hxxps://194[.]9[.]6[.]125/ping[.]hta

Analysis

user interaction
yes
max time kernel
209s
max time network
194s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 11:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://194.9.6.125/ping.hta
Sample261024-nfbbeshv41

Score

3^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1200	msedge.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1400	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{5F621E24-29F8-4D3B-8E43-1B5060477CC8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2788	1200	msedge.exe	84
PID 1200 wrote to memory of 1400	1200	msedge.exe	85
PID 1200 wrote to memory of 1680	1200	msedge.exe	86
PID 1200 wrote to memory of 3744	1200	msedge.exe	87
PID 1200 wrote to memory of 1680	1200	msedge.exe	86
PID 1200 wrote to memory of 1680	1200	msedge.exe	86
PID 1200 wrote to memory of 3744	1200	msedge.exe	87
PID 1200 wrote to memory of 3952	1200	msedge.exe	88
PID 1200 wrote to memory of 3964	1200	msedge.exe	89
PID 1200 wrote to memory of 3952	1200	msedge.exe	88
PID 1200 wrote to memory of 3952	1200	msedge.exe	88
PID 1200 wrote to memory of 3964	1200	msedge.exe	89
PID 1200 wrote to memory of 3964	1200	msedge.exe	89
PID 1200 wrote to memory of 1624	1200	msedge.exe	90
PID 1200 wrote to memory of 1624	1200	msedge.exe	90
PID 1200 wrote to memory of 1624	1200	msedge.exe	90
PID 1200 wrote to memory of 2152	1200	msedge.exe	91
PID 1200 wrote to memory of 2152	1200	msedge.exe	91
PID 1200 wrote to memory of 2152	1200	msedge.exe	91
PID 1200 wrote to memory of 2416	1200	msedge.exe	99
PID 1200 wrote to memory of 1168	1200	msedge.exe	100
PID 1200 wrote to memory of 2416	1200	msedge.exe	99
PID 1200 wrote to memory of 1168	1200	msedge.exe	100
PID 1200 wrote to memory of 3932	1200	msedge.exe	103
PID 1200 wrote to memory of 1220	1200	msedge.exe	110
PID 1200 wrote to memory of 1220	1200	msedge.exe	110
PID 1200 wrote to memory of 1220	1200	msedge.exe	110
PID 1200 wrote to memory of 628	1200	msedge.exe	111
PID 1200 wrote to memory of 628	1200	msedge.exe	111
PID 1200 wrote to memory of 628	1200	msedge.exe	111
PID 1200 wrote to memory of 2588	1200	msedge.exe	113
PID 1200 wrote to memory of 2588	1200	msedge.exe	113
PID 1200 wrote to memory of 2588	1200	msedge.exe	113
PID 1200 wrote to memory of 2736	1200	msedge.exe	114
PID 1200 wrote to memory of 5064	1200	msedge.exe	115
PID 1200 wrote to memory of 3032	1200	msedge.exe	116
PID 1200 wrote to memory of 1032	1200	msedge.exe	118
PID 1200 wrote to memory of 1032	1200	msedge.exe	118
PID 1200 wrote to memory of 3348	1200	msedge.exe	119
PID 1200 wrote to memory of 3348	1200	msedge.exe	119
PID 1200 wrote to memory of 628	1200	msedge.exe	120
PID 1200 wrote to memory of 628	1200	msedge.exe	120
PID 1200 wrote to memory of 3392	1200	msedge.exe	123
PID 1200 wrote to memory of 1100	1200	msedge.exe	140
PID 1200 wrote to memory of 1100	1200	msedge.exe	140
PID 1200 wrote to memory of 2856	1200	msedge.exe	141
PID 1200 wrote to memory of 2856	1200	msedge.exe	141
PID 1200 wrote to memory of 2608	1200	msedge.exe	142
PID 1200 wrote to memory of 2608	1200	msedge.exe	142

