4c107dade56f24a0edfc0a61109d48dd74b0abbb018ce3598b3bbc2e2f67987b

Analysis

user interaction
yes
max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 92KB
Sample261014-m74llstwdv
SHA256 4c107dade56f24a0edfc0a61109d48dd74b0abbb018ce3598b3bbc2e2f67987b
MD5 6ae5686a030f36d0b60d60e9e632ea9f
SHA1 420f811a2fb545fce2748f90a8f0b85895f80ac5
SHA512 6e203ac51a5a59d6beecec922ecedb32500e76adb2a9bdb7758bf410ad4e92f132550d1b6d3cc79d5f212dc02d3be6360c0520e790e76e7e01f38c93da827fe6
SSDEEP 1536:R7BmOTc4OTV1yO2lPA5een3Ueeee8rhxeeeeX6reWeeeFxr+JFpT9qeeTeBk/eeh:BOnyOmIiMxYFhWZbja81
TLSH
T1CC933013E3C12C1AD83B5474D1A2677CBBB801C2A7124EB9555B3A379B4DCD786F32A8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5008	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{6EF20E46-0F0D-48B6-9AAB-F1D3C13352EC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe
3712	msedge.exe

Suspicious use of WriteProcessMemory 53 IoCs

description	pid	Process	procid_target
PID 3712 wrote to memory of 1656	3712	msedge.exe	86
PID 3712 wrote to memory of 5008	3712	msedge.exe	87
PID 3712 wrote to memory of 3272	3712	msedge.exe	88
PID 3712 wrote to memory of 3272	3712	msedge.exe	88
PID 3712 wrote to memory of 3272	3712	msedge.exe	88
PID 3712 wrote to memory of 4892	3712	msedge.exe	89
PID 3712 wrote to memory of 4892	3712	msedge.exe	89
PID 3712 wrote to memory of 4300	3712	msedge.exe	90
PID 3712 wrote to memory of 4300	3712	msedge.exe	90
PID 3712 wrote to memory of 4300	3712	msedge.exe	90
PID 3712 wrote to memory of 4688	3712	msedge.exe	91
PID 3712 wrote to memory of 4688	3712	msedge.exe	91
PID 3712 wrote to memory of 4688	3712	msedge.exe	91
PID 3712 wrote to memory of 1708	3712	msedge.exe	92
PID 3712 wrote to memory of 892	3712	msedge.exe	93
PID 3712 wrote to memory of 1708	3712	msedge.exe	92
PID 3712 wrote to memory of 1708	3712	msedge.exe	92
PID 3712 wrote to memory of 892	3712	msedge.exe	93
PID 3712 wrote to memory of 892	3712	msedge.exe	93
PID 3712 wrote to memory of 4136	3712	msedge.exe	98
PID 3712 wrote to memory of 2248	3712	msedge.exe	99
PID 3712 wrote to memory of 4136	3712	msedge.exe	98
PID 3712 wrote to memory of 2248	3712	msedge.exe	99
PID 3712 wrote to memory of 4968	3712	msedge.exe	102
PID 3712 wrote to memory of 412	3712	msedge.exe	112
PID 3712 wrote to memory of 2364	3712	msedge.exe	113
PID 3712 wrote to memory of 2660	3712	msedge.exe	114
PID 3712 wrote to memory of 3888	3712	msedge.exe	123
PID 3712 wrote to memory of 3888	3712	msedge.exe	123
PID 3712 wrote to memory of 4224	3712	msedge.exe	124
PID 3712 wrote to memory of 4224	3712	msedge.exe	124
PID 3712 wrote to memory of 4036	3712	msedge.exe	126
PID 3712 wrote to memory of 4304	3712	msedge.exe	127
PID 3712 wrote to memory of 2684	3712	msedge.exe	128
PID 3712 wrote to memory of 4304	3712	msedge.exe	127
PID 3712 wrote to memory of 2684	3712	msedge.exe	128
PID 3712 wrote to memory of 2176	3712	msedge.exe	129
PID 3712 wrote to memory of 2176	3712	msedge.exe	129
PID 3712 wrote to memory of 4444	3712	msedge.exe	130
PID 3712 wrote to memory of 4444	3712	msedge.exe	130
PID 3712 wrote to memory of 4444	3712	msedge.exe	130
PID 3712 wrote to memory of 5012	3712	msedge.exe	131
PID 3712 wrote to memory of 5012	3712	msedge.exe	131
PID 3712 wrote to memory of 5012	3712	msedge.exe	131
PID 3712 wrote to memory of 3456	3712	msedge.exe	132
PID 3712 wrote to memory of 3456	3712	msedge.exe	132
PID 3712 wrote to memory of 3456	3712	msedge.exe	132
PID 3712 wrote to memory of 1860	3712	msedge.exe	133
PID 3712 wrote to memory of 1860	3712	msedge.exe	133
PID 3712 wrote to memory of 1860	3712	msedge.exe	133
PID 3712 wrote to memory of 4552	3712	msedge.exe	134
PID 3712 wrote to memory of 4552	3712	msedge.exe	134
PID 3712 wrote to memory of 4552	3712	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffd505ac188,0x7ffd505ac194,0x7ffd505ac1a0
