hxxps://uplcm[.]com/afu[.]php?zoneid=12112715&var=12112715&rid=ksX-wKK1z8yLZCaWKyzJyw%3D%3D&rhd=false&ab2r=0&sf=1&os=windows&os_version=19[.]0[.]0&is_mobile=false&browser_version=156[.]0[.]0[.]0

Analysis

user interaction
yes
max time kernel
4s
max time network
9s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260911-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260911-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/11/2026, 03:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://uplcm.com/afu.php?zoneid=12112715&var=12112715&rid=ksX-wKK1z8yLZCaWKyzJyw%3D%3D&rhd=false&ab2r=0&sf=1&os=windows&os_version=19.0.0&is_mobile=false&browser_version=156.0.0.0
Sample261102-dql6kaea44

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3644	msedge.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\UpperFilters	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{75EC3F2A-8EE0-4C95-BF6C-57AB1278B700}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-686476835-2493921010-524562731-1000\{6532E1CF-A01A-4E8B-A1C7-587BF8E93B3B}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe
1560	msedge.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1560 wrote to memory of 948	1560	msedge.exe	85
PID 1560 wrote to memory of 3644	1560	msedge.exe	86
PID 1560 wrote to memory of 4004	1560	msedge.exe	87
PID 1560 wrote to memory of 4004	1560	msedge.exe	87
PID 1560 wrote to memory of 4004	1560	msedge.exe	87
PID 1560 wrote to memory of 4252	1560	msedge.exe	88
PID 1560 wrote to memory of 4252	1560	msedge.exe	88
PID 1560 wrote to memory of 4688	1560	msedge.exe	89
PID 1560 wrote to memory of 4688	1560	msedge.exe	89
PID 1560 wrote to memory of 2580	1560	msedge.exe	90
PID 1560 wrote to memory of 4688	1560	msedge.exe	89
PID 1560 wrote to memory of 2580	1560	msedge.exe	90
PID 1560 wrote to memory of 2580	1560	msedge.exe	90
PID 1560 wrote to memory of 2476	1560	msedge.exe	92
PID 1560 wrote to memory of 4816	1560	msedge.exe	93
PID 1560 wrote to memory of 2476	1560	msedge.exe	92
PID 1560 wrote to memory of 2476	1560	msedge.exe	92
PID 1560 wrote to memory of 4816	1560	msedge.exe	93
PID 1560 wrote to memory of 4816	1560	msedge.exe	93
PID 1560 wrote to memory of 2492	1560	msedge.exe	96
PID 1560 wrote to memory of 1252	1560	msedge.exe	97
PID 1560 wrote to memory of 1252	1560	msedge.exe	97
PID 1560 wrote to memory of 2936	1560	msedge.exe	99
PID 1560 wrote to memory of 2936	1560	msedge.exe	99
PID 1560 wrote to memory of 2936	1560	msedge.exe	99
PID 1560 wrote to memory of 3888	1560	msedge.exe	100
PID 1560 wrote to memory of 3312	1560	msedge.exe	101
PID 1560 wrote to memory of 3888	1560	msedge.exe	100
PID 1560 wrote to memory of 3312	1560	msedge.exe	101
PID 1560 wrote to memory of 5108	1560	msedge.exe	103

