hxxps://ddec1-0-en-ctp[.]trendmicro[.]com/wis/clicktime/v1/query?url=https%3A%2F%2Fsecure-web[.]cisco[.]com%2F1IoLgrPlI1XlEHsZFuH8Okut9iEv0oLuadu1qCq-89bBS6dr6e9hhlYO0r3q1DLmh0s1mhS3hieYPdij18Z8PHBkZ4gK2ruphbEuK9CfLx1xcGmkercKUL3w_Oo8nh2KfjyVvh9EpGugXsVlms2c5kdnIYjKPvMXoW2Ul21uAIqPfJiBagRxJaIk0DV5j8pRdAAQeoAv9lKkcy1mUha2KCucltG30hYu5vTWZsWNk3m2a7w32yggFuTaVD5GUHqqYyvAjWLOY7AYBfLTES-C2O2wDDtz5-dOl8NEBNPcx6uovctC0AQ-E_htjR83dSRqgXRUOXxSRnlm16DdtmVDuDQ%2Fhttps%253A%252F%252Fsv7os[.]mjt[.]lu%252Flnk%252FBAAACZ0vmkwAAAAAAAAABDiOQyIAAYKI_hQAAAAAACwIZQBq2XmdHaDBOVdgQbWHxiQKI5ej_AAopiU%252F1%252FBfTKx40Qlf3fFWuAr9-tRA%252FaHR0cHM6Ly9zdWRvMjEubWJzcnYubmV0L3dwLWFkbWlu&umid=57187b3e-8deb-4f6a-b242-a0ee081d029d&rct=1792637489&auth=6ce738278ddfa18290e808d7f7ea6e1d71763812-fe28e9b2e91867fd79decbb9352ea60285ea63e3

Analysis

user interaction
yes
max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3A%2F%2Fsecure-web.cisco.com%2F1IoLgrPlI1XlEHsZFuH8Okut9iEv0oLuadu1qCq-89bBS6dr6e9hhlYO0r3q1DLmh0s1mhS3hieYPdij18Z8PHBkZ4gK2ruphbEuK9CfLx1xcGmkercKUL3w_Oo8nh2KfjyVvh9EpGugXsVlms2c5kdnIYjKPvMXoW2Ul21uAIqPfJiBagRxJaIk0DV5j8pRdAAQeoAv9lKkcy1mUha2KCucltG30hYu5vTWZsWNk3m2a7w32yggFuTaVD5GUHqqYyvAjWLOY7AYBfLTES-C2O2wDDtz5-dOl8NEBNPcx6uovctC0AQ-E_htjR83dSRqgXRUOXxSRnlm16DdtmVDuDQ%2Fhttps%253A%252F%252Fsv7os.mjt.lu%252Flnk%252FBAAACZ0vmkwAAAAAAAAABDiOQyIAAYKI_hQAAAAAACwIZQBq2XmdHaDBOVdgQbWHxiQKI5ej_AAopiU%252F1%252FBfTKx40Qlf3fFWuAr9-tRA%252FaHR0cHM6Ly9zdWRvMjEubWJzcnYubmV0L3dwLWFkbWlu&umid=57187b3e-8deb-4f6a-b242-a0ee081d029d&rct=1792637489&auth=6ce738278ddfa18290e808d7f7ea6e1d71763812-fe28e9b2e91867fd79decbb9352ea60285ea63e3
Sample261024-cd72ts1zd1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4352	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{A6002C3D-C2F4-4DA8-A2C2-6550F6BD40AF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe
5076	msedge.exe

