c47f968c1d9b9a7e0acea51f17b0a1d13cd5ab0ce75655a68c9d4f7348c021f1

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 36KB
Sample261102-res2macx5n
SHA256 c47f968c1d9b9a7e0acea51f17b0a1d13cd5ab0ce75655a68c9d4f7348c021f1
MD5 7f8a96226153b2c289c3784b306b63fd
SHA1 dfa904032372e1261c04b6bba2f7bba5d4a32677
SHA512 92c14bacc530d4e1284c9b81ed3114089bb0067b883eeb575d3dd33fe6240e4f863a97ceabab48d06395a44c2f7d8a5f770d06fd60f53af87bbca40e28a01f03
SSDEEP 384:kw/XYRdwOGDNq++FxTF6ntYZTpBfkFfDWWVF:XXYRCOGDNq+mTYtYZTpB8Fr7F
TLSH
T193F232A295F020564292C0EEAA756B39EF87594FD64C5604B3FC2B8E9FD0D21CE6720D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

discovery persistence privilege_escalation

Malware Config

Signatures

Downloads MZ/PE file 2 IoCs

flow	pid	Process
104	5084	msedge.exe
104	5084	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Event Triggered Execution: Accessibility Features 1 TTPs
Windows contains accessibility features that may be used by adversaries to establish persistence and/or elevate privileges.
persistence privilege_escalation

Accessibility Features
T1546.008

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5084	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-681733028-2344970462-962213935-1000\{2E04720A-0E46-4744-BD8C-EE73FB102591}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5188	msedge.exe
5188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of FindShellTrayWindow 60 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe
6140	msedge.exe

Suspicious use of SetWindowsHookEx 6 IoCs

pid	Process
4064	osk.exe
4064	osk.exe
4064	osk.exe
4064	osk.exe
4064	osk.exe
4064	osk.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 6140 wrote to memory of 5256	6140	msedge.exe	84
PID 6140 wrote to memory of 5084	6140	msedge.exe	85
PID 6140 wrote to memory of 6064	6140	msedge.exe	86
PID 6140 wrote to memory of 6064	6140	msedge.exe	86
PID 6140 wrote to memory of 6064	6140	msedge.exe	86
PID 6140 wrote to memory of 2188	6140	msedge.exe	87
PID 6140 wrote to memory of 2188	6140	msedge.exe	87
PID 6140 wrote to memory of 1792	6140	msedge.exe	89
PID 6140 wrote to memory of 932	6140	msedge.exe	90
PID 6140 wrote to memory of 1792	6140	msedge.exe	89
PID 6140 wrote to memory of 1792	6140	msedge.exe	89
PID 6140 wrote to memory of 932	6140	msedge.exe	90
PID 6140 wrote to memory of 932	6140	msedge.exe	90
PID 6140 wrote to memory of 2728	6140	msedge.exe	102
PID 6140 wrote to memory of 2728	6140	msedge.exe	102
PID 6140 wrote to memory of 2512	6140	msedge.exe	103
PID 6140 wrote to memory of 2512	6140	msedge.exe	103
PID 6140 wrote to memory of 3388	6140	msedge.exe	105
PID 6140 wrote to memory of 4532	6140	msedge.exe	109
PID 6140 wrote to memory of 4532	6140	msedge.exe	109
PID 6140 wrote to memory of 5592	6140	msedge.exe	111
PID 6140 wrote to memory of 3104	6140	msedge.exe	112
PID 6140 wrote to memory of 3432	6140	msedge.exe	113
PID 6140 wrote to memory of 4744	6140	msedge.exe	121
PID 6140 wrote to memory of 4744	6140	msedge.exe	121
PID 6140 wrote to memory of 2416	6140	msedge.exe	125
PID 6140 wrote to memory of 2416	6140	msedge.exe	125
PID 6140 wrote to memory of 2416	6140	msedge.exe	125
PID 6140 wrote to memory of 5020	6140	msedge.exe	126
PID 6140 wrote to memory of 5020	6140	msedge.exe	126
PID 6140 wrote to memory of 5020	6140	msedge.exe	126
PID 6140 wrote to memory of 2600	6140	msedge.exe	127
PID 6140 wrote to memory of 2600	6140	msedge.exe	127
PID 6140 wrote to memory of 6020	6140	msedge.exe	128
PID 6140 wrote to memory of 6020	6140	msedge.exe	128
PID 6140 wrote to memory of 6020	6140	msedge.exe	128
PID 6140 wrote to memory of 4908	6140	msedge.exe	129
PID 6140 wrote to memory of 5188	6140	msedge.exe	130
PID 6140 wrote to memory of 5072	6140	msedge.exe	131
PID 6140 wrote to memory of 5072	6140	msedge.exe	131
PID 6140 wrote to memory of 5072	6140	msedge.exe	131
PID 6140 wrote to memory of 5924	6140	msedge.exe	132
PID 6140 wrote to memory of 4752	6140	msedge.exe	133
PID 6140 wrote to memory of 4752	6140	msedge.exe	133
PID 6140 wrote to memory of 696	6140	msedge.exe	134
PID 6140 wrote to memory of 696	6140	msedge.exe	134
PID 6140 wrote to memory of 696	6140	msedge.exe	134
PID 6140 wrote to memory of 2476	6140	msedge.exe	135