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uplcm.com/afu.php?zoneid=12112715&var=12112715&rid=ksX-wKK1z8yLZCaWKyzJyw%3D%3D&rhd=false&ab2r=0&sf=1&os=windows&os_version=19.0.0&is_mobile=false&browser_version=156.0.0.0
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffb97e3c188,0x7ffb97e3c194,0x7ffb97e3c1a0
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1888,i,18385800188438823929,14433488748556457646,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=2852 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,8043145634331332807,15411702600214500569,262144 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,4703141949906207886,4822555581797923559,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,13810712380001041578,16758210302519710399,2097152 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3396,i,12771090462834833846,6488481462365699105,2097152 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,13617735556091312699,10245753658215573830,2097152 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4152,i,6769596616443937623,13797244967947080150,2097152 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5180,i,15764674518559973295,17412233562041542663,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,8234686620528922572,6139251188901541869,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5524,i,1578312449016239354,1841109119168724482,2097152 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,14086938073943538218,11192469144615040498,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,11625670770565530154,14495917803866679492,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=5756 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,3343897240086944107,11436891794674387200,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,3343897240086944107,11436891794674387200,524288 --field-trial-handle=2668,i,6116170445199730402,15823105899657532706,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:5108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9779891f-0b89-43e3-95ca-20421d5c0977.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9779891f-0b89-43e3-95ca-20421d5c0977.tmp
Size 8KB
SHA256 dd7ac1813aea4fbcc21bd78b73413148e9bcf55b2f1f8448299748a0854c1085
MD5 51473fb9940cd877e763b3229954bdfc
SHA1 aa6668524c54c7c88e121c94bb7656d98986b4a3
SHA512 35ffbd3f0ea7278237a95c9526366ab3aea50457ddce053b7f56bfeeb403e95a17a45e0fd468c2c261162f36ee5b00cfaaba6a2df3bfeafaa9201a313b953375
SSDEEP 192:ZONt6xGuQmiUyc3cq1D0hZ/1bEAjzosxs2oRYc5icTNU6:ZONt6UqL1D0hZlEIjq2xcdJU6
TLSH
T12802F9357C686C7B9EF2AE05B58B2B074FE8112BA5956F84D6E82F1C00CB69C1306837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3a6eb5861393f83eb8b8016687c085da7ebeddb12e0086793cdaa97de2bf4d89
MD5 8f87b0f71fdb0e4babafb4d64f50918b
SHA1 ef9954a611e31dc1fc21cf5cdda9b032620389c3
SHA512 80b6b9a9ac529a7fa05c075fcb3af3a9438a9aa4a8462d2e9843ebf64816a6abb19f112e682567ce8c0abf07c734928796f290fd602cffbf3df31d92dc5eb530
TLSH
T1F5D02220B3038C80C8CCA0BC0F208B002E0EEC080022E2038AF000C0ACC2FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2cbdecd303a7e9ea0ce94baa450d3b047a1edf586300e4947c57d88291910733
MD5 2d8c10d42a8ac6e8eb6e6d36c53591ab
SHA1 9cbb2af787af4f0174815753d1fb7231fae30ec8
SHA512 0365b2fb9fb7c3ddb4d312af474044b0160cbad1e022fa186751cfaa355015874edf8f80c8abdabc28d5fad2b69acf8c17686c8382dcb23c267475468464b67a
TLSH
T180D0222033038C80CCCCA0BC0F208B002E0EEC080022E3038AF000C08CC3FF080C20E0
MD5 SHA1 SHA512 TLSH

Submit Download

f46fc4bb-534c-4dc2-9e3c-4f98f0ecdc43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f46fc4bb-534c-4dc2-9e3c-4f98f0ecdc43.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

89829dd6-453d-4924-9938-31e27d39ff57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\89829dd6-453d-4924-9938-31e27d39ff57.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 21f79f8ed5abafb54f87536a1f1808c78bd48853d25158bc4bcf33148ae268ec
MD5 1a5cbc23aad0df4f66812cb2ffac5781
SHA1 d49252bcab7ec97605cfaa0561080cd83fdb6fcb
SHA512 0559a7dcbcc7593649bf5aed7d9d1b7e4b8899398b4ab817f78d857b6079e099e92b94e5e5e979009d5d66fb02774007f6b4023753c75a16b2aefe951121cd20
SSDEEP 96:KYVWKGQqoOD8o+Ykf38x25AfKhO56fNmuZMU0CpY4KZuo:ERhZNj
TLSH
T17D915110B2BA16003A7E651841F4AA6A524231E33834E52F3BBC45639EA7E145FFCECD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ca5c6fae-d10c-4fb4-8d1f-6e608c0dc797.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ca5c6fae-d10c-4fb4-8d1f-6e608c0dc797.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5aa502e-04be-4f23-901c-bdc95a6a74ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f5aa502e-04be-4f23-901c-bdc95a6a74ea.tmp
Size 8KB
SHA256 6256eccaf39a84b37e10f0a3c820573e6c932d124735b41cd98a0b969e7fe303
MD5 ac879df04d1a18fd3c935a3ac2d7b23c
SHA1 9f23d7d0af8a1a291691d462ac8979285bc2ec1a
SHA512 3f0e51b965ee77ff3986c6b65998ab497bb205dc3fa3b209024b930fab5fc573185ef25c75a72e9cca84e1225a4c82b199305d56278c68ba04e137562e73e48f
SSDEEP 192:DONd6xG8QmiUycycqwD0hZ/1bEAjzosxs2oRYcxiXVa23oiqHU6:DONd6UMmwD0hZlEIjq2xcxiXtonU6
TLSH
T14512F9367868AC6B6DE2A544B08B35034EA41217E689BF90D6EC2F1C01DF59C134F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ba9fabbe3dd4eeb04466d7c9fe3342db91f31c2f32016459910876f352bd6e6c
MD5 0d8c0dfc71b8f96ae58ebbca8ca11167
SHA1 7e8d110e3c2e28a04eced34e36e5f5ddea80a851
SHA512 e1cc8477a8628fa189951d17b4cac0cf3485a6fe51bb818e2d8dcd3e5f0400632644031a2e172448af8e4ab2f0df7dfa6a41db4fd5dd5a203d77b5a5df25a787
TLSH
T183412C58A6EA1158F3B37F4AABF6686E447ABC372F1A946D10110E4E0A62A41C871733
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads