hxxps://forms[.]gle/Bgyupdhdh65bqC7q8

Analysis

user interaction
yes
max time kernel
300s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/10/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://forms.gle/Bgyupdhdh65bqC7q8
Sample261027-tn2fgaea35

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5500	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{8AB1C130-E18E-4847-9906-F9367F7B1BD2}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2091445952-3649787497-104050984-1000\{25F53A11-B86C-4B39-AA30-84C325ADD2E1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe
4884	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 696	4884	msedge.exe	85
PID 4884 wrote to memory of 5772	4884	msedge.exe	87
PID 4884 wrote to memory of 5500	4884	msedge.exe	88
PID 4884 wrote to memory of 5772	4884	msedge.exe	87
PID 4884 wrote to memory of 5772	4884	msedge.exe	87
PID 4884 wrote to memory of 5780	4884	msedge.exe	89
PID 4884 wrote to memory of 5780	4884	msedge.exe	89
PID 4884 wrote to memory of 1248	4884	msedge.exe	91
PID 4884 wrote to memory of 2252	4884	msedge.exe	90
PID 4884 wrote to memory of 1248	4884	msedge.exe	91
PID 4884 wrote to memory of 1248	4884	msedge.exe	91
PID 4884 wrote to memory of 2252	4884	msedge.exe	90
PID 4884 wrote to memory of 2252	4884	msedge.exe	90
PID 4884 wrote to memory of 1828	4884	msedge.exe	95
PID 4884 wrote to memory of 1828	4884	msedge.exe	95
PID 4884 wrote to memory of 1828	4884	msedge.exe	95
PID 4884 wrote to memory of 5804	4884	msedge.exe	98
PID 4884 wrote to memory of 4344	4884	msedge.exe	99
PID 4884 wrote to memory of 5804	4884	msedge.exe	98
PID 4884 wrote to memory of 4344	4884	msedge.exe	99
PID 4884 wrote to memory of 864	4884	msedge.exe	101
PID 4884 wrote to memory of 3284	4884	msedge.exe	111
PID 4884 wrote to memory of 3284	4884	msedge.exe	111
PID 4884 wrote to memory of 3284	4884	msedge.exe	111
PID 4884 wrote to memory of 1260	4884	msedge.exe	113
PID 4884 wrote to memory of 5236	4884	msedge.exe	112
PID 4884 wrote to memory of 1260	4884	msedge.exe	113
PID 4884 wrote to memory of 5472	4884	msedge.exe	116
PID 4884 wrote to memory of 4528	4884	msedge.exe	117
PID 4884 wrote to memory of 5348	4884	msedge.exe	118
PID 4884 wrote to memory of 5684	4884	msedge.exe	120
PID 4884 wrote to memory of 5684	4884	msedge.exe	120
PID 4884 wrote to memory of 5684	4884	msedge.exe	120
PID 4884 wrote to memory of 536	4884	msedge.exe	121
PID 4884 wrote to memory of 536	4884	msedge.exe	121
PID 4884 wrote to memory of 536	4884	msedge.exe	121
PID 4884 wrote to memory of 4512	4884	msedge.exe	122
PID 4884 wrote to memory of 4512	4884	msedge.exe	122
PID 4884 wrote to memory of 4512	4884	msedge.exe	122
PID 4884 wrote to memory of 2928	4884	msedge.exe	123
PID 4884 wrote to memory of 2928	4884	msedge.exe	123
PID 4884 wrote to memory of 3296	4884	msedge.exe	124
PID 4884 wrote to memory of 3296	4884	msedge.exe	124
PID 4884 wrote to memory of 4684	4884	msedge.exe	125
PID 4884 wrote to memory of 3496	4884	msedge.exe	126
PID 4884 wrote to memory of 3496	4884	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.gle/Bgyupdhdh65bqC7q8
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe5debc188,0x7ffe5debc194,0x7ffe5debc1a0
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,4215435798196870556,9493951336784615352,262144 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=2380 /prefetch:2
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,10504117948436331593,12179134995526928668,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,8561634333682846856,3944902127891318099,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3436,i,12463035579680254875,8821860171640893463,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,17193349811243887633,6885130740472162196,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4920,i,2790771086375432470,9198833769159643164,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,13721471817215616982,12414967359170142939,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,17743725762183009385,12566517880101782940,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7648869032877269318,9330727882181743986,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,7648869032877269318,9330727882181743986,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6088,i,8614456693006843047,3688530917470312312,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,9405767208091530582,961362949190655719,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Modifies registry class
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,14792128813339117506,3801808414731664661,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5148743490674888431,13115880603299974025,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,12112296736148297301,13601338807096516013,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,12168588566723012319,7709363447151550583,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=3680,i,14348955437221318090,8475128268631156035,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6180,i,14422175557953546655,5679079280229430016,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6576,i,5204547124138135910,1465200123537616598,2097152 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,13617214417119874303,3442347655943357322,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,5439229728737047788,5803409277464428617,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=1204 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5960,i,17970523515937014791,12483713287762885777,262144 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,4187997046508641622,8012401929974807661,524288 --field-trial-handle=2384,i,15430608662130093294,11972113474782817324,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3496