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://194.9.6.125/ping.hta
1⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa7730c188,0x7ffa7730c194,0x7ffa7730c1a0
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,6724259894968601696,1448045538739811848,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,13286192360434768500,10605731471817541700,262144 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:2
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2400,i,4804226131829994273,18003425328168778985,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2100353210217538310,3474352463805680288,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,5724316782598691075,4553405168810238737,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4080,i,13748723785205221996,2263655093258594032,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4116,i,1417858500614351565,15351351998504282732,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,2865894314874725023,3310542549332409511,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5096,i,10916820197687318733,4526247972315821485,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12131310208977428628,9657621267899188948,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,12131310208977428628,9657621267899188948,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6304,i,1876093830076471573,4054960407256857414,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5804,i,15059300025883219590,721292067011673711,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6188,i,2707391126995747119,9256479968707295758,2097152 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3805474053744763555,14805372740015172762,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=6260 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,8905825018657021485,2046393876414346648,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6288,i,9486911381336363386,16863616854222678512,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3692,i,4812715339833653049,17205858302173506112,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,2368098654919683872,8031347928574171977,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,3138918330201861633,4769621588246345892,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6028,i,333072876425880962,4886777702387252699,262144 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,12514893176866230192,16463354887602512514,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,1885794419677889211,10958072459198123560,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,16226336869399274912,693606322086356491,524288 --field-trial-handle=2380,i,6692812455829300120,9395607818231345366,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2772

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3008

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:3076

C:\Windows\system32\DisplaySwitch.exe
DisplaySwitch.exe
1⤵
PID:3912

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:1908

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {24AC8F2B-4D4A-4C17-9607-6A4B14068F97} -Embedding
1⤵
PID:4072

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicePickerUserSvc
1⤵
PID:3668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DevicesFlow -s DevicesFlowUserSvc
1⤵
PID:2700

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:1616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

012df1f5-8b11-4ec3-bfef-6c8b6e6e90ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\012df1f5-8b11-4ec3-bfef-6c8b6e6e90ba.tmp
Size 18KB
SHA256 ca95c41d3026bec70c1aae4b56d5f3897aef2fd553b9211c022822b12d137d79
MD5 c4034d9c4eaadd8e78c606bc98e318cf
SHA1 02bc89e3bade2a2bf886815096eef2bb699c85bf
SHA512 123eff5b82d9ee4c14fb8b956c0870e2003225e993060f417d21137ac0cc536fafbb4da9dc07894f13911372694cda467a843e8a2acd98e289c507b59921c3a3
SSDEEP 384:1QkUSvtsNQTmKVQTHp5u8i0+aPZ2IfuQIIl4:PtSKufkCPZ5fuQLe
TLSH
T1B0828C326CB87C279AA3E560F14A3613AE74915BD3C85FD4DACD6B2C05CA2DC130BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02c754bf-6043-4aa3-8fbf-5780598d821a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\02c754bf-6043-4aa3-8fbf-5780598d821a.tmp
Size 8KB
SHA256 f06e3b5f8fce1a66073de36debce376bd32a803a8ce47539e7d697d22f03fbb6
MD5 5e99fba931c4379e58ccd0175bd6553e
SHA1 4109c111edfb006235ad846081c998f1dc7b0f3f
SHA512 22365cc912b6f056a1b7342db83888a52874723def4e78fbd6f19ec10789b25b21d21610d92e2c98b482004d964c6afaa2fd53604941b871c1b67f425471475f
SSDEEP 192:ZONx6iDnQmiUycX1q5u88PA9+aMuZjqyU6:ZONx60/1q5u8i0+aTZU6
TLSH
T110122B36B878BC6B6DA3A961F44736239EA4026BD7886FC0D9DC271C01EF59C130B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57eedb60-a9b9-4086-adc8-2d759a1156cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\57eedb60-a9b9-4086-adc8-2d759a1156cc.tmp
Size 18KB
SHA256 6ddf79b0edba10f1ab4d5de1ccc4c04950e8c8d372a4dd4972c96ca1a09281fd
MD5 7f8b8aa4dde504e5d963c3ab762b1355
SHA1 1ca5decffcac32927aa8a44f485b07a1509f2ec9
SHA512 b1b920232d47a781f744d5019348488a9972e3cf4b487a8f4311da2664ec13ca691b216b466075d95cee8893d563d933e827c4f73bf19fa4e99e36173d383e27
SSDEEP 384:ZQkUSv0sNQwmKV/THp5u8i0+a8Z2IfuQIIl4:70pKBfkC8Z5fuQLe
TLSH
T172828C366CB82C279EA3A560F14A36139E74916BD7C85FD4DACD6B2C05DA2DC130BA03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