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,12032345725686759462,15224534736248827984,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,7689115411263966686,15183278338321579036,262144 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,14792917447046835640,14102198337323743867,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,13716261852799396386,16399041576940132581,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,13950092301997686410,13463013451154115746,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,16574004700346172397,9360504128619594256,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,1943507604545708468,122529517170497962,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,12920365885433913555,4603295150746164517,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,17567982932653471692,13591387893528318855,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,11861306684451443375,6572669885530763946,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,11861306684451443375,6572669885530763946,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,15327610260769838742,10716752744600067187,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=4708 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,10953376820989628482,16157296342370390466,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,16016619158481812607,15453709207598633651,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=4460 /prefetch:8
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4728,i,15793172734023010050,14242006970626774556,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,9924504438147318904,6995608836894932491,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,9385969084154283724,11181779796154312719,262144 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,16250129903455926381,15380583934947444795,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=748,i,2623855886244803801,4656412573925372301,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,4656745897895285886,14897415446409044609,524288 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5496,i,17865081695195296889,14084340457985711138,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=1692 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5292,i,2812535653231848619,2911845447864250711,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6308,i,3434776470920011467,5373561520395547420,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=4216,i,12088279969544310339,4549457388767082520,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6628,i,852952286010759342,2585040371975160132,2097152 --field-trial-handle=2348,i,3566019680557238101,9808170899773467181,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08461b03-e1fd-45db-b2cf-7f4ebd5a5ce6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08461b03-e1fd-45db-b2cf-7f4ebd5a5ce6.tmp
Size 21KB
SHA256 b93fb36d862382ab48244ee39e17a38777b66e7314a80d1ef5672c7af2479b0d
MD5 881ec35d079d9262b39ebc90a015b612
SHA1 fad2daea0a553fad6377e5bf663bc6ca20f2f91f
SHA512 6c22ec716fe72c3719f2c1b8e9e2616d46461dabd57d87d27037708d5784968adfb77df2d49aaadce7b00d997ac9348433326b1f581f412f51e1e45b73d862b8
SSDEEP 384:aiFzQkUSvLzsN48TUNTUlIlbb/ObYzcOAh//kXxYotngPJAxJ4ChAIIlG:RFdfZwgN/lc/clgPkJ4CWLQ
TLSH
T1B9A26B32A894AD3BAEA39B91F64B3203DEB09167DAD56B90E7C9AE1C01C71DC1307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

19301d2b-0b69-4262-949b-a4e705623298.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\19301d2b-0b69-4262-949b-a4e705623298.tmp
Size 18KB
SHA256 0be8d511f8f857d56f6e2f5225e8d4d86ce0cf2c0e5fd4b1831d778d9fa69abf
MD5 3d4e8b8bc592556326249ca88cd2be28
SHA1 5ec7c635b22bf7246ecaff253c653b3d84a3c336
SHA512 e9d1cb4718c6aace9e55d4b7e2a4b38d318ad2c5dfad96267dbc46143f69e10a4d3e26919b3566cd5d19659d029fd6b3ccbfba20e3325cf0ed83499546153e91
SSDEEP 384:xQkUSv0sNIsb/ObYzcOAh//kXxYoRngPJAxJ4ChAIIlG:j0O/lc/cJgPkJ4CWLQ
TLSH
T11B827C35B8A4BD375AA39291F14736039F70912BEAC51F94DACDAF2C01CA1DC6307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a91d790-f50f-414f-a07e-2eb31cb0321a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a91d790-f50f-414f-a07e-2eb31cb0321a.tmp
Size 8KB
SHA256 e3fe5eacdc2a0d040b15df0e309649f4fcd1c1d2839062f00da932067d9bdfcd
MD5 6c1706e2b9972eda1a2621fd34e823e3
SHA1 3bd666f88c72763412e261447d7aa76a7bc22ffa
SHA512 2d7a2e90ae5c7160a73901f31da478e2f16791ea8dd19d947a8d941115c195226750cf82347f0f9ba2274c5a0699bdf75e051cc8367696448bff2d0b85a147d3
SSDEEP 96:KqONkvQsjpfbUmjH5ih/cIPURHl8h4otop5eaDsBKP4v+Y1xf//ojdpxBY6ywMdW:BOND6JUm0QmiUyTgso//gyweBCu4U6
TLSH
T1B202C835BC687C7B8EE3AE85B4877B239FA4107BA6911F84DAD86E1D01D755C1303C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

