hxxp://sodexoretail[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 09:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sodexoretail.com
Sample261102-lrpbbagx3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2164	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{B74615DA-3A73-474C-BBA9-1699202947DC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 4384	4288	msedge.exe	84
PID 4288 wrote to memory of 2164	4288	msedge.exe	85
PID 4288 wrote to memory of 3896	4288	msedge.exe	86
PID 4288 wrote to memory of 3896	4288	msedge.exe	86
PID 4288 wrote to memory of 3896	4288	msedge.exe	86
PID 4288 wrote to memory of 2384	4288	msedge.exe	89
PID 4288 wrote to memory of 2384	4288	msedge.exe	89
PID 4288 wrote to memory of 2384	4288	msedge.exe	89
PID 4288 wrote to memory of 2364	4288	msedge.exe	88
PID 4288 wrote to memory of 2364	4288	msedge.exe	88
PID 4288 wrote to memory of 744	4288	msedge.exe	90
PID 4288 wrote to memory of 744	4288	msedge.exe	90
PID 4288 wrote to memory of 744	4288	msedge.exe	90
PID 4288 wrote to memory of 4700	4288	msedge.exe	91
PID 4288 wrote to memory of 4700	4288	msedge.exe	91
PID 4288 wrote to memory of 4700	4288	msedge.exe	91
PID 4288 wrote to memory of 3932	4288	msedge.exe	92
PID 4288 wrote to memory of 3932	4288	msedge.exe	92
PID 4288 wrote to memory of 3932	4288	msedge.exe	92
PID 4288 wrote to memory of 1072	4288	msedge.exe	96
PID 4288 wrote to memory of 1072	4288	msedge.exe	96
PID 4288 wrote to memory of 1072	4288	msedge.exe	96
PID 4288 wrote to memory of 3136	4288	msedge.exe	98
PID 4288 wrote to memory of 3136	4288	msedge.exe	98
PID 4288 wrote to memory of 4504	4288	msedge.exe	99
PID 4288 wrote to memory of 4504	4288	msedge.exe	99
PID 4288 wrote to memory of 4632	4288	msedge.exe	101
PID 4288 wrote to memory of 4676	4288	msedge.exe	110
PID 4288 wrote to memory of 4048	4288	msedge.exe	111
PID 4288 wrote to memory of 4184	4288	msedge.exe	112
PID 4288 wrote to memory of 4584	4288	msedge.exe	114
PID 4288 wrote to memory of 4584	4288	msedge.exe	114
PID 4288 wrote to memory of 1288	4288	msedge.exe	115
PID 4288 wrote to memory of 1288	4288	msedge.exe	115
PID 4288 wrote to memory of 3140	4288	msedge.exe	116
PID 4288 wrote to memory of 3140	4288	msedge.exe	116
PID 4288 wrote to memory of 1544	4288	msedge.exe	117
PID 4288 wrote to memory of 1544	4288	msedge.exe	117
PID 4288 wrote to memory of 1624	4288	msedge.exe	118
PID 4288 wrote to memory of 1912	4288	msedge.exe	119
PID 4288 wrote to memory of 1912	4288	msedge.exe	119
PID 4288 wrote to memory of 2664	4288	msedge.exe	120
PID 4288 wrote to memory of 2664	4288	msedge.exe	120
PID 4288 wrote to memory of 2264	4288	msedge.exe	121
PID 4288 wrote to memory of 2264	4288	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sodexoretail.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff8b66fc188,0x7ff8b66fc194,0x7ff8b66fc1a0
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,1240237839740995812,1722214551602608971,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,9386315239907196142,18089565112281728472,262144 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:2
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,1962007746346421390,14213937229744036027,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3372,i,494885908020731066,3708885065102021107,2097152 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3376,i,18428653950337633036,5798533304537239920,2097152 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,4060292060958969095,15645437671977627241,2097152 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,8375196714287146661,4301169629714133993,2097152 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4972,i,10232839184003556319,599167112356070541,2097152 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5240,i,17521209575142054624,3605047331111020499,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3920 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,15787094262798663998,4890573763834796340,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3884 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14577442855939078414,10744886434453950716,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,14577442855939078414,10744886434453950716,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,17681878685915492771,8559376351346844460,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4152 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,5581541140206142794,551783240952999679,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,719456844588613339,5448688384048191033,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3884,i,8134159683096086487,452902338242794546,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6476,i,12951785342788923965,16766700723103084761,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,11034275191598444792,10075663195272010501,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3960,i,14887904248984527193,7544299379016370563,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6316,i,1905999068013374679,6980904688662831569,262144 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1536,i,1235968796239465499,3309744627036378664,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,8541542924025729182,14779105875586518970,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,39609366665505026,11724178175474258348,524288 --field-trial-handle=2432,i,4560343656612291204,478687849035342309,262144 --variations-seed-version --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  PID:2264

