hxxp://clients2[.]google[.]com/time/1/current?cup2key=9[:]8haS6fF_lqS4xGSIy2GVjI6TAiZLvIhomDGNgELbERs&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Analysis

user interaction
yes
max time kernel
298s
max time network
190s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://clients2.google.com/time/1/current?cup2key=9:8haS6fF_lqS4xGSIy2GVjI6TAiZLvIhomDGNgELbERs&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
Sample261026-vsbahsft5z

Score

3^/10

discovery ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4980	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-939655444-3071939294-1401108526-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{F9DCA301-EC41-4BCA-B498-6A67661CF3B7}	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
4360	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3380	msedge.exe
3380	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 4180	3572	msedge.exe	84
PID 3572 wrote to memory of 4980	3572	msedge.exe	85
PID 3572 wrote to memory of 1388	3572	msedge.exe	86
PID 3572 wrote to memory of 1388	3572	msedge.exe	86
PID 3572 wrote to memory of 1388	3572	msedge.exe	86
PID 3572 wrote to memory of 1640	3572	msedge.exe	87
PID 3572 wrote to memory of 1640	3572	msedge.exe	87
PID 3572 wrote to memory of 4976	3572	msedge.exe	88
PID 3572 wrote to memory of 4316	3572	msedge.exe	89
PID 3572 wrote to memory of 4976	3572	msedge.exe	88
PID 3572 wrote to memory of 4976	3572	msedge.exe	88
PID 3572 wrote to memory of 4316	3572	msedge.exe	89
PID 3572 wrote to memory of 4316	3572	msedge.exe	89
PID 3572 wrote to memory of 1256	3572	msedge.exe	92
PID 3572 wrote to memory of 1256	3572	msedge.exe	92
PID 3572 wrote to memory of 1256	3572	msedge.exe	92
PID 3572 wrote to memory of 372	3572	msedge.exe	91
PID 3572 wrote to memory of 372	3572	msedge.exe	91
PID 3572 wrote to memory of 372	3572	msedge.exe	91
PID 3572 wrote to memory of 3480	3572	msedge.exe	95
PID 3572 wrote to memory of 4928	3572	msedge.exe	96
PID 3572 wrote to memory of 3480	3572	msedge.exe	95
PID 3572 wrote to memory of 4928	3572	msedge.exe	96
PID 3572 wrote to memory of 3464	3572	msedge.exe	97
PID 3572 wrote to memory of 3464	3572	msedge.exe	97
PID 3572 wrote to memory of 2208	3572	msedge.exe	98
PID 3572 wrote to memory of 2208	3572	msedge.exe	98
PID 3572 wrote to memory of 2208	3572	msedge.exe	98
PID 3572 wrote to memory of 3764	3572	msedge.exe	99
PID 3572 wrote to memory of 452	3572	msedge.exe	104
PID 3572 wrote to memory of 4360	3572	msedge.exe	107
PID 3572 wrote to memory of 1000	3572	msedge.exe	114
PID 3572 wrote to memory of 216	3572	msedge.exe	115
PID 3572 wrote to memory of 208	3572	msedge.exe	116
PID 3572 wrote to memory of 552	3572	msedge.exe	117
PID 3572 wrote to memory of 552	3572	msedge.exe	117
PID 3572 wrote to memory of 4908	3572	msedge.exe	119
PID 3572 wrote to memory of 4908	3572	msedge.exe	119
PID 3572 wrote to memory of 3380	3572	msedge.exe	120
PID 3572 wrote to memory of 1824	3572	msedge.exe	121
PID 3572 wrote to memory of 3016	3572	msedge.exe	122
PID 3572 wrote to memory of 3016	3572	msedge.exe	122
PID 3572 wrote to memory of 1824	3572	msedge.exe	121
PID 3572 wrote to memory of 1660	3572	msedge.exe	123
PID 3572 wrote to memory of 1660	3572	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://clients2.google.com/time/1/current?cup2key=9:8haS6fF_lqS4xGSIy2GVjI6TAiZLvIhomDGNgELbERs&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff87c40c188,0x7ff87c40c194,0x7ff87c40c1a0
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,378773802784600138,5427050689039679275,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,5324432171483969770,10535400787021677350,262144 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,16598662454457501142,2306244340203450573,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,11960076441040159996,6283130860979124302,2097152 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,8630815857198343419,16671596341104433303,2097152 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,3017117393965713099,7209188060803706157,2097152 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,9855160485793778666,14124690456308313342,2097152 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7709263827781869002,5957179198179325358,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,15125377903196097666,3234823363817263566,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,10342064015210412223,4004353379062049828,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5744,i,3790274196630672767,8416159634673783395,2097152 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,2455681769063308062,11173791463083452485,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,15393575822094360775,10456812530146239779,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,15393575822094360775,10456812530146239779,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:8
  2⤵
  PID:452
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\json.txt
  2⤵
  - Opens file in notepad (likely ransom note)
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,16955545096215739480,15990755383879397332,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,17685623284386656038,8933819614783239501,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4736,i,5387588716162526790,17239465199664830418,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5160,i,8709132371246562115,13910244142283907719,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5436,i,9822040009391552599,17546299141440037372,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6584,i,2937013973328008458,11298503308422981931,262144 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=6832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,5172931327837165735,93418364174613909,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,16166138565518118188,14203594008647873351,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,9437675101156634190,16686791063529654758,524288 --field-trial-handle=2272,i,8790674531138184054,2981248659345396225,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:1660