837124c4-e153-4998-bea8-53d57d8da4e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\837124c4-e153-4998-bea8-53d57d8da4e8.tmp
Size 8KB
SHA256 15de771e32cedc268cdf552d1a97f55ee3289e20151a9eac5f3cbd5193011e34
MD5 e571f552424b9a423773af2add532a1d
SHA1 835223880408b12ca87d46340406727c42cdf9b5
SHA512 f88849484afbef3979a6acfae754408eaaba49c900aeb53c0329d9fca1cd39813ccef77c7551cf7a135d392988598f3c26aa2d3a442bd5a34bc83a6559954606
SSDEEP 192:vlON56JUKgQmiUyG3ggo//gywXFnPwoINxSqXgU6:NON56+BNwgo//kXxYoSngU6
TLSH
T194120835B868BC7B5DA3A595F08336139E644167EB856F80D9DC2F1C02EB1AC530BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e674b4c-8f9c-4477-8363-1f85080d5771.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\6e674b4c-8f9c-4477-8363-1f85080d5771.tmp
Size 105KB
SHA256 ebf0f1691f49d860fa202d63b050ce2cad38a0496d2658dba8550bd94b28fce4
MD5 7e383905ea5e52c72981148e0ba96a63
SHA1 69b00ea95b83255ffb3f785258efe9e2849602af
SHA512 9017a3852bc1710a7236871d7d43724c12d99f4aac743e58adc0ed0e10a6b4d51529c2fd094425d056a04de8831ea1cbb443ebf8f28e3ebce5c3178e7f66be02
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7q:fwUQC5VwBIiElEd2K57P7q
TLSH
T1F0B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 04d384e503ac7726cb96f043e69cad98489c2eafc2665c80e33cb016d873b6e5
MD5 c5a323aac1462c81d1642ed0f7b1b5a2
SHA1 c07fc90a5c5d549ecbf33b4bc8cb6cb9ca204f88
SHA512 222a743460a5faf30304aa1d67f0e10e2db3eb1a339b1bbf5ca524b4a2fcaa1361289e4358333bae502b5bb38029cddb6902b4cd64293b0ad42b474cee75f892
TLSH
T1B2D02BA4A3D839C9E112183602214366348D40A15057E010CCA0518907C91538281460
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e249170bbcfe30a2a7f421f287b6f81c1c4b71b07e845351f15d008b660ff09
MD5 81d112607d82fd2070ddb7aeeb981683
SHA1 14d14f6413d240f3629ae2eba8f5d1139dc415d0
SHA512 983c5ff8fde2dccf9dc8cf1c11f0008f124b59c2922b2ae470dc2c7595c82289abfd0b4819d73f1bf062a77e62e9ed53318e5f62978a688554f46d0a6c41cbfb
TLSH
T1CFD02BA463D83DC9E512183602204366348D40A15057E111CCA0518907CA1938281460
MD5 SHA1 SHA512 TLSH

