hxxps://nexomia[.]net/

Analysis

user interaction
yes
max time kernel
146s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 17:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://nexomia.net/
Sample261012-vpsemacz4x

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-53044966-3830981193-2402648431-1000\{7E92F16F-5704-4BCF-8FDD-7833103891B8}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 4648	5648	msedge.exe	89
PID 5648 wrote to memory of 2516	5648	msedge.exe	90
PID 5648 wrote to memory of 1936	5648	msedge.exe	91
PID 5648 wrote to memory of 2516	5648	msedge.exe	90
PID 5648 wrote to memory of 2516	5648	msedge.exe	90
PID 5648 wrote to memory of 2928	5648	msedge.exe	92
PID 5648 wrote to memory of 2928	5648	msedge.exe	92
PID 5648 wrote to memory of 2620	5648	msedge.exe	94
PID 5648 wrote to memory of 2620	5648	msedge.exe	94
PID 5648 wrote to memory of 2620	5648	msedge.exe	94
PID 5648 wrote to memory of 344	5648	msedge.exe	95
PID 5648 wrote to memory of 344	5648	msedge.exe	95
PID 5648 wrote to memory of 344	5648	msedge.exe	95
PID 5648 wrote to memory of 5692	5648	msedge.exe	96
PID 5648 wrote to memory of 5692	5648	msedge.exe	96
PID 5648 wrote to memory of 5692	5648	msedge.exe	96
PID 5648 wrote to memory of 2144	5648	msedge.exe	97
PID 5648 wrote to memory of 2144	5648	msedge.exe	97
PID 5648 wrote to memory of 2144	5648	msedge.exe	97
PID 5648 wrote to memory of 3852	5648	msedge.exe	99
PID 5648 wrote to memory of 4176	5648	msedge.exe	100
PID 5648 wrote to memory of 3852	5648	msedge.exe	99
PID 5648 wrote to memory of 4176	5648	msedge.exe	100
PID 5648 wrote to memory of 1980	5648	msedge.exe	102
PID 5648 wrote to memory of 5408	5648	msedge.exe	106
PID 5648 wrote to memory of 5408	5648	msedge.exe	106
PID 5648 wrote to memory of 5408	5648	msedge.exe	106
PID 5648 wrote to memory of 5796	5648	msedge.exe	107
PID 5648 wrote to memory of 5796	5648	msedge.exe	107
PID 5648 wrote to memory of 5796	5648	msedge.exe	107
PID 5648 wrote to memory of 5948	5648	msedge.exe	109
PID 5648 wrote to memory of 5948	5648	msedge.exe	109
PID 5648 wrote to memory of 5948	5648	msedge.exe	109
PID 5648 wrote to memory of 5404	5648	msedge.exe	110
PID 5648 wrote to memory of 624	5648	msedge.exe	111
PID 5648 wrote to memory of 4892	5648	msedge.exe	112
PID 5648 wrote to memory of 2580	5648	msedge.exe	113
PID 5648 wrote to memory of 2580	5648	msedge.exe	113
PID 5648 wrote to memory of 4296	5648	msedge.exe	115
PID 5648 wrote to memory of 4296	5648	msedge.exe	115
PID 5648 wrote to memory of 4296	5648	msedge.exe	115
PID 5648 wrote to memory of 1128	5648	msedge.exe	116
PID 5648 wrote to memory of 4152	5648	msedge.exe	117
PID 5648 wrote to memory of 4152	5648	msedge.exe	117
PID 5648 wrote to memory of 4152	5648	msedge.exe	117
PID 5648 wrote to memory of 2668	5648	msedge.exe	118
PID 5648 wrote to memory of 2668	5648	msedge.exe	118
PID 5648 wrote to memory of 2668	5648	msedge.exe	118
PID 5648 wrote to memory of 3020	5648	msedge.exe	119
PID 5648 wrote to memory of 3020	5648	msedge.exe	119
PID 5648 wrote to memory of 3020	5648	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://nexomia.net/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2d8,0x7fff6a32c188,0x7fff6a32c194,0x7fff6a32c1a0