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3525fb9a-6b85-4112-ae88-8e282f8e6c88.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3525fb9a-6b85-4112-ae88-8e282f8e6c88.tmp
Size 18KB
SHA256 2e8fcfdf673c4b50c7ef4b27a032ed7f4e90fdc67dec70efc98412200e19e3de
MD5 0c52da6fc2acb6a6787aec9d4242945d
SHA1 1e21f7d90f65f1f5dc5729bb939ce7fadb4a9df7
SHA512 6cf6ea2bd266e053ff62c8ff6dfa4b6bb90bc6b44019bd71b1e592ef8d5d3c1ecafb5626af2011b38299461f5596f14f4ef01d4e4d6a47cbed37cfe71276ab5d
SSDEEP 384:WQkUSv0sNibsEKZJ1dkHX58EvOeJB3JrxG0H7vBEz4IIll:20mEKtdKa8OY3hxG0H75EML3
TLSH
T164827D32A8786D3B19F2E204F14A3A53EFB49157D6D92F90C6DD5B2D01CB29C234BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

468eb729-fae5-4be0-97f7-9ba18a080bcc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\468eb729-fae5-4be0-97f7-9ba18a080bcc.tmp
Size 8KB
SHA256 c987ace2d209f62ff6f61433f2bfe9ce42f5fc46bba535815bcc9fe62bc3b502
MD5 3dc201b4ba5d0dc3da6f26e3bffb15e1
SHA1 1790cb3cea61e6ef8a4358e8d2d7ce34f4be55e8
SHA512 fbec4bd65535844e5d8d4d41cb85c4e2da6de676c3ca4b7012e8e04b3a3f928ee4eb18c41cd1e462872c51b046ae053147cd233254728d84beb6d4fe86d7abaf
SSDEEP 192:fON76wlDpQmiUyUbHk4X58gZvOKNJyqwSJrYveYqQ0U6:fON76kHNHk4X58EvOeJB3JrjG0U6
TLSH
T19D121936B568AC275DE2A545F48736139FA55127E6867F94C6EC2E2C01DB2AC130AC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a454c33-0a8b-4325-b6ab-59a92e8002da.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5a454c33-0a8b-4325-b6ab-59a92e8002da.tmp
Size 8KB
SHA256 b742633eb96cfd0f5549ef027aeeeb3470b345a84e3772b6059c66fb8a36feba
MD5 a7c7a17e9ace06bc063f6028f27b6f50
SHA1 ae9674e0ca9c4ab7311a3af1cee71f652c6cac5e
SHA512 d68aa6c3e21cae0029efed754fa603c3a5c3d42dc611dcefcef58d0c518bff7b6797a986df111b76816ae1ace0668c1f5a385cbad674ffe5947d5d3c20800ef7
SSDEEP 192:1ONgV6wlDgQmiUy2bHW4X58gZvOKNJ7Dli9U6:1ONu6kgFHW4X58EvOeJdOU6
TLSH
T1EC02EA34F9687C7B9EF2AE09F58737139FA5106BE5552F44DAE81B2C00D765C130A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7a66a178-92e7-477a-94d2-b423f7c19d75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7a66a178-92e7-477a-94d2-b423f7c19d75.tmp
Size 18KB
SHA256 4e78cdf02b99e1252adf1dcbb5ae387a750f78d17eba604c714169608b886866
MD5 b68422abef5b239842990b1781fb86bc
SHA1 c6e10d5e91d8fc53366f6cf04b997c9a991bee15
SHA512 5e077ae92115ab463a9c77b3a458925bc75ae874df258fb7221a7781b03e116a6858bbfecaafea56ab421530d9121cccb24b709bdf7864c41babba2cb1026e16
SSDEEP 384:GQkUSv0sNiOsEKZJ1dkHX58EvOeJB3JrxG0H7vBEz4IIll:m09EKtdKa8OY3hxG0H75EML3
TLSH
T1DD827D32A8686D3B19F2E204F14A3A53EFB49157D6D92F90C6DD5B2D01CB29C234BE16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7f14c547-6e70-4e67-ae9a-8b28e0e9aa0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7f14c547-6e70-4e67-ae9a-8b28e0e9aa0b.tmp
Size 26KB
SHA256 f7ea43c819f88da64637ca69f649e600140d2c5eeb53732b17cce3d480e977e2
MD5 06b474d6540e915715dd6882a09f36cd
SHA1 442ead5b85354961f134eafb9f1b8c46b9f959fb
SHA512 54de4a19676092a5dfb9ef5799b5c0168a941588c09a39b7dae6053d74dbca9114c898a8bcf75faf315552afcdfa6331ba333d335f28f7580334af86e6191610
SSDEEP 384:jiFzQkUSvozsN68TUNTUlIlOsEKZJtdkHX58EvOeJB3JrQG0H7vBEz4IIll:OFdUbwgREKldKa8OY3hQG0H75EML3
TLSH
T1F9C207F294D79D3AD9AE9703A33E2D139EBCC053F4856A50B389591CCC8A1BFD34A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