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

01d206b9-0eab-4721-bfdc-66e55c7f074c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\01d206b9-0eab-4721-bfdc-66e55c7f074c.tmp
Size 32KB
SHA256 d31990a39b2184098ef854c3e326c244b5fff0df8547cbbe3431009ee0bff07e
MD5 38cc00169506c2a6f6b8b5adaeae99ae
SHA1 9adcf9eafcaa0715e02272c03adde31cc31b0ac0
SHA512 3a7b0845fe9c2d8b60ebebf410d56719be949d8d9e9ec447125a44b758f89cfaedcdb93cbf5d58cfadca467d2271d65e38d98f5dba0c3d0d36e25a7988e02925
SSDEEP 384:nwKiFzQkUSv2+3sNd8TUNTUlI4FaKMlWxP2w2fiBCdvsDmfvaTZccHRgL/7IzXIU:iFdd3gwg3adxBCdcmfvaTZccHJLL
TLSH
T1DAE291F598D79977D9DE4B93A33E2D029ABCC153B5885A84B7C80C1CCC861BFD30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47913dbf-83e9-4c8b-9116-c9a3f99a37d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\47913dbf-83e9-4c8b-9116-c9a3f99a37d1.tmp
Size 392B
SHA256 aeb135d2c33ededddc7d5230828f53834ebcd98d8ff7e8608a8732d98e78db5f
MD5 5928b809a0c345e7338aae19bc8dc2a2
SHA1 58333bbb1f3a313f177907d31b6c9db764636e6d
SHA512 fab1d81f9f363d63197172a49f0a830c044452c9b2f9c6abdb9c4c6d345247199c00a5d928adf8e511e32307581ba33b89aea70af548a4add80c457a9d5c7623
MD5 SHA1 SHA512

Submit Download

5d46648f-93ef-4cd0-805e-16fabf0c6830.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5d46648f-93ef-4cd0-805e-16fabf0c6830.tmp
Size 26KB
SHA256 9cc18a29d41cd40463623bf5d58231000f71557eed0e09c6b5f8b3231fa52851
MD5 f20984538f136e453137d26022c47d5b
SHA1 154ee9e1cbcc648699207097e15749b8be5c110f
SHA512 42dd101178332fbb184bd6207b5a6ffa037871008b26017ea991a4e7e35a1b72a729cbc5b44c42ed81ab92d1b85315dc2d4d82c2b3fe79d64c6838ba537fdd76
SSDEEP 384:nwPiFzQkUSvs3sNd8TUNTUlI4FaKMVdxP2w2fiBCdvscifvaTZccHRgL/7IzXIIL:pFds3gwg3ldxBCdBifvaTZccHJLL
TLSH
T197C24A36ECA8DABBEDE64AD1A34A3603DEE04163D99C5AD4D5CD5C6C00DB1DD130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

