hxxp://hexane[.]cc

Analysis

user interaction
yes
max time kernel
148s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/10/2026, 16:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://hexane.cc
Sample261029-ts67hsbf63

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
960	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-939655444-3071939294-1401108526-1000\{34B0F250-F7EF-4C39-8301-B7F670936C4C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 5008	4196	msedge.exe	86
PID 4196 wrote to memory of 2436	4196	msedge.exe	88
PID 4196 wrote to memory of 960	4196	msedge.exe	87
PID 4196 wrote to memory of 2436	4196	msedge.exe	88
PID 4196 wrote to memory of 2436	4196	msedge.exe	88
PID 4196 wrote to memory of 4520	4196	msedge.exe	90
PID 4196 wrote to memory of 4520	4196	msedge.exe	90
PID 4196 wrote to memory of 416	4196	msedge.exe	91
PID 4196 wrote to memory of 416	4196	msedge.exe	91
PID 4196 wrote to memory of 416	4196	msedge.exe	91
PID 4196 wrote to memory of 3532	4196	msedge.exe	92
PID 4196 wrote to memory of 3532	4196	msedge.exe	92
PID 4196 wrote to memory of 3532	4196	msedge.exe	92
PID 4196 wrote to memory of 4124	4196	msedge.exe	93
PID 4196 wrote to memory of 2848	4196	msedge.exe	94
PID 4196 wrote to memory of 4124	4196	msedge.exe	93
PID 4196 wrote to memory of 4124	4196	msedge.exe	93
PID 4196 wrote to memory of 2848	4196	msedge.exe	94
PID 4196 wrote to memory of 2848	4196	msedge.exe	94
PID 4196 wrote to memory of 2928	4196	msedge.exe	97
PID 4196 wrote to memory of 2928	4196	msedge.exe	97
PID 4196 wrote to memory of 2928	4196	msedge.exe	97
PID 4196 wrote to memory of 2344	4196	msedge.exe	99
PID 4196 wrote to memory of 2344	4196	msedge.exe	99
PID 4196 wrote to memory of 2344	4196	msedge.exe	99
PID 4196 wrote to memory of 2140	4196	msedge.exe	100
PID 4196 wrote to memory of 2140	4196	msedge.exe	100
PID 4196 wrote to memory of 2140	4196	msedge.exe	100
PID 4196 wrote to memory of 4296	4196	msedge.exe	101
PID 4196 wrote to memory of 4716	4196	msedge.exe	102
PID 4196 wrote to memory of 4296	4196	msedge.exe	101
PID 4196 wrote to memory of 4716	4196	msedge.exe	102
PID 4196 wrote to memory of 4460	4196	msedge.exe	106
PID 4196 wrote to memory of 4700	4196	msedge.exe	113
PID 4196 wrote to memory of 4608	4196	msedge.exe	114
PID 4196 wrote to memory of 416	4196	msedge.exe	115
PID 4196 wrote to memory of 1072	4196	msedge.exe	117
PID 4196 wrote to memory of 1072	4196	msedge.exe	117
PID 4196 wrote to memory of 1072	4196	msedge.exe	117
PID 4196 wrote to memory of 1408	4196	msedge.exe	118
PID 4196 wrote to memory of 1408	4196	msedge.exe	118
PID 4196 wrote to memory of 1408	4196	msedge.exe	118
PID 4196 wrote to memory of 4608	4196	msedge.exe	119
PID 4196 wrote to memory of 4608	4196	msedge.exe	119
PID 4196 wrote to memory of 1924	4196	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://hexane.cc
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ff9ac74c188,0x7ff9ac74c194,0x7ff9ac74c1a0
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,16506929274574332690,16620463344776358548,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12856667341276500561,5310356346525491789,262144 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,10954899145393710566,2493221434715702035,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3488,i,2737143038450200001,17949948484601752334,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3492,i,10982001236970760960,2014131379197956428,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,9459918543940041337,17890618082148572947,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4224,i,5777416516395626251,15391600059862843492,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:2
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3688,i,7585422063457637141,3812991301711444916,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5300,i,15795719734264977686,1233735204900776906,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3700,i,15720496915034888133,2540759400922656868,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,10365024247739249497,16274709020675267375,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,6652351291775429977,16130690948982098235,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7313504663365787685,12793969959240239826,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,7313504663365787685,12793969959240239826,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,4279926000343988481,1003934499882469247,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,6526422530275714038,17650895127286882465,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,5011584941324462500,18437391275325850947,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2076,i,10403674984351943060,16598639399529581301,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5596,i,44442627884188883,14633753089606310133,2097152 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,15840199281544787539,17876805874841291125,524288 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5908,i,14359311437462917689,13280961240272447076,262144 --field-trial-handle=2272,i,3368102480929896973,14227445455782684483,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1924