Submit Download

4ba1aad5-d162-4146-9b7c-c4d49c3e8d1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4ba1aad5-d162-4146-9b7c-c4d49c3e8d1a.tmp
Size 9KB
SHA256 68d09755f2ba1a6c6aa159c39775308ec8f0ffdf204352290ae114047f398b73
MD5 9988514730b8769d0ecebd19aa2209c8
SHA1 c01085e8ddfea64970f0a1ca07d0988507d62fc9
SHA512 d732fa1082014a0e085088a8f21fd37eaddb5b19a239792debb90dd0586d8fbe962421fdf5673ba470f4cd19b01630ad5a8b5ba9dd8929fbe639dc3c12a49fc6
SSDEEP 192:sxZ/hR5WzV/fTasNPGIdpdtHW6+WNGY36WoqDIgrJ:sxZ/hqzV/fTasNPn3HbGXM9
TLSH
T1E322D811AE78A93B8CC7D20DBA26BF13E5F9203265D11E48A6FCC61C05E6ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88f5a325-ce92-46d9-931b-9005e9bf1cd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88f5a325-ce92-46d9-931b-9005e9bf1cd8.tmp
Size 10KB
SHA256 a4fe757ea7b76b30d0814b9f244d740f2b194cf86309f774fd67460de4ec5146
MD5 961365fab24b8b420fcc41a0aaf4e01f
SHA1 0edd3842009a71fc7c22fb3c53e559e11011bfd7
SHA512 c3ac30e8b7a3a5defa51d3bc323f0dc59b6e03b7fe68fee175b51518d39a3eb0dab766d79de0d9cbdcc0c88e028ad5568e11ab958bac374885c6b6908896d3cc
SSDEEP 192:sxZ/hR5WzV/fTasXPGIdpHtHW6+WNGY36lVwDIg5rJ:sxZ/hqzV/fTasXPnNHbGXq/
TLSH
T11222E951AE78A97B8CC7D20DBA66BF13E2F9603265D11E48A6FCC61C05E66DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

940fadb0-62a6-45b3-8911-f5d99be48084.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\940fadb0-62a6-45b3-8911-f5d99be48084.tmp
Size 10KB
SHA256 8bf4d0b26a8f24196766239e8d336d8bf9054a6aee006443695c27dffb4b58db
MD5 2710d19dc51f11cb393a578eb84d8309
SHA1 3aa71556126437e82f836473cd3163a97b50969b
SHA512 151b9b0c3b7390ba5345bcdc6c293085daf661246b3248635f9532110861dbf97d4ad77cf359f6167e75f57cf013cee569bab83138e9faeae371ba77da0709a4
SSDEEP 192:sxZ/hR5WzV/fTasX0GIdpHljHW6+WNGY36lVwDIg5rJ:sxZ/hqzV/fTasX0n1HbGXq/
TLSH
T11932E952AD78A97B8CC7D20DBA66BF13E2F9103265911E44A6FCC61C05E76DD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c591556-8fa0-4278-9a96-cd8a208c9adb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c591556-8fa0-4278-9a96-cd8a208c9adb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 92b56437cca263bf068e3a3c8a840102e46705ab602b7138377565dca816bf4f
MD5 a8aed354cefd351f4048e99f017cd785
SHA1 bb6ef685fed3c12c2d6eadc74974e7ac71cdafa0
SHA512 75d1aec0ef4475dbff6e7daf71431094fa573de278701e4f6d6fe73c4fe5a69441ce807cdc82f083d1c2584381975d0a25c73798b96f9844c93a1e3afe2676cd
TLSH
T1CBE026E545CAC23EA30C674742A8630CCF81261EA2C2790E1740CFC5710DA46A2A27A4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e650179711b98c9f2518f119b23c1fdcac3b071f09e0024b1e2811159ae42ea1
MD5 1f22bf96d682c147c50b94206ad26954
SHA1 8871f052628be87fb3a44b78d6d32c6734be6197
SHA512 1377fd78981088affb337a91a9217185e96ff9de276fca42cb49990940a3dc27c6033e281fa581a6af190e24068521d8afc1d3c274d75ac444cf35ce071dac32
TLSH
T1ABE026E456C8C33EF30A6687426CA30ECB91266ED2C07F0F9744C7887089A40B287A94
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000041

