eec30cfef6be8caa3d9db458e0982c90ecdc1523de7cf6c97b582b41c09d0cf3

Analysis

max time kernel
898s
max time network
732s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
workstation-and-fusion.html
Size 5KB
Sample261102-de8v7aea33
SHA256 eec30cfef6be8caa3d9db458e0982c90ecdc1523de7cf6c97b582b41c09d0cf3
MD5 dfea9050c58414b25f2bdfd8b60c1ad3
SHA1 03780a8b91b9981a5c8135499c793ab32e7b67a9
SHA512 7c62f0de6f2f6043bfef9c988ab8db489bee1d4a7ea03b765f698ddd569e004a6044fc06b50e355ba2687962a87c8e01ccdbc388cd47a13890c9a1f0d8fc8c18
SSDEEP 96:zX0IuueiXuueid8owAeIYmw6ujHJlBljitKG3MLiXX:7fuueauue08FAeIYmoHJ9ItMLiXX
TLSH
T1FDB1C463FC14C85E1DB1536AB676F048CC47991EEB88AC0060E782AF61C5F984A37B0A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2464	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1404337215-1550464601-2805570857-1000\{29876366-BAF0-45A5-93D5-4C647A48A55C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3752 wrote to memory of 5388	3752	msedge.exe	88
PID 3752 wrote to memory of 5344	3752	msedge.exe	90
PID 3752 wrote to memory of 2464	3752	msedge.exe	91
PID 3752 wrote to memory of 5344	3752	msedge.exe	90
PID 3752 wrote to memory of 5344	3752	msedge.exe	90
PID 3752 wrote to memory of 712	3752	msedge.exe	92
PID 3752 wrote to memory of 5316	3752	msedge.exe	93
PID 3752 wrote to memory of 4192	3752	msedge.exe	94
PID 3752 wrote to memory of 712	3752	msedge.exe	92
PID 3752 wrote to memory of 5316	3752	msedge.exe	93
PID 3752 wrote to memory of 5316	3752	msedge.exe	93
PID 3752 wrote to memory of 4192	3752	msedge.exe	94
PID 3752 wrote to memory of 4192	3752	msedge.exe	94
PID 3752 wrote to memory of 3528	3752	msedge.exe	95
PID 3752 wrote to memory of 5704	3752	msedge.exe	96
PID 3752 wrote to memory of 3528	3752	msedge.exe	95
PID 3752 wrote to memory of 3528	3752	msedge.exe	95
PID 3752 wrote to memory of 5704	3752	msedge.exe	96
PID 3752 wrote to memory of 5704	3752	msedge.exe	96
PID 3752 wrote to memory of 1604	3752	msedge.exe	99
PID 3752 wrote to memory of 3740	3752	msedge.exe	100
PID 3752 wrote to memory of 1604	3752	msedge.exe	99
PID 3752 wrote to memory of 3740	3752	msedge.exe	100
PID 3752 wrote to memory of 2244	3752	msedge.exe	102
PID 3752 wrote to memory of 5640	3752	msedge.exe	106
PID 3752 wrote to memory of 2880	3752	msedge.exe	107
PID 3752 wrote to memory of 5588	3752	msedge.exe	108
PID 3752 wrote to memory of 4444	3752	msedge.exe	109
PID 3752 wrote to memory of 4444	3752	msedge.exe	109
PID 3752 wrote to memory of 3352	3752	msedge.exe	110
PID 3752 wrote to memory of 3352	3752	msedge.exe	110
PID 3752 wrote to memory of 2340	3752	msedge.exe	112
PID 3752 wrote to memory of 3448	3752	msedge.exe	113
PID 3752 wrote to memory of 3448	3752	msedge.exe	113
PID 3752 wrote to memory of 2772	3752	msedge.exe	114
PID 3752 wrote to memory of 2772	3752	msedge.exe	114
PID 3752 wrote to memory of 1060	3752	msedge.exe	115
PID 3752 wrote to memory of 1060	3752	msedge.exe	115
PID 3752 wrote to memory of 4392	3752	msedge.exe	116
PID 3752 wrote to memory of 4392	3752	msedge.exe	116
PID 3752 wrote to memory of 5848	3752	msedge.exe	118
