hxxps://sdzgranitephils[.]com/xy/Adobe_Installer[.]html

Analysis

user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/10/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sdzgranitephils.com/xy/Adobe_Installer.html
Sample261021-abc3kadf77

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
70	3088	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3088	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{3ED3DFFE-A17C-4B09-89F0-7709A56A2AB3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 5308 wrote to memory of 5812	5308	msedge.exe	84
PID 5308 wrote to memory of 3088	5308	msedge.exe	85
PID 5308 wrote to memory of 4992	5308	msedge.exe	86
PID 5308 wrote to memory of 4992	5308	msedge.exe	86
PID 5308 wrote to memory of 4992	5308	msedge.exe	86
PID 5308 wrote to memory of 5188	5308	msedge.exe	87
PID 5308 wrote to memory of 5188	5308	msedge.exe	87
PID 5308 wrote to memory of 6016	5308	msedge.exe	90
PID 5308 wrote to memory of 6016	5308	msedge.exe	90
PID 5308 wrote to memory of 6016	5308	msedge.exe	90
PID 5308 wrote to memory of 2084	5308	msedge.exe	89
PID 5308 wrote to memory of 2084	5308	msedge.exe	89
PID 5308 wrote to memory of 2084	5308	msedge.exe	89
PID 5308 wrote to memory of 1872	5308	msedge.exe	97
PID 5308 wrote to memory of 1480	5308	msedge.exe	98
PID 5308 wrote to memory of 1872	5308	msedge.exe	97
PID 5308 wrote to memory of 1480	5308	msedge.exe	98
PID 5308 wrote to memory of 2808	5308	msedge.exe	100
PID 5308 wrote to memory of 5492	5308	msedge.exe	104
PID 5308 wrote to memory of 5492	5308	msedge.exe	104
PID 5308 wrote to memory of 5492	5308	msedge.exe	104
PID 5308 wrote to memory of 1492	5308	msedge.exe	108
PID 5308 wrote to memory of 5772	5308	msedge.exe	109
PID 5308 wrote to memory of 1492	5308	msedge.exe	108
PID 5308 wrote to memory of 5772	5308	msedge.exe	109
PID 5308 wrote to memory of 5772	5308	msedge.exe	109
PID 5308 wrote to memory of 4652	5308	msedge.exe	110
PID 5308 wrote to memory of 4540	5308	msedge.exe	113
PID 5308 wrote to memory of 3220	5308	msedge.exe	114
PID 5308 wrote to memory of 2272	5308	msedge.exe	115
PID 5308 wrote to memory of 548	5308	msedge.exe	117
PID 5308 wrote to memory of 548	5308	msedge.exe	117
PID 5308 wrote to memory of 1028	5308	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sdzgranitephils.com/xy/Adobe_Installer.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ff8e7a0c188,0x7ff8e7a0c194,0x7ff8e7a0c1a0
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,12935974159860573367,9296228114504547760,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,10281908742872421597,4293466569153018128,262144 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,7195546162709518835,12728182105351724360,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:8
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,10740225637674858511,2593079320136076171,2097152 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2001284998023033984,2376044813139126518,2097152 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,9113890089005799297,5611618686578148615,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,3362144671894937277,3667835631149453785,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7920396798728839154,4843568933742174900,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,7920396798728839154,4843568933742174900,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=6156,i,8681506458879239579,17158463523672767711,2097152 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,5626105128072268325,13306462945456836011,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6320,i,10767227991628742515,15043193991683672679,2097152 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,8931527277446461212,13301175998941341797,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:8
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,13696037337732519056,1000401325615215547,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,4726116241317749955,6091028164738246905,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:8
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,1568390156051971262,4798767325263795511,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,699196690377353134,14606460095716031665,524288 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6128,i,9766469777748609403,17156775483857691648,262144 --field-trial-handle=2204,i,11168591960016600963,119105773902695802,262144 --variations-seed-version --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1652