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,3971764099978919628,11600296814663314788,262144 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:2
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,13342940043749348691,139532871875048639,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=2552 /prefetch:11
  2⤵
  - System Time Discovery
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2148,i,2980139722774443253,13062369336899866966,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=2980 /prefetch:13
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3636,i,5785991189781018468,14844421151099511200,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3660,i,16808243614218513610,1616479541175599572,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,14140055809107604555,1979112934872499317,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,16126186843334888751,7948832400978216599,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=4832 /prefetch:9
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,16333544748199939830,1714420864100485952,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10995826136775572475,10581888972897598020,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:14
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,9555242531225394531,16663268903056578744,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,9555242531225394531,16663268903056578744,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6584,i,17773526668188592965,9390033205937023489,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3844,i,12659111206728967449,8121824054272794445,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=3928 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6532,i,1228011830321839192,12207474437402233292,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:1
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,7021449200042871483,6782482360620623155,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:14
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,3822394869065408221,11370628046939116316,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:14
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,6280880915250756796,3534157618433409220,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:14
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,14726050903840866476,9355927603194571705,524288 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4852,i,16951649313297496061,5618804844990395938,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=804,i,1870871517007981322,7807747732048722463,262144 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5536,i,16468119551914311261,15092781838119441329,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6628,i,5013358234801552914,11333574890795886624,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=3260,i,11487210523534032802,8380528347938294715,2097152 --field-trial-handle=2524,i,2731675837581490646,12887180276484766101,262144 --variations-seed-version --mojo-platform-channel-handle=3904 /prefetch:1
  2⤵
  PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5848