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x298,0x7fff05d2c188,0x7fff05d2c194,0x7fff05d2c1a0
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,15700875574068080432,1601085630532605396,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=3024 /prefetch:3
  2⤵
  - Downloads MZ/PE file
  - System Time Discovery
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,13488206588002769163,17405831420931977503,262144 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:2
  2⤵
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,16139063410931166790,14625256020673113971,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,15239894010862697976,18359055483565131736,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3504,i,7687752494340468366,5912043551141742116,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8959341078908015885,3040320829425298153,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,5327097232563471269,12596395304913960101,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5982651542938659222,8300479119709046476,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,5982651542938659222,8300479119709046476,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,1007738955603049227,4812461397737098544,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,14873279999829880735,2129414292849062329,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3323893842399988566,5528548930334225683,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,17290116324343947861,3169391862712530378,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6596,i,3523256112704641726,17540147952806854747,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6540,i,1570553913626938136,11583525474735999445,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4944,i,6113496951108560193,18072585040339861077,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=7072 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6792,i,15242878431244216448,1047089433209079699,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6944 /prefetch:8
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6684,i,11154298844528860741,16856757477544505586,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6964 /prefetch:1
  2⤵
  PID:6020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3464,i,17327203424159803699,2482843740271167985,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5972,i,17742577179680288535,18223096626314721585,262144 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4944,i,2383948494412155719,913365379982957128,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6436 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,11583154682385457354,1820228378683235298,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:8
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,16388785374466741715,9590523077654298788,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6856,i,13051266151808078484,865166930686484198,2097152 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,14401728211111038186,9290141175248987733,524288 --field-trial-handle=2996,i,14405873678618642405,11370118142048407818,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:8
  2⤵
  PID:2476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2656

C:\Windows\system32\osk.exe
"C:\Windows\system32\osk.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4064

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x498 0x2c4
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Privilege Escalation