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0705f3dd-35ab-4bf0-a9ce-84d82c9f603f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0705f3dd-35ab-4bf0-a9ce-84d82c9f603f.tmp
Size 18KB
SHA256 ab13d697eee8865139bf5da96b7eeb41a7eb5a405da27079bcf12f3df9f57cdb
MD5 c5417ba963b745925bba9ad7e75dfb60
SHA1 1996f478ca217b8bfef17c97cd4f6ff4778be963
SHA512 cc08172c1f0b86d91405516c9db397593d13438095a8cddbb0099e0312f6255f1a294949f5ff3928bcb6bfb9cc3e10d169db53f9999cb414eb6f8071d611f440
SSDEEP 384:3QkUSv0sNffqLjxS1UiQNzIGmsDuCHiPvaTZcYCIIlH:J0ZjxSeNxvDuqiPvaTZc3LB
TLSH
T1AF826C32A8786C279EA3A514F58B3A13DEB1D217D6C41F94D5DD9B1C04DB29C234F922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2b210b8e-4f70-47e5-b1e9-bcaf4eb45d28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2b210b8e-4f70-47e5-b1e9-bcaf4eb45d28.tmp
Size 8KB
SHA256 182f40dddea92d1baea910efded0207a0c799dac8edd6b822f508450028ddf9c
MD5 fb2ebd5561dab3e4e3d0a0feb99e202a
SHA1 85bcfbf7b4eea94ee434f96ce22d65957952d03e
SHA512 3c1921f3d35354991930c2ab61219f0f8ed5476df13ea38f7ad4847ba573f9a4c48b4984cf3853f13559e3098640393e4c08434a2256f825aacdf211231c4ca4
SSDEEP 96:3qONkKQsjpfe/tyng7X5ih/cIPURHl8h4otop5bYDpNBnP9ZvEI0IG2jbQER0qqe:aON+6IE7QmiUyipTPuIGmsD3C7sTOU6
TLSH
T16702EA39AC787CABDFF3BD08F4876A239EA5112BA6952F84D9D85B1D00D725C1307923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

41f0129e-98f8-4eea-b23a-4f1c4c7721bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\41f0129e-98f8-4eea-b23a-4f1c4c7721bb.tmp
Size 392B
SHA256 4b75f6ed5631bc777122c87db2f5a21fd0d0af3a67b27bee91da59861e842e37
MD5 32f607592e11381680803b278e5418fb
SHA1 2683e299bb3f900890888c44f332c80819346e32
SHA512 8ab36590873a82293e53fd691da5e784251fd4fe9bb73aaaa43554e33fbf6b41dba387c15fda1938d313b2b0d6654813c71484852105e630a7080c1edbae0c5a
TLSH
T1E4E00103E30552BEC139023100831F31AAA7813002A211161E2446A83C223102FA0ED1
MD5 SHA1 SHA512 TLSH

