hxxps://app[.]saasfirst[.]com/backend/marketing/w/0f4a27c5823f3a94e46c/m/12/c/5a2afba18d32a0cb1f004728509bd74f3ca3e960/s/67154/click?url=hxxps://f575113439d600d5cc26ab5213e36b18e5284af6[.]asadvertising[.]net/#cGF0cmljaWEuc29yaWFAbWFjcm8tZ3JvdXAuY29t

Analysis

user interaction
yes
max time kernel
149s
max time network
131s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/10/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.saasfirst.com/backend/marketing/w/0f4a27c5823f3a94e46c/m/12/c/5a2afba18d32a0cb1f004728509bd74f3ca3e960/s/67154/click?url=https://f575113439d600d5cc26ab5213e36b18e5284af6.asadvertising.net/#cGF0cmljaWEuc29yaWFAbWFjcm8tZ3JvdXAuY29t
Sample261026-vxtyesvs8r

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{1B7F2B4E-8F74-473C-93AA-89A4951575CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4192	msedge.exe
4192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe
4740	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 4740 wrote to memory of 2164	4740	msedge.exe	83
PID 4740 wrote to memory of 4668	4740	msedge.exe	84
PID 4740 wrote to memory of 4352	4740	msedge.exe	85
PID 4740 wrote to memory of 4352	4740	msedge.exe	85
PID 4740 wrote to memory of 4352	4740	msedge.exe	85
PID 4740 wrote to memory of 4432	4740	msedge.exe	86
PID 4740 wrote to memory of 4432	4740	msedge.exe	86
PID 4740 wrote to memory of 3908	4740	msedge.exe	87
PID 4740 wrote to memory of 3908	4740	msedge.exe	87
PID 4740 wrote to memory of 3908	4740	msedge.exe	87
PID 4740 wrote to memory of 2400	4740	msedge.exe	88
PID 4740 wrote to memory of 2400	4740	msedge.exe	88
PID 4740 wrote to memory of 2400	4740	msedge.exe	88
PID 4740 wrote to memory of 5004	4740	msedge.exe	89
PID 4740 wrote to memory of 5040	4740	msedge.exe	90
PID 4740 wrote to memory of 5004	4740	msedge.exe	89
PID 4740 wrote to memory of 5004	4740	msedge.exe	89
PID 4740 wrote to memory of 5040	4740	msedge.exe	90
PID 4740 wrote to memory of 5040	4740	msedge.exe	90
PID 4740 wrote to memory of 4664	4740	msedge.exe	94
PID 4740 wrote to memory of 4664	4740	msedge.exe	94
PID 4740 wrote to memory of 4664	4740	msedge.exe	94
PID 4740 wrote to memory of 3440	4740	msedge.exe	97
PID 4740 wrote to memory of 3440	4740	msedge.exe	97
PID 4740 wrote to memory of 3440	4740	msedge.exe	97
PID 4740 wrote to memory of 4472	4740	msedge.exe	98
PID 4740 wrote to memory of 4472	4740	msedge.exe	98
PID 4740 wrote to memory of 928	4740	msedge.exe	99
PID 4740 wrote to memory of 928	4740	msedge.exe	99
PID 4740 wrote to memory of 2552	4740	msedge.exe	101
PID 4740 wrote to memory of 4784	4740	msedge.exe	106
PID 4740 wrote to memory of 4784	4740	msedge.exe	106
PID 4740 wrote to memory of 4784	4740	msedge.exe	106
PID 4740 wrote to memory of 4532	4740	msedge.exe	111
PID 4740 wrote to memory of 1636	4740	msedge.exe	112
PID 4740 wrote to memory of 1976	4740	msedge.exe	113
PID 4740 wrote to memory of 4716	4740	msedge.exe	115
PID 4740 wrote to memory of 4716	4740	msedge.exe	115
PID 4740 wrote to memory of 4716	4740	msedge.exe	115
PID 4740 wrote to memory of 536	4740	msedge.exe	116
PID 4740 wrote to memory of 536	4740	msedge.exe	116
PID 4740 wrote to memory of 3936	4740	msedge.exe	117
PID 4740 wrote to memory of 3936	4740	msedge.exe	117
PID 4740 wrote to memory of 4836	4740	msedge.exe	118
PID 4740 wrote to memory of 4836	4740	msedge.exe	118
PID 4740 wrote to memory of 4200	4740	msedge.exe	119
PID 4740 wrote to memory of 4200	4740	msedge.exe	119
PID 4740 wrote to memory of 4200	4740	msedge.exe	119
PID 4740 wrote to memory of 4192	4740	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.saasfirst.com/backend/marketing/w/0f4a27c5823f3a94e46c/m/12/c/5a2afba18d32a0cb1f004728509bd74f3ca3e960/s/67154/click?url=https://f575113439d600d5cc26ab5213e36b18e5284af6.asadvertising.net/#cGF0cmljaWEuc29yaWFAbWFjcm8tZ3JvdXAuY29t
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86466c188,0x7ff86466c194,0x7ff86466c1a0
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2008,i,16062193577198074930,11581136569435569960,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,2335063158269048040,4894129396506291467,262144 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,8978421594592870514,12702439792894202963,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,18063789476041728857,4935517558192264330,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,14468148185036898864,9952269133387796880,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,1113456286186370400,11097505725260028721,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,1058957735574661683,8679259607546041935,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:2
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3584,i,1275599929620261490,14871470226162309300,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5196,i,10350021612507404410,13997193251430503040,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,3686551816778996925,12852569698441079350,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,3732136487699178281,1820637490088047169,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4479739854742579317,13865216775619634459,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,4479739854742579317,13865216775619634459,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:8
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6280,i,1909582501584389270,10588836909424682473,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,12648535960390091094,1962081606050424109,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,14874411390363533202,13174395180146880382,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4264,i,4340862986185801628,6366782650257017540,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2772,i,18019192933748883323,13970885196338439890,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,16663722994180813984,12916635217322091193,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,13991432655545498258,2528698953213742248,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,16458968548147003934,6090653630001365220,524288 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=760,i,3653426504137574762,1691211382271377190,2097152 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=2880,i,3761990136618434612,12598931520021296677,262144 --field-trial-handle=2164,i,11268061471076065161,11778226993043549672,262144 --variations-seed-version --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4192