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ca1037a-e030-47b0-b590-fb2e04296a50.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ca1037a-e030-47b0-b590-fb2e04296a50.tmp
Size 26KB
SHA256 b34962954dde73343e7dc6b953bf34f80db212252d00818cf2be5d663e4a260f
MD5 550c36242ab01c4bbcc80feac1212a57
SHA1 a452d443d83347f41a2d8c6c18000faf88d5b1df
SHA512 8ee46ac8e98269dfa0e973a2bdb1e86dab7fcaf7ebbefd3dd411c0d27af9ca74081592f7b38caabad1ef6b3d947211616b0dfc87643547d26c7c239cf9647903
SSDEEP 384:nniFzQkUSvC3sN28TUNTUlI455mgqq6K2flBVTPUVYlFipqQhTgL/7IzHIIlO:iFdC3/wgNEQBVTPhFqphzLI
TLSH
T174C24A36E8A8DDBBEDEB4F95A70A7647EEE04213C58C9AD4EAC91D1C00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

42a0c965-86d0-404e-8ae6-ce257407c721.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\42a0c965-86d0-404e-8ae6-ce257407c721.tmp
Size 32KB
SHA256 5c9aaa21b6e276f5f442353d598af561dde409f524909c287ae07ac9d7dcd1dc
MD5 6b229deb3996d864cdf5605e60e6557f
SHA1 0548ae529237299775898966f990e010c57da2fe
SHA512 aa88ee6857c4d6ee3edc9ce6943e04a5673b426c581a7d0c75b4e6149d17a9de10373d86efdbf3eb69cf5befae1784cd4e193a163ad07b9b707424eb5b4206ba
SSDEEP 384:nWiFzQkUSvPxsN28TUNTUlI455mgt96K2flBVTPUVYlFipqQhTgL/7IzHIIlO:9Fd5/wgN4QBVTPZFqphzLI
TLSH
T13EE2A3F598E79977D9AE4B83A73D2D029AFCC113B5885584B7C90D1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

55891655-9a1c-46ed-9f99-6226e357847e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\55891655-9a1c-46ed-9f99-6226e357847e.tmp
Size 25KB
SHA256 c1f9ae34a3083c65e49f0bb2ae479ea32426f04e06f369597000070cc344c7d4
MD5 dbb83733b6265708e64af795f1cd2ceb
SHA1 382b7efefa571d4574f81181a214115b128c6358
SHA512 eed171bef948349c51faccefaba4390067b6940f68d5922c4bf188ba1f57e06c6299a579287945dbbfe36ebdb93e00957ffa415b913c5a1cf6c7cac8bb77354e
SSDEEP 384:nfiFiZcI63sNF8TUNTUlIm25mg51nK2flBVTPUVDd7O6R2FeoCWgL/7Izgow:qFQ63AwgSqJBVTPyd7TR/N3
TLSH
T1E8C23A36EC68C9BBEDFA4F9AA74A7A07EEF00163959C8AC0D5C85D1D009759D130BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58004362-a4ca-453d-9564-c396ce5dcfc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\58004362-a4ca-453d-9564-c396ce5dcfc9.tmp
Size 26KB
SHA256 70225517cb2223958a7643d05def3869af61844604342361387325f2bc7b8646
MD5 4d137f49e10194a904c64cb60b22f138
SHA1 f41116eaec4df703467f7888b97d805a0ccdb385
SHA512 00dc19539499d34a992e23ff3d711f7881e052f9718b972e178ad4589e1c2eda0401771cb49f166c148d01771b902548ea2066497bc29d70c41631571b65528d
SSDEEP 384:n8iFzQkUSv+sN28TUNTUlI455mgtq6K2flBVTPUVYlFipqQhTgL/7IzHIIlO:nFd+/wgNDQBVTPhFqphzLI
TLSH
T1DBC24A36E8A8DDBBEDEB4F95A70A7647EEE04213C58C9AD4EAC91D1C00971DD130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

38db5d27-2da1-49cc-b1e9-4c2bd8f03c8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\38db5d27-2da1-49cc-b1e9-4c2bd8f03c8f.tmp
Size 414B
SHA256 67634653833f9c9d375314748279fb0e8cd24988408c65b9b420e1b2ff33695c
MD5 f12d942ae13b60e1fd5ec6aedf61aa35
SHA1 f0c61aec0744f7e65a612f647cb2b934ad05eb75
SHA512 cd298d06d8e977727740340b272206b93f431f9025c634b0e207286681f5c966bcf10e5c1683cca0f42fae503a77acd678ef87575e0021d70a7b6d5ff474b0a1
TLSH
T1B1E02BE9CD16AC3709FC4B2850640645EB41134B2A80858B373D910D8FF6A36518686C
MD5 SHA1 SHA512 TLSH

