hxxp://cm[.]ors[.]od[.]nih[.]gov/mab/data/Lists/MABQuotes/DispForm[.]aspx?ID=1406

Analysis

user interaction
yes
max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cm.ors.od.nih.gov/mab/data/Lists/MABQuotes/DispForm.aspx?ID=1406
Sample261023-sdk53aew5p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2884	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{EE64D4F7-7780-4027-B3B0-B00AF544884B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3796	msedge.exe
3796	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe
4840	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4840 wrote to memory of 1320	4840	msedge.exe	86
PID 4840 wrote to memory of 2884	4840	msedge.exe	88
PID 4840 wrote to memory of 4372	4840	msedge.exe	90
PID 4840 wrote to memory of 4372	4840	msedge.exe	90
PID 4840 wrote to memory of 3324	4840	msedge.exe	89
PID 4840 wrote to memory of 3324	4840	msedge.exe	89
PID 4840 wrote to memory of 3324	4840	msedge.exe	89
PID 4840 wrote to memory of 3888	4840	msedge.exe	92
PID 4840 wrote to memory of 3888	4840	msedge.exe	92
PID 4840 wrote to memory of 3888	4840	msedge.exe	92
PID 4840 wrote to memory of 2792	4840	msedge.exe	91
PID 4840 wrote to memory of 2792	4840	msedge.exe	91
PID 4840 wrote to memory of 2792	4840	msedge.exe	91
PID 4840 wrote to memory of 3896	4840	msedge.exe	93
PID 4840 wrote to memory of 3896	4840	msedge.exe	93
PID 4840 wrote to memory of 3896	4840	msedge.exe	93
PID 4840 wrote to memory of 3784	4840	msedge.exe	94
PID 4840 wrote to memory of 3784	4840	msedge.exe	94
PID 4840 wrote to memory of 3784	4840	msedge.exe	94
PID 4840 wrote to memory of 4656	4840	msedge.exe	98
PID 4840 wrote to memory of 4656	4840	msedge.exe	98
PID 4840 wrote to memory of 4656	4840	msedge.exe	98
PID 4840 wrote to memory of 3832	4840	msedge.exe	99
PID 4840 wrote to memory of 3832	4840	msedge.exe	99
PID 4840 wrote to memory of 3832	4840	msedge.exe	99
PID 4840 wrote to memory of 4448	4840	msedge.exe	100
PID 4840 wrote to memory of 4448	4840	msedge.exe	100
PID 4840 wrote to memory of 2448	4840	msedge.exe	101
PID 4840 wrote to memory of 2448	4840	msedge.exe	101
PID 4840 wrote to memory of 2184	4840	msedge.exe	104
PID 4840 wrote to memory of 2624	4840	msedge.exe	112
PID 4840 wrote to memory of 2624	4840	msedge.exe	112
PID 4840 wrote to memory of 2624	4840	msedge.exe	112
PID 4840 wrote to memory of 624	4840	msedge.exe	113
PID 4840 wrote to memory of 624	4840	msedge.exe	113
PID 4840 wrote to memory of 624	4840	msedge.exe	113
PID 4840 wrote to memory of 4584	4840	msedge.exe	114
PID 4840 wrote to memory of 4584	4840	msedge.exe	114
PID 4840 wrote to memory of 4584	4840	msedge.exe	114
PID 4840 wrote to memory of 3108	4840	msedge.exe	118
PID 4840 wrote to memory of 3108	4840	msedge.exe	118
PID 4840 wrote to memory of 3108	4840	msedge.exe	118
PID 4840 wrote to memory of 1592	4840	msedge.exe	121
PID 4840 wrote to memory of 3448	4840	msedge.exe	122
PID 4840 wrote to memory of 1244	4840	msedge.exe	123
PID 4840 wrote to memory of 4592	4840	msedge.exe	125
PID 4840 wrote to memory of 4592	4840	msedge.exe	125
PID 4840 wrote to memory of 4592	4840	msedge.exe	125
PID 4840 wrote to memory of 4040	4840	msedge.exe	126
PID 4840 wrote to memory of 4040	4840	msedge.exe	126
PID 4840 wrote to memory of 2796	4840	msedge.exe	127
PID 4840 wrote to memory of 2796	4840	msedge.exe	127
PID 4840 wrote to memory of 2684	4840	msedge.exe	128
PID 4840 wrote to memory of 2684	4840	msedge.exe	128
PID 4840 wrote to memory of 2684	4840	msedge.exe	128
PID 4840 wrote to memory of 3796	4840	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cm.ors.od.nih.gov/mab/data/Lists/MABQuotes/DispForm.aspx?ID=1406
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7fff9750c188,0x7fff9750c194,0x7fff9750c1a0
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,18304513038183071923,11371338604629991258,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1736,i,1468467332753749916,7999706375204844041,262144 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:2
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,10989343830914127924,16500525726745939314,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,16657406359510612847,11076456865595431298,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,16020922166294489230,15003740474559405246,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,8081479880937496917,7989218246876472681,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,953503148656580292,13802079543317912721,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5152,i,7573701936824576928,6487464831683874992,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5052,i,9135980973941288212,4429620622746355936,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,4532723249857716940,6963520526878123722,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5276,i,693095151419226105,3794980154089380404,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10423357298980976537,16300083375017248054,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,10423357298980976537,16300083375017248054,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6276,i,10616351572173530097,7896091393852553894,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5020,i,14599267510823105413,476843305097524151,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6304,i,3952520691419146099,12886049914346818119,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6056,i,17582026876155257959,2965347708114358017,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5016,i,7351093457732325058,9649267953325535752,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,9916274295399754737,13310308747648356573,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5004 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,3793464514865157451,15125743066577203583,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=2736,i,5053686990629666978,15592729339291598141,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1004,i,11988465805744084250,7688999971363947704,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,3151199712299633279,2054113973978185640,524288 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5284,i,11208226397140114635,15190960374640318800,2097152 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6232,i,16889141958853239177,13429531187670659535,262144 --field-trial-handle=2916,i,9454261393330666229,5816950217555938444,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4476