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29d82530-9aed-46a2-a00b-f669ac2c826e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\29d82530-9aed-46a2-a00b-f669ac2c826e.tmp
Size 8KB
SHA256 d4256072d40c9f808355a58356ed4799d63c65440b2daa7c07fa464287624da4
MD5 b2fd8468e2ebd64823741453ca3f645d
SHA1 764e5014d6a1566d2857efb77c3973881f8c59e4
SHA512 5fa22d4f3bb2b5e5df3d2893aa1af8d5c63dd9c0a8b3d789f30e804b17663630b16379c38a7f61ee6405e97ca338f9fa5d5abb3ae2d9804224789f8a798acdd2
SSDEEP 192:7ONf6iDtQmiUyL9Bq5u88PINuAPwouuZZqvLv1U6:7ONf6aOBq5u8iI8AYoRO1U6
TLSH
T17B122B3568787C6BADD3A865F58736139EA5821BE7897FC4D8EC161C04EF29C130B613
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

780b17d7-73f5-4708-aef4-9c2cda2648a1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\780b17d7-73f5-4708-aef4-9c2cda2648a1.tmp
Size 8KB
SHA256 fb989d6693e96fa077a48afbe2826835ab6bc693c3df37aaa939c3c66e0cea48
MD5 8cbbea9a862cfc1b1ac19121783ac7f3
SHA1 abb4d840580361ecaefbb8adcd2ec8d843b729fb
SHA512 8aa11d854e2aec14126acfc47e030c96cfb4070c2093812a31bb52ca413f587b3f92d35120d7255f9b610d688e08d891e93eb389b40fef358651dfe71e75be88
SSDEEP 96:PqONk/QsjpfwDISp5ih/cIPURHl8h4otop5UmDjBfPGxvw45RxmJm78lFDxv+Nj5:SONX6iDCQmiUyn9Hq5u88PINhSq51bU6
TLSH
T1ED02F939AC787CABAEE3AD15B5477B179F94012FE6952B84D9E81A1C00D729C1307523
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