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1c2ccfa6-f598-4e49-894a-6c5d79c80a8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1c2ccfa6-f598-4e49-894a-6c5d79c80a8c.tmp
Size 36KB
SHA256 3cef8f5cae9c0a99aedd884d27d5c81a28898e7c21310a8fe0a7473fbfb25c93
MD5 7d526004098beec7f34b74a9cba0f519
SHA1 c8cae493f17b48be6a9da3b3884de27549d3a9be
SHA512 2077b18b4ad987fc6ea263771054274c93405771179e47541b590b0eec9050aa1c2c61710ea252c390329d8cbfbaa555e4616f692f615807cc877f73d56b1dc6
SSDEEP 768:FFQ03jwgD+99TOfOf+tf+MtiGJYe1ELsAvC8/YESiGJCbETI:k03RXfOfSftYe1EQujY6ICbn
TLSH
T13EF29E73DCA0CA7B6DF69B89F64A2713EEF48123D5849A94E6CD2A0D40871EC130FC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2bf2a207-09be-47b3-b73e-283e88cfade3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2bf2a207-09be-47b3-b73e-283e88cfade3.tmp
Size 33KB
SHA256 55812576917a55dbc690ea85f4f6db6d4ea61a4fe0455432279814e2ef8998cf
MD5 5817945d7270bf2b3e089b9a09e8a99a
SHA1 df364def03b49872ba882d9590720b7394a28634
SHA512 711d560da595fa252e6dfb8eb0cfe768ac5e421ae9e8ce03293c77430b27124ccaa0161bcd331196c9ce1281c6fb674a6cc70b0b3a3422886b2c25e4524b7773
SSDEEP 768:sQ3k199TOfOf+tf+MtUyJYe1ELsAvC8/YESiGJCbETI:sQ3kcfOfSfbYe1EQujY6ICbn
TLSH
T174F2AF72ECB0C9775DF26689B64A2B13AEF88023E5C49B94D5DD2B0D44876ED130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c270d57-d315-430e-b5a3-9cbd747cfacc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c270d57-d315-430e-b5a3-9cbd747cfacc.tmp
Size 38KB
SHA256 6339f3099f28c91d6c596c86759e8af6c3af3ed2464f574c7cc3495bc54302bd
MD5 f267ba617066d1b120f1c6d71e3452df
SHA1 86d16b2f01cf3d242986e4554e09ef144cb64090
SHA512 a2e3723b02841ad98fab88dee9f21136ac12c21fc98646ea5e83536638c227f47074ce5477adc7c3ba6d691d478031e52c09b5aa008fd6043c0f7fd146330e16
SSDEEP 768:x/UxvxjgC+i3uf9TOfOf+tf+MtsyJYe1ELsAvC8/YNSiSHrkw:EZj3+i3RfOfSfLYe1EQujYBS4w
TLSH
T11603BF32EC74CD375EF2A298764A5753EEF8812395C45AA886DD2B0C05C72EC630F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d491e909-c8b0-40dd-81cf-35377f6d9b96.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\d491e909-c8b0-40dd-81cf-35377f6d9b96.tmp
Size 105KB
SHA256 4ee1e0056f41a046e8efbfc68a394a9993e9e1572e402e58600b2c2d27cdbad0
MD5 cbb9f3725f3320854f02b5fb7d1eee93
SHA1 9c687195aa5a8f617023a505ab65229bb9a04596
SHA512 a8e728ca1dd3f2320d59c0244f1a4c82c5213ac624c22798462d831fa8936055eccd554951d7106079089867cda6e052f87a3bef24aa908224fd8e90caa6ebfc
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T13DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2664448b8ab4f4edce89a8c875c31ed1e748ff3060fa1567c434149210bb4fc5
MD5 35b0bc3bbbf168c9b6c74d3bc119d3eb
SHA1 3dde0e79982d9dbcf2dbd3045bae0a5bc63e14cd
SHA512 9c5f83f731b8e4bf7f7e64c2e51191192b13fa5260950a1fcade843318dbf7d5b99057f3ca893e35cb6c19942f5b5852e7124ed01f7c46e7de9bcea70152fc0d
TLSH
T173D02BB4B76DCDD3D00310FE0014AE0421B37015EE040280230248484400104110236C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a9db3b181fe23d2da858b764c2d3bc2baae4a7e217d8cc5885ed34c7b21166b7
MD5 c2e18a2143bb27e5b37e2d5b65c09643
SHA1 43bb7d235630acc17d81e04e37f3cd25e299ecc7
SHA512 08f1e7fa966122b22bea5e316c89298987fac4c53be675ad48a1c1c8a784dc7b1d8789be8d1abdb8cdb59c14d6757e0f1934d0a56d919c8fb08e311621fe4d9c
TLSH
T109D02BB0B77DCCD3D00310FE0015AE0421A370159E0402802302885844001041101358
MD5 SHA1 SHA512 TLSH