862a0cfe-cb59-44a5-a43f-0b37fb8d6e2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\862a0cfe-cb59-44a5-a43f-0b37fb8d6e2f.tmp
Size 26KB
SHA256 b3a772c2eef4734b80c3463cb211b3330b8d29f356aa15ec20649873eb14bba0
MD5 8d514d9e447ac1c22e77df1186b28ee8
SHA1 b025d4e67212d5efd1658a4bb9d8dd6a53a84888
SHA512 9581f36c300b8f7cbf88cc0f4ddaa115d23da9dd3b28a46136b7e6ec28a459c5eb96f773f7542cf8bc039b7a744bffcb721e088f410fa246363898308948253f
SSDEEP 384:nPPiFzQkUSvs3sNd8TUNTUlI4FaKMnfxuw2fiBCdvscifvaTZccHRgL/7IzXIIlN:CFds3gwg3trBCdBifvaTZccHJLL
TLSH
T1C2C24A32ECA8DABBEDE64AD1A74A3603DEE04163C99C5AD4D5CD5C6C00DB1DD530BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3c1c88a1dc8e5439a1a520e9db930955bf4755654f664147c54e6cba8b43ed4c
MD5 22184503a294aa98846d9a4c3975971b
SHA1 44809070563819cceeff10eeef861544783faf98
SHA512 5d29c381872b72159a2d05366e0578c0ad56eb5ef51240db505660b787e0b3b88212c74bad2c16783f95846d95fdad86172cdc01a84d34426cca804e937a679d
TLSH
T1F4D02B24B2AC7654E01A343C0114428C30CE5970140BB400805413940FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2f67a665126f0d437497b394b50cc87ce72773b6abd85385bb78adf0ad326302
MD5 a98f4348736e1c7c5e70799864c15774
SHA1 fa2e3725e970aab935f77d155b649177f50be7d6
SHA512 c1dd68c743d45af6f713c7d8fade4a675abe4d224e86b956c5aaf959ccda0a92b9824b0e784a0ee9992843bfc2a7a73f85267479d6e5ffa0aa5827760492419d
TLSH
T19ED02B20B6A87654E006343C0114428C31CE5570140BB400809413A40FC261201C4069
MD5 SHA1 SHA512 TLSH

Submit Download

107a6657-0359-457f-8687-1341eef10ad4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\107a6657-0359-457f-8687-1341eef10ad4.tmp
Size 414B
SHA256 04759b4a7e41915bbd3e4a7e185c81b9077d52f958bc3391193c0e1a3399d563
MD5 b19125e7b1a79cc7d6480f189e84963d
SHA1 f99781f72bd69857eecef98f215794a6fdf1355d
SHA512 aa6775130b3dd0436a0b10bca90077c1c9a0315f5c7e1667127168ff8470db5b034eadef88c8dd670e2e686a16ddde5a504a7da1b66ffc1eef2a5fd2c00af8fa
TLSH
T142E02BAAC911EC7B18FD0B7C50550689E74023672A409C4F3B3D85188FB457646968AC
MD5 SHA1 SHA512 TLSH

Submit Download

1cc1199f-9537-423b-84ef-c85b591162ac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1cc1199f-9537-423b-84ef-c85b591162ac.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

8253ed3e-a452-414b-b879-581091c766c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8253ed3e-a452-414b-b879-581091c766c4.tmp
Size 12KB
SHA256 02329a4171cbf5d707e9eb452d6bedf34764ea08921353ae012bf94a0b4eaa38
MD5 e0750e427a9f4642f892d46dce4d3e48
SHA1 fb80c44249b9432535727032d9974b3849f6e386
SHA512 4f6023e62618bcde707ba5e62e4535e98da03c3a160665665e2011fe2484012b2bde37a4c2dae1be7dbe15b5285acc3672fff1b2d77e6df26e2f3321e8805b3c
SSDEEP 192:sxZXRikr/fEsWaQZL98xzodpawXFHW6+WNfPE/YoeZdSnNIgjtJJ:sxZXzr/fEsvOe6BHbU/uSRjtz
TLSH
T1BA42E916AD28A97B8CC7D209FB15BF53D3F9503294D51E48AAFC8A1C15EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c165bb0-3eea-47d2-9f1c-4e8feb1d4a47.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c165bb0-3eea-47d2-9f1c-4e8feb1d4a47.tmp
Size 12KB
SHA256 00eb07c9928b451d0c5da9f8d7b85a7877b4b5bd6873ab7fbee8e5ba7e1fd569
MD5 c5b6a293db75da8d41ea60fa7ce7d4ca
SHA1 8d59c9a4b7e239ddee29344e3e2b8fd6571a40a8
SHA512 1c60f2875917ab3c4e92d7c05ed52050f2d75ac5be4e2ad40ac1503786d662d5785e1e92a7982e6dcee71678fe2550bdbe483bec111be572668e3a37b09576e5
SSDEEP 192:sxZXRikr/fEs2aQZL98xzodpriwXbHW6+WNe/3ncKfYoVZdSnNIg5ZtJJ:sxZXzr/fEsPO26bHbSvfHSRntz
TLSH
T1B152E7166D38697B8CCBD219FA15BF53E3F9503290D51E48AAFC8A1C15EB6DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