63845f41-23c3-4bce-b6ad-4860da46e33f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\63845f41-23c3-4bce-b6ad-4860da46e33f.tmp
Size 8KB
SHA256 c17598d9b7a931ca75bfddf0c535a91ea2d0bcb7703ef7744557038b7f6a8482
MD5 1fc1f4c89aea715ec484eaf93692f72c
SHA1 e9ef5be55f11de7369ac521a14c0810371039fe7
SHA512 a3b2847b4bd93e4184a8e5028054fb09db2bddca8ae3fef238a6199d6dc72334e03c2a68829635d6d85cc9f22405fedea4dd6d8617e12e34627f904bffc1dc9e
SSDEEP 96:PqONkgQsjpfwDISp5ih/cIPURHl8h4otop56mDhBfPGxvw45RxmJm78lFIxCYbqU:SONo6iDCQmiUyNXHq5u88PAgSqqaqU6
TLSH
T1CC02F939AC787CBB9EF3AE15B54737139FA4116BE6941B84DAE8172C01E769C1307823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

965960b9-2e17-49f9-8caa-295c8fff03c7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\965960b9-2e17-49f9-8caa-295c8fff03c7.tmp
Size 18KB
SHA256 c5c46161c0d95c0dd6225777ee24466b0e7e4e4e4b16c04be93e6a1b8b3ffe22
MD5 fe59c25f2c90949e9b0bd3161ba7b7ee
SHA1 4c5a1b7a877a92d86d1baacb485f39b9c7e399dd
SHA512 50446234e98486b9d2fc4fbd5521daf4a4e132b40f9bbbb052eb4dde6f89f78d704aca0416438b8f94b9a72dd8908a8f3be5a3427bd02705c58dad011d450f08
SSDEEP 384:+QkUSvgsNQkmKVzTHp5u8i0+aDZ2IfuQIIl4:ugVKtfkCDZ5fuQLe
TLSH
T1F5828C32ACB87C379AA3A560F54A36139E74915BD3C85FD4DACD6B2C05DA2DC130BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f995ed9-68b2-44e2-8812-03bbe66d2bf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9f995ed9-68b2-44e2-8812-03bbe66d2bf4.tmp
Size 21KB
SHA256 6ff0af6c8773867d3ba53f4cad6d21e9c3e24cabca9d5e8bfa27284ed668b180
MD5 ad17b8322ff3d2a6eb9a6ab4af38b0b7
SHA1 ea6018feee97de051180921222667ca75325d779
SHA512 2f5fa0dd18ee8424aec3fc0455296efa13a50f91d4e821d7cd5e26c53c16edfed7584f2fa633e7feab6744d3e618f9d85a43a48fe22f1113e0ca8dafaccc6f3a
SSDEEP 384:piFxQkUSviGsNQ8TUNTUlIlTmKV0THp5u8i0+avZ2IfuQIIl4:AFjDxwgIKufkCvZ5fuQLe
TLSH
T153A26C335CA8AD7BAEA79A60F54A3213DEB05167C6849FD4E7CD6A2C01DB1DC130BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bccbdad4-a911-4972-a9fb-23fad2e63aab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\bccbdad4-a911-4972-a9fb-23fad2e63aab.tmp
Size 105KB
SHA256 a871097de08ac10fa186cf6374ed47c165532d2f45190d4a8a4920973b41eeca
MD5 8b1e50f3cab92971b2c83d5f4ebc1515
SHA1 dc7b9575587818187af365bfdab1445f1ceef6aa
SHA512 7dcbd713320e797358c4142ab7fe7cd08a8847ad447d0a5ccf2716297d7d9afff43a5332a49259ad7775f9b7a7ef3a0f23024a9cb2350bfebb1224fe83d27079
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7V:fwUQC5VwBIiElEd2K57P7V
TLSH
T17BB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b6f38f22081ddaa1111b84705bb0452e935cba70ffda2b2886601f1d8df6360
MD5 ec02b779d41e6c7bfde9a979b0a24d5d
SHA1 d7bfaab5e399fd543bd91b28be91cb05e1603c12
SHA512 7039abea8da570fee0fd1cebc7e8feacc30cdd16fd0348ba5146c309f1696c541bd99a85a480ad3c227df6df586718bd26cf483ae0af65010caac2db1bde30aa
TLSH
T156D02BC8D0D43558E01630351027850233CCDD54F003224680450591C4402C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4953eb47ddf8fed591c7d8926a102a58328776c2f8bcb0dcc6c2f6f790020aa9
MD5 4dce79f6f910909bafe5b8817320847d
SHA1 e10678ff1c26e3e9d2f3bf3bb824dc7adf3c47e4
SHA512 9329ecf2bfca29939d71c91b740a18344d0c73d558771b355af8d5bafc3d053fd9c23a07e1db9b22bfa7909d7bb78bb5272f713dbfc950acdbf066383642330d
TLSH
T146D02BC890D43958E41630351026850233CCDD54F003234780450591C4412C205F0869
MD5 SHA1 SHA512 TLSH