1adc61c9-0fd2-429b-addf-5b09241ea570.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1adc61c9-0fd2-429b-addf-5b09241ea570.tmp
Size 10KB
SHA256 f008bbb214bbd3007393647a5241c814a774c217d1ae023c04b7533621cb4554
MD5 a271790a12880e61babeb2a6294c2221
SHA1 db05ff40e387339956dded9d7b1ef8eea6722da3
SHA512 4c4398321c5f30c58d136b1d373a0293d626bda73d9073b4dd4e136252b1af9f2e33e02eb26a73f32a007719b156905a9a57e5f0d8de5ec9cae1a4a083354e23
SSDEEP 192:sxZ/RrWp/fus/JHIdpTBHW6+WNoGVXYrrT9OIg5VOJ:sxZ/4p/fusRIFHbLXv+
TLSH
T10422C9526E28AD7B8CC7D209BA19BF53E6F9503255D52E44FBFC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7127aa13-9d60-467d-b87f-d2ee11476dc3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7127aa13-9d60-467d-b87f-d2ee11476dc3.tmp
Size 10KB
SHA256 dd2f22a05697ab948d41f8a059491e655bb8ea0c0b8cc4d6949a34d06e923598
MD5 f0045dc93ffb73a3c3eb10e236d5bd86
SHA1 16e3307c2c9a83e0865693ace87c15fbc9692f96
SHA512 24806baa615c194f7debc417a67093570d953d8340ac98bfc8f22fe9015e4ff69cc79c94b8c0840118fcad4a2389ee31ddedb36f96ad614e7c6da3de4f32ea0e
SSDEEP 192:sxZ/R6np/fus/JHIdpTBHW6+WNo4vdYrtT9OIg5VOJ:sxZ/mp/fusRIFHbndt+
TLSH
T18522A7526E28AD7B8CC7D209BA19BF53E6F9503255D52E44FBFC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c01ef04-a6c4-4265-b0ae-f0e5b3ef6528.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8c01ef04-a6c4-4265-b0ae-f0e5b3ef6528.tmp
Size 27KB
SHA256 71165fde84860fdf8957f4ec52544300aa200331347dd698c0a89baddbb9abad
MD5 9a6ed2a152052d8b6febf76cf47cbb8a
SHA1 2d487a3a4c0b97fb586d13e081ff150bbd51f50a
SHA512 8987e7527ee6268d6d7ee1f83eab4ab3935e1083387cd9efdf696b1fa82d21578fbdaf6bacb5ba0d649296d513f7ef17df94e55df447c3ea8d2211f03b9b6b17
SSDEEP 768:GTy4J/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbproRT0:GTy4J/DWvbtBhu1jajiLm0bCt0
TLSH
T13EC2FB3B684CCA7E4FC00A9DDD5E6FD73E9802C79A948D4047FA994C02C77EA91264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98f6ac2c-9367-443c-83de-626547c92b4b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\98f6ac2c-9367-443c-83de-626547c92b4b.tmp
Size 10KB
SHA256 252f9a7793335cab0a6599a59dfa89632e0459d8f4f150f22a78d0618092a30c
MD5 2222b1e33677a53bea3160e339059fd1
SHA1 bdd3190e783a02e2963320867f5a137b53d13ad3
SHA512 843ea32f0e9cf363c401ae5d0bc9a6c37e4a00151568a373c315f2cfbfe473ddd0f29f305b63327c54a4652e81788a2cc79efd77af1bc00a1b27a9080d829435
SSDEEP 192:sxZ/RrWp/fus/JHIdpTBHW6+WNoGVXYrnZ9OIg5VcJ:sxZ/4p/fusBIFHbLXLU
TLSH
T1AE22B8526E38AD7B8CC7D209BA19BF53D6F9503265D52E48EAFC851C04E76CD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9c7352c1-92f4-45b8-acd0-eb17ffe673f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9c7352c1-92f4-45b8-acd0-eb17ffe673f8.tmp
Size 10KB