90115cca-f0f8-4ef8-9594-2a2d24c0acf2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\90115cca-f0f8-4ef8-9594-2a2d24c0acf2.tmp
Size 13KB
SHA256 8ac237e8ba5636c1d610e315cf71d359c4cdaa96342341bebedfba07c563bd41
MD5 bf33e2e303bd0944e6a021ab9657e70e
SHA1 6021f446e84c8591228ac4161ddaec43ed8cbcfb
SHA512 58bd3a8683b99188a9b8a6cede3e282af48ed03522d9760037d61631d07a8c2150d2e02ca759dcdb0a732bb00af79346b47b1e2604eb53e7cee03fb9352343aa
SSDEEP 192:sxZXRikr/fEs8QZLR8xzodpriwzi8HW6+WNe/HvHisK6gg9YoBZdSnNIg5ZtJJ:sxZXzr/fEs8O66XHbSPCE9rSRntz
TLSH
T1E052FA526D3469BB8CDBD219F605BF52E3F9603290D51E48AAFC8E1C15E7BDD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e0aa900-1304-4b3f-b6bb-c0c978707fd8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e0aa900-1304-4b3f-b6bb-c0c978707fd8.tmp
Size 13KB
SHA256 87f205275caa8cc6f32c10a09ea4661c488333313725a86fce50b01b4b193c0f
MD5 2a844f7b5a4988aaaba5253834bc671d
SHA1 89b782473629e81b6578081a5b58c557d3e504a9
SHA512 81569bb6e7fc6c63e14f2d17aaad71a9cd2a71253cc9d425fa8131d9fd4c5c5b0a6431d79667204948de94fccb279a46328d9d7641b4c21fae54c73f13e899aa
SSDEEP 192:sxZDRikr/fEsKQZLp8xzodprCsbziLHW6+WNe/zYisK6gg9YoBZdSnNIg5ZtJJ:sxZDzr/fEsKO66JgHbSjE9rSRntz
TLSH
T17952E956693469BB8CDBD219F605BF52E3F9603250D50E48BAFC8E1C15E7BED220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 46ce1e7e01c8f00cbe49713d5383831d2b99fde71546656bb6adc2ef63d034aa
MD5 9560f0f0f55fd70c23078506b7d0842b
SHA1 c9564c63636a3465867b306e05877a6dc6a1414e
SHA512 81e1a739bbea04aba15204e8c5198f1aa9951cb64a3cbfa4df5051631bf89a8511b76ed65b498f3a3232c316efc6bfe08875c68de4aa7ddbbe3b628cd3a2ac90
TLSH
T143E026C504CBC22FB25865DB017C930C8382365A92C0AA0E5700E68C770F8A8A396690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3065461703e9966f88d4fa3a2ecd359aae2603dde1ae3962bca2de195c525734
MD5 a0db0964b2cbeee993a43c4942385dc9
SHA1 7355351a9d193b8b220efc902ce596dc5c9e386c
SHA512 d858049e7b1f7eb72edd66b1822a633fd80cf942d49cbfbc6baa4b9c509fbe25e35af10d6630fb01b8ab64c0e83d5855b9c8240e5e3f6d2a1fe4d585def4a31f
TLSH
T1CFE026C404DAC22FA289A4C702BC770C8782365AD3C06E4E1704C98EB24B448A7C76D0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000057