Suspicious use of WriteProcessMemory 37 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 3480	5076	msedge.exe	84
PID 5076 wrote to memory of 4352	5076	msedge.exe	85
PID 5076 wrote to memory of 4876	5076	msedge.exe	86
PID 5076 wrote to memory of 4876	5076	msedge.exe	86
PID 5076 wrote to memory of 4876	5076	msedge.exe	86
PID 5076 wrote to memory of 5052	5076	msedge.exe	87
PID 5076 wrote to memory of 5052	5076	msedge.exe	87
PID 5076 wrote to memory of 2064	5076	msedge.exe	89
PID 5076 wrote to memory of 2064	5076	msedge.exe	89
PID 5076 wrote to memory of 4912	5076	msedge.exe	90
PID 5076 wrote to memory of 2064	5076	msedge.exe	89
PID 5076 wrote to memory of 4912	5076	msedge.exe	90
PID 5076 wrote to memory of 4912	5076	msedge.exe	90
PID 5076 wrote to memory of 2488	5076	msedge.exe	91
PID 5076 wrote to memory of 2488	5076	msedge.exe	91
PID 5076 wrote to memory of 4000	5076	msedge.exe	92
PID 5076 wrote to memory of 2488	5076	msedge.exe	91
PID 5076 wrote to memory of 4000	5076	msedge.exe	92
PID 5076 wrote to memory of 4000	5076	msedge.exe	92
PID 5076 wrote to memory of 1676	5076	msedge.exe	96
PID 5076 wrote to memory of 3740	5076	msedge.exe	97
PID 5076 wrote to memory of 1676	5076	msedge.exe	96
PID 5076 wrote to memory of 3740	5076	msedge.exe	97
PID 5076 wrote to memory of 4132	5076	msedge.exe	101
PID 5076 wrote to memory of 3176	5076	msedge.exe	102
PID 5076 wrote to memory of 3176	5076	msedge.exe	102
PID 5076 wrote to memory of 3176	5076	msedge.exe	102
PID 5076 wrote to memory of 808	5076	msedge.exe	109
PID 5076 wrote to memory of 2036	5076	msedge.exe	110
PID 5076 wrote to memory of 3640	5076	msedge.exe	111
PID 5076 wrote to memory of 4244	5076	msedge.exe	113
PID 5076 wrote to memory of 4244	5076	msedge.exe	113
PID 5076 wrote to memory of 4304	5076	msedge.exe	114
PID 5076 wrote to memory of 4304	5076	msedge.exe	114
PID 5076 wrote to memory of 2716	5076	msedge.exe	115
PID 5076 wrote to memory of 2716	5076	msedge.exe	115
PID 5076 wrote to memory of 2744	5076	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3A%2F%2Fsecure-web.cisco.com%2F1IoLgrPlI1XlEHsZFuH8Okut9iEv0oLuadu1qCq-89bBS6dr6e9hhlYO0r3q1DLmh0s1mhS3hieYPdij18Z8PHBkZ4gK2ruphbEuK9CfLx1xcGmkercKUL3w_Oo8nh2KfjyVvh9EpGugXsVlms2c5kdnIYjKPvMXoW2Ul21uAIqPfJiBagRxJaIk0DV5j8pRdAAQeoAv9lKkcy1mUha2KCucltG30hYu5vTWZsWNk3m2a7w32yggFuTaVD5GUHqqYyvAjWLOY7AYBfLTES-C2O2wDDtz5-dOl8NEBNPcx6uovctC0AQ-E_htjR83dSRqgXRUOXxSRnlm16DdtmVDuDQ%2Fhttps%253A%252F%252Fsv7os.mjt.lu%252Flnk%252FBAAACZ0vmkwAAAAAAAAABDiOQyIAAYKI_hQAAAAAACwIZQBq2XmdHaDBOVdgQbWHxiQKI5ej_AAopiU%252F1%252FBfTKx40Qlf3fFWuAr9-tRA%252FaHR0cHM6Ly9zdWRvMjEubWJzcnYubmV0L3dwLWFkbWlu&umid=57187b3e-8deb-4f6a-b242-a0ee081d029d&rct=1792637489&auth=6ce738278ddfa18290e808d7f7ea6e1d71763812-fe28e9b2e91867fd79decbb9352ea60285ea63e3
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa9cb6c188,0x7ffa9cb6c194,0x7ffa9cb6c1a0
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1780,i,14159865637335826083,17362212764073042450,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,1071746256744360645,2585126760439693811,262144 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2640,i,11256243748498093442,7594217904484133803,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3484,i,14922274534471525845,7809143924339529693,2097152 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,4492287352123021448,884990972169930575,2097152 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,11585426455659675123,2626743627156565973,2097152 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,3207848554756273061,17295919798534383382,2097152 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,9430792745337847161,9366457662373342306,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,4946410204393710634,2237149328800771774,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18197924967557688031,10840851646924373032,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,18197924967557688031,10840851646924373032,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6016,i,3456002835380435862,291010244023858686,2097152 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,8622274724680554437,3653301191609476645,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,1922724905367403776,16182992241997331631,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,6094534513536513009,10910482859014031352,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3024,i,3967347242339122000,11933295289155204380,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3867349797050462148,13674117324802421049,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,9704468592383413162,12428065509025087604,524288 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6304,i,7399361514734729274,16190025298904742267,262144 --field-trial-handle=2320,i,14383493896414865096,9891867163467615879,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2696385f-1cd5-49ab-84a5-c43c0921979f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2696385f-1cd5-49ab-84a5-c43c0921979f.tmp
Size 18KB
SHA256 9b945396aff01cf491731e42acb24cf2a5216a55eef2ca2ffa054f17b7146f28
MD5 14c8a3c965c2d7e725bd0df4786793c0
SHA1 6bac3b67c24485a50792dde75c39df0240a5759f
SHA512 c6c88fbbbfba44342d810b38fd7c47462ceb97266156dd5d9d2368d034f83eef04b1f099fa16790170db1c9e10048737e325f07fdb82e3ce75537d7f725c346c
SSDEEP 384:jQkUSv0sNVU0uZcRLp5u8i4tfiP2IVMtUeIIls:N0qTkyW58UeL+
TLSH
T1BA827D36ACA96C3B9DB3E560F54B36139EA48117D7D81F84D5DD6B2C01CA2F8230BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