Submit Download

0b6a7c20-2a40-4e08-a36e-eaf7dd206e09.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0b6a7c20-2a40-4e08-a36e-eaf7dd206e09.tmp
Size 11KB
SHA256 cf894a22225590aa4e2380d20df9c0d7a1bded412f47fba7f85464d3bc6def0b
MD5 64516edb8902d5a128fc81ca3b49b115
SHA1 e75348574dc6fb1f39c6ac7c13899c10d48955ae
SHA512 bbef26771a55ed953d8b89ddb40af336a509fda240c18df881002f692488bc84e9e8a5abbcdcb32a03d8c403a9f06a6166d4c0dcc60d87c15207384a167a3124
SSDEEP 192:sxRyRjbJM/fezss4qrViEPzoA8p2y/g6+WNIYx6oqUwG/9IgDVJ:sxRyxa/fes9eifp/5IDUrhD
TLSH
T16732C615AE28AA3B8CC7E21DFB55BF53D6F91432A0955F48A6FC8A1C00E66DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4de8267b-0659-43ee-80b8-61d9f241f5fa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4de8267b-0659-43ee-80b8-61d9f241f5fa.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

5176cb96-9770-4350-96c4-1a423ff4963b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5176cb96-9770-4350-96c4-1a423ff4963b.tmp
Size 11KB
SHA256 8a875b1f3f2412cd7bdf4a78bc8d8692656345e72f18e0e26763a01ea0f94d86
MD5 faa9d4f3fa61a8b4f51e72b233b1882e
SHA1 155526a994dd7a96cc6369f459df892d97ea753d
SHA512 a2d60cc5bce52feec5676581a74583ff50593b7aad966123b715f88dfcd8201360c6460e34237ec841ce04d467843f1e65ec8c845b71d9ea6424989e090e3408
SSDEEP 192:sxRyRjbJM/fezsf4qrViEPzoA8p2y/g6+WNIYx0CqUwG/9IgDbJ:sxRyxa/fesgeifp/5I/UrhB
TLSH
T11332C715AE68AA3B8CC7E21DBB55BF53D6F91432A0955F48B6FCCA1C00E76DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5752b07e-34cc-439c-8dd6-79a3cd87abb4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5752b07e-34cc-439c-8dd6-79a3cd87abb4.tmp
Size 11KB
SHA256 4364167b5e6e81e8df34f5631b79eb943e67ec569c0ba5ca12bdbd327470b1b3
MD5 83917750d822245d1110aa14c1869830
SHA1 c140b67bba828fd2f53de69ed63c44d751d8f3ef
SHA512 0a5ca4219cb115f30f6a876d0cfe1a17ddb6da924a7aae5863b77bdd68d61f9991e9e3032d4e1037d6fad3e7dee2b5ba01a5ae1674dfec1f91af47758fbffcd4
SSDEEP 192:sxRNRjbJM/fezsi4qrVioPzoA8pi/g6+WNIYxUoqUwG/9IgIJ:sxRNxa/fesHeiji/5IHUrhs
TLSH
T1AC32C6156E28A93B8CC7E21DFB65BF53D6F91432A0955B48F6FC8A1C00E66DD221740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9a147889090ff95eb626a81c6ccb74f93825e534e74c2cf55a41113411b03bff
MD5 466f38749b2f0e3bfb0ae0e8d91a50ca
SHA1 759626becde4f37aa4e73d081e17aaf02a935886
SHA512 4f6462adaae0863e3d9da2761e05e3003309b765cfe156747977d9c7e12f9ea9c785ac0bfa5a7cd411518e9bd7a36531d476a48fbbb2e84d7cd924ef74c2e430
TLSH
T14F614D441398CEB4D7DC5E70CFD872A63A325AF865B72FA2309AF5746A0631FE0D6244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6bb98100fd19d3bdfbb99b988627495e20e77d811e8f575da0e4af4880c95bfc
MD5 518c6db18cdb19cbfc8d4c17493582ac
SHA1 62ee0d834db04809c30cabfe1bc5a18256ec207a
SHA512 e627c19b44a8235159d7a0581ee329071ee3fe3c259707d736c6b2a587419e5b66e429bd779f7434882b4b87d246ad4110cbaa5a3c14b55bcdde5bdd100e593b
TLSH
T162614D441398CEB4D7DC5EB0CFE872A63A325AF865B72F62309AF5746A0631FE0D5244
MD5 SHA1 SHA512 TLSH

Submit Download

38ea624d-7ee8-4e6c-822e-7410ff7d8ddc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\38ea624d-7ee8-4e6c-822e-7410ff7d8ddc.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c51a0a7-802a-41bd-991b-8823171aa14c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0c51a0a7-802a-41bd-991b-8823171aa14c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