Submit Download

2734a6e1-b790-4c18-82cb-ff0f44474b32.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2734a6e1-b790-4c18-82cb-ff0f44474b32.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

54f659ae-2ba7-4466-ad01-c44d93c3764b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54f659ae-2ba7-4466-ad01-c44d93c3764b.tmp
Size 10KB
SHA256 305f0ba271d8d64fe5484f7c850cad72a879d553f24dc88cd17c888f6dfc0d25
MD5 2656590bb8ad14cba22b943ee8ccfa4f
SHA1 104c04e5d6f6d3d30c5cf803c1fa4f85a4de9255
SHA512 1e6b765f12cfa0e79f2bdab4f58a28751351caaa5d3ffa09c4abc2e5b6664fab74a0de03a4e41fe57cbd78b9b7262e0d75df3b74483e9d685006c11c665dabde
SSDEEP 192:sxZWRknh/fXs9YgIdpmMHW6+WNf9L/YacOxcDIg5mHJ:sxZWkh/fXs9Yh3Hbd/UU
TLSH
T16422B852AE28697B8CC7E20DFB55BF53E6F5603291901E84A6FD861C05E66DD130B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b744e45-c488-4cf4-b39e-2cbdf949e00b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5b744e45-c488-4cf4-b39e-2cbdf949e00b.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

6f7b8ff0-53da-48be-81c1-d5be9a25834b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6f7b8ff0-53da-48be-81c1-d5be9a25834b.tmp
Size 9KB
SHA256 79880f59f3acf9b7785e438d8d111f1726544399b934bce3905ebe1578d0c887
MD5 68ce9e1e0ebfa8500f1391b5f6053b56
SHA1 7877d9c2427293bf278c7ff433ad257e1b292661
SHA512 a9e24c63780626e18875e24da9ea5f7cc732079f44bcd01463632ade77f689e76e36da2acce052bcd71ee3de12c5f6f5b0dff587f4d9a3e2491aedcc3b2b37e0
SSDEEP 192:sxZWRkWh/fXsPhgIdpJHW6+WNGYaNOcDIgrJ:sxZWRh/fXsPhhJHbGn9
TLSH
T12012C8516E28A53B8CC7E20DBB25BF43E6F9503291901E88EAFC861C05E66DD130B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90f4c0ec-1be9-46ad-bd86-05be5b54034d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90f4c0ec-1be9-46ad-bd86-05be5b54034d.tmp
Size 27KB
SHA256 a0799f93fbb9aee8563c88fd413098bee4c083fdd793de3ad74e13c11adcddc4
MD5 535a2a58a3a690649391300117a3c5aa
SHA1 79418cd5fcc930a9b8872d327f923c0844e36efc
SHA512 f358ddd65fd535fc98cedd7f4bde11dedda5189e629e87ec4a3fc7d8255c40e57f86d24b99e1b28f9f505cad3e128b48c892f472159226300a3c270f4913d64a
SSDEEP 768:1OyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3SrodZhWq:1OyQRbrWvvlpZu1jaXKLf33JdZhWq
TLSH
T160C2FA2B640CCB7E4FC01E9DDC666F976EA802C7A6588D4447FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d0b4c3a4b1bcf3e9e83a820e69c1e7394534acc0443957f1cfc7512445cdbc4c
MD5 60f14b3ac9d6bad79f20abdcb01a5e36
SHA1 afe142cf6ee574f11b2944780ff327d29e240b1b
SHA512 607b930c0bd4c14b63f7d6ffb438d6039c7956f61512101b0f41d31961dc7d46e5fb85cb859511cf2331eaea284dae6f0eddaf78b82903ae5a3bfb762447addd
TLSH
T191E026C945FAC23EA30DE4DB017C930CCBA0371B92C16E8E5B01CEC5700D080B292AE1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7bcf88a6afb6664433a966bd7cbe41968757223a854a61c04204260a8dd4d964
MD5 39d1634a3a4bb0c96bf2f6fe8975b680
SHA1 00ae6a1968075b2cf9ffb0a97de2c7a8c491b8fe
SHA512 beea8132d105c959516452abf0d86940fbf25572f13c85cdddb19fcce9d4263864918dd6ab1a50c044d7c72dd202c452f0e5f8ad5698bdfe3d3e08688162c8e9
TLSH
T140E0209444C4C23E724CB58B515D930CCB82666F92D4694F1F00CEC9700948063C1BE5
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 51829f1106dd886095a3fa29a5ca0c600471fe74b16e09a3c823c33bc521f07a
MD5 42a949067be0a77ceffd543a228db603
SHA1 9e51f85ca61ad4b512d5df883e80b01c6d96bdf3
SHA512 0139ca86cf564fa232283ffb717b5641701113ad3299372d57009e3265598d993a0b12956bed13ba6aaaeaa6f8a1f53088e84b6c5fa3453b58adf59e167b9f5f
TLSH
T1C5616178B8FCC4D5F7D8447CDBD52A8736BCEA829C979EF201A0DB786D8AF101154046
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 eace8ae4d29dda173d119c2f9dee168f9d130604354de7a0b1078ea9933d2101
MD5 c33b3e0a5c50b965a9c0b8371b0b8702
SHA1 09b75b4e6aaa67e48f13037bfd73fad979076d2b
SHA512 ce2632ae26bad0459316b26392495d1151c8dbce36be2376f467ce3bf80764e5f28e8fc1c617a80e5052285608fed802e932d1fbdcc83cad6b2743aadbabce2a
TLSH
T176615078B8FCC4D5F7D8447CCBD52A8A36BCEA869C979EF201A4DB786D8AF101154046
MD5 SHA1 SHA512 TLSH