778679b1-691e-42d5-bd38-f984977050df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\778679b1-691e-42d5-bd38-f984977050df.tmp
Size 26KB
SHA256 acbbade2313c7910e9772a3ef5d3d18bbb3ee148db20aa5887994864d29a02fd
MD5 b818b3920aa575fcf727bc66b10fa445
SHA1 74f7e30319c390ef6ce1ce704be7318e9963880f
SHA512 0f47443adfd6da9a976c3672a3e7a69f69163be2e4304f3a36e46bbb880bae3cb8004a9af3767b93b195e9412b4175ce61bd709848006e6e4421e94b96c6f1e2
SSDEEP 384:6iFzQkUSv1zsNG8TUNTUlIl0uZcMLp5u8i4tkiP2IVMtUeIIls:xFdNDwgPTk/W58UeL+
TLSH
T1D1C229F248DB583AD9AE9B53A73E3E038E7CC157F6845A54B788591CCC861BFD306902
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8560515b-ad83-4214-a945-5c5d5457b414.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8560515b-ad83-4214-a945-5c5d5457b414.tmp
Size 18KB
SHA256 4bca3c0550ef906bbfee5bbe589f481fd9fd1e822ffe6fc96a997e4683f6f1d7
MD5 df4a98cb27450693894f49cb0b885c24
SHA1 6704c9dcbf88b32735b09407c7a1b6cb26b1c44a
SHA512 f4a949c990feb49d19c35331011fe7f3f69a69a7349e2531fe5c894b12e2bc53b6ce911d07dee1856c246adc6be00f189c8eafeda2b8b7e12957ea8969a467fe
SSDEEP 384:hQkUSv0sNVUxuZcRLp5u8i4tfiP2IVMtUeIIls:T0vTkyW58UeL+
TLSH
T14C827D36ACB96C379EB3E560F54B36138EA48117D7D81F84D5DD6B2C01CA2E8230BA17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95bd8eaa-498b-474f-8233-e7e01edca011.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\95bd8eaa-498b-474f-8233-e7e01edca011.tmp
Size 8KB
SHA256 c03688e3f156536def4625c9d443d8255b26b43e6f235bf41fb54bf1ca25df9f
MD5 40bd1dcd6a42e59dd9e3c2082ae9025f
SHA1 2e5bd6eb60b8bb3c7f3b7c2a5e59d80d88d74019
SHA512 452e0f7d508f920aaa2adfa77cc9bd82f86a4794a5978d0ae802d2ddfed1703ee7ba02a6eb966fbcc3a1bf95e58bc7ef6925620fd3ffd96d28eee63b992667ba
SSDEEP 192:lON/6iDbQmiUy7YJq5u88P4tmethNuZyqyPU6:lON/6onJq5u8i4t2iPU6
TLSH
T13D120B356C787C7B6DE3A855B48736139E954227E7887F84D5DC1A1C01EF2AC230B523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96e691bb-f054-42df-a3df-782e30db6e16.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\96e691bb-f054-42df-a3df-782e30db6e16.tmp
Size 105KB
SHA256 73d0e97f18eabd66ced5f78af8d0ee3a36d197f120279f6fe22862877514d939
MD5 48ffe64f366166704c21161efe0b504f
SHA1 a6403dde2edbd6b341ad301811396e7d3aea1af5
SHA512 ad78beb367abbdbb0a58e28566138180a03a9826f30f2dc412a05e0ca179742f6e123202adf44a50da1f4b71145ff6cb0cde66f326d4e9b116ce56b2281ea253
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T1B3B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