49a64770-9144-4ecb-a7e7-1299795c9cf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\49a64770-9144-4ecb-a7e7-1299795c9cf5.tmp
Size 10KB
SHA256 96a60d5b800900659f6897002bc048cad8436165b033eea71fb32cbf3433784f
MD5 cb0f9c7b2ad61eecb172b469d3466ae4
SHA1 5d7eed284d2f73b1a273931f6538ac9a0012eac9
SHA512 e3c745b3351b82be42ed23652d51be0f40d07f9fb69936b14000f965191d7d351c639e7781cf7517b97dac4c3643b1064fbfc4afc020039e5ab372060bcc68fe
SSDEEP 192:sxZikRWWUX/fP/sQ4oeqK4IdpkA4QHW6+WNGYaz66RIg5DJ:sxZBz6/fnsQ4Hq4DHbG5T
TLSH
T16322DA516E28A97B8CCBE61DBB15BF53E6F9503251D01E88EAFC861C05E76CE224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4b5c5782-149f-4e29-ae31-789121cdf698.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4b5c5782-149f-4e29-ae31-789121cdf698.tmp
Size 9KB
SHA256 9c909bf342eae375901882d5f2064138150f29517b747fa419871387f36ad14d
MD5 f99327d3a8a56b656e9779e34cf96a02
SHA1 4fe67981368d13b25baeb25d1f10905172e84b55
SHA512 553c231c6e52b77fd1a60d270a44a0df28fd7bd55871de14766cfac5751e7f99395baca2c40b70b74bb5d1269dd23d50153ddf541ffeb7ec9c27b82f41a38456
SSDEEP 192:sxZikRWWUX/fP/s64SqK4IdpOA4QHW6+WNGYaJX6RIgrJ:sxZBz6/fns64Sq4JHbGG9
TLSH
T12F12C8516E28A57B8CCBE21DBB15BF53D6F9503291D41E88EAFC851C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75855234-0e77-4003-97a1-fa45e78cf7b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\75855234-0e77-4003-97a1-fa45e78cf7b8.tmp
Size 27KB
SHA256 f101f35caa4ea1204155ad9096268cb4c54a87a571f45f355d5b575599532e6b
MD5 6358c2885f8ad7ec4df1f271e3ac7efd
SHA1 539801f01ea784bacf8b97a6946e92dbfb9e46f1
SHA512 4ebd369b162f260115ad6387e6ff22207fc0e30d0eedc56331ee1ae7f495da2cf113bad06bed9d276cc5e46a5055f80e8df0e72d9a68298d12a37b7cd0bf1df2
SSDEEP 768:aTyQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3LroYZPj:aTyQRbrWvvlpZu1jaXKLf334YZPj
TLSH
T11FC2E92B640CCB7E4FC01E9DDC666F976EA802C766988D4047FA994C02C77EE512B4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c24643d-45b6-4642-a9b6-0558851bdb20.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c24643d-45b6-4642-a9b6-0558851bdb20.tmp
Size 9KB
SHA256 94db7469a074f02f3e2f8977552af840c524cdccc6d53ec13f4cc672c5598de6
MD5 38c80d678ca3fa7ab5ca45b9fbc6924b
SHA1 b489e04324d513c5b9a22338e9ac2832c3768d77
SHA512 411a143cf52e2ba900dac1d92a47dacbeeb73a6aba11f0b08c0e3220c5f4aadc286f2d436a6a141aca1b61675289c7e4380e9a5314eb74d9a91a338270f0c129
SSDEEP 192:sxZikRWWUX/fP/sQ4SqK4IdpOA4QHW6+WNGYaJX6RIg5ZJ:sxZBz6/fnsQ4Sq4JHbGGd
TLSH
T11B22C9516E28A57B8CCBE21DBB15BF53D6F9503191D41E88EAFC961C05E66CE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 613b5cda48d3686e526ed1bf742a7f1ac72fba387278cda78c58212d038c1698
MD5 7b26a33647b8b6a5700253a7e08d7cf2
SHA1 f1641c686f79b7ca982b808299e50a31af225849
SHA512 53437c1c4ab4930e92684b4680c6aba4a56659b8fb29128fb4b6caa749b37d90b3237a8fca98b35b5d910aa94c32ba35b6dd381d301885948ec38048b287f4ae
TLSH
T1A7E026C44ACEC22EB20E644B02BC774CDBA0366BA2C0AE9E1B04C5C47346040E7E37D5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 050791664095f75319b0313b0c3e7d1a48f1cf25a089be8ea50130cb7007a730
MD5 b5ec824fb57234bad6c7e625c0f46865
SHA1 b3e02c86ed8fae35c6d12d9909ca4fe411e32da6
SHA512 e8363ba6b196d85f6c9b7b15bdf53088b965d9ecfd057c583629b9b5c17a930f2dd1b8a5b82aa2e68fc7b3bd1904bd301f050712bb2f6b1210f313b3e30e8fe0
TLSH
T19CE086E445CED2AEA21D644B026C674CC790266B97C57D9E270CC9847346548B6B37E8
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 30cdc66c9b51368bbd8760fc955c884d54bc1d6c1ec7cadb98728e2734a1e627
MD5 fde3dd95b734db3c524860f7891fd91b
SHA1 e4ff9f9be76a9dc64171e9b421b634c429c86571
SHA512 206577230ff2f00ee22752eb55b5d70a4a93eb3d268f413bd8143d46c0d0b9c64e54d5e506a4e3fc0dc21e444d13152e2832a26abf8a818914366026a59d0e44
TLSH
T1116194A954A00071DB986132B2F4A0873676F0B55FA3EE7200DCC8BFBF4A7599387220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cd5d57ebca9cc82993315221805fb5668b42a48d7c0523198979c91f402f4724
MD5 fe7530f6f2cbd783210881b27baae3c2
SHA1 eb51165f884f73937d0931a26d56d404dfb684d0
SHA512 bfd302904fcafd62950610042f6ed751f7684e251b8368f9e677d68e59f1997cc3867810009c6571146fd82ccbc8d01614e33e465089ca2a0c27c8b1506b77c9
TLSH
T1F56193A954A00071DB986132B2F0A1C73676F0B55FA7EE7200DCC8BFBF4A7599387220
MD5 SHA1 SHA512 TLSH