Submit Download

ea0b041e-9908-4ec2-86db-36a1e54248c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ea0b041e-9908-4ec2-86db-36a1e54248c0.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4648656f-a7ba-4f27-ab1c-45b28a00a52f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4648656f-a7ba-4f27-ab1c-45b28a00a52f.tmp
Size 949B
SHA256 d4bf7d48664842d6e5dfbd45f7b3ca0715bac61e46b44b739eb2bfbac766763d
MD5 dfa77ee7e249927019d3cac47fc82333
SHA1 509adfdbd6e2bdc9551f1771ec511cbaeaf04f60
SHA512 cb700339ed3f9ecdf33325da8744a854e155d0dee7dff0bb272aa14e12b7a31c65ab620a2eae05dd569437789b1ff378603c19ed17bd874ea0780876bc2524f3
TLSH
T125117DF3C7D5856E894156F05A24AE1BCE1D0A15422C7C15C5D8EF2B93F3476D00255B
MD5 SHA1 SHA512 TLSH

Submit Download

d4ae8513-2bc1-430a-b77f-065de676e7ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d4ae8513-2bc1-430a-b77f-065de676e7ae.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fca40e81-f185-4360-b51b-3deab5dc080f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fca40e81-f185-4360-b51b-3deab5dc080f.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f2faff2655a1f6038c34b4734f8a45f670d5c9e8664b3cbed2bd077c3a3e110b
MD5 3062adaef0bfdf06cd98e44f8e06b74c
SHA1 599d4a11a4bed3f7062b74f52cbf87f855136af9
SHA512 73aa1ac05c42cfbd3a0f3b47816610b999e21bc28c1131008daa64321ddcbf6b0d789ec7bef628e1842a1e17e3c2e98c2a9aa57b426c44e5100e8375866c3a37
SSDEEP 48:K0hwdR7/DcbvaHISpcK9J1jcxBMY6LBByLtMBdvbfAbzGTISVAK9V13AxFQYWXrF:K8S4K7S6aaoKnKUOsKXqqym8KTax
TLSH
T198B15111317A0A0079BE2648607A873A675171F23058E53FBBBD91F24F6EE180EFD6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b0fd5154-38a5-4e8d-b9e5-7ef21c7e4fc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0fd5154-38a5-4e8d-b9e5-7ef21c7e4fc9.tmp
Size 10KB
SHA256 934c1ca3fea8a94676604eb075808db0bdfe43e7a3f50a514bb0e0c516413ccd
MD5 153c0f14bd1c391003d3b78a2fee9f18
SHA1 d0949b179b84c668e02f057219ff0f5d2365c4a7
SHA512 3c167233e6de62b534d69e40e35091b4e71efaac16775fc90d5ada3df228d7acb30485f44723a9579d0a094309a2c4c71fc2880daa16345c5b14e9041eb34ba4
SSDEEP 192:sxZWRk5h/fXs9YgIdpmMHW6+WNf9L/YacOxcDIg5mHJ:sxZWqh/fXs9Yh3Hbd/UU
TLSH
T11322C852AE28697B8CC7E20DFB55BF53E6F5603291901E88A6FD861C05E7ADD130B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c1f0ffbf-2f82-4b73-b443-8ba3db81e692.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c1f0ffbf-2f82-4b73-b443-8ba3db81e692.tmp
Size 10KB
SHA256 ecc28f3f6839421c9106d2c5dcfdd3c5133d28efffff5bc13cc8949d2c8bd115
MD5 e8a26c8675ff8f165a8e2bdc829ecf2e