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0c7b6967-bd19-4d6a-9f1d-abcceb6b9e6d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0c7b6967-bd19-4d6a-9f1d-abcceb6b9e6d.tmp
Size 21KB
SHA256 19956ef0cdf3c61354213fc0198a542b57679a99d6ec55d55a295efc7c1b695a
MD5 fc1530f214d905fa5cc32304da700906
SHA1 dc490bddedf257fb6cae1465fd8521d9f2fda1ee
SHA512 d97476ac1dbb879242601b9208f93024183189caefd88cd23cfa226d9d4aab25c1254c735b2d95e52df777db2c1bd64ea39a255654c7644a793348d268518f35
SSDEEP 384:ViFgQkUSvIKsNz8TUNTUlIlz3hf1wzq1zIGmpE8ro7XULDiB2I8uNIIlT:cFItKwgthfB5SKzULDiB58uNL5
TLSH
T1CCA23B339CA8AC7B9EA79A44F54A3613DEB48167C9D4AB50E7CC6A1C01DB2CC134B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3e6ddcdd-03c2-4610-acdf-745db16c80a0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3e6ddcdd-03c2-4610-acdf-745db16c80a0.tmp
Size 8KB
SHA256 4256edecd4dab5aab546f45f948e80181ef09aefe1c19a7cdf9c6482add6c391
MD5 a22267c724a3333cc8ffaf10fc68a760
SHA1 768f2b844f7047ff60d533fabb56bab8fbcbb2db
SHA512 d657f9082a686ac794b0f7ece87913b53d157017b4d52ad8f1d7e13847f7c6f8d6ef0027a205d25af8442ddc6836c918b231ec60dce48cde413226f3185af33e
SSDEEP 192:nONgh6IE9QmiUy5VTHuIGmpUjzor0Ao7XEeUPT27HwqXU6:nONE6D7oHuIGmpE8ro7XUgHBU6
TLSH
T10A12FA369878BC6F5EE3A948B4873913ADB54217DA886F50D6DC2B1C01EF65C134B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