Submit Download

ffedf6bd-32b9-4210-9711-0be632637757.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\ffedf6bd-32b9-4210-9711-0be632637757.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

3381bec3-94fc-417b-abf6-e499b17531a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3381bec3-94fc-417b-abf6-e499b17531a9.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

76d8d510-fbc7-4196-9db4-0a49bb90de26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\76d8d510-fbc7-4196-9db4-0a49bb90de26.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

829d20b3-51de-4111-8056-242ef8668076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\829d20b3-51de-4111-8056-242ef8668076.tmp
Size 866B
SHA256 3828a7ce84bf6595ff47ad658553e15d74cc4f0938a01c607328ad95b965a847
MD5 2a371425848d17cf01a8981f0743b263
SHA1 7d5ca72de1572d80b2c4b6843374eb3ae0ad3858
SHA512 224537269555ee820d2b5af363d33bd1de9086232445fcae4fe7dab58d9289f4c89339273790001b5852e5e3a99f831ced067860f2898e26e9a9e0cc696bbfd4
TLSH
T1351180F387E4996E8A0156F06A145F1BCE2D0511431C7C5685D8BE2B93E3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

ba013e8d-52f2-4c79-9fcf-bdc2f134126b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba013e8d-52f2-4c79-9fcf-bdc2f134126b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc87bc9d-0342-4e40-bb6f-a7f0d6a8e79d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dc87bc9d-0342-4e40-bb6f-a7f0d6a8e79d.tmp
Size 9KB
SHA256 4a95307b201fc2cecb4914fb48a02c8388d4927bd39e701fde4837079204e748
MD5 dd9c85d5afc231327837bd0e101d8f61
SHA1 66dc30f4ce8092d1df1894de6f69a9220e72e90f
SHA512 6ee07db6f40818667c1404e5ed0fae0ca4223644a5dc973d84c6f3e6f919ae87f7e6821145ea4ffa95cead3165c12b72bfeee3c65a5875ddb9480c5d54d6fc79
SSDEEP 192:sxZikRWWUX/fP/sQ4oeqK4IdpOA4QHW6+WNGYaTd6RIg5DJ:sxZBz6/fnsQ4Hq4JHbGKT
TLSH
T10A22D9516E28A97B8CCBE60DBB15BF43E6F9503251D01E88EAFC861C05E76CE224740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