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000041
Size 201KB
SHA256 f81a1d093054a5f721a6d6d4dfa889ec7e9a6d4ff35e3abb1f522b9b93dc0366
MD5 3532c85e36baf5534cef3e8bead4da8e
SHA1 8b7136dc056821b1f859ad46b7ea0248fe10b0fb
SHA512 eb7132c5941c492166507ea79011657e2bc5da894659259420d0515b342eaaddcb9b51df734e45531822fb62f1baa178f912b8dc34ed5230c068e2ca5ded80ec
SSDEEP 3072:Bs1Yxx3qYXNvMNzqPz2JIh7RH1yaPA+m2LPw/5mLqnQ7bbSINMJU1bnx:qYndvqzwVhpT4Ss/dneSu7xx
TLSH
T18A1422829AA948F16B08D961A7130CD5ADBA3DC0DB4FCA77C04FA11432BD6D2E75D70D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 51e2ac9f28a0714a8a2d182583125cc3e8dce53c16370f5678869ae96bc4834e
MD5 11539be0c221904fbc0b05c4c1b6c113
SHA1 46cee7e25ca21e0f591bcb4fefe78747f63e95a2
SHA512 6a47b0c7f5e9e4313ea3dfb43a7bda85b28e0c69acfe4125d2f1ff27eda451ec73272979d9c97e0fb70d3760c236f0eed17a01afbc4d4ac2e4d1b0d6281ffc97
TLSH
T1B8518171DE608098FF9841BA95D01DBB3A3677A024738F3B1DBCCAF849363D849C8046
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 e1ad06797a42941b50a4d72465db3d3a29b18edee4cac49f2ab030383516a416
MD5 440473c139f391fc3218ac18a488197e
SHA1 a232e7757d530a76a1c89df0a3d2cf1cafefa20d
SHA512 f7e4223d555b570dcc627daa0e2b50479e691306531bed6ecfb8005d5f573d9eb2ea0e4bb331980d21f0dbbdf45031b0c9f11a07cc4b8f53895b8fa5eda6cb4b
TLSH
T103514070DE608098FF9941BA95D01DBB353677A024739F3B1DBCCAF859367D549C8046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1691c98a2a2dd987ec0c26d0e759efadf4675b8ded6e767180b58b9b8f6d1a5f
MD5 7d2a4b637c949f00e201725f3ebd4590
SHA1 a9516314d648821dee835f96c7b066539cf20a9d
SHA512 67cb9127d70c2c96cea8b31498ab8f59ee8e40cf6782b8e5d69b5afed9ec386dee99ee9eb8606f9a27cdf0d2b856a727a9537456770fa2bd527811e1473a5e09
TLSH
T122516070DE608098FF8941BA98D01DBB353677A024739F3B1DBCCAF848363D549C8042
MD5 SHA1 SHA512 TLSH

Submit Download

40ad394c-2bd9-45d0-a469-c945eb50faed.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\40ad394c-2bd9-45d0-a469-c945eb50faed.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

5097c143-fe1c-4ead-aa68-89dd882e7f7b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5097c143-fe1c-4ead-aa68-89dd882e7f7b.tmp
Size 733B
SHA256 ccbddc1a181f36b77b057e32a6bef47656e50e060cdee86aad7e4e9122c82cd5
MD5 8a0ed13368e7356ae89556a2b9dbbdd2
SHA1 c3dad913becd3492b6d5842c18f2a1b627f31c4d
SHA512 e2dcc3dde4930a2b6b239411e4a76d9fae87537d671cf366cebebaf0f9a3bca979027fd91d394e1e721b64374e394ee90f0a68dc5ffaea28ba44048384821fc3
TLSH
T1F101C5F3C3E4996E890156F06A18AF17CE2C0506431C7D1AC5D4BE2B93F3475D10189F
MD5 SHA1 SHA512 TLSH