PID 3752 wrote to memory of 5848	3752	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\workstation-and-fusion.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe8f65c188,0x7ffe8f65c194,0x7ffe8f65c1a0
  2⤵
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1828,i,6486905266230632521,2444410555537313301,262144 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2200,i,18416051726114833350,6433350057663889331,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,5792642055308613042,7222418525231889929,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:13
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,11030849126346816739,4647590869903280020,2097152 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3376,i,16332784925776415738,14548460130565061004,2097152 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2593664912697656452,5725719287119311890,2097152 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,1893799158228811686,16868169586176790225,2097152 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=4796 /prefetch:9
  2⤵
  PID:5704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,10291163964836942575,2960217305396311506,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,8358220254455930854,7247575335628563608,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,13375763587419933362,16057651395968122987,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,13375763587419933362,16057651395968122987,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:14
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1388,i,5863492983616135203,7870983223178425091,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:5640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1396,i,16921108979243005020,52590759227401133,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:14
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1404,i,11698785842743403224,10604547025142287659,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=4976 /prefetch:14
  2⤵
  PID:5588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,7237209724452023122,4138738430677380339,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:14
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,2710738082384601089,6115153680384061125,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6220,i,2276840525751790880,14668252076140547790,262144 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,3464236324621520480,13279848435576543069,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,13626519262288194416,6808586670174078584,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,9922120429898049645,7161495644774173819,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:14
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,1608317360873801232,8641915635507511986,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,3792999057095126891,17494467476683930347,524288 --field-trial-handle=3048,i,18169896730941498840,13810132271277657310,262144 --variations-seed-version --mojo-platform-channel-handle=1292 /prefetch:14
  2⤵
  PID:5848