Event Triggered Execution

T1546

Accessibility Features

T1546.008

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ed889fa-d340-4616-81ee-62637171bfab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1ed889fa-d340-4616-81ee-62637171bfab.tmp
Size 26KB
SHA256 3752aa2989bb0b5998a273f1245c3d6f653bdec31b2d7f6bae1ba09f03e9b65b
MD5 b3a7651af8eea957119b501b6c69cc8f
SHA1 c0017beedda34087b29126da8649a2ef729bc373
SHA512 1f58dee37f82e05155f47df0f06e189fb78af2332e1c6224e6a463e9293eff527db3235b18269cc24a8376bd4c020a6976571ed1195a7b1d5315186409f3b6d0
SSDEEP 384:nlMiFzQkUSvl3sNz8TUNTUlI485mgwCtuK2fMBOHLtuVnp9stH7vBE8HgL/7IzYm:l3Fdl3ewguehBOHLtEstH75EJiPLR
TLSH
T1D9C25B32E894DDBBADE78FA5A74A3647EEE04253C5CC9AC0DAC95D1C00CB18D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6aa9d3de-cb1f-4a62-ac7c-60b52cc8facd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6aa9d3de-cb1f-4a62-ac7c-60b52cc8facd.tmp
Size 27KB
SHA256 3ad6584e9b9d895d9820e92fea32cc3c9a054a14f1832bdb8e5cd7d52e143d3c
MD5 034ca161fd6bd033f84ab2042d08cf3e
SHA1 86d56a2435b2f783097de18c27887c77c4bada7f
SHA512 26795ff290b7d40309aa5558f216a702a03ffeca11c6095be87fd53a91a4cd56b1ca315c3d7b948706cfb42c08173900a7fdee2a4d63418bf8a93827042eba49
SSDEEP 384:nyiFgQkUSvId3sNz8TUNTUlI4g5mg5rtuK2fMBOHLtuVnphystH7vBE8HgL/7IzJ:5FI43ewgi2hBOHLt8ystH75EJiPLR
TLSH
T180C24B32E894DDBBADE78FA5A74A3647EEE05153C5CC8AC0EAC95D5C00CB18D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8bd89a3c-a09a-4dec-96fe-cc44f7e48447.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bd89a3c-a09a-4dec-96fe-cc44f7e48447.tmp
Size 26KB
SHA256 005d3a40e52ccac91abe8af1cfdc899c93b596f7fac4564036686df7d4403ca6
MD5 70dfff740cdef96c5539d760ddbfba50
SHA1 8a316905e0585bf01c7376eb7790dc1b481c9f54
SHA512 3e47d1278a0b33e6acc279bc30d1fc508d14a260c76e50c27f3a43dd05f47b4f6d03641e21fb5092f3d728dfdcce99f7e8f27c40e0ac90b4cb66c16fa8d3cc00
SSDEEP 384:nwMiFiZcI63sNH8TUNTUlIm25mgH7FK2fMBOHLtuVnptst7O6R2FeoxgL/7IzKoG:w3FQ63uwgSQOBOHLtSst7TRVl
TLSH
T139C24A32E894C9BBFDEB8FE5A64A7507DEF04153858C9AC0D9D86E1D009B59D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

966b0467-b7fa-4d5c-909e-2095fd29da01.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\966b0467-b7fa-4d5c-909e-2095fd29da01.tmp
Size 26KB
SHA256 63ecd10e55ea81377679e982c9475d88142f3186e35e55ca632b088942188d04
MD5 d269ce0c5caac7e75c93e288c0eae7b9
SHA1 d2c241c2fb071dc6a187646d24df570bf0f44008
SHA512 5fc16428190c134bb53c2abc427068406aef7ffe0e015066b1c9e8f93934d6df7f0f5446954ff206dec6ca4e5ef8f5e59e11926bd3ed496cb380c70879468731
SSDEEP 384:n0MiFzQkUSvl3sNz8TUNTUlI485mgIttuK2fMBOHLtuVnp9stH7vBE8HgL/7IzYm:03Fdl3ewguBhBOHLtEstH75EJiPLR
TLSH
T156C25B32E894DDBBADE78FA5A74A3647EEE04253C5CC9AC0DAC95D5C00CB18D174BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

98231106-e564-4733-97de-3f7fd1d15f23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\98231106-e564-4733-97de-3f7fd1d15f23.tmp
Size 25KB
SHA256 8b2af5b7f8d12a89640fb21b59d694facdb1c20efcc3883e6326110584cd8e45
MD5 d37da945085d5876b0a084231a828c18
SHA1 f360012e0e50eedd3adc30db52652ef8114c3538
SHA512 b68a5be4d032396d586fa410f3bab527d83e6a3de2f417aae4efd37125b26309d6d9859825b37655e6dda81211cd18b559c53b45700001729c9bce24441875e0
SSDEEP 384:n0MiFiZcI63sNw8TUNTUlIm25mg5MnK2fMBOHLtuVnosv7O6R2FeoxgL/7IzKoG:03FQ63RwgSzQBOHLtRsv7TRVl
TLSH
T1CFC25B32EC94C9BBEDEB8F96A74A7A07DEF00163959C89C0DAD85D1D009769D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db759c3c3934bf56069e934969b7b09f586fed452182c151bd01633b9b27bf87
MD5 ab67867c211ab688848725ec145740f0
SHA1 c091eed57aaf62fb4b4c293d73ad6ac09823e67a
SHA512 36ec910e186d3dbb24e30337fbca8d6f6bcd7a8f248a4d5f5379e227776ea65d887c40363ac37f303049490eb20265c1934114c84ce3526c2d0868d9793068a6
TLSH
T177D02B4899C83A64E956243A22185281B0448D550A07244041A303840C413B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b7c7b629cf980554ba201945f9dbcd1c64e77cc796fc6d8aedbe4749bf0d2698
MD5 844568391c8d79f46705230953f1d7f9
SHA1 a9cd387c1c5dddc3c8fa77739776f3408ec661d4
SHA512 85a2814e7f88919b1be438203c2053dccaf55dcefa377da5cfa8fa7daf780315b818c6b4ce3d02d6cc49b8673ba077bf7b9fd475c54c978185fc230f70cd9b53
TLSH
T13CD02B449DC43A64E942243A22185281B14489550A07244041E303940C813B200840D1
MD5 SHA1 SHA512 TLSH