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3d3c60d8-abd3-4181-ba82-83bb7905e1e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d3c60d8-abd3-4181-ba82-83bb7905e1e0.tmp
Size 8KB
SHA256 fde39d4f256c1a21d6534f192b31c9d9816dfeafc547572e219b16d70bd33777
MD5 8b932f8495c5ac7a5e653d275b80e63d
SHA1 b3a46871814411e20d87efa37aad749dbad88fb4
SHA512 dd7983e0311994e34eafa928c68af330115d5f7f86ef2dcd9562543b631b5a3f5b8021e1f734c0a2870d7a91a80312c64df066132d164cf890b76f49efc0e42a
SSDEEP 192:SONk6ygpQmiUyADtOCTVgcSMosSPzPCuoU6:SONk6lHdtOCTVHglbmU6
TLSH
T17D02E935BC687CBB8EF3AE06F88726139FA8117BDA552B40D5E85E1C01D766C2307936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3facd5f4-fc10-40e5-8b1c-1eaf7cf27fd3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3facd5f4-fc10-40e5-8b1c-1eaf7cf27fd3.tmp
Size 18KB
SHA256 45514fd1cdade51b39057b04e8e28522324a4eaecb11000e51d09d6bbdbd1d9c
MD5 1e3cd16adf76b0a57dcbe6e0c63dd090
SHA1 5de55a5d2606a8532491891ef7cc77c09f9d02d8
SHA512 da172f7dc33869b04d51bf50c25df10e5f04bd93c81d8ce4ada7a54a1bc799887edce2540926dedba8ee4f26c0172563d6d80ce94ba53cbac6d91087b4f1f60f
SSDEEP 384:oQkUSv0sNTUEwD7XjidOjTVHglhBt4t2IrQ56IIli:g01yQnOFt4t5FLA
TLSH
T1BE827C356C687C778EA7E501F58A36438FB88157DA992F4095DD6F1C01DB2AC2307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6334dc77-3669-41dd-8db4-9ee702286bf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6334dc77-3669-41dd-8db4-9ee702286bf2.tmp
Size 8KB
SHA256 98a1addbfaf70cee5a3e62cd99cb57548e6a686917077523bb8718bacfb049e3
MD5 c616ab92a271fca681bee2b545664047
SHA1 c38164c97cad45d0254a945e6fe66d8bf77817a9
SHA512 938acf9f4572da33a1bb8eb9e12c8bec33a90fe2b978106c6fe458e6f9d0188f0779924b19dd6d2f77692d146a1913534860006df8a9eb3fa2ebd6e60a91e464
SSDEEP 192:gONh6y0QmiUyIjD/OCTVgcSMosSh2BEwp13UCKqLtU6:gONh6vv/OCTVHglhBL4tU6
TLSH
T170120A357C687CBB5EE3A541F48732039FA85267DA4A7F80D5EC1E1C01DB6AC230792A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75730c7c-8fdc-442d-a4f7-b42e2dabdec8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\75730c7c-8fdc-442d-a4f7-b42e2dabdec8.tmp
Size 18KB
SHA256 1838f398bda626471405ebc4fa6db9656f8a0301587f3ab38f4ba877eb784868
MD5 d0e8f2bf126890e0afc66a70f3744221
SHA1 0e76af356bc70d11d9fad4b396dd9bfb29e8568c
SHA512 38ad5314670af7287a320d4101cdd34ea7edc455ab6c409077b5a0a0cdd1dbffade78a94aceb139263c922504f3b51af4194d899c83abcad32ec8e9da22cbb3b
SSDEEP 384:KQkUSv0sNTU9wD7XjidOjTVHglhBt4t2IrQ56IIli:y00yQnOFt4t5FLA
TLSH
T1FE827C356C687C778EA7E501F58A36438FB88267DA952F80D5DD6F1C01DB2EC2307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ad9341a3ad2b263d2be4ffd8a97b10f49a2c167d02a5b66182496dee5e8cf827
MD5 8f79499bd1d234dc030ef99e2f850e0e
SHA1 4dd7c44b8570ce93f3db7df7fe1188f189fa82fa
SHA512 d06aa3eb27c999ba47fce9a170740591ef6bacf188a5d364ad9a567936919e24290b5c0c3a8ad16cae1e37c71c2364d9db3ba42e5914a96b0f1f732c29ff5945
TLSH
T199D022F83BC00800C8C830F3303ACB8003B2EB208202230E20F20E080C303F23202880
MD5 SHA1 SHA512 TLSH