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4456

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:964

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4792

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12a57088-de9f-4e37-8443-b3f5058f0a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\12a57088-de9f-4e37-8443-b3f5058f0a2b.tmp
Size 38KB
SHA256 413051eadc125972ca8ca6098b1c6a53906f22ff2010904c3a07b5a133c1b2bb
MD5 4ad7830ecb53d1181b696c6090c72d8c
SHA1 8b83a6333e359a0ec1163db6aa0a9f519efbfa58
SHA512 7429a67a39b3e8f693ff0a4e91649deffa918d73c70dc17f8e880b44a3596d944921ccd3bb35d3bf8988f5ed28a145b577b3550997aa77387a2deec2a2cd5afb
SSDEEP 768:p/UxvxjgC+W3wCSc7fZrKREb1tYp5XSwQs88uBkiTzz/P84g:cZj3+W3wYtrZmILNBxHg
TLSH
T16603C039E8945873BCB393813A5B274BAFF06153C4C41AA44DEE6A0E038B75D634B897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a1dfe56-7b7c-4552-8de4-dea3c36cfa66.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1a1dfe56-7b7c-4552-8de4-dea3c36cfa66.tmp
Size 33KB
SHA256 d9b108cffbee01009f5891095e7a064c5a6bd3d4cb9749147b119961c316b337
MD5 d300926fca6afc3391df165f5c217a76
SHA1 fa14f692582784d7a9b4a065936feb2a124b6ef9
SHA512 fff4c112cdf553aa589613a26a2428cb1bb920afa768d9fff26de105b1059a693208086c80128081a8187af1a1e6b3908f102f67e8dbff6a9bb6f62b42769574
SSDEEP 768:1C3XyO3oc7fZrKREb1t3p5XSwQs88uBkiT2zE75EyL5:1C3iOLtrZpILNB2kB1
TLSH
T11CF2AE35FC945863ACB39342B65A3707AFF0A147C4C80784D9DE661E02CB75E678B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5bf85a87-6aa4-4a04-80b0-54b9160f19e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5bf85a87-6aa4-4a04-80b0-54b9160f19e4.tmp
Size 36KB
SHA256 c56b5c17f580798dae9a84d07d0213af9d545b61f3e35c4b19fc1c25a45ad2c3
MD5 c19ad31936515b5113d1f29e81100785
SHA1 3e44dcab0b1ede12951b74dbaa3ed15d2b7be12d
SHA512 23c5fc0b011cb866eb48d6aefae8b13081b54abbf3b719b743a587a04a06378756912ed396c1ce367980ba60d4650f512438fa1ccbaca253501227e732ef39c8
SSDEEP 768:XFdX3wwgVyO3oc7fZrKREb1tR8p5XSwQs88uBkiT2zE75EyL5:nX3DOLtrZBCILNB2kB1
TLSH
T132F2BF36EC848977BDB39B81F65A3707AFF09187C8D40794DACEA51D018B29D238BC56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8635616c-f713-4e77-800a-82de0f930a27.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8635616c-f713-4e77-800a-82de0f930a27.tmp
Size 37KB
SHA256 04c1aad99779b2d416b1cae9e7880a5af3e10d3ffbc45de0a45dd25205bd9beb
MD5 999fa017d82d2bc57bc49477055b9670
SHA1 91c62c5e6a510ad7f689003e3f31f718eb1636a0
SHA512 fc59c5d783371c456401e3d356e018168129caa0dab2100571aa9930b15bda0f9c3c936610a8e8f6722b53229bc0856ae01173c38b0e6d4888af79ca7328bf90
SSDEEP 768:R/UxvxjgC+W3TCtvc7fZrKRIp5XSwQs88uBkiTC//P84g:kZj3+W3uStrtILNBGHg
TLSH
T1D803C039EC946873ACB39385365A275BAFF06053C4C41B9849EE7A0E038B75D6347897
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 932f01682de6215b2c3b5faeb96a07b886e28db2ff6f8242a36da556c4292464
MD5 667b54168424526a7188593696f59ace
SHA1 deeb9f5ad1bccaabad57a386f08ba0c0740b2f81
SHA512 698f5a88d262c546b9bf21ead67e8dbe00ce6bd13f196761a5910f59ff69ca7532cacdf03c070f8d3b9f5d4fb8990b358e9b60ace9e48a0848e4a9da1d92b3ed
TLSH
T1D4D02B79F95ECD23E85204F540D1420832A77581DC04418125018C080A603850001182
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0b193400a27c0cdf94ac11f5fb5b0747828b5b461169cefeffb96191b9e4834
MD5 edaab58c014c1abbfa900853b2ab2696
SHA1 e35eb02c0343d109af1ddd7dbd39dee3b989aea3
SHA512 b3cca7ed39fd4708b9c01cbefd67aab972f585372e01b5fa39d4a0840a7f579725d1202ab2916cda4e7635fb16dbc74178888461c7b6a2b3ea91d273ce2909ea
TLSH
T1BBD02B75F96ECC23E85204F940D24208329775818C0441812601CC080A603850000182
MD5 SHA1 SHA512 TLSH

Submit Download

3c347722-c258-4dfa-b64b-9d1c2c2a9edc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3c347722-c258-4dfa-b64b-9d1c2c2a9edc.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

