433c-a2eb-8a4d91ac0e98.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bdee716e-e4a8-433c-a2eb-8a4d91ac0e98.tmp
Size 10KB
SHA256 03120ef969746faab42fefb4bad57612394f88179cae3ad9486ce3395ad17ef3
MD5 393ffbca30f94f48eea4eebd3d3025f1
SHA1 b5fc3fff9e33645332c5d7cf053569ec855cd9bb
SHA512 f57f101e386dafb3e5d978de525ee18a37c0175126c947800bb7a32a24158e3258788b39020b626b9b2f5799460d1e9a8aaefd42f2d61ed146abe575484ad0b7
SSDEEP 192:sxZHRQWD/fQs7tiIdph2JHW6+WNgVyowXYgIiDEXIg5lHJ:sxZHhD/fQsZLh+HbgsTX6Lt
TLSH
T17932C751AD34AA7B8CC7E30EBB55BF53E6F95072A1901E48A6FCD61C05E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d271da95-e75e-483a-a19b-718b718d2f63.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d271da95-e75e-483a-a19b-718b718d2f63.tmp
Size 27KB
SHA256 cb769c929461bbc4577b1fdd2149370686fa5edc79060c90d8a3d57d1aff913c
MD5 a45be55c569a966d5c217e3156139a07
SHA1 80136b9c8109a3afa869e5a4f3eac0f14453c08b
SHA512 eca523e370a2edbc9273148c663d804b9e7ed16be9117adb4fb531d906bac267266f1c0672f434e2f14d159550656c4fedf5423da829ba5b3c181fcfdb7a1171
SSDEEP 768:6vichfPWvPZpl8F1+UoAYDCx9Tuqh0VfUC9xbog/OVu+LlEKXzhro6OJ:6vichfPWvPZplu1jan+LKgzalJ
TLSH
T1CAC2FA3B640CCB7E4FC01A9DDD5A6F9A7EA802C7A6588D4047FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6189fa0-11d7-4bf7-8fc2-2be88bd189ad.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6189fa0-11d7-4bf7-8fc2-2be88bd189ad.tmp
Size 10KB
SHA256 d7d41aa7a550bcd9a415d2b00ba8a5a489ebeeb9784bab9f281b8aa083d3fe6b
MD5 62c97f152c8b4fef89edeb477f5b0b2c
SHA1 24d875d19eecf4e785413e646348d15b9055cf65
SHA512 58946f1ce03f09b203efb288bd57d3461ad409a87737735e125948492b1af57a1c4e1849a936b608661c0edeb1364ca88c11050174c6514751e2b7a89e6e3532
SSDEEP 192:sxZHRQWD/fQsbtiIdph2JHW6+WNgVyowXYgIfREXIg5/HJ:sxZHhD/fQs5Lh+HbgsTX6Ub
TLSH
T16322C851AE34AA7B8CC7E31EBB55BF53D6F91072A1941E48A6FCD61C04E66CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c74b8ca5-b9c4-4d81-be8c-de4df86e22ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c74b8ca5-b9c4-4d81-be8c-de4df86e22ec.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1ba23bb-7ef7-4d5e-8194-e115020e108c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1ba23bb-7ef7-4d5e-8194-e115020e108c.tmp
Size 18KB
SHA256 2ec4241bddfe87ea11ea7ec0f01047cbc6720a701244475698d33b50654e0fc2
MD5 d05a1afe5e076733e0e6587cfbeb61cf
SHA1 6d54e8d923c5663212607edb8be8c753691a6236
SHA512 fea50cd09b26dd636933d645acfec4594dc28ff4ba4300dca676c117a29df33ef9fee5b994e0ac45aa31c5c835dd49e467ca965b424ca8a78e2f405686a067ce
SSDEEP 192:uTm+xasuheOwQxMMsNI5Q0iphv40E5QmiU1xwe9n4BGYX59ezWC+m4gx+ewkH1es:zZcIHsNI5E5cXzP94BGYX5EfMgxj9MT+
TLSH
