hxxps://persistent[.]oaistatic[.]com/codex-primary-runtime/26[.]1013[.]11914/codex-primary-runtime-win32-x64-26[.]1013[.]11914[.]tar[.]gz

Analysis

user interaction
yes
max time kernel
140s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 18:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://persistent.oaistatic.com/codex-primary-runtime/26.1013.11914/codex-primary-runtime-win32-x64-26.1013.11914.tar.gz
Sample261014-ww7cssgy31

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{257B16AB-2234-4EA6-8777-C10A71119F85}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5600	msedge.exe
5600	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SetWindowsHookEx 11 IoCs

pid	Process
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe
4472	OpenWith.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4676	4152	msedge.exe	85
PID 4152 wrote to memory of 3992	4152	msedge.exe	86
PID 4152 wrote to memory of 3796	4152	msedge.exe	87
PID 4152 wrote to memory of 3796	4152	msedge.exe	87
PID 4152 wrote to memory of 3796	4152	msedge.exe	87
PID 4152 wrote to memory of 3972	4152	msedge.exe	88
PID 4152 wrote to memory of 3972	4152	msedge.exe	88
PID 4152 wrote to memory of 2428	4152	msedge.exe	89
PID 4152 wrote to memory of 3536	4152	msedge.exe	90
PID 4152 wrote to memory of 2428	4152	msedge.exe	89
PID 4152 wrote to memory of 2428	4152	msedge.exe	89
PID 4152 wrote to memory of 3536	4152	msedge.exe	90
PID 4152 wrote to memory of 3536	4152	msedge.exe	90
PID 4152 wrote to memory of 3720	4152	msedge.exe	91
PID 4152 wrote to memory of 3720	4152	msedge.exe	91
PID 4152 wrote to memory of 3720	4152	msedge.exe	91
PID 4152 wrote to memory of 3060	4152	msedge.exe	114
PID 4152 wrote to memory of 3060	4152	msedge.exe	114
PID 4152 wrote to memory of 3060	4152	msedge.exe	114
PID 4152 wrote to memory of 3360	4152	msedge.exe	97
PID 4152 wrote to memory of 3360	4152	msedge.exe	97
PID 4152 wrote to memory of 2724	4152	msedge.exe	96
PID 4152 wrote to memory of 2724	4152	msedge.exe	96
PID 4152 wrote to memory of 764	4152	msedge.exe	98
PID 4152 wrote to memory of 764	4152	msedge.exe	98
PID 4152 wrote to memory of 764	4152	msedge.exe	98
PID 4152 wrote to memory of 4576	4152	msedge.exe	99
PID 4152 wrote to memory of 4576	4152	msedge.exe	99
PID 4152 wrote to memory of 3888	4152	msedge.exe	107
PID 4152 wrote to memory of 2404	4152	msedge.exe	108
PID 4152 wrote to memory of 2404	4152	msedge.exe	108
PID 4152 wrote to memory of 2404	4152	msedge.exe	108
PID 4152 wrote to memory of 2620	4152	msedge.exe	110
PID 4152 wrote to memory of 2620	4152	msedge.exe	110
PID 4152 wrote to memory of 2620	4152	msedge.exe	110
PID 4152 wrote to memory of 3200	4152	msedge.exe	111
PID 4152 wrote to memory of 3200	4152	msedge.exe	111
PID 4152 wrote to memory of 3200	4152	msedge.exe	111
PID 4152 wrote to memory of 3060	4152	msedge.exe	114
PID 4152 wrote to memory of 4436	4152	msedge.exe	115
PID 4152 wrote to memory of 3624	4152	msedge.exe	116
PID 4152 wrote to memory of 5352	4152	msedge.exe	120
PID 4152 wrote to memory of 5512	4152	msedge.exe	121
PID 4152 wrote to memory of 5512	4152	msedge.exe	121
PID 4152 wrote to memory of 4476	4152	msedge.exe	129
PID 4152 wrote to memory of 4476	4152	msedge.exe	129
PID 4152 wrote to memory of 5600	4152	msedge.exe	131
PID 4152 wrote to memory of 5700	4152	msedge.exe	133
PID 4152 wrote to memory of 5700	4152	msedge.exe	133
PID 4152 wrote to memory of 5700	4152	msedge.exe	133