15aa4503-3c32-4fd5-af5e-fe18113607e0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\15aa4503-3c32-4fd5-af5e-fe18113607e0.tmp
Size 9KB
SHA256 a945522cf7a35c3a18ee82b753afe38566e691239686ad5e7833c92117bffd69
MD5 688400bb4bdc740cad16026f22d5f66d
SHA1 df6116206138a47efd1ca59fea539fe2fdd2fc3a
SHA512 ffea4469941b65347abdd08e85b28fe650dab8c1f22d2861aeb5774d48d31f06e0b40b82bf416450c0301f4984b321b5487f92d482f69ead1e4e6af3277feb29
SSDEEP 192:sxZqrR1nZ/fes5G1pdIdpJHW6+WNGYapJqQFEIgrJ:sxZEPZ/fesYOJHbGm9
TLSH
T1DF12B912AE38A57B8CC7E21DBA25BF53E6F9503265D41E48EAFC861C05E76DD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1e964e9e-1e78-4ca3-97ab-15b606d86ed3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e964e9e-1e78-4ca3-97ab-15b606d86ed3.tmp
Size 27KB
SHA256 3bc7010eb70f787ff25be70a3e51b805977421c36b73c0001c5ed473a8b9eff0
MD5 e54ea08d46994fbed42009600762c140
SHA1 17d7d7385f00dd1d83362114eb675206773d8ec9
SHA512 2828234bc3608d77404e7fe2f628731d9a978f59ae663c1cfb3d5d9ecbdd12b93ae3e46c06221aa4f30d131582352c396289a9a8fa326cc469dc816bd28bbaad
SSDEEP 768:g4WPcLKWvKeEe8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Pro4rfeemRF:g4WPcLKWvKeEeu1jaClLiF7c4rWemRF
TLSH
T1D6C2EA3B640CCB7E5FC01A9DDC5A6FA77E9802C79A648D4047FE944C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a395ef1-92f8-421a-aefa-3c566c4be6cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5a395ef1-92f8-421a-aefa-3c566c4be6cb.tmp
Size 10KB
SHA256 aaaae942e4aaae08c63ade0fde7d3a157b3001decc5cbbce0b2ccab78186df5c
MD5 4b8a4d10f4cb13333e782a73a7295507
SHA1 7602d75f9d834b22fbdd87cbf71718b59dcd5679
SHA512 989992f21c962096ce0e978b002f26adcf2d419dc7df1442ca06367092a1d36fe955314e48ff76d452fd37995c529516afba8955c7d8daaa9ab82a61c8726281
SSDEEP 192:sxZqrR1nZ/fesJv1pdIdpJHW6+WNGYapEuQFEIg5LJ:sxZEPZ/festOJHbGVH
TLSH
T11022C752AE28A57B8CCBE21DBA25BF53E6F9503255D11E48E6FC861C05F76CE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c3e7bf1-b4b9-45e1-af5e-85db7d6f05f3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7c3e7bf1-b4b9-45e1-af5e-85db7d6f05f3.tmp
Size 10KB
SHA256 88b4a66b47bc150d06d0ff99d2d65cb585f6fa1027746528852e198ffb2a2629
MD5 7ddbfe9b4679551bb1e35a1ba9d84584
SHA1 31d76ae9f1cb2ded0beb31b595a32d5a0ffffca9
SHA512 dfa14bc5be40a37bdfef1c3f8701abbad4af5c0f5d9377fedbd17189696d93731a26793afb15a81b4ae11322e35a4bc0e0ea472de8055692034c5d168afe98e6
SSDEEP 192:sxZqrR1nZ/fesJv1pdIdpLHW6+WNGYapwcBQFEIg5LJ:sxZEPZ/festOLHbGeUH
TLSH
T1B922C852AE28A57B8CC7E21DBA65BF53E6F9503255E01E48E6FC861C05F76CE120740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8146f3ce-4082-48ab-85a3-ce1d610c0817.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8146f3ce-4082-48ab-85a3-ce1d610c0817.tmp
Size 9KB
SHA256 90b44ef4ae03099b8df955c5a0faae2b7c3becd5ab05821b347e110cff097a11
MD5 062bcd29d07d74997f4a0edfcec1bf48
SHA1 e40254b747afd369c13ae92b2dbc5183a850668a
SHA512 290349c4a29d5987015b80b71cf9c49e7e4cf4e90e58d0870e9ebf2e90fd7a056b906e2f3a41afd2352e213724f324394a96227c875af297f815eb2a55006b4b
SSDEEP 192:sxZqrR1nZ/fesJG1pdIdpJHW6+WNGYapJqQFEIg5RJ:sxZEPZ/fesoOJHbGmh
TLSH
T14D22C952AE38A57B8CC7E21DBA65BF53D6F9503255E01E48E6FC861C05E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 33B
SHA256 68c7ad234755b9edb06832a084d092660970c89a7305e0c47d327b6ac50dd898
MD5 f27314dd366903bbc6141eae524b0fde
SHA1 4714d4a11c53cf4258c3a0246b98e5f5a01fbc12
SHA512 07a0d529d9458de5e46385f2a9d77e0987567ba908b53ddb1f83d40d99a72e6b2e3586b9f79c2264a83422c4e7fc6559cac029a6f969f793f7407212bb3ecd51
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 7241673d7b27ee459e272207dea8830f5cf4cb10541f613a1b013844665288d3
MD5 464ebca0a9d36b1c093ff910937b1df0
SHA1 317d041a8f18ee59de57549d10e56ef00fbea891
SHA512 8856dd8d6e69136c06355c0af52c69944024eff4b5178cbb3c97798ee97cef858375de5e274690cafc01ef59e0d026cd68e6fce82ac03d339490be484b7079f7
TLSH
T12BE0268546CEC22EF3CCA44741BC530DD38137DA92C2BA1E2700C5CD730B080A386690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 293B
SHA256 a6a84a1dd61cb02e37c9de0ef9da687555d55ffa8a7603c1bfdd444ddbd3a216
MD5 31a53ffae35a30f5661803e25365be97
SHA1 36ef1866921a0b75da0d88b53b0135ae31a1bd26
SHA512 2b0411f4a6f9c865771791479330c2f3aed02e55f655487bc4eff98e8b93b50c7f423e6fd7d27be952420c4a0bea701e96cbeb7d591c4875cbe54f9dee5f792c
TLSH
T13DE02B1588C9C22E5368A4D70638934DCA943B9ED7C1BB3E4F04C94C314B4C8A79A695
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 15d33210dbbd88fdc097d5c22b845c475e29129f4c3e7f48879f88adff04a9e4
MD5 54f6a8bc6db287bda65a63a30ea3c044
SHA1 7c7dc85b1aef5ce8d31671e3db85a2bdab4e7ac5
SHA512 413104b24c0c6203a2929ccd0eeb47d3e904e3ba0ca4bb478529ed6e3fbe6eba257e8f9b724c91c4ed9037bf1521f33ac18f6402021ff07ee77cedc5762b1ee5
TLSH
T15451C4C516A58FA0FBBB86B090C432433B3489F3D2A32E01779DE0F90D65B56BCDA004
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 6b3af8c70f6124f2dbc2be655539be039c9158474ea68d060f2436d76d30cc14
MD5 43f1e659833d28f62b6913696941ee96
SHA1 4db12326d26e6cd8371d66bb451a249ae3fca273
SHA512 af03a78ae39b1ff9bc22f72112e4a8f419baee6278683330d6478cc0d37b432ae5d96eb8cdbf31cc20b82a066fdb630a060ba12a2d526fc2f7d1cf7adecf5b1f
TLSH
T17651D6C516958FA0FBBB857090D432433B3489F3D2A32E06779DE0F91D61B16BCDA004
MD5 SHA1 SHA512 TLSH