Submit Download

4fa8917b-94f1-44f2-a24c-75c78d902d2f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4fa8917b-94f1-44f2-a24c-75c78d902d2f.tmp
Size 392B
SHA256 719184ad8a93cf11404a4c540836cf991acf866971869a86414c1e604abf1e7f
MD5 0e41e74fa9786a02e8cc6ab878e74fd8
SHA1 30fe5a1b0f17cee13afb5ec18289c76fa9ad232a
SHA512 9e6b7dfea052ca7033381572f2cb68035a5f84efbf29218e1e2fe631cb17271b98965c210adcff3cf2e2991f76b3ca031ec1a29196cdd7e30a5d948a64d7913c
TLSH
T128E00202F305523EC139023100831F31B7F6812003A21116162446B83C123101FD0FD1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a82246f88da27a43b1718bd24e8cdfa3c17ae97a8d238e7befd5fac9a384a0a9
MD5 89669bdc21a8230bc30fb1b7dd97b74a
SHA1 2a5e6b394e76cb0c70b0bba2c18c74bbdd1a4cf6
SHA512 0c8eb5310ea11fffab4f6974f3ba27683ef8dd0cc87e73007e67d163fd017b83b6c0025e8e6b07401acc6ea67dcf75918453237e2f7dcf47044e2050973484b7
TLSH
T1C3D022F8FBE28020F0B23A3200BCC3C30008AB0820A803303C33200C2C880CAE22BE8C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e6cd13b34cf3f758c2f4e7c55e8801132cc91647c947cbafe475ce8928ff2c2f
MD5 b36cb034fe7df72fefb0bfa9340c6a6f
SHA1 8471623779cc15452b8cb60924e40c193607fe42
SHA512 6f72e14e09c254a1a7d581eaf85757baf7b4cd74f1e1978ecd80b20d91bc8f87462f9d782c3b0604a3b7c22e084b46d1afb4dd162a82905a3464ca87d8223542
TLSH
T1C6D024F477D14010F4713531007CC3C300045704105443303C33100C0C440C5D117D4C
MD5 SHA1 SHA512 TLSH

Submit Download

0a4009ba-a99e-4c71-a5b8-645f177f6c60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a4009ba-a99e-4c71-a5b8-645f177f6c60.tmp
Size 10KB
SHA256 ea39b50c4a04bb0cc6999915f3fd547f525f8d1e3fa226e0c4441c4dae78cd6a
MD5 f569de5f3e79e41851010cafd06f587d
SHA1 65faa669df76262a303147b016f1ba56d135cecc
SHA512 917df0a095aba5a802e214f1f27e6665ddace9fd1f66d4f32846c7b2b09217386bdb6ed558b4d38498e76fc662dae184e800cc4587b234a644fa82a680e61660
SSDEEP 192:sxZaRmWp/fusAxlIdp8kHW6+WNbbZ/YapGfa+lIg5/J:sxZaDp/fusAEdHbp/43
TLSH
T18322B8126E28A97BDCC7E21DBA55BF13D6F5103191D01E58A6FC861C08E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0c9ec5e3-d727-4d55-b79f-bab7f6ebeccd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c9ec5e3-d727-4d55-b79f-bab7f6ebeccd.tmp
Size 9KB
SHA256 d2c56ff8bc811537bb8ff0e313cf4cc574e3bea1a93839ac18a0c8e85132f208
MD5 e15cb914521c6ac551f1d68ae05dc4a3
SHA1 3a3355116cc8c5394e948793f1f6d9eabe804c71
SHA512 3f2f6c5e1ea6fa084deddf6ccbabf0331e2b29881094494b97ea4faca557021ab064caccd4a0aa9dc474cb4efabedf37b15e7371f9012e66e3a334442200333d
SSDEEP 192:sxZwRmWp/fusIolIdp8OHW6+WNbbZ/YapGfa+lIgrJ:sxZwDp/fusI1XHbp/49
TLSH
T16222B9126E28A97BCCC7E21DBA55BF13D6FA503291D41E58E6FC861C08E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3f1ac7fc-e596-4c0c-8c03-25dc4652c4c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f1ac7fc-e596-4c0c-8c03-25dc4652c4c5.tmp
Size 10KB
SHA256 6c13fb852cf2e95abb46fc542b3d8986c9adf20bc112b9c6dc8394271eedf05b
MD5 516df1018307db8f0abc9acd05b0dce4
SHA1 f5ea110cb4f139b21989e03c6d13b4590b808cca
SHA512 8da7637c779a7f97eeddf901803cee21efbb836ba760ec38d908b48b6fc08cf7c6b78c989b6d10ae23a1801beb83a3907bb38cc4dc4608638a6c8439a2da26b6
SSDEEP 192:sxZaRmWp/fusbxlIdpq7HW6+WNbdxdYapBfR+lIg5GEJ:sxZaDp/fusbEMHbDd2wI
TLSH
T1F622C9526E28697BDCC7E61DBA55BF13E6F6103291D01E48A6FC8A1C05E77DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