Submit Download

3f79b448-f19a-4843-8cb0-831e8abe204c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3f79b448-f19a-4843-8cb0-831e8abe204c.tmp
Size 11KB
SHA256 b5962e68ef42fd974c08c8304a12ea15ac4910fcd2a3293110f01d56bc6b42c3
MD5 2d4ba9a4362311c26712a52ae9377714
SHA1 1a4e78a1801b8142535ff8a0b365400041bbefd2
SHA512 cd67d50754ccbce2adfa60c61e5a126b263e6f80ac03a4556865b5c8f14e4f47085e1a40eaa73d29f4bd0e4cc40c10cb07e705248c2fc7e3a6a75b038acf670b
SSDEEP 192:sxZRRgvkR/f2snyQZZJ8WzodpHRHW6+WNGYbIcjmYns+6Ig5dEJ:sxZRxR/f2syOZetxHbGF7YsD/I
TLSH
T17D42D755AE28A93B9CC7D219BA55BF53D3F91033A0951E48AAFCCA1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

515e578c-6d89-4ff7-9ba7-b6ed0a8ae6cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\515e578c-6d89-4ff7-9ba7-b6ed0a8ae6cb.tmp
Size 11KB
SHA256 cd814118ac15a6341c67ff38e44d8407c677cbbc7538be6c1f388b404a710c05
MD5 2dcab303096429f1a1f169c1cf7f518b
SHA1 d0a55ff392b778c8c7ba7a4f53fe7cb04d6fe4f1
SHA512 9132005756cc2202075b93fc05906b85443340fa60a30d298d7832afb8522856b1759ada08b6fa76abaaf972940abd8d2a272f8549a530559f0b0e14be6cd935
SSDEEP 192:sxZRRgvkR/f2sLWQZZJWWzodpHRHW6+WNGYbIaFYns+6IgjEJ:sxZRxR/f2s6OZotxHbGFwYsDjI
TLSH
T16E32C655AE28A93B8CC7D219FA55BF53D3F91033A0951E48AAFCCA1C14E7ACD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

862bee17-ed4c-46e8-8ee0-c6033a1d5d7a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\862bee17-ed4c-46e8-8ee0-c6033a1d5d7a.tmp
Size 414B
SHA256 be9225d2f86485e94de49c0867192126e5deb179ad0a8dcbe4d696a0b0fb9759
MD5 618b517f8e7c11e00a21d9055c0c06bd
SHA1 3a65ac91fb361db7ef8b5600aacbbe1cd46eca0f
SHA512 98a0795b17b551c35ea0c772a7dcdd5c266211de7b1445122e0388c2420252dc4691ad5b6551133f835038ffbb5227bd56918bf1389696a5dc76653ce29374d2
TLSH
T107E02BE9C916FC3708FD072954540685EA5103572A808D8F373C811D8FB1A36958686C
MD5 SHA1 SHA512 TLSH