Submit Download

7e5de0bd-c48a-45b9-a207-7cbc74396769.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\7e5de0bd-c48a-45b9-a207-7cbc74396769.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

006f2d35-308e-4b20-94d8-c7e525631e25.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\006f2d35-308e-4b20-94d8-c7e525631e25.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

3fa0a373-daf2-4254-8eca-dc56bb018adb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3fa0a373-daf2-4254-8eca-dc56bb018adb.tmp
Size 1KB
SHA256 750ba24c28d26a09e1a9bffe2622460f49160753e216e55e7736d3d179cf66d0
MD5 f668ecb0b598ef92911e5a07bf9dddd8
SHA1 1471b12ce9ecc36cbe8e9b5d0f29bcb5f77cdad2
SHA512 f50026aa3eb9e5a66a35ba89fb6bd905ef281a3da3ab75691153e652a1977e7544764900fb174e9b7585d104eaac60f72ef7293ac0a074c4a7f465ffa4332512
TLSH
T176216AF3C3D5856E890156F4AA24AE2BCE2D0A05421C3C1699D8EF2B97E3475E14159F
MD5 SHA1 SHA512 TLSH

Submit Download

7854da08-d705-4532-bd5f-25876a770239.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7854da08-d705-4532-bd5f-25876a770239.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