Submit Download

2b1181dc-5e31-420e-bd26-800cdfceefbe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b1181dc-5e31-420e-bd26-800cdfceefbe.tmp
Size 10KB
SHA256 0e0b11e69343f0295be336c432d4116785e3e8854bfda325565498778a74dfcc
MD5 440a544169f2ddc1a8b8097fd330b16f
SHA1 6e19d516ad4c708313bd4db039dc5489ff9f1a2d
SHA512 c9e12e451a68543032ffb2a31a6251c4450cf40cda99618f58056f1b69f04fb46a9db69ee853630a40e209cf7a352864ff23ed2439ed512bcbca826da783636f
SSDEEP 192:sxZpQRRWE/fRseKIdp5eHa26+WNGYRPt53V+MIg5+J:sxZpQ2E/fRseDIH6GmJHE
TLSH
T1D722C8126E28797B8CCBE219BA55BF53E6F9503291D51E48AAFC8A1C05E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

599d4f1a-ee25-488c-8856-37448d76ec43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\599d4f1a-ee25-488c-8856-37448d76ec43.tmp
Size 9KB
SHA256 21d2d4bf5abf1fd5eb83d05853bb08230b9879e6b45232b16e917da092454c09
MD5 2090d6fcf61880bdddd49f4faabe2a5e
SHA1 9d037cd64ba95f0700996938f22e448d073d6cd8
SHA512 55205838b9ea8888eaa56510cb4b4b55aab176d8bf861f2ab51d08498c15a30132db7d72dadb15a1b0f89625d4a268a3dc300b9105ca134464bf0d08555fd73e
SSDEEP 192:sxZpQRRWE/fRsQKIdp5eHa26+WNGYRPnxV+MIg5MJ:sxZpQ2E/fRsQDIH6GmTHG
TLSH
T12922C8126E28B87B8CCBE219FA55BF53D6F9503291D51E48EAFC8A1C05E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