Submit Download

86d5030d-22ca-4f22-8002-5536bc6f275e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\86d5030d-22ca-4f22-8002-5536bc6f275e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e0fbb8cc-ac3b-47f2-9fe9-b8480c54ee1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e0fbb8cc-ac3b-47f2-9fe9-b8480c54ee1d.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 5cf072c16ff8189516434ea459583ed626cb17db525ed28d7643085d40fcdcbd
MD5 33dfb98f2f29087490ddd309268444f2
SHA1 076af71ffe1d64b05c140a35df143eb870c64249
SHA512 eeedf1d6f51295b1ff69565c52b75402c699aa108c2cd646491354efb359ff99d2ca8a1f1d2ee7327f7b47dc57921439f380944e9bf7b42999bd8d04d92e08b3
SSDEEP 48:K0HqTnpJZybRcBIS3yK931dyx3iYUFn7yLAPGKQ6uvbG9mISivK9+1Evx4/YF2eG:K8Y4KBm++HiKocL/2KQwGicgKZ+M
TLSH
T13AB1FD4130BB024439BE25889075975E52423173355CFABAFFBE00A68A6FE541DFF9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5e08da4-0459-47b1-8f01-111d124c6a78.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5e08da4-0459-47b1-8f01-111d124c6a78.tmp
Size 10KB
SHA256 031125bc3c624b6673d89267e8c32139680bd892a719e757ebe569be7ec01f34
MD5 ac050158e66c0ac8c8a1bee05f8acc30
SHA1 ebaaf0507c4359faf57d8813755827dece0ee31d
SHA512 4dbada28f5c8d836b50d135b166f9de9c0110c4d7d442f5377329eda149451060d9f6a59836b82129066a1b49798210d5b20bdf60d3caf824789c5b525624a32
SSDEEP 192:sxZ/hR5WzV/fTasXPGIdpdtHW6+WNGY36DCqDIg5rJ:sxZ/hqzV/fTasXPn3HbGX1/
TLSH
T11F22D851AE78A97B8CC7D20DBA66BF13E6F9603265D11E48A6FCC61C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba1d909c-3fd6-4a63-985a-12167717149e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba1d909c-3fd6-4a63-985a-12167717149e.tmp
Size 10KB
SHA256 6a6344ce2df6418b2972da02a9abc1e29501aa4edc347814e597984060a2e267
MD5 164387899f83e1b44b6e39c57d2e700e
SHA1 32c2bed024107bb2d120ed2facc53d89b267fc90
SHA512 e6e4140d0b2e45a792fc2c03b81de6ba90fb80fe871592466bd8b22045353fb1f6b89dd79cf09ea93b53c0cfd0ec741c9198db4af236b69a89605afa2a75d0ea
SSDEEP 192:sxZ/hR5WzV/fTasEPGIdpdtHW6+WNGY36WoqDIg5xJ:sxZ/hqzV/fTasEPn3HbGXMp
TLSH
T13222E911AE78A97B8CC7D20DBB66BF13E5F9203265D11E48A6FC861C05E66CD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fd5418ef-7459-4d11-adab-866c4d0ac8e2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fd5418ef-7459-4d11-adab-866c4d0ac8e2.tmp
Size 27KB
SHA256 2a383f3b4dd3b259130eff9826c50578e7c54152c8332d077cc716a2aab13a44
MD5 5d360acf7211f3f4b4b281f04dd09559
SHA1 7930f7b98fe3c36ec7d1e68ad1fa19ec3c7db223
SHA512 f6b3933fc366f887a6762a3bdb71cc30da8dd9c707242b9b4e4cae58e3501f3c5d4b4f5fcb6f32e349b895fc28c7240fb9315b88e27dbdd2eff4177b9d12e1b7
SSDEEP 768:nTKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/QroaA:nTKlm7QWvUYe0u1ja8/L/E/7aA
TLSH
T1F8C2EA3B640CCB7E4FC05E9DDC5A6F976EA802C7A6588D404BFA984C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

db35c7db-ecdd-469f-95ef-70df2614f09f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\db35c7db-ecdd-469f-95ef-70df2614f09f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adbd43d1-5cf9-49e9-9d18-5de046fc1d88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\adbd43d1-5cf9-49e9-9d18-5de046fc1d88.tmp
Size 18KB
SHA256 47a30180bb9216104840d998b82cdc6d5ff695ff0d47c2df57db2cce47a9a35f
MD5 6f0e97ca08d1f6999880834396d5670f
SHA1 53d56dc44c187898f1448ec1607c50f6d6e1e0ca
SHA512 717e848db05c14b6095503b7f6e9549fed27db55e951544e8fb89adf34bf8057297889241139f4d3c5642fc4ecf6aa78a92056db476320fffb6af8bf1f34fdb0
SSDEEP 384:4QkUSv0sNIbb/ObYzcOAh//kXxYoRngPJAxJ4ChAIIlG:w0X/lc/cJgPkJ4CWLQ
TLSH
T1D1827C35B8A4BD375AA39291F14736039F70912BEAC51F94DACDAF2C01CA1DC6307D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3a9f767-d8af-46dd-85d9-eda9d4591de7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3a9f767-d8af-46dd-85d9-eda9d4591de7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 694f0a680f3721c91b947709e43854c0e32157007797b341060ae9f013ef19fb
MD5 6d9a106d2970121b32050370c665cf64
SHA1 fc85542f2d371c163b1258deeecc2fff590e7105
SHA512 dc61b1aeed667480928c84f67926537d22de7cb4f3bf0e91f77a1baad6d51bc4b6fd936f288b416ac2e0da82233da6aea9fd6ba85009e4ed8ace0a641ff81aa7
TLSH
T1DB411C58A7EA1148B3B77E16AFF7A86D457B79672E0BD45E10010E4F0A37B00C961B37
MD5 SHA1 SHA512 TLSH

Submit Download