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000057
Size 39KB
SHA256 8462fd26e8c981d2b6768418248346c2788fa677003dea58473def4429c0876b
MD5 f30f608e7592659250dd5afcaddd3869
SHA1 4227480ca8eaae984cdd1b0131b715ef96b82786
SHA512 b87e378173f050a898f34ebcd051bbee89a233319939800d735c762614745ea2e41e9932f7d2123a26c6e9b02fc8ac17a03c24b9e8b35272e49afefde65a28c9
SSDEEP 768:bfUi4xw1uroLOBDOGAN0WWQLZJ+cZ0H3FzoHgNnzZfAAIozD7uD:bfUiu4urckOGWWwL+cZE6gNnNoK0
TLSH
T1C603F1E380221E9E395F597CD352F2971F47EEEE44468B480E727FDA22527809E82487
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 76KB
SHA256 d0dcbcb2c005124340925417c375200b19690a0de9abf247cb5443f1f9f2715c
MD5 d1878fb0c17c21cee5fd8d9a3c3f352a
SHA1 9e84b99a09af4b36a017945915a34939c3845fb3
SHA512 8c2b311e17c43df412585870d2fc2f8f1fe985fc20a29e2a02445e8a218fdc200ea031fac1c166d5ae04f88642419ac2abc5b2c19a7b02b28f90339b2a960930
SSDEEP 1536:wwE7bedTOKqryXPbovUHA0Fe0Avodg/2e9XflWSaOvtAmM:qbKOLryXTzHx40UA1e1lj5SmM
TLSH
T105731205E9E54BB49048895BE2F0B805178B0357F54BDA939456F43FC8EF32A3A7C839
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 aa50b3272a3477b5a5b02a8d484270b9a6593e4df76d103cdfe2a82f4994d818
MD5 0b14d2a3085f574c883b5e353ca5b576
SHA1 fb886e25ab99081871f4f7cbb9099c3ed3e83ca7
SHA512 b77aa296eb797e8a852d61de7926bc4391fc54b7ee70a4d5db8d29526ee7303a6a315ce0c05a0fee2a3117dd025c0069954ed276276444d72dbb921252296f87
TLSH
T11F81A7A05890B4EDF7A8A07AB1E81AAE753407CF0787AC515292F8799473F783D1DCC5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 48bd6e24e4e1306e851875358f4aba13e07a92d57346d406ce0d40f697deabfc
MD5 658a468ebc957ce122a24eb7be685ed4
SHA1 758481f81dbc7a2bdda2a200b817790501a69959
SHA512 7abf3f9a0178cd5d967ea837029470804b71b81ea4b0421f49691a984862ae1fee3d682f8065d2e031aa7ed3a04863ebd6fac0b63983a527c9cee0235799e40c
TLSH
T1DA612DA05D50B0E9F7A8907AA6E916AF3A3857CB17873C5113D2F4799877F706C0DC90
MD5 SHA1 SHA512 TLSH

Submit Download

92d7c01d-2684-48d5-9fda-6bd37d42bbf4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\92d7c01d-2684-48d5-9fda-6bd37d42bbf4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

04214426-d952-4fc0-91f8-442f3f389889.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\04214426-d952-4fc0-91f8-442f3f389889.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

1e631e83-0fd7-4657-ab76-0a5330d2e79f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1e631e83-0fd7-4657-ab76-0a5330d2e79f.tmp
Size 8KB
SHA256 d14c513844a018c647f54b24a0cb01c4162cc1aec2e9c66128d2e2ff961353d0
MD5 b5649b08155aa80dc9eecfd8206793de
SHA1 fe476a71c016cf919865778e7bd826b28722fc6c
SHA512 3561453d529b84882d1d817d4719029529afc57d8c40ae3e20e5365ab81672694e8a258bfadef59a9445de94c54dd21258eb0496e73b386d806bf1ad1ce808df
SSDEEP 192:D1eG+soqSjyBD77D75Y6D29aa4FgczG4sAwRbd11+mfeVPzr6SbR:D1eG+soqSjyBbZjC9aa4FrzG4sAwRbdK
TLSH
T17D02ACF7C3D8812DC81156F49B15AF1FCF2D1A18432C3D6A88D8AE1B93E2871E25565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4828a18b-08f6-48a9-be08-11f4ddb5d6a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4828a18b-08f6-48a9-be08-11f4ddb5d6a5.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 16912b5eaf1cbe57f313db057f31c0458178ba79466ed9210bc82175b77eb992
MD5 1b0e143e936a6b22ffc407290a7e3552
SHA1 aaf247081fb8ccf2079d5b927b7013a4a82721c1
SHA512 67c85e915413eedb019ea0f96d656336b21123aee0c1e14327aaea846c9384a130b7d3f9d85d35a8be2e49186602aa3839a8d2ffd983bb1f8eed0d18958870cd
SSDEEP 192:ST/2dXOJhJlpfnpp3tNXVrN38rFnnwVZ/m:SL29ObJffppdNlrt8ZnnwVZ/m
TLSH
T145B2325571BB421039FE290891B5872E068231B33159E67B7FBD40B68E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c241fdbd-3722-49ab-8027-253b2d20c876.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c241fdbd-3722-49ab-8027-253b2d20c876.tmp
Size 27KB
SHA256 b889e5382c9e415bcf4e5e68d2959c49597a0b5dcecea8a5067e3c14924f16f9
MD5 355b4edfda2a0287b0e92e6bb13bfc45
SHA1 654be442ee8176e74f3cbcc353b26ad58f0793b3
SHA512 d5ac6b4b1c43a1693926a1f4b0344b0e9c9c7b4f201b20fbb4e5c9a919e780eab5d79897f6e3aca7afe239b52cbfa08377837a95a157097e70915d91fefeb0cb
SSDEEP 768:Px6r8j+WviyUK8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXpLlvVajYroorbgnov:Px6r8j+WviyUKu1jaqpLd4jjovgK
TLSH
T1D4C2E93B640CCB7E4FC41E9DDC1A6F972D9802C796588D408BFA954C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8d71cf7af8edf5da2e6eaa9118dcbfca8a097b857f52769847aeaa4e7354ba5d
MD5 69a5ebdf785ba7f2ab8f5e3467b95b06
SHA1 1f1ff8244d5e0e8c72ba0d32fcff6a669edfd9bf
SHA512 d0c86211549682a8ead74d2c391027806f7512f70f2fc14ede24586a805a9ced8516a2443c4c78cb2364e813e0bdbc23d8d1da734f90c9a020f539cea95362dd
MD5 SHA1 SHA512