508280cc-5090-40d9-ab00-2b450b64ddf9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\508280cc-5090-40d9-ab00-2b450b64ddf9.tmp
Size 11KB
SHA256 609b8daf4f1464f692e978e28bfa1200e9d2a691be95291484006e8a881b807e
MD5 e93ac0aa1aae8f8ee2be69f34778fda1
SHA1 646bf765f343db3af130f024a5a9bc573e244d0a
SHA512 fcca77ecc668920364d80ea19fe1b1397d5d0701a0bb2299156383ea8fff2668d2ecaa597217090cc096fc301bd9704b69cdcdf2c28e99184ebd0cdd4c70e01d
SSDEEP 192:sxRRRRbz/fVsFuUHRl3zoA8p4Z/g6+WNIYE1eeGnIgD3J:sxRRPz/fVs32E/5Imd
TLSH
T14442A715AD24A93B9CCBD21DFA557F53D3FD6032A0912E48B6FC8A1C14E76DD224740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 92223bafd21175a6ff4e2f3a6aa8ee1b72d6b21f21e9f8e6e32d9cc8e9271c4a
MD5 37856f06be8315a382c53e70b2f8b8c2
SHA1 762afd2344adb0ab1aa873204f653a46dcc9bb5c
SHA512 5e5c57955e6c9e8cd06697104c5d96af2b78267491644703c38d895ca0a24ebac6904169199e01e5ac4d1eba7461869f208548020d147bf2f32b84159597657c
TLSH
T1B4E026AB04C9D23FB328A5C741FC830C8280361B93C0A90E9758C8C97002840A6E6AF0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 93a57641387c17c7237933dafe6a8da90dc2f61408915f2901bf318938cfe716
MD5 09350cb9c5ee50530422a5c5e0a28146
SHA1 1c0505a1eceec61eeed5efb2d40988c9bd3fde46
SHA512 ede5a0de18d2e87e703f0594eb4815993762721ea967fcf27f098e3f110b1d1bb6deb55082686711e4aef76518db88e05d9b2e68efca50101cffe4fa724c8887
TLSH
T1D8E07DE606C9C32FA358A48B02EC4F0C86A0361FDBE0698E3748F48C74D1040F2CE6A5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 1b0454b432d76f58f388312dce884de75c51aaf1b8a9abfb464b79726d43746a
MD5 c8149b070e7b317c69fe1190fde516ab
SHA1 6efc3704f2852d60686476f2385106d252fe6d08
SHA512 6805c2839542a4b28f78f867539934b1faadf6544037020257aeb60a00c2855b62f4bfb81ceb7abeb462540c1971e8ec8bc629bafd28cf16c24404fd18113d2d
TLSH
T12AE086ED19DEC23FA60A74CF22F8874D8290771FD7D4694E9704CC8B7143545B29BAA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0620701ea1fcba15edb30cb0dc76895e005305f8bd660f7bc829a7ee4a13c984
MD5 516f7681b3a24490b8ca2f7a832d35c9
SHA1 e881b325cf209d5802243487fc55d3c993b5baa0
SHA512 fcbd23061eaf6e977de6c124d3fc9787562667ef7722f516ebeb0af08e35e74ea57d9c1e3438ed2f7c20185c1d0ff8ab7d7be1b1f74b6ed7607facc34963b3a2
TLSH
T10CE026AA49C8C22FE3086B4B01EC830C87E1361B93CC690E5B48C888B481068E386BA0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 cf6d4b6bf94f8b49d58da721cb6514428c449e614aed80f319439f0f92eeaa18
MD5 cd9fa23e2870a9c7375426848d728ca0
SHA1 3da3a9922252d7ee6303beea504d6d6b1e40f4ca
SHA512 ba0e749dbd59070c553c37bfee267ff8c6cde39f7cb0a8636597a1a38d581dcaf5c6051efd1d674b4124887a5918e6b5c2f65876340ed8ce18fbed32a40bb479
TLSH
T188212B83CAA81045F781B634CBC433333AF4F98E41031E410964C8B5BA0679C7050F3C
MD5 SHA1 SHA512 TLSH

Submit Download

d7bad486-dc15-4b76-9bfd-957ee0e3d0df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d7bad486-dc15-4b76-9bfd-957ee0e3d0df.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

01c90535-5e4c-475f-8f77-0ab1c2748adf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\01c90535-5e4c-475f-8f77-0ab1c2748adf.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

58914ecc-9300-40d1-8cc7-3833269fe94f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\58914ecc-9300-40d1-8cc7-3833269fe94f.tmp
Size 2KB
SHA256 7dacbdb82c1b92575dd709cee8a3c67203f9abab4a89428e813222ce045ce17b
MD5 2609440df801da348c3ef1527653eeb9
SHA1 6c4996789424f7601d4f0337b359879f7b59be95
SHA512 86cc8226ec2403c1c8d3274ab65df156299b401a376882e5fb0ac4b5a5442a67194c3c19f531b0af6a22cd5331762266c8080ca5786282e4bbfe76be4b9b43dc
TLSH
T13C41D3F783B4867E8A0186F0EB14AE1FCE1D0516432C7C5589E0AE2B93F3471E04165F
MD5 SHA1 SHA512 TLSH