5c7479d6-862c-4de8-a8da-f64137f23199.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5c7479d6-862c-4de8-a8da-f64137f23199.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

7db003d2-68c3-4599-b924-7293676e0f1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7db003d2-68c3-4599-b924-7293676e0f1e.tmp
Size 10KB
SHA256 970d5ac3ed3e91642d856cfa0a12be26a6adb3d660991eb9217698dbebefebad
MD5 73e742c2dd7231a67fbd6076fff22caa
SHA1 904abb23ace6f8f9a7c7e39f6135a42f6f1bb03f
SHA512 0eac8be45f1c2ff50107dd0f47c081d116840ea01bacf43043e80005f3d4e2a9a147683bf7c0707c2bd613e319acdff5d986a022cf1519a1dd0dca5f84acc3cf
SSDEEP 192:sxZHK7R/TWSL/fyYs5LksIdpenHW6+WNjMr/YadTb+/xIg5HcJ:sxZ4oe/fjs5LMoHbc/Zk9G
TLSH
T1D022C952AE38A97B8CDBD20DBA15BF53E6F5503191E52E48A6FC851C04E77DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d2f1e03-b459-4541-9eca-ed158114d15a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d2f1e03-b459-4541-9eca-ed158114d15a.tmp
Size 10KB
SHA256 52eb5386abfb1f7c1b583a8d0392dd35ec52755408e5ed1b934f3f5a24063ba9
MD5 ac63a8c1ed4d22c7d88746665a6b6a22
SHA1 38f5863d084be9492d741b3885af5182404b1d51
SHA512 31c7e7354e2bea49b951d5d0994dd528b42f5c2ff34a4e4fdf0f0be5d483780e197be1145d50b7a91b023b7d6d8e78ac892d77f9c515ca56cce12eb631f4a012
SSDEEP 192:sxZHK7R/TWSL/fyYsrLksIdpenHW6+WNjMr/YadTb+/xIgrJ:sxZ4oe/fjsrLMoHbc/Zk99
TLSH
T11822C9526E38A97B8CC7D20DBA15BF53E5F5503191E56E48EAFC851C04E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