743d183d-3ac0-4414-b0e8-5fd23be052bf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\743d183d-3ac0-4414-b0e8-5fd23be052bf.tmp
Size 9KB
SHA256 f8caa474ecad7d0f84b5d97def2353e3f3e22c88b880cc11685dfe870557cd75
MD5 92087cf898e89b9a08d48edc1b277920
SHA1 44c3d28431efc13e3e9e03a1846f1ab9fef135a5
SHA512 fd450ba926879d3a28474efc575841c5a6edf5e215f320cf5f53d589a2f7671a97927c74a231cc5a299c37c29dd00d45f56bec0fb9d05dd9eee36a3d8b1c7749
SSDEEP 192:sxZpQRRWE/fRsWKIdp5eHaK6+WNGYRPnxV+MIgrJ:sxZpQ2E/fRsWDIHOGmTH9
TLSH
T1E722B7126E28B47B8CCBE219BA65BF53D6F9503291D51E48EAFC861C05E66DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7989c738-ae55-4b37-9f5d-6b4dcbbec0cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7989c738-ae55-4b37-9f5d-6b4dcbbec0cd.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6d6fe0b52ca2c45b18dfcaee4b7b8ebd6bd5e3710bc86c66468ef92fff1a3c19
MD5 c78825e33fb2a817e195331e63ac2a30
SHA1 402dce7c464c31f47cb814080cfe49647981e554
SHA512 eaefe2ddb4de2bf3c097e59e023f158f37c5fa9d3658e1bdeabbbfbe69b7ad44899acb23ce7311b63fce42993d3678e019c399a5ff09c3c62c84129ee933207c
TLSH
T1C1E0268616CAC23EA248748B11ECB70CC3C02B5A96C06D0F2F58C984F4C5D80F387691
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 aa6de2826d1a7fd09a9a68aac0ec240e67b1eff9ac44528c143f7882e21cb552
MD5 684c8c4cc924bd2ffc2baad868b1d8d1
SHA1 0c624357771f66108350d5f82c9dc1d639e00d6e
SHA512 f036707096ce546d83a724f11e11e0d751440076aa3a5bcc04ef24cdcc2fcda003b99ef3cebc26fa6561e8d6c1dfb3098153ebd7744a13709384b6ee4397cb8f
TLSH
T14B61A3CAE1E34895F7A806B047C70DC73337DC8355672E5E9468DDF878CA3926109310
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 51ab827b07ff6108ff7a35ef00fd0a78bf28d5ad8b9e48849c011a0382b36b50
MD5 3715489f0a239df464f6b741459a1aae
SHA1 a4abfb46982c0b7440ff567a5a0d00da7eb58a90
SHA512 4b2874e2323d3f5041a8ac1a7ffbc9d1a8bebe07b90ffa56daf1976e6bf9c2e8fa20916c54775800b1fad3209359e2a08ca2f7e4be9ff7989a8262650c22c0b1
TLSH
T1C661A2CAE6E34C85F7A806B047D70DCB3333CC8355672E5A9468DDF8B88A3926109310
MD5 SHA1 SHA512 TLSH

Submit Download

88489759-60bd-46e1-8bec-b5e31765285a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\88489759-60bd-46e1-8bec-b5e31765285a.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

298cf4e8-f228-4d53-87be-262af10ba5b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\298cf4e8-f228-4d53-87be-262af10ba5b7.tmp
Size 949B
SHA256 47c2e63a88da7f51d414130699fc5374ba502eceb6505c2b2eda46ddb05edf89
MD5 a48718fc9ff57b29294f0805ca0aebb2
SHA1 7a0c02df677db3de61fcbcf7b1ce4ff1d4f149ae
SHA512 e5bd887e96453ae171a80b6d406c2db2138977c2da7a459704d19474f22fc6020c51f221831675ba8fe2ad422e7f34b6cf14259733b6f2c143544774b9eee21c
TLSH
T18F11BDF3C3D5856E891116F05A24AE2BCE2D0506422C7C15C9E8EF6B93E3079D00155F
MD5 SHA1 SHA512 TLSH

Submit Download

307c38a8-19bf-4bd2-afac-c8f690daf136.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\307c38a8-19bf-4bd2-afac-c8f690daf136.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