Submit Download

85e5a42f-f1b3-4ee1-9711-f93af7284b8f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85e5a42f-f1b3-4ee1-9711-f93af7284b8f.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a1ae46c2-d86f-4b19-88b2-4527c268a152.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a1ae46c2-d86f-4b19-88b2-4527c268a152.tmp
Size 2KB
SHA256 7761daa856e526b6b07503584a38f81e5e0594861d1117b245d3f83623c37203
MD5 7b0450a5c0a2074d325a2dbe219d1bff
SHA1 f812dc5414b37425c3d868962a6b55ccb917e792
SHA512 70efc8e5051fde3a09d164822c57665bbfae1069d5c8ce6600d5946d65c7e5f36ea7e1d13a6adb0189431d67de9e4746349487e68cde15a56faa0bc5a11bbec1
TLSH
T10041A4F783B4867EDA1196F0AA14AE1FCE1D0516432C7CA589E46E2793F3471E041B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 f74c3a836caaa024b454a26a0123588e6854198820e8595f68b7b986d6542e43
MD5 5bb8a6d65b6ad148ef3a922b2bf3396a
SHA1 a80771522a6c26a13494d233305bbdc59ddb4a05
SHA512 03190cef60a7f989835a54b96ba589e21175ee303a1093bee3eda25f5fbcedc3e9f9568071cf8420ea65398536f4be624984b670b61c410a7594c585566dd117
SSDEEP 384:USupCD0fCtg82FfrLKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVQc9hnRX3roJeZ:U/pCDmWg8KfrL8F1+UoAYDCx9Tuqh0VY
TLSH
T1C9B2C92B740CCB7E4FC04A9EA8196FD77D9802CB9A588D4047FE995C02C77EA91194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 271B
SHA256 2098e6db0a7031a6955c45fd082b21e8c1ed13e13c275462b9a0dbf209fdb2a3
MD5 69061d57b6b1c4036ced873333bcd3c4
SHA1 d7c29bfb609581ab84354ba67547200657383232
SHA512 0d94da4004f1df7628572c674eb9721533b8d8ba6614498637503d3f2737f0a89738dcfa2e302576b68e81d0e7d0f983d34f63b77433aa5b45502c2c7963cee8
TLSH
T158D02BF718764414FDAFC7D1103140650001B895DA45FC8E002D478300B13263402C25
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bc09239664a365470167fbec9d326ab8286bd9a58a1e967aefb637843b14274f
MD5 8eb7891155c4d3df6cf98cbdd09a4725
SHA1 3a1102a1aab439279d6ebd8b4b7fd5806a081d57
SHA512 c3f344ebdcdf8762ba86eef3545ff29c40144cf0d0891e7e2fa146234170a40aae1663af209f03ecfbce70fc2c8925e7b98864c8d6f2554337c7b623cb72fa7c
SSDEEP 48:KiaSS+givlIxA+KyLKW+eYuHXGQfyZsIDKF6cTyFPsr/dhFkVhCPICHkKDBLlk3p:KcjyKo4CasQKF6iKEgK9mZ
TLSH
T14291C01572BE420138BF364A80B5871B524131B3705CE63B7FBD50668A67E146EFECD9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c55b097d-be58-488f-9d80-617359bf794d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c55b097d-be58-488f-9d80-617359bf794d.tmp
Size 11KB
SHA256 9cc3ee4e61042224881d8964756320815ba01d202f6392d444e218fa424e008d
MD5 3f7f640d8acd426ffa34dbaae1274a54
SHA1 7030e52f154b91a9f5f4f07bbecee77c946a791f
SHA512 b3765fad977264841044bd0adbb6e73d53ae02c1149ba88ee48db405f942ec3647e71ab31aa9259e5a56fa4b6cb672abb801ece5c737fe1043636fd549001ea3
SSDEEP 192:sxRKRRbz/fVsjUHRl3zoA8p4Z/g6+WNIYEGSeGnIgIJ:sxRKPz/fVsY2E/5I3s
TLSH