SHA1 63a87ff1f66613269d8350a675fa8fd9632087e7
SHA512 19d02e6f02bbdbc41fbf7990b7b3e15aed1877aef490c47ca385eb8f1d5377c57f343b1c7de2b047939e886bb1b5efa8edd38c668a440a7acebf87e1546cbaaf
SSDEEP 192:sxZWRkWh/fXs9YgIdpgMHW6+WNf0a/YaJOOcDIg5mHJ:sxZWRh/fXs9YhVHb1/CU
TLSH
T15622B951AE28A97B8CC7E20DBB55BF53E6F9603291901E84A6FDC61C05E77DD130B40B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c88265b1-2ebd-4361-9545-ed401fef4d8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c88265b1-2ebd-4361-9545-ed401fef4d8c.tmp
Size 9KB
SHA256 5b24ce826fbb31938cf531af74355780c7c0c55b9acc5e583de532c3647146bb
MD5 7d06714aab56e4b8ed712be3a08cea0c
SHA1 fb6096d33d266532237bd1707a4ad20a907e7b5a
SHA512 6acecf09932e4f32531fa3e7e1924a098c7b753487ea92d56fc61e1f34046414f9c1a9c81b7bcfccc2e824c37589de2e0a3075b652ba758fdfb2e23e5406ec20
SSDEEP 192:sxZWRkWh/fXszYgIdpgMHW6+WNGYaJdcDIg5mtJ:sxZWRh/fXszYhVHbG0W
TLSH
T19D22A851AE28A97B8CC7E20DBB65BF43E6F9503291901E98E6FC961C05E66DD130B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4877c615-18e9-40bf-900b-8e9e0d77e45a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4877c615-18e9-40bf-900b-8e9e0d77e45a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b7063a57-d0da-44a4-a7cd-baf5a4ebd4b7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b7063a57-d0da-44a4-a7cd-baf5a4ebd4b7.tmp
Size 18KB
SHA256 7e640683c54e084535338f722aa4c4c2b6f6e9061f3669ce62b5f6fe3eeb8669
MD5 c667f3712ea384dd1e1f9fdf38b3fafb
SHA1 25bc808f5cf0b080da71f74f04adffadf0cbb026
SHA512 d15bc2e018a6d9a41a2188c3b4010c422964cc362d19aa446097a10a026174f2723112da03ce18f59cf4f5f83e11640080958411d0a043657404c3adfa7655d0
SSDEEP 384:rQkUSvLsNQTmKV1THp5u8i0+aPZ2IfuQIIl4:lLSKLfkCPZ5fuQLe
TLSH
T189828C326CB87C279AA3E560F14A3613AE74915BD3C85FD4DACD6B2C05DA2DC130BA13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5860d117-ac2e-4382-9fa1-f35bf90b4e5f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5860d117-ac2e-4382-9fa1-f35bf90b4e5f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 622d0ae1a054c36678a095d7f40a7daa14b8b0022688a763a0e42e68fefd9033
MD5 e531a6f7d6162ebe51ac417d236f012b
SHA1 615d08fdfe18e349a90d8d5c15ce894f758ef4be
SHA512 af5367a399b35cbe94025cd6170eb5b2040c7746643e3d17bfe62221752c42e520c03417d343aaf64d85d6fd34b7e0ddcf36450a9948b29e80249fad88f906e5
TLSH
T15F41D35CA6ED1148B3B36F1AABF6A9AE487F78772F07805D10110E8E4B22B40C961737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3932-199-0x0000023B2CAF0000-0x0000023B2CC39000-memory.dmp

Download