92aefd07-d094-457c-bb63-942bd7e18e46.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\92aefd07-d094-457c-bb63-942bd7e18e46.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e437d56c591440bceb25b61fd03bd5656f4a51ac4562c25a7542dfb1be157c2e
MD5 9031a2301cb6eaab2d7c8c8afed8d38b
SHA1 629b50786269fb5494136eb879c0c5eed557291d
SHA512 6e34fc58d1bfed513ee2c089fba003b0f0c9d1cc81cf2351f55e42272c7f20d6362f3e70ab606d084113b5794ad2d6a71c1b6316e409ff37278d798a0d44f8a9
TLSH
T186E0269E05CAC32FE21874C71578530CCBA0366E92C47A1E1728C5C9710A444FAA36D0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 f8d1ad279fdba63f1a6356b8189dcdb22a2f4bb5d0f466739d88b84816534968
MD5 832314e65733f835dd4a3a9d61d86065
SHA1 bfab7f4e02855fd8cea23c84662c45283a59e8ad
SHA512 39a5afd78566d8b29896c4570eb5a7abcdf4ffb5ec95f69301075513c5435a9593dc6b75458f982a2bc1ec4081f83a5de3fab20a4d9ceaecec2a5f6850bbf9d9
TLSH
T132E026C708C8C2EFB60864870368430CCBC5262E9AC0BA5F1B08C9C9708D150E6836E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 01d414ed4d0000785744eeb21840cf2b5752dc41cdce9bc3aa2f5121a9ae79ae
MD5 4e8ec967f8acdb26811f7c81c7c0ee33
SHA1 3c29cd7ae22263c6dd31dfb8ce04007f7907a97c
SHA512 8dc761afc269fe44e78187ce863e2083999444a7d8cae1d5aceb90baafc7a45c2e49622a88e9368d79ef759caf1b3ad19218fbbb3872a612f400d48c49f56fa3
TLSH
T11661F586FD50E4E3FB989130A9FF258AEA6549B0988F2D3200AEF5FDEF15B9C4004074
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f4d7de52064ae8e5a73594d46d83d8a6d421aa089dd25a3d356cdc246b9f3d2e
MD5 4f1a6f5173fbc898440e2e7934553771
SHA1 8596759044b9055af9bb589e75e4c539da750439
SHA512 910bfb290aa4ed92de79ee07c71762d0d53aac937e1780858c9c2723682c7c222c7bce36e1d8477c148ece281aab62469508ec70c89ab0fdcab5cf8efb616703
TLSH
T1F661F686FD50E4E3FB989170A9FF258AEA6549B0988F2D7200AEF5FDEF15B9C5004074
MD5 SHA1 SHA512 TLSH

Submit Download

9b6e7638-437d-4750-a78c-d59add7ffe19.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\9b6e7638-437d-4750-a78c-d59add7ffe19.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

8734293d-5fd1-4246-8344-ed24ae70d3b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\8734293d-5fd1-4246-8344-ed24ae70d3b5.tmp
Size 1KB
SHA256 15236ad38555546e8d29fdc9f7f328b356ba810e5fdc4d24e0e89cf44ca57e5c
MD5 3767ae75059fa522af7931a7477d9cf7
SHA1 233babfdc038e5998f220a6cb754c5bec6e82f6f
SHA512 80f80cf34dd05c35cec88198ec7a94ccda0dddf30bda1f6d1455d68293723042bb37325920dd390672977ec078a9b1c240f39e8b8da2c0031de3cb7b889a2ae6
TLSH
T15B217CF783E5856ECA1156F0AA14AE2BCF1D0615431C7C2A85D4EF2793E34B1E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