5dbfdc8f-616f-458c-ad24-544fae8f5b3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\5dbfdc8f-616f-458c-ad24-544fae8f5b3d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 909278484508fac6b1c325e2ff771b027473676d5ae7b8c298c26971ee51be12
MD5 05da21523514408dcd9e964ec2a6856d
SHA1 36b87657e538c10486599aabaf812160e037a6ee
SHA512 a37b65f1157f022678fe83d527fca66a309c32f1a1ee9b69cdc4bd3c6bf10ff421d97da3b67871cd314095dcfcf2e226ee2b36b4dc3b32a8dbbc90b739f8152c
SSDEEP 48:K0mImRAthrvzMb/KXIS5MK9Z1zMxxcYKbRRy2s9ocuy2kGy/PI/kkKgBIWkU80N0:K0mJGQKjiO+7eKEwe+fWK8Ul
TLSH
T1B8912106327B460138BD265C41A68A1F426235B2315CFE7F7FBC45B68E2AE015DFE9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b3651f34-7afa-4951-ac4f-d26d4f6c78de.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3651f34-7afa-4951-ac4f-d26d4f6c78de.tmp
Size 27KB
SHA256 81f7e606b77e50bfb981a571edc54397b8126a26a14b44d32d31d7c1c54a520e
MD5 26230931f1c8a95070c0c731485a25f3
SHA1 dbdfd93cffa717a8fc9e443146706a1aa79298e1
SHA512 d9fb770ab86963ce327cae551fc18fb901ec01227cc969b12048525a3aed0ed5ddad70a8a4b899c1ea2ef7668675f7f51a699902106ce70dad9ebb98303d848e
SSDEEP 768:agK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3droc+x5:agK9uzYWvcQWsu1ja0HL7Q3Wc+x5
TLSH
T1DFC2FA3F640CCB7E4FC01A9DDC5A6F972E9802D7A6588D4047FE984C02C77EA522A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe3ffc42-3c22-42c6-b423-e3a8475dcb71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe3ffc42-3c22-42c6-b423-e3a8475dcb71.tmp
Size 10KB
SHA256 0fb143deb4c71768a4690a4424a2051bdd51eceab1c49a68b8215e7bd73062e7
MD5 f35b3d222fbc773d29038041bbb00ecb
SHA1 fda7847cc8ed3947d22621703e4a62b3403399df
SHA512 a4b676bb5af6edcb5ab58e43f6b8f95c2f6c342efc6869a61cb6734df55167e48f5c70f6461c99dbb9ff82c77a7b2116fe7883429accacfa976437fdec63c0f4
SSDEEP 192:sxZpQRRWE/fRseKIdpreHaC6+WNGYRPX58V+MIg5+J:sxZpQ2E/fRseDSHGGmwHE
TLSH
T13822D8166E28787B8CCBE20DFA55BF53D6F9503291E51E48AAFC8A1C05E76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b66eced-1086-4012-a400-65ebe22acdbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\7b66eced-1086-4012-a400-65ebe22acdbf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d25e4252-0d21-4f7a-93ba-068a0bb1ec99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d25e4252-0d21-4f7a-93ba-068a0bb1ec99.tmp
Size 21KB
SHA256 844fce30f73d41a5cb80e3edbaafd51335e07514f35f7387bcbdc50f6a086ab8
MD5 9847aa08992b15e88f62418e87388bae
SHA1 1f2fea568a74ae6b96d5a68ec5357e63ec9f6669
SHA512 341a7e733fbcf32388102961f65c9f851c41070735df677982724a7b0ea48ab7a40e06bf3d8cec0efde05799111e5d19971b66c20f24012980829d5e44e0e7c1
SSDEEP 384:9iFzQkUSvhzsNI8TUNTUlIlEwD7XjidOjTVHglhBT4t2IrQ56IIli:0FdR5wgPyQnOFT4t5FLA
TLSH
T193A26C325C98AD7B9EA7DA41F54E3203CFB481A7C995AB90E2CD6E1C01DB1DC2347D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5d576f49-43d4-44cb-bbc6-5d2bf7a17b36.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5d576f49-43d4-44cb-bbc6-5d2bf7a17b36.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 39d53349604afa9f470b8f3369010e3b1ef292c1acb146046e86d0fdce84cae1
MD5 f36a487bb2dfa28d13d49187ea4d6f35
SHA1 7592ec1742d73e75bbe48f11e93bcd39859d80d2
SHA512 cad921ed1d6a1facf7903f516587e2e9ffa294ce0165cbbb2cc749cfb68e8348df792cb3da0b6c0ee53b0cbdfbb16b03a6817345f78b872092b9920138891f1c
TLSH
T16841275CBAEA1148B3B76F1AABF6A96D447F78772E06D45E10110E4F0A23B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download