Submit Download

953ef5f5-469a-49b9-b3e3-c2909595d6ec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\953ef5f5-469a-49b9-b3e3-c2909595d6ec.tmp
Size 12KB
SHA256 b534e65da9a7847c2370c5eb4de2a866d599a4ad23ae0fdaa45038c55c73622b
MD5 64f87f8203cea70c14b69a5a282cfbaa
SHA1 4dfad057618a35050bbbb9852abff2a59d5146d0
SHA512 ea52e2516268b04ecd73796801cc75695c7b9243df19308e1b1c982e5d6cbfec03fa989923a5e782405081bcec49973ed4c958c2911b8cc75c8ce9793ad8754c
SSDEEP 192:sxZRRgv9R/f2snyQZZJNWzodpHlpHW6+WNxyoXYbIO4OHYns+6Ig5dEJ:sxZRER/f2syOZzt7Hb3XFGYsD/I
TLSH
T13142C755AE38A93B9CC7D219BA55BF57E3F91033A0951E44AAFCCA1C14E7ADD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97a0ec14-fc2e-400c-8280-28400d536cec.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\97a0ec14-fc2e-400c-8280-28400d536cec.tmp
Size 12KB
SHA256 3a5624d8afa49ca9e3f423c0fdaa8eb4c01320c77335d230743e700dadf91c59
MD5 5c920dd74da3d7f2163da778d3e4ea19
SHA1 84e0ba519d7d9c75c831ba203820d9b74eaa1c94
SHA512 f9c81fa57e13ba73bb86fe78b3870a3b3c6fac59f25880889dc5418334ce3bdb1f91395d0853c087de8de79f7a574b42beed05bc2209be13e3d9dee837c3a429
SSDEEP 192:sxZRRgvkR/f2snyQZZJNWzodpHlpHW6+WNxAx/YbI84OHYns+6Ig5dEJ:sxZRxR/f2syOZzt7Hb6/FkYsD/I
TLSH
T13742D855AE38A93B9CC7D219BA55BF57D3F91033A0851E44AAFCCA1C14E7ADD220380F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9f6138c6-57d7-4a8f-bcbe-35a609c8086d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f6138c6-57d7-4a8f-bcbe-35a609c8086d.tmp
Size 12KB
SHA256 0c04131729fe692d8fef1fcf4fc987fac11bbe359fc1a7366b6e122b4c374f9f
MD5 74bb649708e1826acf7f7be7ab5360d6
SHA1 1829f577dae7a43b30ed6045b355b3b0216ed6b4
SHA512 f8d99c272f4dc3ac5fa2ad8ab17b7ad7d1639b46303f20b0bec3b60afc0868c0316a86b68cf10f67b3f3ed89120e35f43e5ae20a5e1bf31bbb0af2655c48cae7
SSDEEP 192:sxZRRgv9R/f2snyQZZJeWzodpHlsHW6+WNx20dYbIG4OHYns+6Ig5dEJ:sxZRER/f2syOZstiHb/dFOYsD/I
TLSH
T1DA42E955AE38A93B9CC7D619BA55BF57E3F91033A0851E44AAFCCA1C14E76DD220340F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 17KB
SHA256 04167f015274472a925b7d16ebc81a2ca212c74fd08ef4ead2d1ac5dea112293
MD5 227f10cca94b4d2a77c5d9ab8d0f6415
SHA1 45c1da00483db9c60be82707bdd7b07a99a76388
SHA512 38b58c31757aa9dd92cf35c60f83c9af53ac6f445f67f5b40d807f6717bdf9c25de1633f505318ed675e926d680955fc136b4425e4aa41013b8f8bb6a1ed72d4
SSDEEP 384:bdWNEuGG31dQybQxd+xp/Ef7mguZfxUMeEKgJ0HaDu5Prv:bdWNEuG21dQybQ2bczmgofiVEK9aDiz
TLSH
T1CF82DF366509763313D444AB1B0F80669D9DE9AB1ABC1FD93EB8C8787D05A35701C9CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 125KB
SHA256 9b71579741886a2f221ba2150647db6afa7579f5f2061c8c342233d5f47d71a7
MD5 c0b34de2aaa6996a6de7ead9d376c077
SHA1 6380dad125045f25cd1d248007dda0e3505e0ccc
SHA512 f8095bdf6515f06eacad088e30ac3aa80764822ea87bcf0ed4522f72f2f23710f42e68ff501dd725e7c8c22789d3df3ab5b032731b11395df0fc62afacfb1a09
SSDEEP 3072:lkGBMlj8gmg1VkM6vpZMjzmCqb/BvT+rpB44rCV7qZhQPQ1n41:lkGBMljRL1VksjzmC+TQIuCV7U6qn41
TLSH
T1EEC313FE15AE6ACABDC2C0342B449F117D7A714BEBB1D3112BE5E156483230672584FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000076