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://persistent.oaistatic.com/codex-primary-runtime/26.1013.11914/codex-primary-runtime-win32-x64-26.1013.11914.tar.gz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffa8324c188,0x7ffa8324c194,0x7ffa8324c1a0
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,5919329267392836534,6750975138644979632,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,3744940217947025309,10712324473630305070,262144 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2468,i,18084322068617265155,11280615341121010015,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7233394251078354950,43437940966378998,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,18403103284197667102,13398138333251605542,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,10352930561801881776,17789624997475751717,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,16924095637511117376,16753324749409654348,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:2
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,5882869129862917418,5940892177826136443,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,10832163984243147487,7377341120196440666,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5712,i,6686381420000365410,640421875322853467,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5736,i,4254922679891514716,8015678736282813728,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,588779502119538396,6055734729016705000,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,588779502119538396,6055734729016705000,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7004,i,14597096217544575505,17428430756549759503,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6632,i,16571794808044015507,12067911344413265499,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3444,i,15583180928322453920,2009101283819323179,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,14173341067783224837,6927520032499316260,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,553325064694265172,16912832826143660799,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=7020 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,3805919683462368283,16826768753832709742,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=768 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,8326344101390465609,13316976788852683609,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4768,i,15943245454015232809,2640921572299866761,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:8
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,7564199406103608656,13448648107402926568,524288 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5188,i,10323646337993210185,16099267635014535687,262144 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3784,i,6294069446624475062,6114836494645625821,2097152 --field-trial-handle=2304,i,15248282626663803999,10866959899069091967,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:5700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3468

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8acfbf6d-d2c3-4bb3-8126-1742cd8cc3c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8acfbf6d-d2c3-4bb3-8126-1742cd8cc3c7.tmp
Size 18KB
SHA256 ed1f8de2bfb2e24921654af34cdbf5c1cbe2ec0017943c9d9e70a5e797367fc3
MD5 1a031b8c9e1e0cb32873cb4ccac58e0f
SHA1 3adbaf9caea6dd7bfd3e3210fcb3918de97c244c
SHA512 528f8d714952af8c85358ad69d8dcdaaac3dcf822f894e19aeb5bb6775dea468db76569ca8bddd235a91faac5187e380f3e309bef236367283096dc767482c27
SSDEEP 384:dQkUSv2sNiYRtQTdp5u8ijOBNRPJAxJYWIIlCr:H25JkORPkJYWLkr
TLSH
T1D8827E766C797D379AA6A510F54B36038FA4822BF7D41F94C6DE672C01CA3D8230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

3e0e8c74-414b-4517-aed4-5c084d31770d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3e0e8c74-414b-4517-aed4-5c084d31770d.tmp
Size 10KB
SHA256 7a14da54f82dac5418fc0b3bcd9c10d75cc1f14bd6e750182aca9902cc4f830a
MD5 aec4622a95567a567e05b6ba2dd1be6a
SHA1 c27a12609856d792f31bfb2c3f356a2a95a5ac79
SHA512 40e2a7d2663b4b87b29f8a9b948738c521f764ad82369d7b0beb4e2fa3847fe106a014f1e7d36e882eabe21fea9efc070f7ac9517f58bbd94ba02dd7a5d0bb00
SSDEEP 192:sxZLR2ni/fJsqzjIdpLHW6+WNGYaDKGLIg5/J:sxZLSi/fJsqz8LHbGzz
TLSH
T1F822C952AE28A97B8CCBD21DBB557F43D6F9503265D01E48E6FC861C05EAACD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