65dd6f12-bc02-4141-88d8-9ec684de36ef.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\65dd6f12-bc02-4141-88d8-9ec684de36ef.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c52e3231-02a8-44cc-9ae9-d653051ec87f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c52e3231-02a8-44cc-9ae9-d653051ec87f.tmp
Size 18KB
SHA256 7028b5faf80ed1f7d92470fc2fc31344084aafbab321a931a94156f3c1ca6158
MD5 003bc40e463fe2058323b2f579704fdd
SHA1 a8f338c9827298c6386154196bb481bfa81f784d
SHA512 dcddcc5897cfae12cc51647ab55cf0fdbca4804540bb96de9f35dd0b40402ca4fa0efd90bdd9d1f8f96d171467c2ecd02bea0549b90d950caa00bc2f3114fbaf
SSDEEP 384:uQkUSvtsNhz3hf1wzq1zIGmpE8ro7XUkiB2I8uNIIlT:etkhfB5SKzUkiB58uNL5
TLSH
T13A826D369C797C7B8EE3A910F54A3A53EE748117D6C82F50D6CD6B2C01DB29C134B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

df38c4a5-af82-4c40-808e-a88363c5483a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\df38c4a5-af82-4c40-808e-a88363c5483a.tmp
Size 18KB
SHA256 fcc0d577cd7befd6673cecd9896454a1a73d05bf3c3a7f5410206213f35e10e8
MD5 7570560fb27596c4f183aa1bc4a9676a
SHA1 d4cff003fa038dab0a6eb804557385f8849b8b5d
SHA512 b62ef1b055b9246cf9d93fd6f2cae66ed5598e052758eda0e3ce5ab7e9f625451324dd2957fc6dda38599beb2438c1401b2b78a8f424b3c1506eded95700a452
SSDEEP 384:eQkUSvtsNhA3hf1wzq1zIGmpE8ro7XUkiB2I8uNIIlT:OtrhfB5SKzUkiB58uNL5
TLSH
T10F826C369C797C7B8EE3A910F54A3A53DE748117DAC82F50D6CD6B2C01DB298134B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1508308-ceb2-4595-b3f9-b020b835a641.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e1508308-ceb2-4595-b3f9-b020b835a641.tmp
Size 8KB
SHA256 0519f1fb251ecbc867632a0b269de3fae9a7a70a94debe1f398640ca8fc406c9
MD5 7743e0afbcaff230e00d717260a4ca62
SHA1 91db8707c754fe57dc478122c9f59eba7868d706
SHA512 e1487d313e29466eae3c5ce411d90f8a05b3e153e7d36d8ce76cc4a78dc744a65201f9302638f765455e6bb11e342aa9ab95c027e75d6d1a8beb916005f0a4c4
SSDEEP 192:aON/6IE7QmiUy4VTPuIGmpUjzor0AxC7sQ+U6:aON/6Dt7PuIGmpE8rysrU6
TLSH
T1A302EA35EC787C7B9FF3AD08B4872A23AEA5112BD5952F44DAD81B1D00D764C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f5a0dfc-062a-45fc-a188-c3595123f01f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3f5a0dfc-062a-45fc-a188-c3595123f01f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ccb6cffe386ca4cd6ce51a253387de51da2cdfa84bc08d0d01aa48c228368fc0
MD5 d0ed31c41dcdf9ee882eea742e911523
SHA1 d274c4035f63de249b37ffc31845bc8aace0c859
SHA512 959b0d2eb49500063e1c18ac6e2f4cfea167d600b646605f5a94e3e7e8ffebce63ed05570ad11a932f5368d4d3dc353a6b4b355032aa088c64015cdd6bd4bfe2
TLSH
T14E412758B6EA1108B3B77E5AAFF6A86D88BABC732F07D45E00010D4F4662A00CC71737
MD5 SHA1 SHA512 TLSH

Submit Download

445bcd52-98ac-48af-86be-3b7c59c9f3eb.tmp

Path C:\Users\Admin\Downloads\445bcd52-98ac-48af-86be-3b7c59c9f3eb.tmp
Size 81B
SHA256 cdc7455292c928a1f2e0e2cdc15e7495b8c7df2dd699ae0e1380395faa96cb4b
MD5 5097a1837615bf6331ef03629e40102b
SHA1 99dac293670cb7ef003a37fe588703b318853c68
SHA512 4816a2c385481aa8c7ef76a544567b015c3809623c9290aab020c86792b93e67f6c7714a24a9579f52de20137b82c5fcf7f4bbe018bf08e57117ec76e86bab4e
TLSH
T13AA0243C45704033CDC30314351047501D1F50031C1504C303015C7D055D4D313C3500
MD5 SHA1 SHA512 TLSH

Submit Download