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000076
Size 17KB
SHA256 5a0812430d3fd8c9afe8ed4fbf925f99cc43bb28b17f2adc0d7df3c70847a408
MD5 29bb64fc2b50e1d3af24be69c167f4b4
SHA1 d5ce1f22e5d82998b60b4ddce2714d1528cfa154
SHA512 d77dd6acfc5dad1ac40aad48624a65e23bb570daa006abc9fbb4afc224d8abcb280494814eef779e1415e706cdafe19a932d2fb13cff604c25d8ddd5c1944011
SSDEEP 384:SS63vtLbXMXCUnAnHisIMzCe/bDAEEOEtN61NZQyDEY3try8fv:S5vlMyk3sIS/fAVOElyDh3trpv
TLSH
T17882D18E3504BF74664876997234597ED8D345AFE08E9D36A928D281C05DF04943DFD3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c777759028321537256ed4c3d277414427dfb68e716b831768240b04d7abc34d
MD5 ae13d31fa198809400fe562a361be64e
SHA1 3efc0668522751509a104ba0670718aff60cfab8
SHA512 7503b6b766cf64b1378e48116d6fa2089ccf1854d405fc263ffa6de17aeff414525ff7b77a47894bf724c49a834aa3d319d0e6785d17becec8891e16c6b28a07
TLSH
T172710B890CB09769FB4C3DBE91E62DCFB57891D093834D0A0264DCF8DC367B5AD0A548
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 edce1171d9033a5fe8b50fdfedf934f7684bdf9ea0479fd027664fc3c35c6c91
MD5 8898ad25ecf3e3aa99caae9fa70dd53a
SHA1 d865fed6d265643fb952712b707b18b3570ba7cb
SHA512 e1f1461894a3bdcfba6be2256b8510be17762b021dd6349b8a1e5a1542e08bd7f77c151b776c592640e0f8e4918e85650d09660cc201b322113946f5e4949373
TLSH
T19061E9894DB897AAFB9C7DBC91E10DCBB4B815D093831D0A0264ECF9D8367B12D4A480
MD5 SHA1 SHA512 TLSH

Submit Download

a7e4f25a-9621-4bc4-a448-37c2068a091c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\a7e4f25a-9621-4bc4-a448-37c2068a091c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

1b79f506-cad1-40d2-b044-3f841d4070be.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1b79f506-cad1-40d2-b044-3f841d4070be.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

6b5560fb-170c-41e4-a5eb-3c74aa4a823a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6b5560fb-170c-41e4-a5eb-3c74aa4a823a.tmp
Size 2KB
SHA256 e91b0abbe067c4062b4e2378ddab0b3939ae2471496b09ec3417f6c6ee7e2228
MD5 8ebabcf77d18c850cb59810a7a04fbd1
SHA1 d4c6c496881f98f750f6060eca8bfeb21ea42200
SHA512 e9caf246fa171ad289be672b10f3035297298b0ca0a174537d78ab03141ea2aa57f7d596e991762d8ef48996a757c90873e306cf4a244df4ee0b21db2fe7b6b0
TLSH
T112518DB7C3E8876E891196F09A14BE2FCE1D051A432C7C5A89F4AF1B63F24B1D14169F
MD5 SHA1 SHA512 TLSH

Submit Download

e48553e2-b2b8-46da-a483-7cde5a3d7d6a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e48553e2-b2b8-46da-a483-7cde5a3d7d6a.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync App Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 5f9010715e8231bcae84df05a2316f5c30b8d63121d5abbd6424415a9b220926
MD5 ea62bb9a5f0f9fdde7bb62f2f2446491
SHA1 b40cd9ab4c53bc7d08350a07926c26a0900435aa
SHA512 41c973285bad44a812cf7013bb8d7be802ae88b765fa70fb1aba5274e08a69e89d383377afbc3c6ab50d47300a67463f5647ae9f91f3e4c6f293fb60a038bc39
SSDEEP 192:Ojhff4AZWCAmGdiXW6M4hg/YwP6X5vo7FPD1rhP4DFhvXIzZD:OtfFvpopPxrB4RhfIlD
TLSH
T1D1B2131571BA021038FE690C81B59B2F464232B33159E63B7FBD14A69E6BF085DFD8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