Submit Download

42942e25-bab2-4d97-8f93-96a5c0f91b4f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\42942e25-bab2-4d97-8f93-96a5c0f91b4f.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

69e75159-0f9e-47a3-b156-7fe1194b3131.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\69e75159-0f9e-47a3-b156-7fe1194b3131.tmp
Size 12KB
SHA256 190710eaf6ea603101b9f295f783516753d20820042d99e0c95656d0803efa6b
MD5 493672901f7c24e2571765af45c2f2df
SHA1 abe6c66b90acb8dd115328a11a233c61e473346c
SHA512 3f23518b2bbd36d400005c62fb20f44ad161ff2fc79b9fce5a860e04c0aae2b3e4b6063ab7dfcc1b0edaa695adc29cc11e0cccc896a547a2a443879fe1570b6c
SSDEEP 192:sxZDRw96/fUs8QZZktzodp9CHW6+WNIVYTNNXYbIfUb0qY1LJIg5GKaJ:sxZD86/fUs8OZkmYHblXFAY1hgL
TLSH
T1D242E719AD38A93B8CC7D609FA55BF53E7F9103390911E44AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

88a9dd05-2321-4819-aeb7-cc3093b22b7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\88a9dd05-2321-4819-aeb7-cc3093b22b7f.tmp
Size 12KB
SHA256 8098e72c9b3f250151493836185c93729aca52d7ddde593cf614fa845c19626b
MD5 ab3afe0f707087e48bae5515ab7ea138
SHA1 4d0d461e5e98cd4f8ef302dc85f3b5445d5be8a8
SHA512 856328db4e0412f95a0e7d03d8bc38e4b8f1e4451cac106a06d3e1adbdcf36c3af1770c7967cd22c4e3e2f3a313d89209333ed1379ae04fd3a8f9794dc35b19c
SSDEEP 192:sxZDRwk6/fUsaQZZktzodp9CHW6+WNI3TP/YbI20qY1LJIgjKaJ:sxZDZ6/fUsaOZkmYHbM/FQY1hjL
TLSH
T14E42D719AD38A97B8CC7D61DFA29BF53D3F9103290945E44AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46b6ac3f-10bd-4ebf-94d2-25efb0fe1f1f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\46b6ac3f-10bd-4ebf-94d2-25efb0fe1f1f.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6ae945de-2086-4450-8ebf-e3fa9a432713.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6ae945de-2086-4450-8ebf-e3fa9a432713.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

c9488cfc-edf9-4ab7-9e39-5705c4dce54b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c9488cfc-edf9-4ab7-9e39-5705c4dce54b.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f3b7b196-94cd-4eb7-b2c2-93521958cb64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f3b7b196-94cd-4eb7-b2c2-93521958cb64.tmp
Size 3KB
SHA256 3ba840bb1ab7b30ebe73ea061fb8516ab52b3b8a0815e234765ba97ac3a34e02
MD5 e4ee5e59e96d04eec98f2d5c45574515
SHA1 9deb019ea96e8e4fdd45774ec0a811b47053cb63
SHA512 9de3b118c010444d7f1d0d9a6d06cabc3971c34efd6b2143e0fa53a09dbeb4bdc1e03b1a47a08dc6fce84cbcabe1a6a162d0ce9f3ba99fbc4c03f6331ba4e63c
TLSH
T1A571ACF7C3E4962D8A11A6F0AA187E1BCE5D0A24431C3C5AC4E8AF5F93F2471E34065E
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 592c0a328e4e973ab4e881106cdb3fe8c5d252529bc030b5ae294b8a3b234dba
MD5 f24f537ff7da3ebaa7dd7ca6994b4fc7
SHA1 9773cf7a38931f6217ae88dfe1d407d4c6444630
SHA512 7394c6c6f38f8e627d6178c8e75200f73f8e3f4cf0e2228b85a88bff450f861629b53154935964b384d447375087e3e83775728ad4454ff6736ef62d69e7d7b0
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvX47fuw:OtfFvpopPxrB4Rhf4Tuw
TLSH
T112B2331471BA121038FE790881B5972F464232B33259E63B7FBD54A69E6BF085CFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a7c33ee4-d1fd-4e70-91c8-93343ed9214b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7c33ee4-d1fd-4e70-91c8-93343ed9214b.tmp
Size 12KB
SHA256 a00d273e8eed3ff716f20a2395f363681c3003b07d9728dda89bd748a8a5db94
MD5 b86583f7c43b9c4610e07691f861f4da
SHA1 472074ad4705a03977651f2772dade6fea5739fc
SHA512 b4fb6025152dd987827f73c8b4b374db96152936aae7a5f884c3f173de266d2316a2dfdd61740375e2215e9df0c1784281eb9d9eb6dd46fbacb9814458d0d05e
SSDEEP 192:sxZDRw96/fUszQZZktzodp9CHW6+WNIVYTNNXYbIf30qY1LJIg5GKaJ:sxZD86/fUszOZkmYHblXFnY1hgL
TLSH
T1E342D719AD38A93B8CC7D619FA55BF53E7F9103390941E44AAFC8A1C15E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