51f423ec-10a1-4c2d-ac1e-267433174c7c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51f423ec-10a1-4c2d-ac1e-267433174c7c.tmp
Size 9KB
SHA256 8294cef372ed7df9482ff8cb43535734cf1af22b4724a6f7ecc5fb094a1649f5
MD5 28ac81a4527ff740ea05136d4c7f6a16
SHA1 d4edea7324751678c6bf521c73253c64d982c24f
SHA512 7757174c35ac54548ec70b29f31688e9f97ef5c01e65652736b3acfd3e167c7f627a0d0915aa92c108e8e39837a7150105054fd81f6b141b2a0eddf0e190a377
SSDEEP 192:sxZLR2ni/fJsdzjEdpJHW6+WNGYa0GLIgrJ:sxZLSi/fJsdzwJHbG19
TLSH
T18A12C752AE38A93B8CCBD21DBA657F43D6F9503265D41E58E6FC861C05E6ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96c81b87-2fca-4089-9a54-d2bced09a724.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96c81b87-2fca-4089-9a54-d2bced09a724.tmp
Size 414B
SHA256 930ddcad38685460cf0242349299f7e7585b337c8048c6b43fb7f25f7ad72c59
MD5 e8e2c6f122c5d6280e9c21b76bb92644
SHA1 294d49783f944c7ddc6af84f4de8d85d325d1426
SHA512 f6b8b8ada9a0b535d3048cf4dc780b84000a1db6c9b833812b6ba4d954c2c19e1bc1e3a0154bb3fac9edb60f1a241d60432c71c11e28077795fa3e3b56fe448c
TLSH
T1AFE02BA5C822EC7718FD0B5DA5501B46D711135B2680850F3A3D810C8FB473A068685C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 16b09a4ca48c078b322803061c36b8994e4ab5bfc3bf1d5a0157db1699520f3d
MD5 807fee99db913a4ca1ba0f42aaeecc85
SHA1 18a57aead773f07336536d3bf9c26fb386f3c813
SHA512 9fb9b920a9230c40904a6185768b8dc3c22d2e7a9298026f2863b092e61edb1288e3163608926319c8e8f61abf8da6fbf875098e06c2d6e0c5a048d868d5d7b1
TLSH
T1EEE026C806C8C63FF358644B027C530CD790365F93D5690F5708C98C704A281A386FD0
MD5 SHA1 SHA512 TLSH

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 181B
SHA256 7e2c9ea1a5eb3a215d57770c527699e7c9afae0fb76cd5ecbf79a0777cef3251
MD5 f73b0ebfd4e9cdf75ca4a5b7839c6063
SHA1 dcad3de5b520aae65abacf9540cf522b4e94ba71
SHA512 ab2058e5a056d675249a2e70e85423d720ffeef880cf4fbc6bf52844563cf9521ccd2ad0009bb11ce15170e83ad197a1936f1db2323920a10ab34a996aefa006
TLSH
T116C0224AC4B696B485FD024A8A0087C88811038A2890C60D3728C09C80F130413CA8D8
MD5 SHA1 SHA512 TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 206KB
SHA256 a1fb798b93396ee8a9c1fb2198310347fa58ef7f7a9bff1a420ff6dcd9fe467e
MD5 19af1d0ef660a1d44e613503f76f8b39
SHA1 63215809403ab500d39bfc2f19ba7374520de9a2
SHA512 9898bcd29bf16b74f702666d5f2c84c4e8c8d2a04a771110451206bdd84030e13e945dd87a134fb7da79bbad6ccd0197a2dde8ba5dedeb311437612005a43376
SSDEEP 3072:4p0CErGJM1kOpBmNy29n86j628g9s4qfdiXM6k7/i1bevSfNMeTA3hMpY1BAHmCg:6VEaJvOp0B86jR8I46o7/8aSCqSXCt8d
TLSH
T1632423353D6682383822B65B729E3D6FFD480FE56E0E3D6725EC830759C88B652F4849
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 16KB
SHA256 ea74aeb9bbc1fd7d71b911d911108b192c03a4422bc3078ae67ab84d4bea9152
MD5 1fc7b98d7b8d83c93c45656d8bacaace
SHA1 e5ed1e596b49a1416389400fe57aac7cd867fe55
SHA512 9ec64198a81d68eef7c591ff1123c688e83572f762cd7e8c5d318db741d643cd5e0b8ff5046588afa4e8a1582b35de487d9accbbfe2f3664063ddf1b118bf303
SSDEEP 384:K0rSq12+fB4YJoA23iSbqJ+Va5YBrF31RolWVop7X:Kmf4YK12wVa5wF31Rou6j
TLSH
T19F72D0F9C3563FA63B3BC2E8461499C3439D184024BB428144FA52E53A6E5C73F7EE29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000072