52ecc70b-784b-4a44-b4e2-26591ac66680.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\52ecc70b-784b-4a44-b4e2-26591ac66680.tmp
Size 10KB
SHA256 9d1ce09fe31a517e389bbdba9d91b6fc3eac0727deca1fc96b7b6773bc135e28
MD5 3975af65a5c01176cdc08aab2d05ba5d
SHA1 b9778d4b308965815c57886ab67e10fd47bd6c9b
SHA512 4a7ecef47c46b1710c4a620cc0caaa28462352f70c9ccccd0bf5bb415b801c1773e26d15dc074edd32743adaf3773091a419a69725062ecc1129ea83f988042d
SSDEEP 192:sxZaRmWp/fusbxlIdpqEHW6+WNbAXZYapcfR+lIg5GEJ:sxZaDp/fusbETHb8ZHwI
TLSH
T1B422B9526E28697BDCC7E21DBA55BF13E6F5503291D11E48A6FC861C04E77DE220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68537968-69f5-468c-820f-94bd66e8a6fb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68537968-69f5-468c-820f-94bd66e8a6fb.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68a75b8e-2db2-4409-83d5-c9d129796bb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\68a75b8e-2db2-4409-83d5-c9d129796bb3.tmp
Size 27KB
SHA256 97695d407017dd4c3aa6f80d2d750825b4397f8ce458ac0e4aa4df4fe7953cc4
MD5 618258b886769f9c1952091fa531bb9e
SHA1 88723765362733c05e5271b5f791b6465b50f8e3
SHA512 1e40435c747cd8d4d0c1d8dde502ace43720a627a0ac197473cde3362f1b06a9b8b80443a3c550257e49f5f38dbb2068fb9ae698947871504aeef9c7cb0e102b
SSDEEP 768:uSWPcLKWvKece8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjlLlACy7Jro4ASJmR1:uSWPcLKWvKeceu1jaClLiF7i4ASJmR1
TLSH
T1A9C2FA3F640CCB7E5FC01A9DDC5A6FA76E9802C79A548D4047FE984C02C77EA912A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6a53aa18-6e72-42dc-8bc7-ab6cc6642ae1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6a53aa18-6e72-42dc-8bc7-ab6cc6642ae1.tmp
Size 10KB
SHA256 56fde7662acbc464545599b67670a47378b6fd0545b2c0d226c119264c1814a5
MD5 0671de63a1bbeffe5d09e088ab556f04
SHA1 5f1dbef4a9fe02b9117bf3286a0c1c95f1fa3c42
SHA512 1905f38b1169e7448da2e66d81f66b19adb718d976e02819d60a37e74f7bf6d394e15371ad25d9efeaa88e7747a83fecad008bc7640c6ffdf46e9e25296e63cb
SSDEEP 192:sxZaRmWp/fusbrlIdp8RHW6+WNbbZ/YapSfe+lIg5GEJ:sxZaDp/fusbqEHbp/KwI
TLSH
T1E622C9126E28697BDCC7E20DBA55BF13E6F9503291D01E48A6FC861C05E77DE220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 24d2bfda12fcec89522b049fc885f289686b02cb97455e910d28c37a667b0c20
MD5 0e7a246e59a1514c6995bbcf92646faa
SHA1 f671cd4c7f9897974764768ba7800b02a1917d20
SHA512 e3006380530975b5fd82c95a68032cee3090b9058e726d8247dba3df0a89213985439af7b42a183506bf648371b8c156eb348833fcbea05fb8aebb9f6807a33d
TLSH
T127712CA2588156AEEFD848B249D51D83F9FD9DB449930F4255E7E47CDB4BFBC1002047
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 608edd3e3f21d4a3227d15ba64e2bf9b0d9be88c9f195be17945ae0689dc9c60
MD5 1a7d8eb6a5ba9656faabd8a695e3c656
SHA1 22063ddbf9129000bf2c03a64c01f0e328d9d3d0
SHA512 124c6db0cf38069f8abc4211602b3a655d39e164b768b583f500986aacae01edbacaaf5be66f589cb355bb72ae042f5fb67ccecf6eaa36f6019fa491b49a6e90
TLSH
T1206109B1588116AEEFE848724DE51987F9FD9DB44A970F5215E7E46CEB0BF7C004204B
MD5 SHA1 SHA512 TLSH