SHA256 9f34177cb10adac2c4d1d766e9c58987129462440056b3db85c1a64034e8b601
MD5 8a1f64b47eef9c67511fb5bcc161054c
SHA1 f428043075bdfd0722393b04e3bbc6e8b9e88993
SHA512 b1836ad4ed281f93bc6f5c4bc7567cc363e2bba37b74dfb42d6edfe46acf93a2c2fa0356a818adf2458223d3d095e87fbecb75d602095f00d58251e3b75c3a15
SSDEEP 192:sxZ/RrWp/fusuHIdpTBHW6+WNoQf/Yr5Z9OIgrJ:sxZ/4p/fusuIFHbz/l9
TLSH
T17E22A8526E28AD7B8CC7D209BA19BF53D6F9503255D52E48EBFC861C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9ec46853-1b7d-483e-9b8f-b78d8c81aadb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9ec46853-1b7d-483e-9b8f-b78d8c81aadb.tmp
Size 10KB
SHA256 ded9e14e6064a361e0a18d68d560df53e9ec22770177363041ed7a7ec0d678c1
MD5 4f5785802ea45d1af7ec9b0e1d18ff09
SHA1 e5a18eedec9d488d7b5bf46763e15e16913a7f45
SHA512 80c85fa8a1e35b97a1843c289887b2e1ed4d681efcb393f3b378fc9349de0d67227fb8d642f797a001581603164c738765c4849214f0d59431582484bb827276
SSDEEP 192:sxZ/R6np/fus/JHIdppBHW6+WNo4vdYrSwjOIg5VOJ:sxZ/mp/fusRITHbnd7+
TLSH
T11132B8526E286D7B8CC7D219BA19BF53E6F9503255D12E44FBFC861C05E7ACD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 670d0c5866d89d5248a65bce57f29b76cd4f853206a83e3544ab762a35a9a0a4
MD5 8ad2da32f35a77ca99839e0fc777a6ab
SHA1 0fd06a662f90fafb9d349e3b970f80d84ed775ae
SHA512 429145908afacfcceb9c4f504d37d44cb9c0e8287607f2a0f35051e0428b07eb16fce2b56f807f644075d532ebeba5f88359d01604044a3d1834f061119f4915
TLSH
T17AE07DB96BD8C22EA20E644B03EC570CD280363FDBC06D8E7F02C8987685140F2D6AA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 75412108ccc2051be153416ae44f7164405d6667db50e415b16025e8cdc8b6e9
MD5 ac2b1c01735221bff204854aed3fe55f
SHA1 70b17ed49abc96b3a71e948f5e6193f77d30b8a1
SHA512 59a4616628552d4feba197b89a732f6160569ddeb3d273dbe6d83f43423c1853ab727b9196eb9712cd3a177a19d33aeb26df8d7b20dc31844f7fdd507e9fbfdc
TLSH
T13FE026A906CAC32EF208744703FC930C82A0365FD3C0698E2704C4D8768A941E7CA7E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6e88d12a411c26a58001126275895b3e1bf33b923a682fa72d005539fcf417fb
MD5 197a969b37776c879a854d17378935ba
SHA1 8e650f4168b9cd678ce49bcdeca4897bc3dc0d97
SHA512 18af7883909f3fe8f80a8f15df333050ab37c006d46c417b9f124888c597a3b2fefb42b3c0a769c1c708a6c69c04313a183f38b04bbce4bb6cfbf60a9f6f507e
TLSH
T1F5E086A506CAD27EE20C658701EE574CC2A0361FD7C96A6E3B17C4887742984F3DA6E0
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 94b3bee8688c89448a4cbf7c3e574fafb4f625f8790c6fb54725c395b62c430c
MD5 903e726929262645b23751ebb810fcc7
SHA1 2a9b82e0e733915e256cccf038a662f891e90058
SHA512 f0d0591cbb23271791bea6fef428ef82125af66de4e37c1fea6348650b8d4278068732d206f95f0c8c6f7cdc631c5c42f975401ceb40f98588ee6cd5c9947c20
TLSH
T1E771B34E55B042B7FBE94135D1F313EB36388F6054833E420896F2B5B946368CFA5B96
MD5 SHA1 SHA512 TLSH