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000072
Size 17KB
SHA256 112e05f8d6492fa8de5fd8442ff8e611c48ec239ac153aca03926b85c57b7254
MD5 1ef39242358d9c9591efb3cb4ff339b5
SHA1 0901c7b0d823502032a70c7aa84a4bd4de6733cf
SHA512 806b0734e8f095e258854a2be648501d0d913d5c9ee0ab5053719cbe4a6e2d9e19d3ac0c77232e92b161f8ee016ac81e61ddfe4ea997483a8b305ee0313b03d1
SSDEEP 384:XHu/YTZ+IwdeeB6g+JkEMizmvGD2N2/bXyibE6wG3wzxMijX1dY:XHu/YV+9e5g4kEMizWU2IjCibE6wGMxw
TLSH
T19382CF9808A719EE1CE8BC5EB431A564767F7AC271A433512061B8F75D3C3889F1AE1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000073

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000073
Size 56KB
SHA256 3e3a5b7df892755aad0f7c837cda65543935c2e1d5dd3a0389d2227b27b3c783
MD5 cdbac43e4e71cd007053a75f021eb0e1
SHA1 2450aaac0722fd318010405b608619807002d31b
SHA512 7d537786ef34c077d8a418397f8e68d7855836b0c6409ffa0649f4b23a7e53279efff2b507f5e4d51a127fde6f287fd63ed8cb336c1ebd064ea8fe0bd13cd9a4
SSDEEP 1536:kotc2k+ZIMG+j/rAuEiJe6Vfx7M7giDNGwiUTJWRj:ko3FISVM7veUdyj
TLSH
T1594302607208529B4CC35AD4AC8E8447C76EF93686E0D6129F69899F1DF8F6E0DD4E0F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000074

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000074
Size 46KB
SHA256 acd89fd7ab2eb7d194867fd59a6d8e9d70810a9ffe7c4a7410ec9a32f49bdfbf
MD5 a4dc87784190ca2743575ce45acf95de
SHA1 1b8763f8ec7a17a7adc9d00153ef757551f0ab4d
SHA512 3362ac81a974bbb8f8624cefe6b22c4feac2911a7caf3b4c4e88a5add59c797b9799a723a87c277cc78c6f2e54ef84719c497032add72e3af07f9154b9b77d38
SSDEEP 768:4MX3VgcsVqeBP0u432SaDpFUz+i79LPXe3cXuuSjd8SKn3qohh2A7F2V:D+c+qeUi8t7Bm3ypYLaqiEAZ2V
TLSH
T16623022B312DD55E15F4F7398B5CF16A24A088CA2A471CFE10B8697DFA1DB284284F7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000075

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000075
Size 59KB
SHA256 484fed28305e8a1256870a26f905be957ee23b5c5dc9c0daa5b01435e7de3408
MD5 4a71d19f1524347cefdace1552ca0ce8
SHA1 88807a5961fcea0ac750386a58fe15cd2bcac4dc
SHA512 56265d2a570ce38ce785c4465efc3f93013dfbf663cfe379647c3447d8da4d640634333d13d8655286591766d53ec04ffed8c9bbbed0c0275e303aa4e6f2cf08
SSDEEP 1536:I7NouaEbzqNcgQMXR/ZSnTn4M1U6nnZ1Sop:IR3aEbzq6eRBkn3Z1H
TLSH
T15A5302E98EDBC7BE8506083278A11D875DCE4685B53EEC1D9058223F53D4CBAB7E825C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 72KB
SHA256 fcfaf2e8e1a5d8cff6e2c7736a10a6a3faf27d4696d5d4bf1e2d34cf3512b5e0
MD5 e23f701a0478bb09e5547db5f18b17de
SHA1 cdff049aee29553f0533f7d692d37fae129b7a6f
SHA512 370329619cd303f5ce5bf42692bed1ef7f8c04f4a26181ad42269ac5f6b81fd1ca87034a629b969cffaaa46a626f1eb60fb70e71dabb9f11148b5cd038bb6959
SSDEEP 1536:SVJ0GggPe5RTRIY+6gr24bw02G3LkxUsljvsEQ+:825wY2K4bw03Lhs2y
TLSH
T1CA7312B9871A01B55393D610C935859E3AAD5E1EDF02F85B3FB969A8B08F1B1CCC0D24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000078