dc96b54e-dbe2-4995-bd70-4a4415780daf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\dc96b54e-dbe2-4995-bd70-4a4415780daf.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 a735a6117b6c46a1e7485993e3108f7aae341a348c07d409b40425a57ece31d0
MD5 fb2a9a5eb8ad99363e4b327a3b2a8ab7
SHA1 88b80042ca71ba908ec16db6a1950374f5808289
SHA512 eb5cfbbe6e10ceea08b48c24e34c1786e98255203e8bfa6fc8dd64b05c7ec1c63783d85c4baadc06fa03e7ef70d383cd7006b3a8723cdd430ce11086e9eec42c
SSDEEP 48:K0ydgMyQwBbsbcISkBK9o1yBxKRYTkQCyL+5UY28slbQ3YISwlK9U1mlxe1YPQUU:KYduKGwC2JSK60RiEKj6aS04KxuA
TLSH
T1D7B17B01347B460079BF3A4950A5AA6E824271773019F62F7BED40A74A2FE2C5CFF9D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7249b7e-7e0b-4768-aa3b-90ad987b739b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b7249b7e-7e0b-4768-aa3b-90ad987b739b.tmp
Size 10KB
SHA256 c40d369c818d39c569784123564f1c8891f2027fc621c2876d07aa413399aa32
MD5 ae861e6ed6d0478b16f305ab18750c57
SHA1 2634163b2ba5627ffa88723db75e56dd41586634
SHA512 9318a2ead2446a9559ad757d238553da190a1963988c5c1e68ac8eee843954237b7f8a4a7e1d7b4ba9a3956a242e1bcb1425bf5b67a43183e21279d6ee142ab9
SSDEEP 192:sxZHK7R/TWSL/fyYsuLksIdpenHW6+WNjMr/YaUPhb+/xIg5HOJ:sxZ4oe/fjsuLMoHbc/Ak9E
TLSH
T11122C951AD28AD7B8CDBD20DBA15BF53E6F5503191E52E48A6FC861C04E77DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c3a82ea6-95e7-48a9-93d4-f1b8739b3e61.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c3a82ea6-95e7-48a9-93d4-f1b8739b3e61.tmp
Size 10KB
SHA256 28dcd98c99e489a60fed39f1376d9acbd2c46a646bad7ac8894e121a7fe029c7
MD5 e9db8a7d12f1cb3021b96ce7bed638be
SHA1 bafeaf1cb9cfe4c41afa0a698723905fbea65eef
SHA512 65589652127998d4070f8fbd4d68a5e1483c8e83a9f6bfc019267b047d9366d9a4e7747f76da70dc98f805f103a06e85d1148b8bd7abd214087ccf56a65e4ffc
SSDEEP 192:sxZHK7R/TWSL/fyYsuLksIdpsnHW6+WNjMr/YaTPub+/xIg5HOJ:sxZ4oe/fjsuLMCHbc/yk9E
TLSH
T18622D852AD28AD7B8CDBD20DBA15BF53E6F5503191A52E48A6FC861C04E7BDE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4d1820b-07fe-4e07-b3d8-0f52445756af.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4d1820b-07fe-4e07-b3d8-0f52445756af.tmp
Size 27KB
SHA256 0c70400b680a1e9a2335c1edd810a8cb422d6d2146294a4241a05fc07c9a381c
MD5 523c013a58ed27adc451a787e62be4f6
SHA1 d0bb26b929978e61ca06c8edac1f2a24a2c9df25
SHA512 646da41baaad0b7ffe731e028eff1fcb119ad72cdebeae88df9a02c7f2834149449e1aba2d80b9f33d6744c0c7f43803e986f15aa4a671909a6a8869885f02a9
SSDEEP 768:q7yQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3FroPZkQ:q7yQRbrWvvlpZu1jaXKLf33+PZkQ
TLSH
T14BC2E93B640CCB7E4FC01E9DDC6A6F976E9802C766688D4447FA984C02C77EE51264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3c629f64-e0e7-4d25-a8ba-0b9544dfe222.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3c629f64-e0e7-4d25-a8ba-0b9544dfe222.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bd71cee7-4e60-4c25-9b48-14c5be9d6547.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd71cee7-4e60-4c25-9b48-14c5be9d6547.tmp
Size 8KB
SHA256 f63779b5c6bad10f78c10121a952a20b3d5e44322065b32e6e6859e5c7339b93
MD5 07b5701d24eb9ca03d089f9387c24fb6
SHA1 568760bcfea3189e6ad7d40d44046c417178fe1c
SHA512 a0a1826a09ca769167fdfe38c68e672cd24be1c7a47a335785134afbb3bca3c7e56cd4238907ab6abb5a7f178b21d67785e47cfbaf424aa7a1595f1d0bcb00bf
SSDEEP 96:PqONkOQsjpfwDISp5ih/cIPURHl8h4otop5RmDUBfPGxvw45RxmJm78lFfxQpLkE:SONu6iDCQmiUyqYHq5u88P4ASqU1zU6
TLSH
T18F02E739BC783C6B9EF3AD05B44737279F99112BE6942B84C9E81A2D01D729C2306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f50b1e58-e9b8-469e-be2a-d860ea568b0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f50b1e58-e9b8-469e-be2a-d860ea568b0e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d17948043ec752b9b364b4f4864a4c7901adbdcec5255ce1d73cbd1798d3834f
MD5 cb96056f5fcc6ff82c3849aa98feec12
SHA1 bc228054c8ab44e0c3393cc427f739bd5fa2838d
SHA512 760952320c19b2493116e7b4b283059c688165ba0489fae606c72cddd76801ee7f220ecf1057d1418341eda9e5653f72c5cafaef722e92fc382040a9cb3348ea
TLSH
T1A141279CB6FA1148B3B77E16AFF6A46D447A78372E0AD46D10010E4F0A62B40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download