edd24d04-8c6a-4268-a42f-0f0efa7c6b8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\edd24d04-8c6a-4268-a42f-0f0efa7c6b8f.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a959fec3-c369-4580-ac35-e9c3ab78a015.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a959fec3-c369-4580-ac35-e9c3ab78a015.tmp
Size 26KB
SHA256 d5067ac808ff3e9014eaad0e3e9ac509b89d562aa3887ec1320778ed78cb3c1e
MD5 71390d8d5034a21639d70541e6f69a05
SHA1 712cdadde021a7f6a2bf26ddacf8bd26644a917a
SHA512 ed2f881dfb898ffda07e53d34396dbf4c05993528a4d9703e352d9c5f46330ee4afb9cd3b839b2f470614e03b4bdd7b7ad5aad6f7c32cafc44a426c34215ff78
SSDEEP 384:nhiFiZcI63sN68TUNTUlIm25mg1FbK2flBVTPUVY/F7O6R2FeoCWgL/7Izgow:IFQ63PwgS09BVTP7F7TR/N3
TLSH
T153C24B32E8A4C9BBEDEB8FD6A74A7607DEF44253D68C9AC0D5C81D1D009B59D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ad6ebf71ebfaca5add1050f687217db16f46a550d2c1f8c4ebc46a37858bbd91
MD5 853113e2884e61becd65998ee084a849
SHA1 588b54ff4b52a51df38921313600ca080e0fa20d
SHA512 bdd39aed6cdaf16cfa5604cf7f712d9cee6ea923f4a66882f8752d76740ec124f9066129ad9f20815158a10bdd775384270efb1b3f084a9687850ff881e3f763
TLSH
T1F6412A58B6FA1148B3F76E5AAFF3A86E447BB9732F0AD45D00110D8F0A26A40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

ScreenConnect.ClientSetup.exe

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe
Size 12.2MB
SHA256 a19e7fdd72f1f46d07ce3e2cebff8728edd3d1dd4377b7db510bf62bb4ecf37a
MD5 d9fc5cd50f244b874801ae8aaaa6b3f5
SHA1 76a7f8b157523c4687cc92829c30ff1ab84b1e18
SHA512 11be9f39a36441b83d759b714917c8dc92ab8280c6973ccb93b44e9ecdbf080081daeb644f77063198b00c4e6566a8e6fde449d67a7101e773512a58ab6017fc
SSDEEP 393216:rVe8raL251Z1Ve8raLXVe8raLkVe8raLm:rQ8rEK7Q8rEXQ8rEkQ8rEm
TLSH
T192D61211B3E995B9D0BF0A38D83E92659A71BC158752D3AF5390796D2D32BC08E32373
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ScreenConnect.ClientSetup.exe.crdownload

Path C:\Users\Admin\Downloads\ScreenConnect.ClientSetup.exe.crdownload
Size 159KB
SHA256 b5f4608d3ece1f7f78b6359ef3d54f60bc98004e1c6b7317be4227baae744500
MD5 67f788753cd295dcadb6da1dfad57a6d
SHA1 f474706282e127a1b1e98f0ae2b7ef012029501c
SHA512 435aa7c374e2f81f6b7e2c6177f4053b335e8cf4b0fa8f940deb1325b4eb7660f2158568ee97d4f5a3748e05916b9c6ca0995f781fbf3eb3c161633a74789470
SSDEEP 3072:2/iRchsvSgP1iwGFDnotqJTryrwgUF763THJgXZFhMvMGa8S:hzTmgU56GXxh
TLSH
T1A7F35C02B5D48D31C37F1AB68060494FC679D812B6EAFBFA27DCD1F53A92390E904672
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download