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000078
Size 71KB
SHA256 d40ca516a00f4b6ae9937cf0eaa8e1f0c2033aaf783dae3c461d68b8b142bc4e
MD5 8f850aaafc8da0df7f8f0a0b682a934b
SHA1 ef55df2e866abed76fe19b05ceb51c1147a6961f
SHA512 15160500824282d1e829908670dc7405abeb4d571ffdcf94532f55294fce77552c832f27fc14b91141ffd2aa142c441fd8e48df8e43cdbfe9283a043da2460dd
SSDEEP 1536:m4kLBYkMICj9ZBz3ff3Vpsrc6gy86ywUOWo3xmWVNKz/8A7yWuBKZS4PHS:elsr9Lrf3VGQ88hLoxPq/N7y0ZS4Py
TLSH
T14573F15242B8D90C1F6550E30BAA1EF1CD6B18CB94D4A0CCE8C7EF9DD259EAB4D66880
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00007c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007c
Size 256KB
SHA256 058eb9674b820893fff9e55cfe93bd695bd889d05f0f90334d3b989715777d83
MD5 9dfb182f3c052fce549551574c7b340a
SHA1 0c3678063cd5bb8bd5bcdeee48f0ef6e7e010dd4
SHA512 64212b0e9cc7518893beba3f2df2dd5a5b228c1f267f9765ef9c5ae328cb7b7abab8f3dcd574aebeecc543f2ede018b5e69412bf57cc840dfce9125b97e1f9c9
SSDEEP 3072:kgfDA0xxnEw3BLm2IZ/TD50hJlxfboz1c+mc/a9tKcJ7K:k70xxEwRMZ/ulxTslkJ
TLSH
T19C441674F7C3EB82DB4326BDA03C3D731B9401C5A1C5591B49A39D61A499B3AE30B93E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 548a9ebe03eb0959cb3fec80a858f0ceb6a9e9e9bf01355425b932e1d6d061dd
MD5 667ab3916fb777127cd5cd28239d8037
SHA1 64caba1a651e35c52d72cf9c8b2dc75b8415199b
SHA512 3eebda30285941a9072073eb247df51ac2c2a344bbe2136eab08cfef88e1d52542a6714b9ddacf7211b300a34f6e51224b3f6cda886de288a921d451cc1e1beb
TLSH
T1026142CA5ED0297BFF6865B0C5FD154B3B3034B045A31F5A28E6F8741E8D7892D96238
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 87f9d023a6d7f139d5f624b6a655aae11809de6dc2231b2efc39e3e1c186694b
MD5 9aaa2a60fe1e2e45ce2df5e3cbec177d
SHA1 8d240ef1683302a3bc24d252c5f2822c77850340
SHA512 18f2023a69f61f96d6f2945aa8096ad4175e30e694d311da33e022933edcedbe63179cf4a75836cd4245c78324ec04d7aba222bc7c8b31a875ea4853cd2e2184
TLSH
T1586142CA5ED0287BFF6865B0C1FD154B3B3034B059A31F5A28E6F8741E8D7882D96238
MD5 SHA1 SHA512 TLSH

Submit Download

dd0417de-6546-4157-bd05-6375138fd770.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dd0417de-6546-4157-bd05-6375138fd770.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

27aad8ab-afd9-4ef4-a2da-ac2fc698902d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\27aad8ab-afd9-4ef4-a2da-ac2fc698902d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

44dd405f-dfe8-4970-a084-158d01494b4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\44dd405f-dfe8-4970-a084-158d01494b4c.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