76c7fc56-c081-4438-bddc-1be8f38c0223.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\76c7fc56-c081-4438-bddc-1be8f38c0223.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 6ada5ce797c6c07414ec30e682d048f39caeb25bcc7b260fd9dc65bc011b050c
MD5 a3c8c9b65f92925d2e6e357717bfb68f
SHA1 845c44db53378b78e882328f283ee0fccaa3bea5
SHA512 4cfbd42efb91a74ddea43bb4130992be78f547b8f5b94c0722ad0b23b2d39f96881a7e0af27acf8120b209c88f8378d00d790b2cedc6ac2c569833dc9d11f239
TLSH
T1CC31C2F787F4867E8A0196F0AA18AE1FCE2D0515431C7CA9C5E4AE2793F3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 2207b78f6bd1ab1bf9e543b466b146de89df6d818a6020f814352fd1d556af99
MD5 f583eaf884e38b8fec2d5a59ff1508f1
SHA1 3d05187536abe74d535523f50e007e492e06481b
SHA512 098fbb709971f0b78fa0d2890449776eae92104e26fb7caba674c8c4bed271b7508cf3dc9a8352b7a56c5b0e972e9eb022b0872d4c9c114edd17b8dd5af57529
SSDEEP 384:z/ZDnwZfCtgbRFfkWKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVnL9K6RMarowYl:zBDnwFWgbjfkW8F1+UoAYDCx9Tuqh0VT
TLSH
T17CB2C92B644DC77F8FC00AAD9C196F9B7D9802C79A548D4047FE994C02C77EE922A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bd4070be5b3057bb0487291d29f265c19027a15182b6f68466904d3a4e2692d2
MD5 78dacb7f2fd2eccae6157e5339eb7a22
SHA1 e5d97c046b135f901884753a2ca995a1755f8b17
SHA512 d73f70334dbc33aee340cc26d134016dccf9d27774b046f485e95d8b49de578075105aa8639191d6d8cd046e64c2a6a1ba87a508cb2cabef2ec51f0353c0b0fa
SSDEEP 24:KGErMYyI5KYh81iSFqxyXS5WtklInKBhK1uS8bafQLoTIPKHhW1qSGBLyXw3I4:KI1I5KO88zy5GInKnKofsIPKBWszyC
TLSH
T10B9121727436D304787E690982D4A66B4A4271F37424A96B3BE941D58D2BF045DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

ef2c0f8b-bb47-4d7b-8d3f-4e8f410a6c9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ef2c0f8b-bb47-4d7b-8d3f-4e8f410a6c9f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3e3094b-3cfd-4339-96de-74fed9d56121.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b3e3094b-3cfd-4339-96de-74fed9d56121.tmp
Size 33KB
SHA256 6e8db7b8095bdae39418b86b7164363daf3065a2829ec404f390b84061c23ab8
MD5 8a8ae01a23d7f8e1280fd06929987d13
SHA1 6d2ea975e284501fa480a258f12c12bde2555f9b
SHA512 5028951c4fdb2a19fccc89796b97522bc4af60610126289f9f0d42ab31fb9dc192ec1f2333d8bf4a89399aa77a2bc8989c179bee59f163dc26bc861d0d3e90b1
SSDEEP 768:oQ3P+99TOfOf+tf+MtpyJYe1ELsAvC8/YESiGJCbETI:oQ3PXfOfSf8Ye1EQujY6ICbn
TLSH
T112F2AF72ECB0C9775DF1A685B64A2B13EEF88123E1C49B94D5DD2B0D44876ED130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bdc4f1fd-e700-4363-a2b2-d5a877b5cc43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bdc4f1fd-e700-4363-a2b2-d5a877b5cc43.tmp
Size 37KB
SHA256 811c85573bbafd7013399b46590ea07843c9598914d1392a7a482142968aa6f9
MD5 acce9a19e623ae5148a465a10209e6ee
SHA1 2edc37d1c918ef06173ba88bae6f095bbb4dce29
SHA512 6c8bc54a33edb12b5cf3e09f6699531981b38db73bdbac12defce65782cecbdd96b6ffc5033c9ae96727446f4af9709f692351abdf66d3e1ba8c6a10512c3f2a
SSDEEP 768:h/UxvxjgC+i3zj9TOfOf+eKJYe1ELsAvC8/YMQdSHrkw:0Zj3+i3ofOfKYe1EQujYrS4w
TLSH
T19903CF36ECA48D775DF2A388774A5713FEF4811395C45AA886DD2B0D06C72ACA30F85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d04c8561-e7ba-45c0-a449-0daa5f529f7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d04c8561-e7ba-45c0-a449-0daa5f529f7b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/1980-188-0x0000019C898C0000-0x0000019C89C7B000-memory.dmp

Download

memory/1980-179-0x0000019C898C0000-0x0000019C89C7B000-memory.dmp

Download