Submit Download

1f7bbccb-df2d-44c7-8047-ac4564fc2cdf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\1f7bbccb-df2d-44c7-8047-ac4564fc2cdf.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

068131c6-3a2d-4c28-bf4a-e9727b812cb5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\068131c6-3a2d-4c28-bf4a-e9727b812cb5.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

47c72825-c165-432a-ba3d-d4b90fd9508b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\47c72825-c165-432a-ba3d-d4b90fd9508b.tmp
Size 2KB
SHA256 6c17fe40fbba39e0f9d2bd5a7c8283bcc7dcce4e83ebcb3424fd712a89effba3
MD5 ce69d9cc9697db1e9b6cdec7789148a6
SHA1 718441d6c8acc187e90f510558d8be9632070eaf
SHA512 647e5f7b62987fd70aaa1c06a86fd7786a79129c565a2c24a4b0c38b6049b7e975b240995faeb1c8b1b6895353e432ccde7ae8513e290728343c0ac5fa7b7e24
TLSH
T1F051A2B2C7E9866D882692F09B14AE3BCE5D060853183D698AD5EF4BA3D2171E11174E
MD5 SHA1 SHA512 TLSH

Submit Download

4a134676-ceba-4625-b9df-992143626c07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a134676-ceba-4625-b9df-992143626c07.tmp
Size 2KB
SHA256 86c98545508e8e78500b9b945e3682e1d752aedca62d606bb12e31e4569c22d5
MD5 890d162f90d699e4f9ed35a428f231d3
SHA1 9d6bff982c65c7f5181840020673c674d8ae9f3d
SHA512 816a238f220d1b6557e63edc2eafa26f0bcb821cd430fc7d0b20ffa2097f1c0e60d717d36ef39d779d8f48801ef2dbe36304a89eca4220166b181bbbaaacfae3
TLSH
T1AF51B1B2C7F9866D882192F09B14EE3BCE5D060853183D798AD5EF4BA3D2171E11174E
MD5 SHA1 SHA512 TLSH

Submit Download

da7d9cfc-1399-4cdb-82b9-e2953355fa26.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\da7d9cfc-1399-4cdb-82b9-e2953355fa26.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

00000000

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\00\00000000
Size 1B
SHA256 6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d
MD5 93b885adfe0da089cdf634904fd59f71
SHA1 5ba93c9db0cff93f52b521d7420e43f6eda2784f
SHA512 b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

b462c194-5d51-4d13-842a-566b1fa9afc2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b462c194-5d51-4d13-842a-566b1fa9afc2.tmp
Size 10KB
SHA256 76b6b87a9ff48f892241ba572230f563badc17decfe38e5be73ff57e1437e7c2
MD5 d9cfddef8248442fae7da02e8709184b
SHA1 69ce01b00a9503d43eb2929e845e0ebc19ed306a
SHA512 486d0df75bfcf9dca1d3efd053481389faac37540993f9c5d68e6bc0968a60ef493504f59f734f435c0c2b2bb20bd236b2cf5e1d2e8a56f364d8c7395ab656e2
SSDEEP 192:sxZaRmWp/fusbmlIdp8zHW6+WNbBuXYapgfe+lIg5GEJ:sxZaDp/fusb3WHbkXEwI
TLSH
T1D222B9526E28697BDCC7E20DBA55BF13E6F5103291D11E58A6FC861C04E77DE220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

788562de-d762-4904-bd2f-bd32ec62fab0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\788562de-d762-4904-bd2f-bd32ec62fab0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 502e8a34a60304de03193f87bc696325286ee5d9ba7f32f029cf46eb5cd26d58
MD5 fcdc5749ec29838f3639796cb2126933
SHA1 8e8d8a1fc331f556ca471cddf8c7a185e26a2f06
SHA512 fd299c37e595563ee743eac50f3de0d3606475f2ad848189b7dd5f062134e5475f380ec331f0abd5647b1595f6852f269b3b246bb0587a23decd84630fd53a8d
MD5 SHA1 SHA512