Submit Download

a571a66c-aaf1-4b8b-9ad0-6d777280cfc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a571a66c-aaf1-4b8b-9ad0-6d777280cfc3.tmp
Size 25KB
SHA256 6cb2c2c8bd85821f21a35eaa17d875f2890ec0c7e6eaf5a8edfc5a52c3086d66
MD5 54bda9675952b717736a134bc745a217
SHA1 099d1db2c655a069e33c10d989c100b5e5dd23cc
SHA512 165fbda76a6def68ccc204674f8bef9ed5481869a087fd4aaeed10596e848f85de409c9db71454448d779d57bd7d632d6be459a8ef4699199c25f3c15b166d02
SSDEEP 384:nXiFiZcI63sNp8TUNTUlIm2aKMi64w2fiBCdv4FC7O6R2Feo2gL/7Izjoi:SFQ630wgc1nBCd4FC7TRvR
TLSH
T14FC24B36ECA8DABBEDFA4FDAA74A3A03DEE40163959C5AC4D5D80D1D009759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eaddae0f-d28d-4181-a7c3-b71a7697e9e1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eaddae0f-d28d-4181-a7c3-b71a7697e9e1.tmp
Size 392B
SHA256 be25992ae32a102aec2da2b9adcfaebaf87b45b643a82251ef874d19826ce057
MD5 006fd8dad9b8fd643c60242b06b0c302
SHA1 949792be3f68b3e8f09cc0a83f2a20e79bc57364
SHA512 8d7b8c9d7c7fd5825aeef8771435dafc30f19139af182214fb2dd790e52620e409e9a9e37ca899c6bbb03f6a1441e2ddf51ddfec69d7ca7ccfe5c8ce0131d01b
MD5 SHA1 SHA512

Submit Download

ed7f901d-a2fe-40e5-975d-70682bebb7b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ed7f901d-a2fe-40e5-975d-70682bebb7b8.tmp
Size 26KB
SHA256 4c68918d51c3500104a4b4843f82f1cfec11c81f2349833456f40d6d48891c6e
MD5 5e4eb30c3f53d9d74b51db1e7d49a241
SHA1 89b3cc31802d4b8d024406cf3b6c14a22d565344
SHA512 c309b2fca9111c32775b8f67d0bd2db492e4eb5e7cfabf9a60918d42dd5d8050c98cf2af6fab809b5d37ab53fdf998236965d75dd67ee72701603c5d3c8898c5
SSDEEP 384:nNiFiZcI63sN58TUNTUlIm2aKMXipw2fiBCdvsEif7O6R2Feo2gL/7Izjoi:EFQ63wwgcIuBCdfif7TRvR
TLSH
T1B4C24B32ECA8DABBEDEA4BD5A74A3603DEE44163958C9AC0D5DC1D1D00DB59D430BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 772b1ada90236d6e5fa6a6ed0d47f09bd2c35e9a49a68ce480b9bc34e7f327d2
MD5 a212dcfe0c627559b6aa8d7ef6e22b35
SHA1 fd94fba9bbbec3162cc687918ae059111cb3da5d
SHA512 829d16126075f73c2b2613cf766e5a0abad24b12beccf17e1f118e89e7971e175b9b105bf505acf202c49cff6ba4e4ebb512d49e7003f170a3d1bad842e7854c
TLSH
T16041055CB6F91048B3B77F5AABF6A8AD487AB9772F07D05D10010E4F4A62A40C861B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/864-236-0x000001BAE7540000-0x000001BAE8540000-memory.dmp

Download