T157829C7298B4B83758E3A115F48B3A175FF88127BBC42F80D5EDAB0C01DA1C8130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d47517c0-fc0a-4b34-9a28-398cc057fe22.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d47517c0-fc0a-4b34-9a28-398cc057fe22.tmp
Size 18KB
SHA256 8d69506b124669826437184ea253c61f1c1eaaf3ffeff4b54cccded06211cd49
MD5 c6a0bf5d77ef0038bb6d1d243c8f741f
SHA1 6f60064c5922e5caee51b45692ab4e4f27697543
SHA512 74813008823f3c00b553848fa3878f848022f569b638ce17a927298be2d7f029796cfa55a0fe0face0608fc950d7c94155dca0d687b143233397a232f3e1c90d
SSDEEP 192:ujm+xasuheOwQxMMsNIgQ0iphv40E5QmiU1xwe9n4BGYX59ezWC+m4gx+ewkH1es:DZcIHsNIgE5cXzP94BGYX5EfMgxj9MT+
TLSH
T1AF828C7298B4B93758E7A555F48B3A175FF88127BBC42F80D6EDAB0D01DA1C8130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e71cf25a-2308-4a00-82e5-5d594ed900d4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e71cf25a-2308-4a00-82e5-5d594ed900d4.tmp
Size 8KB
SHA256 2f0767536c6c55d61be5125cb7dcd363614fadfa2a22c2f47412c2f7a4952d2c
MD5 3abb71c64e849dfba2fa0ebf70588d2e
SHA1 dc5b7ab0abde4bb20f56c4b9b8454bfa61e23f3b
SHA512 87acc1afa7237a648bbe8d7db40a7ce033f05cf7ccde1f4221fdd17cda8bc37488b4c8607c58cde536a55c7d76955da1643a521d83ed4e375d9c4c77b8ea285e
SSDEEP 192:NONp6DphuqQmiUyDRaCwGYX59ezWC+m4gx+eukIIeq5PU6:NONp61pYMCwGYX5EfMgx59U6
TLSH
T128121A35D8B8BC7B4DE3A551F08B35135FA85227EB847F50D6ED2A1C01EB28C230B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed48c481-d203-4bb5-9474-fdf4dfd119dc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed48c481-d203-4bb5-9474-fdf4dfd119dc.tmp
Size 26KB
SHA256 62fa46c6b5a9518c112e79c37062e816c7182f4a494072cddca6b31afa27254d
MD5 84d7814a5f0f9ab4fa65391791e8d1d3
SHA1 21ddbea91ae7ce4a7777beb7d5f9ad597a918784
SHA512 ff37fd0c47f9b0303f7008c22ba431aa2d12c2f3703f773984f29cee6fce7e0cf43ced25181c7e8a34f3fbd6ff1fa2d1d4f0073dfe3e693fdb5337c3fcb5678c
SSDEEP 384:8iFiZcIvzsN48TUNTUlIlgE5cRzy94BGYX5EfMgxa9MT+:nFQ7dwgp99iGYufMgk9MT+
TLSH
T1AAC23AF248E79537D9AE5B47A77E2D164EBCC027B6806A50B3D95A0CCC961FFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aafcd89e-0939-4535-930b-833161188a1b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\aafcd89e-0939-4535-930b-833161188a1b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ee6442551c6fc1bfbdd40323d987c0fa0f5161e98d9bb07037fda511fb6ba496
MD5 586885f0c52a206c467bcbff621fe5e0
SHA1 fd94b86f3595c781d043b4881c7cb782aaff652e
SHA512 b16db99baadd6eb4fd1f7db0cefb05ead9feddf0e9ed5aa56047219e5de3e79aca0dd19fddf8062735ab61b67610e6be34e2d87e5e9cf55d1fd851f2aee30f30
TLSH
T19241295CA6F91048B3B76E5AABF6686D947BB9372E06919D10110E4F0A33A40C871B77
MD5 SHA1 SHA512 TLSH

Submit Download