9ff663dd-c435-4377-ab14-e730af4e274f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9ff663dd-c435-4377-ab14-e730af4e274f.tmp
Size 1KB
SHA256 782fec2d166e9c1f492f4cf7d329b63940baff05b0c42814d898b6ee5f371e78
MD5 a1049a200f8e2fc994109f18aa74b750
SHA1 9b8c809aee3c2ec800794de74b88fd7f950053ba
SHA512 05586625f63633b0647d71484508eca849f52d3081ef455dbb795be7072f048f6674c3965eb0c3422f349ac33291970e849e65e78598934bc21952b18e6df13b
TLSH
T13D21AFB7C2D5C6ADC95156F05A14AE2BCF2D0615822C3C2AC9D4EF5BD3E3071E10555F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 576B
SHA256 7e0d4f0083fd51670620c33af127a30327c0e06df89d95ec229f770ee840f5ba
MD5 2af7959bc9d16d3ad255244986c714b2
SHA1 0f169903da6e558cef689af8eef40d3b766e645a
SHA512 22617974790d51550349e81832f376dd02bd98f6e20c08154ba8f429da7da2cf61be57eeaad6545491fd5fe7920a7d1aac0e70e179d5ed24618f9fc2adfbc1b2
TLSH
T194F02BD83E1349DBFC200131643EA1986BB403CC5328688770FCE02A9C0BB80AE82AB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 576B
SHA256 f39303077e1cd304ab146ab4d7143d33f50ef970df5a495bfebdedb9d428fca7
MD5 cd58790ea060c39830e55d6cd1a2e285
SHA1 d218fe4c0b5d1e357176fa510ca4964d70bd41c9
SHA512 ff4248339a63eabae5a8a7585020efc219894e6f1ba88ba9081d7ca04f6541c96ec16cc2c3c23050dc941d73f71e33350df80ea75081fc64d3ba1258b6746dbf
TLSH
T1C6F0F1D816138F43FC040131E97EE19961B551089328794FB3F69029CC03BC09D82FB1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2a544f4d-a007-4f3a-b210-5e4ea2a29b4a\index-dir\the-real-index
Size 72B
SHA256 7ea2e07412fc5fe7bc035ee7447a53552674e745d1facb929c62f8a2eb45d82f
MD5 2834d618991128ced3a2cab75163ceff
SHA1 9bf826b11e9ae2e3200248ec8de660467132a1e3
SHA512 2bdd3b220c4e958ffa06b789e503ba882282d251fe8c62565f2cdb72440778af84e02e61351db31e83b8ccd01afdb2d9bf1878f2e8ae9ebb3ac35c1caea9aaaf
TLSH
T126A002514FC20426D06A11F1355322616300C810160713174097C069EC724405D5270D
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 f8a7999bb34c6e8814a241861cc3399464dc4c6bedcbe24586308d680116d217
MD5 1bc94012982457ad4ffe100ebfe18cb0
SHA1 b16616534568516929252a935af534e515ec979c
SHA512 e27f5361b7f200c5bf7a0db8a1b65760404f0e61464fe395ca0d6c33848e4112237a530aa5ad8b0865249f6c77e7988de85ae81baa658d9e26c3d360d7b5b8c3
SSDEEP 96:KgHmKQou6ucK3q8t0BdnDfkvDePh1kKJBhReIKLyOWj6KwQx:AV3lt0BdnDfyDeJ1pBhyLNk
TLSH
T19ED1425030BB060139FE2A594276CA5A528231F73018E56F7BBC45F16E2FE095EFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6dd8565-9fd9-435e-9490-8e1569323637.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a6dd8565-9fd9-435e-9490-8e1569323637.tmp
Size 27KB
SHA256 3516c71692de91d0c9a400213e0a2c283f11f4020fdba81ed0c6651e1d7ab976
MD5 aaf41b25b48d5ef35bf7344dcffa9593
SHA1 9263b4425d7bf5f01b8bd4b1082d2a33d605064c
SHA512 2203af287712c9b8ee37100d9604f8263f24ab596a912b3d0227ec24b87ea8c440527997b20312ae35b322d1dd2b776dcc1c5da2479c58c740aa620f7cf82919
SSDEEP 768:oZyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH37rogZdf:oZyQRbrWvvlpZu1jaXKLf33IgZdf
TLSH
T1A4C2EA2B640CCB7E4FC01E9DDC666F976E9802C7A6588D4047FA994C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bce92694-8bba-4702-8e75-0d6c8302211c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\bce92694-8bba-4702-8e75-0d6c8302211c.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ed0670f0-6882-452c-828f-0eeaa3bdc396.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ed0670f0-6882-452c-828f-0eeaa3bdc396.tmp
Size 9KB
SHA256 f128e0888c1c667e9fa52384219799bbe7840a6385acf00287cc30077a85dd85
MD5 542ccdc75d20d370cc4060c07668add5
SHA1 12af23740f7b35593ec23e1e75bee8b439f3cfad
SHA512 7998c2961609d1bf8bd7925ce6ed753f053daa0df33017cc5a27428b310545bbcfe1d66c6247ecdceb8bd0b4dbc95618d0d28688962c5257b14b23472ef15859
SSDEEP 192:sxZLR2ni/fJsqzjIdpJHW6+WNGYalNGLIg5VJ:sxZLSi/fJsqz8JHbGq9
TLSH
T1F822D912AE28A97B8CCBD20DBB557F43E6F95032A1D51E48E6FC861C05EAACD130740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f00ac5fc-2157-4e2f-a2fd-f069a211e07c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f00ac5fc-2157-4e2f-a2fd-f069a211e07c.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