49e872ba-297b-41cd-b23b-d0ed9693303b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\49e872ba-297b-41cd-b23b-d0ed9693303b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b941cb78-9485-4dd4-8370-bf9dcea8dd8d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b941cb78-9485-4dd4-8370-bf9dcea8dd8d.tmp
Size 21KB
SHA256 00093c4b899054b539dc58b172c71a54850735c8ddd0d1c0a3531c6265a37f12
MD5 0af4aaa90053ae2f886b4c387ae8b826
SHA1 efecae5dab8084b967f26c709719cae94f572e4a
SHA512 dd411dc115e97f0b644fcbf6c21a8caa6466b0bd9f30056a0932b822c9f886db9043694c40570b9d56054751a8c19938775a8099b0541bc9a44a09e1627331a2
SSDEEP 384:wiFzQkUSvtzsNm8TUNTUlIlSSmmBTp5u8iI8AYovO12I15IIlQ:LFdVLwgrbkI5HO1515LC
TLSH
T108A25C365898AD3BEDEBAE50F64E3203CEB0825BC6C5AB94E6CD591C00DB1DC1347A13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c29898a8-000f-48aa-ada5-0cedf88176e3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c29898a8-000f-48aa-ada5-0cedf88176e3.tmp
Size 18KB
SHA256 184ed277c5911658c53b2c97eeab1e8665ba84bbba40393c71320a03c2df2798
MD5 3282089f25704d5bf41788b9cb31e83e
SHA1 fe207bf1fa074ec3de8b8cadde2e352231da3357
SHA512 84b465ec2f350d7c1564c447a9da765f547e5507fffc47b5eff7d7a01340be48548891cb84537f5e6385c15665a0dabdc9010245b7290dfd5882022f59693c6f
SSDEEP 384:UQkUSv0sNmDSmmBTp5u8iI8AYouO12I15IIlQ:E0ubkI5WO1515LC
TLSH
T101827B3568687C2B9DE7A960F64B36038EA4821BD7C86FD4D9DD6B2C01DA2DC2307717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c32050da-7299-4a06-ada9-e74d980401dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c32050da-7299-4a06-ada9-e74d980401dd.tmp
Size 18KB
SHA256 bb32e00ccc332c39fd88323df486bf1963eb720493fcc35bf46c97f40128402c
MD5 9496275c9f936c4b159792df7cc81a8b
SHA1 0ba61b85eca0079ea7cb07d24c63f3af2f57454b
SHA512 d6d6e5cdbc4bb0dc01e97674f9fafb119273472c86ffd1e503b26df46bb1eb432a3d89e2c540fd01198fe5358217f333ec67393dc1fee5f6b7ae872f17bc7a00
SSDEEP 384:mQkUSv0sNmSSmmBTp5u8iI8AYouO12I15IIlQ:G03bkI5WO1515LC
TLSH
T14C827B3568687C2B9DE7A960F64B36038EA4821BD7C86FD4D9DD6B2C01DA2DD2307713
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

94284d7c-fe35-4f1d-bcf1-7c4e6e1f2f3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\94284d7c-fe35-4f1d-bcf1-7c4e6e1f2f3d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f2944060227f4450f9fe0b29ab70dcac64243369f843ecf4ffb9985f6123a4ed
MD5 80c20ef950fa33997840f4de68d04997
SHA1 dc95e4216b20ca9f971bd74d29d4f46e72d3c9b7
SHA512 21648582204142557388b80030d8298d7359d6484fe21463275afc1d1f1e2e4df2aa356534536083726a5ae414dcaa144da5e0b66730853125c175e05dbd010b
TLSH
T142412B58B6FD1148B3B76E569BF2A97D487E79372F0A946D00010D4F0B62B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download