T11D329615AD28A93B9CCBD21DFA657F53D3F95032A1D02E48F6FC861C14E66DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d14d7879-7250-4dee-8dc9-935bf722915a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d14d7879-7250-4dee-8dc9-935bf722915a.tmp
Size 11KB
SHA256 8966bd26b5d6353f42c786843259b4abffec9acf1a7102c818bdbd3940e0bd7b
MD5 e9c12e29f04e942afa57a86b0036ef61
SHA1 d74b30cd394055c6053bbc2a177342a60d750554
SHA512 674c14f27378a3dc8f328617df2ae761d284ddfe77aaa8aa4ddbd424e1a734c6e069b3e390b019883824a88c2b0988163c1002507c84178d87ca01f7273f4539
SSDEEP 192:sxRRRRbz/fVsF3UHRl3zoA8p4Z/g6+WNIYEGSeGnIgDhJ:sxRRPz/fVsa2E/5I3v
TLSH
T1A832A615AD28A93B9CCBD21DFA557F53D3FD6032A1D02E48B6FC8A1C14EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1bf3fec-0aa5-4ca2-932a-f5f78f05fb69.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1bf3fec-0aa5-4ca2-932a-f5f78f05fb69.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 18KB
SHA256 d675bad1a758b07f1ed431a7812bf9fd82a0134557a9f1479faf96798a2a9d7c
MD5 f18b79a3435844f3cd10f1b52c52502d
SHA1 686226dff62991217fcaf2118b30364ed5b08220
SHA512 203b436d074f1f469ce6afb478f21e5847cb9adeecc4318aacd5ca131357810be9a8992d7737bd36a754ccc8f35273e30b64a8a51eacd17024779ac32e0ed767
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uP:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbA4
TLSH
T15482751CC52C7E3247C92F7D6A2F9D727ACA30CA7081459D798CC69DC31B06DA58A2BD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5bcaa7a-3ac0-48f8-af28-3989dd13bc9c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a5bcaa7a-3ac0-48f8-af28-3989dd13bc9c.tmp
Size 33KB
SHA256 c25e798a4ebd60805a6dbba174ca0d88f4e1a84b3eba564d3b8ea678427a6432
MD5 f7dfbce821b3cf18202069503aabd7b6
SHA1 ab4f426ef01b129c919e11748d5d3adea7824663
SHA512 a8af0b1e5f77e156fda5fca05008097512dd997c42eafc5b98fd4ee2415715e84acd857d0f2962b59987875f1c3f62e97c081c5e1dbae159fcbd9ebd3ef15c03
SSDEEP 768:LC36yO3oc7fZrKREb1t3p5XSwQs88uBkiT2zE75EyL5:LC3ZOLtrZpILNB2kB1
TLSH
T109F2AE35F89458636CB29342B65A3707BFF0A147C4C80784D9DE661E02CB75E678B867
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c68ac1e7-77c8-4e49-936d-72fcf2cac88c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c68ac1e7-77c8-4e49-936d-72fcf2cac88c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

fbb1dd2b-ec70-4f3b-bf2d-e33d3ca513e7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fbb1dd2b-ec70-4f3b-bf2d-e33d3ca513e7.tmp
Size 40KB
SHA256 1f1b073f919e9ccf0294e506ff0849594b89fda6d23a9af9001a635f8c7f63df
MD5 5d1d937e6f2118a59b92ec8c51d50ded
SHA1 88c5679a51d655102d7f6b4cb3d08cbba1c6aa1f
SHA512 d00c6943cc6817f2d89bb08f5aa529b6d4a34c9b1c55fc486119c6217c5bec77aa3276dfa6b1f13071e2056de0df423a09046e7214b2996c0e1e1dc5df29b325
SSDEEP 768:Y/UxvxjgC+G3XyOzoc7fZrKREb1t3p5XSwQs88uBkiT2zE75E+/:lZj3+G3iOftrZpILNB2kD/
TLSH
T1CD03C039FC945863ACF3E345764A3717AFF0A147C4C4169489EE6A0E02CB76D638B85B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download