3cd3be66-1a2a-4fa9-9de2-2dff8463500a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3cd3be66-1a2a-4fa9-9de2-2dff8463500a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a3909753-3a99-43ff-be0f-9100f52954ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a3909753-3a99-43ff-be0f-9100f52954ac.tmp
Size 8KB
SHA256 4a916965f302e2ab77af28ab9862f051690452b2e547e3b733dea0df487d3ecb
MD5 8c05184ad1ed932e94799c68dc6b6aa4
SHA1 d27add7971495f24f36ffdd787034c6706608cf4
SHA512 09cda3f3abe4bcbe0ce0c6887a8a9c329b363747ee81ff518b2b76b6135079bb058eb0b8aca91ab96b936f2c377e1fed7944a9d27142ccf731f3f6ca2c4869c2
SSDEEP 96:PqONkNQsjpfwDISp5ih/cIPURHl8h4otop5cmD3BfPGxvw45RxmJm78lFUxFqsen:SONV6iDCQmiUyfxHq5u88PjaSq/cpLU6
TLSH
T11402E839AC783C6B9EF3AE05B5477B175FA4013FE6942B84D9E81A2C01D729C1307522
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a6fa8cef-232b-4d45-a11a-5658f303c12b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6fa8cef-232b-4d45-a11a-5658f303c12b.tmp
Size 21KB
SHA256 0bb4f35846eeaad18d3e94f3014940acd8bde7c8e7b7272d9e92abfce41d734a
MD5 1d0bdfa98e619047158d65c0eaf5d4ee
SHA1 1f92c7ac6f854b3d0741fc52ccdb917d25628c0c
SHA512 1c3a6ace76c530f6f0131fc00f08bae9b02cb921a94e7bdaf3a02d107375194ec2f6265d8b1bc5f0d83b9c490c61fda3b29f47de77e5cdcb915e1f99a0788383
SSDEEP 384:yiFgQkUSvtwsNN8TUNTUlIlkTbt4EG2p5u8ijOB4RPJAxJYWIIlCr:5FIuCwgsGkk3RPkJYWLkr
TLSH
T11CA26D739CA4AD3BAEB69E10F64B36038FB44267EAD46B94D7D95A1C00C72DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bef6abff-8162-464d-bb40-9354f1c195a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bef6abff-8162-464d-bb40-9354f1c195a1.tmp
Size 18KB
SHA256 6c90dcd930c02cb129451af67007c84a9fff5f2bd3a16848768961d7baeb73d4
MD5 3663bf47a30b0dd5f8a9664ecee80836
SHA1 a2ac27e70cec498a69e4ed3fae8c76fe60284c22
SHA512 f8badec35722ce2fb147ae47664f2b2f31f7b215a533d6b4a376ddf14492ed2638d683e6ef3d74160ce97bc452f0058bef39cfe2af0da15d0351805b4d954c16
SSDEEP 384:bQkUSv2sNiYRtQTdp5u8ijOBNRPJAxJYWIIlCr:V25JkORPkJYWLkr
TLSH
T17F827E766C797D379AA6A510F54B36038FA4422BF7D41F94C6DE672C01CA3D8230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1a777e4-6797-4483-8e8a-a6a18499647c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c1a777e4-6797-4483-8e8a-a6a18499647c.tmp
Size 21KB
SHA256 30f5357fe7008233473127141861c618052a85aae31e4a42865b4690021807f8
MD5 26c00f441be935c41f4c413d6f8b8aeb
SHA1 3c017b1b88f412792ec4ff87f9d25795eb989e6f
SHA512 44d91f1f68dfc5036fd9b1e3afcac68c3a34053d97960de2c64f95d9e6bda66ed29e1302ff9453b57e2bf347489908f4480668195602f11b086eb96455c14534
SSDEEP 384:yiFzQkUSvtpsN68TUNTUlIlYRtQTdp5u8ijOBQRPJAxJYWIIlCr:5Fdffwg5Jk1RPkJYWLkr
TLSH
T145A25D735CA4AD3BAEB69F10F64B36038EB44267EAD46B94D7D95A1C00CB2DC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cd57586f-7340-411b-8477-1f4f6c97e7f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cd57586f-7340-411b-8477-1f4f6c97e7f9.tmp