Submit Download

b0c73c26-eb5b-4aa9-9cb0-43ae5748f657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b0c73c26-eb5b-4aa9-9cb0-43ae5748f657.tmp
Size 26KB
SHA256 4627c63be5e16d7cdaddfce5156a3929d0ff75f9a02511ca1255cfa391b1cd8a
MD5 af2f20690b8043747c41ae4ec51a2c63
SHA1 b609a1159181fa43a0b08cd0a2cafd00c8806146
SHA512 339eeaeaeb6c40cb861cebff348248a8c7255035dcef5f4f9ed6841d83124dff66f8ff4c30595a777222f304b662131fd5d46b27688356134e5ac710dd89fb55
SSDEEP 384:3iFzQkUSvDzsNB8TUNTUlIlfqLjxS1UirNzIGmsDuC9OiPvaTZcYCIIlH:yFdH0wg4jxSeqxvDuOOiPvaTZc3LB
TLSH
T181C208F258E7983ADAAE9B03A77E2D038DBDC157F5805A50B3C8551CCC9A1BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d94f1702-cd80-4c70-9f78-d93fc1a4ef69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d94f1702-cd80-4c70-9f78-d93fc1a4ef69.tmp
Size 392B
SHA256 ea9045ab1b8addb05b7b844c68add74dad41cd64e2963098f88b21407c206569
MD5 a78ba9a700fe8f0a89835204f4381ab0
SHA1 499375501bb35f4bca2bb375ccd6a238e1f484c0
SHA512 703f4a74a9f72d46b09262a70628bc1f6bebc8812b2f402c4388be9e38348410117de90dbc396a6845d2b61b75130c6c79cd290bdd29866fac7ae1dd7dc6cd7d
TLSH
T12FE00201F204416AC135033100831A30B6F1811003621215151445A43C123101BC0BD1
MD5 SHA1 SHA512 TLSH

Submit Download

dfde471d-43b5-4f35-a5cc-6513e9fedfbc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dfde471d-43b5-4f35-a5cc-6513e9fedfbc.tmp
Size 18KB
SHA256 1094de72d481e7478ffc85c4f840213471183673259569773f4d3169a8b39658
MD5 6e12b6bd3122f709db11be26fec335fb
SHA1 8127bab10ff67672256383ab07838b8fe4dd41ff
SHA512 b6eb9102569100e58e67af2990c624986039eea82a262f95f6bea495f500339ff099b043562ab9319dac013d090be2c26d89bcfb52b26990d4f9252f6c16c98c
SSDEEP 384:FQkUSv0sNfKqLjxS1UiQNzIGmsDuCHiPvaTZcYCIIlH:f0kjxSeNxvDuqiPvaTZc3LB
TLSH
T1AD826C32A8786C279EA3A510F58B3A13DEB1D217D6C41F94D5DD9B1C04DF29C234F926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e731dd93-1e69-4883-85cc-cc283417dc3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e731dd93-1e69-4883-85cc-cc283417dc3e.tmp
Size 8KB
SHA256 b5bed8b7038466026e1fb700c4a4c7c4604043b1fbf68e316cf251ee132ceee8
MD5 f1e55927df95dbffda7fbccae298b261
SHA1 d40058394f75d2e2b85c24ac935ef3a032dab3c9
SHA512 2b3401b78511bb670ea30400177af1c1370d82309517115549bf0db396ccec7db66a079177e6cf7784230c7bb3d64809b7c5832801865e98c3e7acb31ba269f0
SSDEEP 192:PONq6IElQmiUySpTPuIGmsDuCNeUT27HAqJU6:PONq6DDTPuIGmsDuC2HPU6
TLSH
T10312E936A878BC6B9EA3A954F48739239DA5521BE6C57F90D5DC261C00EF25C130B912
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b7572e0e-12bf-4727-bcb3-86a78d7fcfec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b7572e0e-12bf-4727-bcb3-86a78d7fcfec.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ebe9c2540c72377abd900881378c42b8c41529a07547e4ca75e05971cdc14309
MD5 bba00ea9a8f60e18a9d2346154df7530
SHA1 d2d2f743f60e4b342c07d5f994592663d3b0c719
SHA512 10f57d600cf3445a544167d3c3f2dadd0df640fbc2d2390d42dd2aa534d6176ec96b229a7aa7c76b6187060dca6a6d3cdd776dba74a9e0ccfe46f6e383927086
TLSH
T16C41F85CB7F901487373AE569BF6A86D487B7D772E0AD45D00010E4F4663A44CDA2737
MD5 SHA1 SHA512 TLSH

Submit Download