a3b7f2ee-1d8c-433d-9ec7-ab38d5574131.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a3b7f2ee-1d8c-433d-9ec7-ab38d5574131.tmp
Size 11KB
SHA256 29f67bf60e6d6002fa77743f18a73063a1ec4a699e57cf1d98a6a14f9e534156
MD5 eb86330f8a3ace82d5daed7f54b1d627
SHA1 9280840a729b58aa07325c326861ef4d06da6824
SHA512 528e9b817310681b8194af383c5ff69cf44f857aa08017779ea022d793abcf103a2493093be00b3c8840487da8241c4c67f8ff0f1db8fc4a1fca80ef3857acd5
SSDEEP 192:sxZRRgvkR/f2snWQZZJWWzodpHRHW6+WNGYbIaFYns+6Ig5dEJ:sxZRxR/f2sWOZotxHbGFwYsD/I
TLSH
T1CC32C655AE28A93B9CC7D61DFA55BF53D3F91032A0951E48AAFCCA1C14EB6CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

abc14454-54e7-4200-b1bc-d24f6b67ac23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\abc14454-54e7-4200-b1bc-d24f6b67ac23.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

cfdf75be-460f-448e-a510-0c9796ed02d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\cfdf75be-460f-448e-a510-0c9796ed02d3.tmp
Size 27KB
SHA256 f230a4ab4e764530740da76557d07216341c8768c7e1efb0b2e77ac27dc0b62c
MD5 8abbcdfa7caeebcbbcd0d5105dc97b2e
SHA1 1e4dad667b45cbc987006d84369b77755c5a1f80
SHA512 a15376caaba7314be4cd64998452f0a51d18c456c02b9982c79ea9ac4e177a4abacc972d1377c7dfa3c866c68dc8676c7d2cf246bc17f9a82357457cebc4b37f
SSDEEP 768:0RyktrnWvDBlt8F1+UoAYDCx9Tuqh0VfUC9xbog/OVmWLlMC7fnroGfk:0RyktrnWvDBltu1jaLWLywf0Gc
TLSH
T1BBC2F93F640CCB7E5FC00E9D9C6A6F972DE802CBA6945D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 6648900fde71cab0e125f5b035b93e2448d356dbea4f8b8e2a97800cd4dbf660
MD5 08ee5dab6a936b54b437a7ce3707bf6e
SHA1 7dc15da86bda3ff0a30449a6d2f36383c8f7e0b2
SHA512 ede381d091d7b6fc415ea09d43dcce7eb45ccbaf21c5d4f6019726d9f57b08a259f1754cef5f6baae94d2457915d5b64e009e7ac8a56bc94fafdddad31bacd42
MD5 SHA1 SHA512

Submit Download

c4d1618c-1337-40c9-82a0-ba8b92d9142f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c4d1618c-1337-40c9-82a0-ba8b92d9142f.tmp
Size 392B
SHA256 9fd5c6922118077dda9c8cd5701ccc5bace428e05b6b0ec1af31afbfff360cdf
MD5 eb9a3ea078a8432ba895f00e5da3e824
SHA1 a4616a41f377e588b44d4cba36cbe2376aea4dab
SHA512 45384a679021f8a6e8a4f87b46cbaf52a6cda0ac03464d35730f7894a8e3846466ecf44d4c9792ed3e5c2752b75bdd2382920643bfcb01a15cba79c05757b9e4
MD5 SHA1 SHA512