Size 12KB
SHA256 47c4aa905f0d17c698fb85f2d874107eeb4a23219d43efe1a628cbd5fe290bd1
MD5 5e98f813e00aa41b9953aeedcc3d27b0
SHA1 06e95c7c86a2317707ccf581bbab96667271f596
SHA512 27a5df76e872d8c269f09dbbd685f09c9a649e006f0f9861b68dc93a9923e893aac2bbfa52907fa78d46985dc2d5d9fd2e696526eac713823d355e5ba86a8f91
SSDEEP 192:7LsNiaQC1o0DP+3QmiU1BUSS4p5u88PjO7FvlAQqPz5I:nsNiaRtQNdp5u8ijOB6RVI
TLSH
T199422A36AC786C37ADE6A654B14B3B034E74426BEB842B84D5ED5B1D01DF2D8130BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6499f03-ab62-48c3-bcb6-dfad3e3c6fbb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6499f03-ab62-48c3-bcb6-dfad3e3c6fbb.tmp
Size 8KB
SHA256 6b8de765990cf9eb0effaea42e175899891c4cf200529931bd03154b10a19e9f
MD5 a342a431b8a8d6176a2ecdb92a23078a
SHA1 6acd1d9eecbc9d23bddafad6912445c665d4f95d
SHA512 89cfbce6698cf570735a7faba93e9877d72b3ff50c3110050ef45ff089da5613081a8e0efcd6ec19a100f25318c3ccb1b70f55376334fdd056afead1d9767d00
SSDEEP 192:fONj6iDNQmiUyf/x/q5u88PjO7F+uZQqPU6:fONj6iO/q5u8ijOBhRU6
TLSH
T150120B36A8787C2B6DE3A954B58736135EA5423BEB883F84D5ED162C01EF2DC130B512
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65a9d609-7fbd-4210-8b0f-0e70e94f447a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\65a9d609-7fbd-4210-8b0f-0e70e94f447a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d7a3b13e4293194ceee3bbf3ed7c780643017478090e601f7b9008d45cb20863
MD5 9ff1962119218a958835e7c8e2ddc426
SHA1 63e51816f20ba126c1fafe976e0e8485b94c60d1
SHA512 9232640124044c1b3da7ab65f83288eeb92bc03f8032e58a745cd615dde6b89946eaa4961647e0aef423558358954c389625521be31f4732ed63730667d2690c
TLSH
T19A41265DBAEA1108B3776F5A9BF6A86D447EB9772F06D55D00010E8E0622B00C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\8b0d4544beb97a69dbb9583fca5575a9aba6e37d.tbres
Size 2KB
SHA256 e5ff346abe0d702c1260e5b13a66b7098f951252e11dfcc7914367153c3ba169
MD5 b478e079a716c1fce9cfd0731e32431d
SHA1 3e61b0cf1212e7f4894a8b4ba537495734ad28da
SHA512 991f324a1ac81c7bcffe8f1e5bb97d385ef8db37e9e608f1b4daf8ba16e46d2b3e7e251723ceba44b402d52636c3bdf7be71b68ad6e18b190d58513ada7b0a2d
TLSH
T11C514C58A6E91148B3776F169FF6B86E887FB9633B07D05E10110E4F0A63A40C9A173B
MD5 SHA1 SHA512 TLSH

Submit Download

7f575baf-6ab6-442b-8188-047cde96d88b.tmp

Path C:\Users\Admin\Downloads\7f575baf-6ab6-442b-8188-047cde96d88b.tmp
Size 6KB
SHA256 bb684c78d949ac67e1434f45f61d7f5ec8b82370b4749f653efba8e3500edc1f
MD5 7f49a9abb936ac9c252f5422134d74dd
SHA1 aef220f751d6510ae01f80ca578416d4878c9813
SHA512 98e59bc781cc2281902ac35425df3ce04bd2b46c6097702375aeb683347ac88a9652513defbeaef8f6005dde7cdeec1ba0a4798ef935f22c3958f69c1af5acd1
SSDEEP 192:N+BiNDV7CJz1hAJyXV6MgkYwdflUu29IqLs:4BiNyA8XskYMeH9IqLs
TLSH
T173E19E6B855F268F8BB5A0F6097F45E2394CDEE4D07DC3281422B91A3B8742F10FC11A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download