Submit Download

4cb68702-901d-4761-9987-c628607e112c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\4cb68702-901d-4761-9987-c628607e112c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

76bc6fc2-53a5-494d-8fd3-e1067004d897.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\76bc6fc2-53a5-494d-8fd3-e1067004d897.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b7edb73f-f37f-4966-8665-27d5e0351b56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\b7edb73f-f37f-4966-8665-27d5e0351b56.tmp
Size 1KB
SHA256 840453a42b8c65592c2a07ece50713bc7f2179eaeee5905da1ffa1a3be36684f
MD5 95dd0a53feb773c0fc33d45e5fb60431
SHA1 91ae807471cfe53e7712e378b5a457b934c8af39
SHA512 ee59c1c32152e8f83340531490439883f0eb88b70a85ec2a58293db01dbb39c570f4f611f74c4eda311fe67ae390a80a5ff93934835dc0bfca69d504da76d9e7
TLSH
T191419BF787E4896E8E0156F09A14AE1BCE1C0915432C7C59CAD8BF67A7F3471E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

e6bc4b33-ef1d-46df-937e-05282830b257.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e6bc4b33-ef1d-46df-937e-05282830b257.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

fe59f8d5-a5a3-44ed-a624-1e94970c6115.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fe59f8d5-a5a3-44ed-a624-1e94970c6115.tmp
Size 1KB
SHA256 439108014b40249d1f97c4c46c9fc21c7679a82acdea9dc0198618397eac1f88
MD5 f984d480584ac63e5f31fcce1c586800
SHA1 adc4c31fa4492afdb779702b1380d30f58673527
SHA512 328c72a6133c54658a5d1e0aa1783e5878a83edfa9720a93efef18e39fe66b58038bb04c0d1b752c8670fdddf5b5a852ace5c4701bd7532a49f1654c405204bb
TLSH
T15B31ACF787E4896E8E0156F09A14AE1BCE5C0512436C3C59CAD4BF6797F3471E001A9F
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 006ebd09dd800381cb5ea2e4141e01698729448358db911397fb16e9cb4e6937
MD5 2c1ad597ba1d56a2ca74ce3b56f08903
SHA1 662e18c3588cdacb19b8b5c27321201cb584531a
SHA512 9de77e466d9b0ca5af4c1a0b4c782ce441952bfeb2465e0e67d2c0abf933fafdde8ac5cff08c9c389d8db4283342cae92f3430cd0f2fc0a4fb2a2d273a2967a0
SSDEEP 48:KIDI1Ks04jyLEzy+suCLbyB6ISWLK9y1ALxEbYJqC4yLpBpQp9pxpbpfpjp8bpPB:KIDCKs0+uzeKEIOSc4KR23
TLSH
T1F891315570BB131538BD258885B4D76A028136B33168EE6F7FBC84758E6BE040DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f5c6e2d0-2c39-4020-84fd-36c9174c7bb7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f5c6e2d0-2c39-4020-84fd-36c9174c7bb7.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

ff81f67b-8110-4f21-8cdc-d56f3c9e8278.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff81f67b-8110-4f21-8cdc-d56f3c9e8278.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

c6224447-5786-4028-b579-480f81f8ab1e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c6224447-5786-4028-b579-480f81f8ab1e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7b0aa2ce-2b18-4264-aca7-dc8634116247.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7b0aa2ce-2b18-4264-aca7-dc8634116247.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef4216d1d4251365aafccf79c84953730e1caa01472b1d68bc54843842e1c18b
MD5 3a6261bcf9fecbba311bc2293f55b5c6
SHA1 5c722ee68d8560a74b4930878ca99a8cbc001e7e
SHA512 66bcf726510c3422a205167723adfe3016bd91a8e00868af6c51382c9a77ed56e1d5d03806ed28fc7b28ce0422e1f8878fe3c80b1e11f98eee6a9fe68510bf44
TLSH
T1B5412A48E6F91158B3B77F1AABF7686E447EBD772E0AD05D00110E4E0A23A41C971737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download