Submit Download

dc89d823-cac5-4899-8297-b6ce052cf005.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc89d823-cac5-4899-8297-b6ce052cf005.tmp
Size 25KB
SHA256 eaafb03c328dc83036b8a2e502ed7884b26996dded61fd5eaee1957148882d46
MD5 f520f77e06eca8e00fe3896acb15dc85
SHA1 255d95654ce4d54f1b0f99cd81a1a725b9e51423
SHA512 d8309204b9674103ebec21f9ad53a156da8947e3d052cbcabf4cdcdecf8dbcfbab7c413eb95fbc0aca2687c9bb6f5f61a3346f657a79d7447ece6f795098eab9
SSDEEP 384:nlMiFiZcI63sNz8TUNTUlI4y5mgw3tuK2fMBOHLtuVnp9stk6migL/7Iz/oZ:l3FQ63ewgObhBOHLtEstkua
TLSH
T186C23A32E8A4D9BBFCEB8FE5A64A7607DEF04163858C9AC0D9D95D1C009719D070BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 af96e920e45b31b4c9e2aa10b25347abfb781607b338ef8f9690fe3cdaf26193
MD5 a42a9bc7b4675265ffc7d322fcd6beff
SHA1 d3446cc8bd373b4fc3348aeeb2779351ccce6cfd
SHA512 29c7f949042848092c1b52bc859bb5d7d013afbd0ac3cf92756d47e869f0cf1680773eb070b51772a693443a19927d5622df2445cb76ee8f0e9650730f783434
TLSH
T14F414858AAE92058B7B72F96ABF6686D583FB9373E06D45D00010D4F0A36B00C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download

49647628-7127-49b2-8042-3fbfe28b4e80.tmp

Path C:\Users\Admin\Downloads\49647628-7127-49b2-8042-3fbfe28b4e80.tmp
Size 15KB
SHA256 5e17256ef22f5a2245ac945b229620a8ff3903e45773b095534c5c217aaf694e
MD5 387f630f165c24ed838a69ad55e95caf
SHA1 a012591c223bb6a7374fcc291c2878e81884d176
SHA512 a1f59a9916047982fb0b6f23cd302a64fea6fddfe1397806782b1f889f0aadbe612c19d7a711976eb88d45e9d075c4730c41baf4f0ba347372206667bf84548d
SSDEEP 384:R3YXyv70yf/2tFAeScYL/8gZTqV3bLfXruCmlANdFU53JD3:NYRy3gScYrjZTqV3b7XruCvN/O3
TLSH
T17C728E53E631D473CEA503B185B4C3BAFFAB563621F27907A3901F193B2A612D90E563
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bcfd6789-1274-4d66-9e04-a4d82b661552.tmp

Path C:\Users\Admin\Downloads\bcfd6789-1274-4d66-9e04-a4d82b661552.tmp
Size 51KB
SHA256 1636b5e4e53f0ed58054ab9f97ed9a71636380f89528903a619115160463a47e
MD5 8cf828e71bb9592e3aeb302161293d7c
SHA1 26c9133e2f4cddf36c4b6e3b7ed7d882111c6294
SHA512 55f495aa502cd691687b0653b3dfc3216dd4fee1bc4755d1ff2861ab4240e6c66c0a4bc3c3b9e1afff46fc4c2e7f2b8fe0fd92cea062585ce535fb1d9cf66f90
SSDEEP 1536:jPdZEszWriITJGrvopX1VF7CXjl7yCbUw2:jsszWOITsEL50jl7yCbt2
TLSH
T1A6339F825A34C07BD9F70F723875A56BEFEE985060F4920B73801E1E79FA9824D0E395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wzdu35.exe.crdownload

Path C:\Users\Admin\Downloads\wzdu35.exe.crdownload
Size 21.0MB
SHA256 92e8c5f5f06bf64aa95e393d7855650d57e5ec483cd25857462febcfb34505c2
MD5 56f545953279b26dd197d72f7ee60b06
SHA1 e5a4f8e8cb8acc4a9e369098989e93e978cdfd43
SHA512 7beb4b8c0adfbbfcdb5b0f8728d723fef013fa747aaa25b8dee05ebb5b86cac1f04b0e8733b1166669194ab7da68fe38ac92e1c7c6dc92d438becffd439efda3
SSDEEP 393216:ak9Z9NvY5vr6Evq8rgDuxl3KYKtCoB/s8D0yNkHkWldoc0GCVt2kOM:ak9Z9Nvoj6EveqSYKtTsrkWlCVGpkOM
TLSH
T1F827337279144AEBFA9A2D30CCD680D96F54FE3B4292E4CF92813BD955B01B1C436F1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download